Commit graph

506 commits

Author SHA1 Message Date
Bernhard Amann
417542f283 Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads
Seems to work -- all test pass.
But there are thread-safety issues at the moment, because the constructors of IPAddr and IPPrefix are not thread-safe, but needed by workers.

Conflicts:
	src/logging/Manager.cc
2012-02-27 22:59:08 -08:00
Robin Sommer
d2b2157454 Fixing merge relict. 2012-02-24 15:52:15 -08:00
Robin Sommer
2eeac54857 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Add to_subnet bif (fixes #782).
  Refactor IPAddr v4 initialization from string. (fixes #775)

Closes #782.
Closes #775.
Closes #784.
2012-02-24 15:26:18 -08:00
Robin Sommer
3323692771 Merge remote-tracking branch 'origin/topic/jsiwek/ipaddr-refactoring'
* origin/topic/jsiwek/ipaddr-refactoring:
  Refactoring various usages of new IPAddr class.

Conflicts:
	src/bro.bif

Closes #784.
2012-02-24 15:21:57 -08:00
Robin Sommer
4ef8607e60 Merge remote-tracking branch 'origin/topic/dnthayer/ftp-ipv6'
* origin/topic/dnthayer/ftp-ipv6:
  Add test case for FTP over IPv4
  Fix IPv6 URLs
  Add a test for FTP over IPv6
  Update FTP EPSV response processing for IPv6
  Fix parsing of FTP EPRT command and EPSV response

Conflicts:
	src/bro.bif

Closes #778.
2012-02-24 15:00:41 -08:00
Jon Siwek
32aabe8432 Add to_subnet bif (fixes #782).
Also fix IPAddr::Mask/ReverseMask not allowing argument of 0.

And clarified return value of to_addr bif when the input string
does not parse into a valid IP address.
2012-02-24 12:34:29 -06:00
Bernhard Amann
d553a3c6f6 fix strange bug when using predicates and events at the same time on a tablefilter.
Testcase is now more involved.
2012-02-23 15:30:39 -08:00
Jon Siwek
d7dafe2fe2 Refactoring various usages of new IPAddr class.
Reducing number of places that internal representation was exposed
via GetBytes/CopyIPv6.

Also fixed a bug in remask_addr bif.
2012-02-22 14:45:44 -06:00
Bernhard Amann
93fac7a4be fix one of the bugs seth found in the input framework.
(bug in PutTable when the table contained only one element and that element should not be wrapped into a record)
2012-02-22 10:46:35 -08:00
Bernhard Amann
7e5f733826 raw input reader for seth, which can simply read a file into string-events given a line separator. 2012-02-22 09:44:45 -08:00
Daniel Thayer
96df1bac40 Add test case for FTP over IPv4 2012-02-21 11:18:43 -06:00
Bernhard Amann
edd30da082 better testcase & fix a few bugs (that took way too long to find). 2012-02-20 15:30:21 -08:00
Bernhard Amann
fe5b376d28 ...and update for table event testcase after fix. 2012-02-20 13:23:25 -08:00
Bernhard Amann
4126b458ca Automatic file re-refresh and streaming works.
* simple testcase for file refresh (check for changes) and streaming reads
* add events for simple put and delete operations
* fix bugs in table filter events (type for first element was wrong)
* and I think a couple of other small bugs
2012-02-20 13:18:15 -08:00
Jon Siwek
b66b74e5dc Decrease strictness of parsing IPv4 strings into addrs. (fixes #775)
IPv4 strings in dotted-decimal format with decimal parts containing
leading zeroes now parse better.
2012-02-20 14:28:42 -06:00
Daniel Thayer
d61fad4f9e Fix IPv6 URLs 2012-02-17 10:55:17 -06:00
Bernhard Amann
91943c2655 * rework script interface, add autostart stream flag that starts up a stream automatically when first filter has been added ( probably the most common use case )
* change internal reader interface again
* remove some quite embarassing bugs that must have been in the interface for rather long
* add different read methods to script & internal interface (like normal, streaming, etc). Not implemented in ascii reader yet.
2012-02-16 15:03:20 -08:00
Daniel Thayer
278704f7a3 Add a test for FTP over IPv6 2012-02-16 15:17:55 -06:00
Bernhard Amann
88233efb2c It works. Even including all unit tests.
But: there are still a few places where I am sure that there are race conditions & memory leaks & I do not really like the current interface & I have to add a few more messages between the front and backend.

