Commit graph

871 commits

Author SHA1 Message Date
Seth Hall
69b7ce12d2 API updates for metrics framework.
- Removed default logging.  Now a function is available for the new
  $period_finished filter field to get the same behavior for logging
  named Metrics::write_log.

- Added index rollups for getting multiple metrics result values
  as the same time.
2012-12-18 01:08:59 -05:00
Seth Hall
69030fdff3 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-17 10:00:34 -05:00
Robin Sommer
ea6b62f586 Merge remote-tracking branch 'origin/topic/jsiwek/const'
* origin/topic/jsiwek/const:
  Make const variables actually constant.  Addresses #922.

Closes #922.
2012-12-14 14:56:37 -08:00
Robin Sommer
7a2901ec6b Fixing checksums in test trace because Bro now reports them. :-) 2012-12-14 14:48:16 -08:00
Jon Siwek
290c2a0b4d Make const variables actually constant. Addresses #922.
Both local and global variables declared with "const" could be modified,
but now expressions that would modify them should generate an error
message at parse-time.
2012-12-13 15:05:29 -06:00
Jon Siwek
43ed437daa Trick for parallelizing input framework unit tests.
Instead of loading listen.bro to block until files are read, just read
a pcap file in pseudo-realtime.  Seems to work well.
2012-12-11 17:06:54 -06:00
Jon Siwek
aff5898442 Maybe fix reliability of a unit test that relies on when statements. 2012-12-11 16:26:01 -06:00
Robin Sommer
b867333c2e Merge remote-tracking branch 'origin/topic/jsiwek/gtp'
* origin/topic/jsiwek/gtp:
  Change binpac exceptions in AYIYA/GTP analyzers to do protocol_violation
  Add GTP tunnel analyzer memory leak unit test.
  Add GPRS Tunnelling Protocol (GTPv1) decapsulation.

Closes #690.
2012-12-10 14:48:18 -08:00
Robin Sommer
e2d20cb7bc Changing the HTTP parser to accept methods that align with the RFC. 2012-12-07 19:42:03 -08:00
Seth Hall
dda36672ac Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-06 11:07:35 -05:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
2012-12-05 16:56:54 -08:00
Robin Sommer
177c014cb7 Merge remote-tracking branch 'vlad/topic/vladg/http-verbs'
* vlad/topic/vladg/http-verbs:
  A test for HTTP methods, including some horribly illegal requests.
  Remove hardcoded HTTP verbs from the analyzer (#741)

I added a "bad_HTTP_request" weird for HTTP request lines that don't
have more than a single word.

Closes #741.
2012-12-05 15:27:42 -08:00
Bernhard Amann
3973cb1075 Merge remote-tracking branch 'origin/fastpath' into fastpath 2012-12-05 12:42:02 -08:00
Bernhard Amann
d367e227c1 ok, this one is a bit... embarrassing.
Delete the correct entry in case of error. Fixes a segfault when the faulty
data is of type string and not the last field of the input...
2012-12-05 12:40:00 -08:00
Jon Siwek
f403e537ec Fix segfault: uninitialized identifiers w/ &synchronized (addresses #66)
Synchronization of state between connecting peers now skips over
identifiers that aren't initialized with a value yet.  If they're
assigned a value later, that will be synchronized like usual.
2012-12-05 12:36:09 -06:00
Jon Siwek
32239ea633 Bad record constructor initializers now give an error (addresses #34).
As opposed to a segfault.
2012-12-04 16:29:23 -06:00
Jon Siwek
75278af8a1 Invalid vector indices now generate error message (addresses #24).
The error/behavior is the same as accessing tables at invalid indices.
2012-12-04 15:22:16 -06:00
Jon Siwek
f7440375f1 Interpreter exceptions occurring in "when" blocks are now handled.
The scripting error that caused the exception is still reported, but
it no longer causes Bro to terminate.  Addresses #779
2012-12-04 12:38:09 -06:00
Seth Hall
3af4517e2a Adding an $end time for result values to measure the length of time a measurement took. 2012-12-04 11:04:01 -05:00
Seth Hall
d61d175a04 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-04 00:17:43 -05:00
Robin Sommer
63d43e6545 Renaming ASCII writer filter option 'only_single_header_row' to 'tsv'.
Also clarifying usage.

