Commit graph

246 commits

Author SHA1 Message Date
Aaron Brown
f29dbb90a5 Allow for logging of the VLAN data about a connection in conn.log 2015-07-22 14:13:17 -04:00
Aaron Brown
d76c7a2657 Save the inner vlan in the Packet object for Q-in-Q setups 2015-07-22 12:52:10 -04:00
Robin Sommer
f97b2b180c Moving the remaining code from Layer2.* into Packet.* and documenting
the Packet API.

Plus, some more cleanup, including removing a legacy option
time_machine_profiling.
2015-07-21 08:30:23 -07:00
Robin Sommer
f69edd1437 Adding missing files. 2015-07-20 16:49:03 -07:00
Robin Sommer
c72d191ab5 Refactoring L2 parsing code to reside in the Packet class.
That way it can be reused more easily. This also avoid having to
change the serialization structure for packets, which is a problem as
external sources of packets (via Broccoli) wouldn't have the new
attributes available to send.

Also moving Packet.{h,cc} and Layer2.{h,cc} into iosource/, and
removing header size from properties that packet sources have to
provide, as we can now compute that easily from the link type.

Plus some more cleanup.
2015-07-20 16:21:34 -07:00
Robin Sommer
64a478dbd5 Determining final L3 layer protocol right inside PktSrc. 2015-07-17 21:44:42 -07:00
Robin Sommer
86440e44fc Adding more cross-checks for IP.
This prevents a few more packets from reaching raw_events(), see
baseline update for the corresponding test.
2015-07-17 13:59:12 -07:00
Robin Sommer
fe3579f1b4 Merge branch 'topic/rework-packets' of https://github.com/jsbarber/bro
* 'topic/rework-packets' of https://github.com/jsbarber/bro:
  One more tinker to Packet -- ensure no uninitialized values
  Packet::IP()-created IP_Hdr should not free
  Make enums work for non-C++11 config
  Refactor to make bro use a common Packet object. Do a better job of parsing layer 2 and keeping track of layer 3 proto. Add support for raw packet event, including Layer2 headers.

Conflicts:
	aux/plugins
2015-07-17 12:56:04 -07:00
Robin Sommer
476a5dbc34 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1408'
BIT-1408 #merged

* origin/topic/jsiwek/bit-1408:
  BIT-1408: improve I/O loop and Broker IOSource.
2015-06-04 14:46:30 -07:00
Jon Siwek
58ea1ff458 BIT-1408: improve I/O loop and Broker IOSource. 2015-06-03 08:25:49 -05:00
Jeff Barber
30fdc37479 Refactor to make bro use a common Packet object.
Do a better job of parsing layer 2 and keeping track of layer 3 proto.
Add support for raw packet event, including Layer2 headers.
2015-05-29 10:37:39 -04:00
Robin Sommer
0620bc970a Make sure to always delete the remote serializer.
There were two problems actually: the iomanager wasn't properly
deleting sourcesl; and in some situations, the remote serialize wasn't
registered with it to begin with.

Addresses BIT-1306 and probably also BIT-1356.
2015-04-10 21:51:44 -07:00
Daniel Thayer
eec7f77913 Correct a spelling error 2015-03-18 16:39:06 -05:00
Robin Sommer
e5adc768cc Merge branch 'stats-bytes-recvd' of https://github.com/msmiley/bro 2015-03-04 13:16:19 -08:00
Mike Smiley
3877b3e34b add bytes recvd to Stats and stats.bro
use libpcap packet hdr.len to count bytes
2015-02-23 21:27:28 -05:00
Robin Sommer
d29679484d Removing dependency on PCAP_NETMASK_UNKNOWN to compile with libpcap <
1.1.1.
2015-02-20 13:49:58 -08:00
Seth Hall
9a71f8aa86 Initial commit of RadioTap encapsulation support)
- It works for me, but I believe that one of the headers I'm stripping
   is variable length so this is unlikely to be complete.
2015-02-04 23:33:20 -05:00
Jon Siwek
dec96234e3 Fix some minor Coverity Scan complaints. 2014-10-30 13:26:34 -05:00
Robin Sommer
38beb6632e Switching the prefix separator for packet source/dumper plugins once
more, now to "::".