But - it works :)
2012-02-13 22:29:55 -08:00
Bernhard Amann
4e868d282d Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-13 02:37:02 -08:00
Jon Siwek
086f747bc1 Add counts_to_addr and addr_to_counts conversion BIFs. 2012-02-09 15:32:57 -06:00
Jon Siwek
f945f3c518 Change HashKey threshold for using H3 to 36 bytes.
This is enough to accommodate using H3 instead of HMAC/MD5 for IPv6
Conn::Key's and performs better since a hash happens for every packet.
2012-02-09 12:55:55 -06:00
Daniel Thayer
d3e432e8dd Add a test and baseline for addr_to_ptr_name BiF. 2012-02-08 11:23:02 -06:00
Seth Hall
161ad1a3df Adding a test and baseline for ptr_name_to_addr BiF. 2012-02-07 20:57:18 -05:00
Bernhard Amann
f6c6387c52 Merge branch 'topic/bernhard/input' into topic/bernhard/input-threads
most stuff is inplace, logging framework needs a few changes merged before continuing here...

Conflicts:
	src/CMakeLists.txt
	src/LogMgr.h
	src/logging/Manager.cc
	src/main.cc
2012-02-06 10:54:07 -08:00
Jon Siwek
2e2f8f5d06 Merge branch 'master' into topic/v6-addr
Conflicts:
	src/bro.bif
2012-02-06 11:06:55 -06:00
Jon Siwek
b3f1f45082 Remove --enable-brov6 flag, IPv6 now supported by default.
Internally, all BROv6 preprocessor switches were removed and
addr/subnet representations wrapped in the new IPAddr/IPPrefix classes.

Some script-layer changes of note:

- dns_AAAA_reply event signature changed: the string representation
  of an IPv6 addr is easily derived from the addr value, it doesn't
  need to be another parameter.  This event also now generated directly
  by the DNS analyzer instead of being "faked" into a dns_A_reply event.

- removed addr_to_count BIF.  It used to return the host-order
  count representation of IPv4 addresses only.  To make it more
  generic, we might later add a BIF to return a vector of counts
  in order to support IPv6.

- changed the result of enclosing addr variables in vertical pipes
  (e.g. |my_addr|) to return the bit-width of the address type which
  is 128 for IPv6 and 32 for IPv4.  It used to function the same
  way as addr_to_count mentioned above.

- remove bro_has_ipv6 BIF
2012-02-03 16:46:58 -06:00
Seth Hall
2cd88ee4f6 Merge remote-tracking branch 'origin/topic/bernhard/software'
* origin/topic/bernhard/software:
  change software framework interface again. At the moment everything should worl.
  start reworking interface of software framework. working apart from detect-webapps.bro, which direcly manipulates a no longer available interface...
  after talking to seth - change host_a field in record back to host.
  forgotten policy files.
  Software framework stores ports for server software.
2012-02-03 16:17:04 -05:00
Daniel Thayer
4a6a9fe9f2 Fix sorting of lines in Brofiler coverage.log
Lines with a range were being output with text "lines", and so were
being listed after all other lines belonging to the same Bro script
(e.g., "lines 123-125" was listed after "line 492").  Fixed by using
the text "line" instead of "lines".

Line numbers with fewer digits were being listed after line numbers
with more digits (e.g., "line 85" was listed after "line 237").
Fixed by sorting on a reformatted string (this string does not appear
in the output) where line numbers are right justified (padded on left
with spaces) so that sorting produces the expected results.
2012-01-30 17:35:19 -06:00
Jon Siwek
0065cf6148 Fix mktemp portability issue affecting test coverage. (addresses #752)
Also update Makefiles to behave better for brief targets and in absence
of external test repos.
2012-01-27 11:01:50 -06:00
Robin Sommer
f6f9dd952f Fixed for Brofiler merge. 2012-01-26 20:55:24 -08:00
Robin Sommer
d6767e1d83 Disalbing brofiling because of problem.
See #756.
2012-01-25 17:36:13 -08:00
Robin Sommer
6a6092daf8 Adding coverage to brief make target as well. 2012-01-25 17:35:25 -08:00
Robin Sommer
848ae2355e Merge remote-tracking branch 'origin/topic/jsiwek/brofiler'
* origin/topic/jsiwek/brofiler:
  Fix superfluous/duplicate data getting in to testing coverage log.
  Add "# @no-test" tag to blacklist statements from test coverage analysis.
  Test coverage integration for external tests and complete suite.
  Integrate Bro script coverage profiling with the btest suite.
  Add simple profiling class to accumulate Stmt usage stats across runs.