Closes #912.
2012-12-03 14:40:38 -08:00
Robin Sommer
d9f90fcac0 Merge remote-tracking branch 'origin/topic/jsiwek/table-attribute-fixes'
* origin/topic/jsiwek/table-attribute-fixes:
  Fix various bugs with table/set attributes.

Closes #866.
2012-12-03 14:11:44 -08:00
Robin Sommer
d4792dc7fe Merge remote-tracking branch 'origin/topic/jsiwek/table-init-container-ctors'
* origin/topic/jsiwek/table-init-container-ctors:
  Add test of record() constructor to table initializer unit test.
  Fix table(), set(), vector() constructors in table initializer lists.

Closes #5.
2012-12-03 14:10:17 -08:00
Robin Sommer
1298f2e974 Merge remote-tracking branch 'origin/topic/jsiwek/hook'
* origin/topic/jsiwek/hook:
  Change hook calls to only be allowed when preceded by "hook" keyword.
  Clarification in hook documentation.
  Hook functions now directly callable instead of w/ "hook" statements.

Closes #918.
2012-12-03 14:07:22 -08:00
Vlad Grigorescu
318f38df43 A test for HTTP methods, including some horribly illegal requests. 2012-11-30 22:06:54 -05:00
Jon Siwek
95ffb1cf27 Quick pass over unit tests, adding -b flag to bro so they run faster.
Doing this made bifs/ ~3x faster and language/ ~2x faster.
2012-11-30 17:44:36 -06:00
Jon Siwek
4e85fe0454 Change hook calls to only be allowed when preceded by "hook" keyword. 2012-11-30 15:39:00 -06:00
Jon Siwek
cc8f20c104 Merge branch 'master' into topic/jsiwek/gtp 2012-11-29 16:11:27 -06:00
Jon Siwek
f7e07f5f09 Fix various bugs with table/set attributes.
- Identifiers that are initialized with set()/table() constructor
  expressions now inherit attributes from the expression.  Before,
  statements like

     const i: set[string] = set() &redef;

  associated the attribute with the set() constructor, but not the
  "i" identifier, preventing redefinition.  Addresses #866.

- Allow &default attribute to apply to tables initialized as empty
  (via either "{ }" or "table()") or if the expression supplied to it
  can evaluate to a type that's promotable to the same yield type as
  the table.
2012-11-29 15:44:03 -06:00
Jon Siwek
00f7bbda96 Add test of record() constructor to table initializer unit test. 2012-11-28 14:53:36 -06:00
Jon Siwek
a0590b2140 Fix table(), set(), vector() constructors in table initializer lists.
Also adds type checking of yield values to table() constructor and
fixes the type checking of yield values in vector() constructor.

Addresses #5.
2012-11-28 14:19:48 -06:00
Seth Hall
956c23eb66 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-11-28 14:57:42 -05:00
Jon Siwek
378ee699ff Hook functions now directly callable instead of w/ "hook" statements.
The return value of the call is an implicit boolean value of T if all
hook handlers ran, or F if one hook handler exited as a result of a
break statement and potentially prevented other handlers from running.

Scripts don't need to declare hooks with an explicit return type of bool
(internally, that's assumed), and any values given to (optional) return
statements in handler definitions are just ignored.

Addresses #918.
2012-11-26 17:09:29 -06:00
Robin Sommer
a5e237f50c The ASCII writer now supports a filter config option
'only_single_header_row' that turns the output into CSV format.

In that mode all meta data is skipped except for a single header line
with the fields names. Example:

    local my_filter: Log::Filter = [$name = "my-filter", $writer = Log::WRITER_ASCII, $config = table(["only_single_header_row"] = "T")];

Contributed by Carsten Langer.
2012-11-23 19:38:53 -08:00
Robin Sommer
d9bb9e0eb1 Merge remote-tracking branch 'origin/topic/jsiwek/hook'
* origin/topic/jsiwek/hook:
  Add memory leak unit test for "hook" function flavor.
  Add new function flavor called a "hook".
2012-11-23 18:39:51 -08:00
Robin Sommer
96ce99590d Merge remote-tracking branch 'origin/topic/jsiwek/improve-enum-doc'
* origin/topic/jsiwek/improve-enum-doc:
  Improve auto-generated enum documentation.

