Commit graph

5909 commits

Author SHA1 Message Date
Robin Sommer
4baf344278 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Normalize Notice::Type identifiers per convention. (closes #484)
  Another fix to the default-loaded-scripts test.
  Add new piped_exec BiF.
  Revert "Fixes for email_notice_to() function."
  Fixes for email_notice_to() function.
2011-07-28 17:05:55 -07:00
Jon Siwek
19dab4fdda Add new piped_exec BiF.
And changing email_notice_to() function in notice framework to
interface with sendmail through it.
2011-07-27 13:52:24 -05:00
Jon Siwek
454fd9578e Fixes to relative @load'ing.
The currently loading script's path is prepended (vs. appended) to
BROPATH to search for the @load'd file to prevent being overshadowed by
scripts/directories/packages in the normal BROPATH with the same name.

This extra search path should also only be prepended to BROPATH in the
case when the @load'd file we're looking for is actually relative
(i.e. the name starts with "./" or "../").
2011-07-23 20:46:35 -05:00
Jon Siwek
b6a371f32d mask_addr bif now returns subnet (addresses #512) 2011-07-23 16:45:29 -05:00
Jon Siwek
b05c34ed29 LogWriterAscii now prints time values w/ constant 6 digit precision.
closes #508
2011-07-22 16:33:50 -07:00
Robin Sommer
8dc1a52d9d Fix for disable_analyzer() problem.
When calling an Analyzer's method to remove a child analyzer, we now
postpone the actual removal to later, as otherwise the call to Done()
might trigger further analyzer activity that can interfere with code
running after that that triggered the removal.

This should fix the SSL assertion crashes that we have seen.

This change is a bit tricky internally, but the trace-based tests
produce the same output as before so things should be fine ...
2011-07-22 16:19:24 -07:00
Robin Sommer
e9bd122f8a Fixing potential segfault in DebugLogger.
The Reporter may not have been initialized yet when the logger ctor runs.
2011-07-22 13:36:21 -07:00
Robin Sommer
1a46d78584 Some small layout tweaks that didn't get committed with the last merge. 2011-07-22 13:35:29 -07:00
Robin Sommer
eb1e76600c Merge remote-tracking branch 'origin/topic/script-load-changes'
* origin/topic/script-load-changes:
  Fix reST file name associated w/ stdin when in doc mode (closes #497)
  Update @prefixes test.
  Rewrite a test using btest's TEST-START-FILE directive
  Fix @unload'd files from generating bro_script_loaded event.
  Renaming a test better.
  Reimplementation of the @prefixes statement.
  Fix accidental overwrite of BROPATH copy.
  Make @load statements recognize relative paths.
2011-07-21 15:29:15 -07:00
Robin Sommer
2892026201 Merge remote-tracking branch 'origin/topic/jsiwek/irc-orig'
* origin/topic/jsiwek/irc-orig:
  Shorten what's displayed in the IRC's log mime_type column for DCC transfers
  Add IRC unit tests.
  Small tweak to IRC event handlder priorities
  Fix IRC analyzer supplying wrong type to irc_dcc_message event.
  Changes to IRC analyzer and events (addresses #469).
2011-07-20 17:13:06 -07:00
Jon Siwek
54c14025d9 Fix reST file name associated w/ stdin when in doc mode (closes #497) 2011-07-20 16:13:22 -05:00
Jon Siwek
0dd1a1e21e Fix @unload'd files from generating bro_script_loaded event. 2011-07-20 15:56:25 -05:00
Jon Siwek
089b822302 Merge branch 'master' into topic/script-load-changes 2011-07-20 15:38:22 -05:00
Jon Siwek
717a2a54f6 Merge branch 'master' into topic/jsiwek/irc-orig 2011-07-20 15:11:43 -05:00
Jon Siwek
063ad9a103 Fix IRC analyzer supplying wrong type to irc_dcc_message event.
And other IRC policy tweaks.
2011-07-20 13:19:44 -05:00
Robin Sommer
6253c7c02c Removing undocumented -H command line flag.
Closes #496.
2011-07-19 17:49:52 -07:00
Robin Sommer
5d7af681f4 Fixing comment. 2011-07-19 17:46:44 -07:00
Robin Sommer
38bc560358 Fixing 0-chunk bug in remote logging. 2011-07-19 17:40:07 -07:00
Jon Siwek
a73ef6f0e1 Changes to IRC analyzer and events (addresses #469).
- Removed irc_client and irc_server events.
- Added is_orig arguments to all other irc events.
- Fix analyzer not recognizing Turbo DCC extension message format.
- Fix analyzer not generating irc_dcc_message event when irc_privmsg_message
  event doesn't have a handler registered.
- Changes to IRC policy scripts to use the above changes.
2011-07-19 17:06:01 -05:00
Jon Siwek
d97003892b Reimplementation of the @prefixes statement.
Any added prefixes are now used *after* all input files have been
parsed to look for a prefixed, flattened version of the input file
somewhere in BROPATH and, if found, load it.

