Commit graph

989 commits

Author SHA1 Message Date
Robin Sommer
8bacb6eb3d New BiF record_field_vals() that returns the fields of a record in a
table with meta-information.

Example:

type r: record {
	a: count;
	b: string &default="Foo";
	c: double &optional;
	d: string &log;
};

event bro_init()
{
    local x: r = [$a=42, $d="Bar"];
    print record_fields(x);
}

This prints:

  {
  [a] = [type_name=record, log=F, value=42, default_val=<uninitialized>]
  [b] = [type_name=record, log=F, value=<uninitialized>, default_val=Foo],
  [c] = [type_name=record, log=F, value=<uninitialized>, default_val=<uninitialized>],
  [d] = [type_name=record, log=T, value=Bar, default_val=<uninitialized>],
  }

This is one more step in Seth's quest for full inspection support. :-)
2011-07-07 19:56:48 -07:00
Robin Sommer
cdd8827cc4 Adding a script that extracts a connection from a trace based on uid.
The script parsed conn.log to find the 4-tuple and then runs tcpdump
to find the relevant packets.
2011-07-07 19:56:48 -07:00
Robin Sommer
084c2086a4 Fixing bug causing crash when running without arguments. 2011-07-07 19:56:48 -07:00
Robin Sommer
97b5f812c7 A new event bro_script_loaded() raised for each policy script loaded.
Also removing the -l command-line option as that can now be done at
the script-level.

A couple tests fail now that use -l. Leaving that until we have
script-level replacement.
2011-07-07 19:56:26 -07:00
Robin Sommer
df1b2f922b Renaming reporter_message to report_info.
Same change internally.
2011-07-07 19:56:25 -07:00
Robin Sommer
eb0580c622 Fixing another memory leak.
This is the ConnVal leak that Gilbert also saw.
2011-07-07 19:46:40 -07:00
Robin Sommer
d3e764155e Merge branch 'master' of ssh://git.bro-ids.org/bro 2011-07-07 19:39:16 -07:00
Robin Sommer
1ebcf4f422 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Adding 'delete' fixes into fastpath.
2011-07-07 18:55:08 -07:00
Seth Hall
d1e8722f5f Fixed a problem with the cluster framework unintentionally terminating bro. 2011-07-07 21:28:26 -04:00
Seth Hall
77435d2724 Removing more vestiges of BroCtl from Bro. 2011-07-07 21:24:51 -04:00
Seth Hall
6010f7950e Update for cluster framework.
- CLUSTER_NODE is now specified by name given as the index
  value in the Cluster::nodes variable.  e.g. worker-1
2011-07-07 15:57:25 -04:00
Seth Hall
e4052aba3d Adding a peer name to the communication logs. 2011-07-07 15:15:53 -04:00
Seth Hall
be65acec4e Initial commit of the new cluster framework.
- It's ok to always load the framework.  If you don't
  specifiy the CLUSTER_NODE environment variable it doesn't
  ultimately do anything.
- The $CLUSTER_NODE variable causes the framework to try and
  load a script named cluster-layout.bro which must be located
  somewhere in your $BROPATH.  The value of the $CLUSTER_NODE
  variable is a count that indicates a node in the Cluster::nodes
  variable that is set in the cluster-layout.bro script.
- The Cluster::nodes variable is a flat configuration because
  it's assumed that it would be automatically generated by a
  utility such as BroControl.  This will facilitate the tiered or
  "deep" clustering that is coming.
2011-07-07 13:21:19 -04:00
Seth Hall
ee59c86b8f Restructing bro.init a little bit to load required frameworks at the end. 2011-07-06 10:28:45 -04:00
Seth Hall
02b94f7141 Removed the notice_tag injection from the conn log.
It had some conceptual problems because notices aren't
always logged and in some cases are fairly infrequently
logged which resulted in a lot of notice tags being
attached to connections where the notice didn't show
up in a log file.  Also, the rule of thumb here is that
frameworks should never load protocols.  It's just bad
practice and probably indicates incorrect design somewhere.

The link between the conn log and the notice log should
now be made with the connections unique ID which is logged
in both logs and is more reliable.
2011-07-06 10:23:30 -04:00
Seth Hall
b2af6b9fd5 Adding the reporter framework. Not much there yet. 2011-07-06 10:07:57 -04:00
Seth Hall
46d0cf517b Start detecting Microsoft Sharepoint servers. 2011-07-06 09:18:22 -04:00
Robin Sommer
c8f5a1eeaa Updating submodule(s). 2011-07-05 18:48:55 -07:00
Robin Sommer
b457e7740b Merge branch 'master' of ssh://git.bro-ids.org/bro 2011-07-05 18:48:13 -07:00
Robin Sommer
c738701ffd Cleaning up some testing stuff.
- The Makefiles now run btest with "-f diag.log" so that diangnostics
  output will always be written into that file.

- Makefiles now hardcode path to btest to avoid picking up the wrong version
  if in PATH.

- The canonifier scripts now live in testing/scripts, and they are
  used from both btest/ and external/.

- There's a new diff-remove-uids scripts that removed connection UIDs
  for diffing. The external/* tests now use that by default.

- Timestamp removal now has its own script: diff-remove-timestamps.
  diff-canonifier calls that.

- All Makefile have a "brief" target that runs btest with -b.