Closes #919.
2012-11-23 18:26:06 -08:00
Seth Hall
5921a68e91 More test updates. 2012-11-20 11:18:55 -05:00
Seth Hall
08538211e1 Some test updates. 2012-11-20 02:08:49 -05:00
Seth Hall
95b12262e4 More cleanup and fixed to the metrics framework. 2012-11-19 23:43:15 -05:00
Seth Hall
5b81cfe7e2 Implemented a nearly generic Queue in scriptland. 2012-11-19 23:42:19 -05:00
Jon Siwek
56e359ca9d Fix ambiguity between composite table index and record ctor expressions.
For tables of a composite index type with the first type being a
record, membership checks with an inline index key could be
misinterpreted as a record constructor instead of an expression list.
E.g, if the table type is "global t = table[conn_id, bool] of count",
then checking membership like "[c$id, is_orig] in t" now works.

Addresses #80.
2012-11-16 12:43:39 -06:00
Seth Hall
e99e090b85 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-11-16 02:49:36 -05:00
Seth Hall
d9195076b1 Metrics framework checkpoint.
- New scan.bro merged in and reworked a bit.

 - Updated metrics API.  Now possible to calculate much more.
2012-11-16 02:37:52 -05:00
Jon Siwek
9e49703087 Improve auto-generated enum documentation.
The names of enum types are tracked so that variables holding a value
of a given enum type can generate a reference to it instead of just
listing the type as a generic "enum".
2012-11-15 16:54:33 -06:00
Jon Siwek
c8d64b5028 Add memory leak unit test for "hook" function flavor. 2012-11-15 14:02:24 -06:00
Jon Siwek
e0fb9eb2b2 Add new function flavor called a "hook".
This new flavor of function behaves like a "synchronous event".
See documentation for more details on usage.
2012-11-15 13:45:13 -06:00
Robin Sommer
5508a5bb80 Merge remote-tracking branch 'origin/topic/dnthayer/bytes-to-double'
* origin/topic/dnthayer/bytes-to-double:
  Portability improvement (data alignment issues)
  Add test cases for the bytestring_to_double BIF
  Add a new BIF "bytestring_to_double"

Closes #908.
2012-11-14 13:20:46 -08:00
Daniel Thayer
b309c265b8 Merge remote-tracking branch 'origin/master' into topic/dnthayer/bytes-to-double 2012-11-13 15:53:18 -06:00
Jon Siwek
fd5eb23fa6 Remove byte count parameter from modbus events carrying register arrays
Instead of these events being generated for invalid byte count values
(they should always be even, not odd), a protocol_violation is raised.

    modbus_read_holding_registers_response
    modbus_read_input_registers_response
    modbus_write_multiple_registers_request
    modbus_read_write_multiple_registers_request
    modbus_read_write_multiple_registers_response
    modbus_read_fifo_queue_respons
2012-11-13 12:09:14 -06:00
Jon Siwek
c911d03c30 Adjust modbus register array parsing.
For modbus message types that include variable amount of register values
(uint16[]), setting a &length attribute without an explicit array size
could trigger a parsing assertion since it allows for the "element" data
pointer to travel past the "end of data" (e.g. when &length is odd).
This is changed to now give both an array size and &length to earlier
terminate the parsing of elements before the assert is checked and
so a single out-of-bound check can be done for the entire array
(leaving off &length causes an out-of-bound check for each element).

Added another parameter to modbus events that carry register arrays to
the script-layer which indicates the associated byte count from the
message (allowing for invalid values to be detected):

    modbus_read_holding_registers_response
    modbus_read_input_registers_response
    modbus_write_multiple_registers_request
    modbus_read_write_multiple_registers_request
    modbus_read_write_multiple_registers_response
    modbus_read_fifo_queue_response
2012-11-12 16:40:16 -06:00