For example, if "lcl" is in @prefixes, and site.bro is loaded, then
a file named "lcl.site.bro" that's in BROPATH would end up being
automatically loaded as well.  Packages work similarly, e.g. loading
"protocols/http" means a file named "lcl.protocols.http.bro" in BROPATH
gets loaded automatically.
2011-07-14 21:32:02 -05:00
Jon Siwek
e39a49833f Fix accidental overwrite of BROPATH copy. 2011-07-14 18:17:30 -05:00
Jon Siwek
e5e3bf28ec Make @load statements recognize relative paths.
For example a script can do "@load ./foo" to load a script named
foo.bro that lives in the same directory or "@load ../bar" to load
a script named bar.bro in the parent directory, even if those
directories are not contained in BROPATH.
2011-07-14 11:35:23 -05:00
Robin Sommer
f83650f14a Fixing reporter's weird flow method. 2011-07-11 22:18:22 -07:00
Robin Sommer
5113b100d9 Making valgrind a bit more happy, and adding code that may or may not
help with #490 and #491.
2011-07-10 15:07:37 -07:00
Seth Hall
8bb240af99 Merge branch 'master' of ssh://git.bro-ids.org/bro 2011-07-08 01:46:01 -04:00
Seth Hall
0af6e47ccd Removed the policy subpaths from the Bro core. 2011-07-08 00:06:02 -04:00
Robin Sommer
8bacb6eb3d New BiF record_field_vals() that returns the fields of a record in a
table with meta-information.

Example:

type r: record {
	a: count;
	b: string &default="Foo";
	c: double &optional;
	d: string &log;
};

event bro_init()
{
    local x: r = [$a=42, $d="Bar"];
    print record_fields(x);
}

This prints:

  {
  [a] = [type_name=record, log=F, value=42, default_val=<uninitialized>]
  [b] = [type_name=record, log=F, value=<uninitialized>, default_val=Foo],
  [c] = [type_name=record, log=F, value=<uninitialized>, default_val=<uninitialized>],
  [d] = [type_name=record, log=T, value=Bar, default_val=<uninitialized>],
  }

This is one more step in Seth's quest for full inspection support. :-)
2011-07-07 19:56:48 -07:00
Robin Sommer
084c2086a4 Fixing bug causing crash when running without arguments. 2011-07-07 19:56:48 -07:00
Robin Sommer
97b5f812c7 A new event bro_script_loaded() raised for each policy script loaded.
Also removing the -l command-line option as that can now be done at
the script-level.

A couple tests fail now that use -l. Leaving that until we have
script-level replacement.
2011-07-07 19:56:26 -07:00
Robin Sommer
df1b2f922b Renaming reporter_message to report_info.
Same change internally.
2011-07-07 19:56:25 -07:00
Robin Sommer
eb0580c622 Fixing another memory leak.
This is the ConnVal leak that Gilbert also saw.
2011-07-07 19:46:40 -07:00
Robin Sommer
1ebcf4f422 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Adding 'delete' fixes into fastpath.
2011-07-07 18:55:08 -07:00
Gilbert Clark gc355804@ohio.edu
21e75891b7 Adding 'delete' fixes into fastpath. 2011-07-05 17:36:29 -07:00
Robin Sommer
cea00fe51b Missing pieces. 2011-07-01 21:59:25 -07:00
Robin Sommer
94be787261 Merge remote branch 'remotes/origin/topic/policy-scripts-new'
* remotes/origin/topic/policy-scripts-new:
  Fixed another SSL analyzer memory leak.
  Attempting to fix another SSL bug.
  Fixing a ref counting bug in the SSL analyzer that I just introduced.
  Fixing memory leaks in SSL analyzer.
  Fixed a parsing bug in the SSL analyzer thanks to tracefile from Aashish Sharma.
  Removing my fix from earlier.  This is indicating the script-land generated events priority problem.
  Updates to the DPD framework.
  Fixed a bug in the auth-addl DNS script.