- The higher-level directories have Makefile to call the subdirs.
2011-07-05 18:47:08 -07:00
Gilbert Clark gc355804@ohio.edu
21e75891b7 Adding 'delete' fixes into fastpath. 2011-07-05 17:36:29 -07:00
Seth Hall
ef96dc8d4d Spelling mistake caused known-services to not work quite right. 2011-07-05 15:55:33 -04:00
Robin Sommer
1fded82c32 Fixing tests. 2011-07-01 22:26:45 -07:00
Robin Sommer
3340bc0f26 Updating submodule(s). 2011-07-01 22:20:34 -07:00
Robin Sommer
ed727aeaad Updating submodule(s). 2011-07-01 22:05:01 -07:00
Robin Sommer
c21d75489f Updating submodule(s). 2011-07-01 22:03:31 -07:00
Robin Sommer
c1a3cc0e5a Updating submodule(s). 2011-07-01 22:02:17 -07:00
Robin Sommer
bbb57329fd Updating submodule(s). 2011-07-01 22:00:54 -07:00
Robin Sommer
cea00fe51b Missing pieces. 2011-07-01 21:59:25 -07:00
Robin Sommer
94be787261 Merge remote branch 'remotes/origin/topic/policy-scripts-new'
* remotes/origin/topic/policy-scripts-new:
  Fixed another SSL analyzer memory leak.
  Attempting to fix another SSL bug.
  Fixing a ref counting bug in the SSL analyzer that I just introduced.
  Fixing memory leaks in SSL analyzer.
  Fixed a parsing bug in the SSL analyzer thanks to tracefile from Aashish Sharma.
  Removing my fix from earlier.  This is indicating the script-land generated events priority problem.
  Updates to the DPD framework.
  Fixed a bug in the auth-addl DNS script.

Conflicts:
	src/bro.bif
2011-07-01 18:59:34 -07:00
Robin Sommer
073358c488 Updating tests. 2011-07-01 18:57:03 -07:00
Robin Sommer
8432258db0 Merge remote branch 'origin/topic/jsiwek/pybroccoli-fixes'
* origin/topic/jsiwek/pybroccoli-fixes:
  Move event arg. record coercion check; now only done for recv'd remote events
  Update istate.pybroccoli test.
2011-07-01 18:56:27 -07:00
Robin Sommer
4580bef3e6 Fixing bugs in communication.
- The reporter can't be used from the child process.

- Don't attempt to send a zero-sized chunk when remote print buffer is
  empty.
2011-07-01 18:49:15 -07:00
Robin Sommer
b520f98541 Updating test baselines. 2011-07-01 15:59:48 -07:00
Robin Sommer
bff8d39428 Fixing bug with even priorities potentially being ignored for the
handler.
2011-07-01 15:40:42 -07:00
Robin Sommer
9709b1d522 Merge remote branch 'origin/topic/robin/reporting'
* origin/topic/robin/reporting:
  Syslog BiF now goes through the reporter as well.
  Avoiding infinite loops when an error message handlers triggers errors itself.
  Renaming the Logger to Reporter.
  Overhauling the internal reporting of messages to the user.

Updating a bunch of tests/baselines as well.

Conflicts:
	aux/broccoli
	policy.old/alarm.bro
	policy/all.bro
	policy/bro.init
	policy/frameworks/notice/weird.bro
	policy/notice.bro
	src/SSL-binpac.cc
	src/bro.bif
	src/main.cc
2011-07-01 13:59:21 -07:00
Seth Hall
38f2cc2d97 Fixed another SSL analyzer memory leak. 2011-07-01 14:11:17 -04:00
Robin Sommer
64b60fd939 Updating README. 2011-07-01 10:08:58 -07:00
Robin Sommer
8992e7de97 Syslog BiF now goes through the reporter as well. 2011-07-01 10:06:08 -07:00
Robin Sommer
fb6a8cec19 Avoiding infinite loops when an error message handlers triggers errors
itself.

If an error is triggered inside one of the reporter_* handlers, the
message about that will now fall back to stderr.
2011-07-01 10:04:27 -07:00
Seth Hall
fbf48dba5d Attempting to fix another SSL bug. 2011-07-01 12:48:31 -04:00
Seth Hall
ab93087715 Fixing a ref counting bug in the SSL analyzer that I just introduced. 2011-07-01 12:32:23 -04:00
Robin Sommer
66e2c3b623 Renaming the Logger to Reporter.
Also changing output to not include timestamps when we haven't started
processing packets yet.
2011-07-01 09:22:33 -07:00
Seth Hall
0dbfebc2f8 Fixing memory leaks in SSL analyzer. 2011-07-01 12:21:50 -04:00
Seth Hall
bab76be87a Fixed a parsing bug in the SSL analyzer thanks to tracefile from Aashish Sharma. 2011-07-01 06:49:41 -04:00
Robin Sommer
4577787d9c Test for the HTTP problem in #488.
The test is currently failing until fixed.
2011-06-30 22:54:25 -07:00
Robin Sommer
a34e5e0973 Test for problem in DNS scripts.
It's currently failing.
2011-06-30 22:54:25 -07:00
Robin Sommer
80fcabdb47 Polishing the setup for external tests. 2011-06-30 22:54:25 -07:00
Robin Sommer
27aa30c683 Work-around for bug in HTTP analyzer.
See #488 for more information.
2011-06-30 22:44:09 -07:00
Seth Hall
26248fa243 Removing my fix from earlier. This is indicating the script-land generated events priority problem. 2011-06-30 22:09:16 -04:00