Addresses BIT-1267.
2014-10-07 15:27:16 -07:00
Robin Sommer
56a2a1a1e5 Fix for allowing a packet source plugin to provide multiple prefixes
with a colon.
2014-10-07 15:26:30 -07:00
Jon Siwek
31b7e984d1 Fix packet sources being treated as idle when a packet is available.
Addresses BIT-1266.
2014-10-02 12:16:33 -05:00
Jon Siwek
9cd85be308 Fix regression causing the main loop to spin more frequently.
Addresses BIT-1266.
2014-10-02 11:33:37 -05:00
Robin Sommer
cce09b75de Changing prefix for packet sources/dumper from ':' to '%'.
Addresses BIT-1249.
2014-09-25 17:54:36 -07:00
Robin Sommer
e9692958f0 Merge remote-tracking branch 'origin/topic/jsiwek/improve_comm_loop'
* origin/topic/jsiwek/improve_comm_loop:
  Add a simple FD_Set wrapper/helper class.
  Fix Pipe copy/assignment to make a copy of flags.
  Fix possible abort on writing to a full pipe.
  Remove timeouts from remote communication loop.
2014-09-25 12:46:48 -07:00
Jon Siwek
a87b22cd0a Fix a compile error on systems without pcap-int.h. 2014-09-15 11:16:39 -05:00
Robin Sommer
160543cbc6 Merge remote-tracking branch 'origin/topic/jsiwek/jj-bugs'
* origin/topic/jsiwek/jj-bugs:
  Fix incorrect data delivery skips after gap in HTTP Content-Range.
  Fix file analysis placement of data after gap in HTTP Content-Range.
  Fix issue w/ TCP reassembler not delivering some segments.
  Raise http_entity_data in line with data arrival.
  Implement file ID caching for MIME_Mail.
  BIT-1240: Fix MIME entity file data/gap ordering.

BIT-1240 #closed
BIT-1246 #closed
BIT-1247 #closed
BIT-1248 #closed
2014-09-12 19:44:54 -07:00
Jon Siwek
59c54a0fc6 Add a simple FD_Set wrapper/helper class. 2014-09-09 16:28:04 -05:00
Jon Siwek
450680f72b Fix a compile error. 2014-09-09 14:36:19 -05:00
Jon Siwek
cf66bd8b69 Merge branch 'master' into topic/jsiwek/improve_comm_loop
Conflicts:
	src/CMakeLists.txt
	src/FlowSrc.cc
	src/FlowSrc.h
	src/IOSource.h
	src/PktSrc.cc
	src/PktSrc.h
	src/iosource/Manager.cc
2014-09-09 14:19:43 -05:00
Robin Sommer
265438b84c Merge remote-tracking branch 'origin/master' into topic/robin/pktsrc 2014-09-08 14:03:16 -07:00
Robin Sommer
5c6dfb2408 Fixing link-layer handling.
Something had gotten mixed up here.
2014-09-06 12:31:25 -07:00
Robin Sommer
4a66a8e341 Bugfixes and test updates. 2014-09-05 18:20:23 -07:00
Robin Sommer
042afd2feb Fixing remaining tests. 2014-09-04 20:55:44 -07:00
Robin Sommer
43e63daa45 Fixing Bro-level BPF filtering. 2014-09-03 17:37:35 -07:00
Robin Sommer
569853444f A set of smaller API tweaks, and polishing. 2014-09-03 12:45:38 -07:00
Robin Sommer
3e669daa05 Interface tweaks for PktSrc, plus docs for PktSrc and PktDumper. 2014-08-28 00:52:36 -04:00
Robin Sommer
5f817513d0 A set of various fixes and smaller API tweaks, plus tests.
Also moving PCAP-related bifs to iosource/pcap.bif.
2014-08-24 19:55:26 -07:00
Robin Sommer
ce9f16490c Moving some of the BPF filtering code into base class.
This will allow packet sources that don't support BPF natively to
emulate the filtering via libpcap.
2014-08-22 17:50:03 -07:00
Robin Sommer
0186061aa8 Small packet dumper API change. 2014-08-22 16:49:32 -07:00
Robin Sommer
caa55ad352 Moving Pkt{Src,Dumper} a directory level up.
Also renaming PktSourceComponent to PktSrcComponent.
2014-08-22 16:46:15 -07:00
Robin Sommer
93e6a4a9db Removing netmap, remaining pieces of the 2ndary path, and left-over
files of packet sorter.

Netmap will move to a plugin.
2014-08-22 16:24:39 -07:00
Robin Sommer
bf6dd2e9ca Merge remote-tracking branch 'origin/master' into topic/robin/pktsrc
Conflicts:
	configure
	src/CMakeLists.txt
	src/Net.cc
	src/PacketSort.cc
	src/PacketSort.h
	src/RemoteSerializer.cc
	src/Sessions.cc
	src/Sessions.h
2014-08-22 15:41:42 -07:00
Robin Sommer
462fd68931 Prototype of a netmap packet source.
TODO: Add userland BPF filtering so that our filters work.
2014-01-27 16:44:21 -08:00
Robin Sommer
9a9451af00 A series of updates and tweaks to the new PktSrc interface. 2014-01-27 15:20:02 -08:00
Robin Sommer
191b63e334 Merge branch 'topic/robin/dynamic-plugins-2.3' into topic/robin/pktsrc 2014-01-27 09:31:15 -08:00
Robin Sommer
93d9dde969 IOSource reorg.
A bunch of infrastructure work to move IOSource, IOSourceRegistry (now
iosource::Manager) and PktSrc/PktDumper code into iosource/, and over
to a plugin structure.

Other IOSources aren't touched yet, they are still in src/*.

It compiles and does something with a small trace, but that's all I've
tested so far. There are quite certainly a number of problems left, as
well as various TODOs and cleanup; and nothing's cast in stone yet.

Will continue to work on this.
2013-12-11 18:00:34 -08:00