Renaming environment variable BROFILER_FILE to BRO_PROFILER_FILE for
consistency. Yeah, I know, such a nice name! :)
2012-01-25 17:12:37 -08:00
Robin Sommer
7a8c9b1c69 Merge remote-tracking branch 'origin/topic/jsiwek/local-table-init'
* origin/topic/jsiwek/local-table-init:
  Allow local table variables to be initialized with {} list expressions.

Closes #739.
2012-01-25 13:47:42 -08:00
Jon Siwek
1e4c3d8ea2 Teach CompHash to allow indexing by records with vector/table/set fields.
Addresses #464.
2012-01-20 16:54:48 -06:00
Bernhard Amann
eacdffff90 Merge remote-tracking branch 'origin/master' into topic/bernhard/software
Conflicts:
	scripts/base/frameworks/software/main.bro
	scripts/policy/protocols/ftp/software.bro
2012-01-20 12:51:58 -08:00
Bernhard Amann
92050af947 Merge remote-tracking branch 'origin/master' into topic/bernhard/input 2012-01-20 12:03:54 -08:00
Jon Siwek
0287f7adc2 Fix superfluous/duplicate data getting in to testing coverage log. 2012-01-18 11:45:53 -06:00
Jon Siwek
ec6560a6ed Make communication log baseline test more reliable. 2012-01-13 16:06:44 -06:00
Jon Siwek
713e3ac5d0 Add "# @no-test" tag to blacklist statements from test coverage analysis.
It can apply to either single statements:

    print "don't cover"; # @no-test

or a block of statements:

    if ( F )
        { # @no-test
        ...
        }
2012-01-13 14:52:58 -06:00
Bernhard Amann
d476e9f3f4 Merge remote-tracking branch 'origin/master' into topic/bernhard/input 2012-01-12 11:07:12 -08:00
Jon Siwek
b6c3567ba4 Test coverage integration for external tests and complete suite.
coverage.log files are output to each testing dir and reflect
the number of times statement locations of Bro scripts are executed.
2012-01-12 11:58:13 -06:00
Jon Siwek
9aefeec4ce Integrate Bro script coverage profiling with the btest suite. 2012-01-11 16:30:25 -06:00
Robin Sommer
3d2dc5f5fc Merge remote-tracking branch 'origin/topic/script-reference'
* origin/topic/script-reference: (50 commits)
  A few updates for the FAQ.
  Fixing some doc warnings.
  Forgot to add protocol identifier support for TLS 1.2
  Finished SSL & syslog autodocs.
  Adding the draft SSL extension type next_protocol_negotiation.
  Fix some documentation errors.
  Tweaks.
  A set of script-reference polishing.
  fixed a couple typos in comments
  Add summary documentation to bif files.
  Add ssl and syslog script documentation
  Add Conn and DNS protocol script documentation. (fixes #731)
  Small updates to the default local.bro.
  Documentation updates for HTTP & IRC scripts.
  SSH&FTP Documentation updates.
  Fixing a warning from the documentation generation.
  This completes framework documentation package 4.
  Minor notice documentation tweaks.
  Fix some malformed Broxygen xref roles.
  Minor doc tweaks to init-bare.bro.
  ...

Conflicts:
	aux/broccoli
	aux/broctl
	src/bro.bif
	src/strings.bif

Includes:

    - Updated baselines for autodoc tests.
    - Now excluding stats.bro from external texts, it's not stable.
2012-01-10 14:00:44 -08:00
Bernhard Amann
3138f015ce Merge remote-tracking branch 'origin/master' into topic/bernhard/input 2012-01-10 11:33:26 -08:00
Robin Sommer
cbfe16db0e Updating baseline. 2012-01-09 18:01:13 -08:00
Jon Siwek
69a0206a82 Merge branch 'master' into topic/script-reference
Conflicts:
	scripts/base/frameworks/notice/actions/pp-alarms.bro
	scripts/base/frameworks/notice/main.bro
	scripts/base/init-bare.bro
	src/event.bif
2012-01-09 15:49:14 -06:00
Seth Hall
3be1222532 Documentation updates for HTTP & IRC scripts.
Closes #733
2012-01-08 02:22:52 -05:00
Bernhard Amann
5bef49d625 Merge remote-tracking branch 'origin/master' into topic/bernhard/input
Conflicts:
	src/parse.y
2012-01-05 01:11:13 -08:00