Conflicts:
	src/bro.bif
2011-07-01 18:59:34 -07:00
Robin Sommer
8432258db0 Merge remote branch 'origin/topic/jsiwek/pybroccoli-fixes'
* origin/topic/jsiwek/pybroccoli-fixes:
  Move event arg. record coercion check; now only done for recv'd remote events
  Update istate.pybroccoli test.
2011-07-01 18:56:27 -07:00
Robin Sommer
4580bef3e6 Fixing bugs in communication.
- The reporter can't be used from the child process.

- Don't attempt to send a zero-sized chunk when remote print buffer is
  empty.
2011-07-01 18:49:15 -07:00
Robin Sommer
bff8d39428 Fixing bug with even priorities potentially being ignored for the
handler.
2011-07-01 15:40:42 -07:00
Robin Sommer
9709b1d522 Merge remote branch 'origin/topic/robin/reporting'
* origin/topic/robin/reporting:
  Syslog BiF now goes through the reporter as well.
  Avoiding infinite loops when an error message handlers triggers errors itself.
  Renaming the Logger to Reporter.
  Overhauling the internal reporting of messages to the user.

Updating a bunch of tests/baselines as well.

Conflicts:
	aux/broccoli
	policy.old/alarm.bro
	policy/all.bro
	policy/bro.init
	policy/frameworks/notice/weird.bro
	policy/notice.bro
	src/SSL-binpac.cc
	src/bro.bif
	src/main.cc
2011-07-01 13:59:21 -07:00
Seth Hall
38f2cc2d97 Fixed another SSL analyzer memory leak. 2011-07-01 14:11:17 -04:00
Robin Sommer
8992e7de97 Syslog BiF now goes through the reporter as well. 2011-07-01 10:06:08 -07:00
Robin Sommer
fb6a8cec19 Avoiding infinite loops when an error message handlers triggers errors
itself.

If an error is triggered inside one of the reporter_* handlers, the
message about that will now fall back to stderr.
2011-07-01 10:04:27 -07:00
Seth Hall
fbf48dba5d Attempting to fix another SSL bug. 2011-07-01 12:48:31 -04:00
Seth Hall
ab93087715 Fixing a ref counting bug in the SSL analyzer that I just introduced. 2011-07-01 12:32:23 -04:00
Robin Sommer
66e2c3b623 Renaming the Logger to Reporter.
Also changing output to not include timestamps when we haven't started
processing packets yet.
2011-07-01 09:22:33 -07:00
Seth Hall
0dbfebc2f8 Fixing memory leaks in SSL analyzer. 2011-07-01 12:21:50 -04:00
Seth Hall
bab76be87a Fixed a parsing bug in the SSL analyzer thanks to tracefile from Aashish Sharma. 2011-07-01 06:49:41 -04:00
Robin Sommer
27aa30c683 Work-around for bug in HTTP analyzer.
See #488 for more information.
2011-06-30 22:44:09 -07:00
Robin Sommer
e87e2ad96e Merge remote branch 'remotes/origin/topic/policy-scripts-new'
* remotes/origin/topic/policy-scripts-new:
  Add RPC/SSL scripts to doc generation target.
  Update the generated script doc organization.
  Changing back the last commit.  It made things worse.
  Trying a different method of record parsing for SSL analyzer.
  Moved the RPC script into the right place.
  More SSL script cleanup.
  Fixed a segfault from empty strings in the SSL analyzer.
  Removing what I believe is the last stray print statement from the SSL analyzer.
  Fixed more eternal looping bugs in the SSL analyzer.
  Updates and fixes for the SSL analyzer.
  Changes to make generated script docs understand new policy/ hierarchy.
2011-06-30 16:43:21 -07:00
Jon Siwek
446521d940 Merge branch 'topic/policy-scripts-new' of git://git.bro-ids.org/bro into topic/policy-scripts-new 2011-06-30 17:06:30 -05:00