Commit graph

352 commits

Author SHA1 Message Date
Bernhard Amann
3286d013c9 forgot two files. 2012-03-16 23:45:10 -07:00
Bernhard Amann
57ffe1be77 completely change interface again.
compiles, not really tested.

basic test works 70% of the time, coredumps in the other 30 - but was not easy to debug on a first glance (most interestingly the crash happens in the logging framework - I wonder how that works).
Other tests are not adjusted to the new interface yet.
2012-03-15 18:41:51 -07:00
Bernhard Amann
b4e6971aab Add regular debugging output for interesting operations (stream/filter operations) to input framework (this was way overdue) 2012-03-14 14:45:53 -07:00
Bernhard Amann
c3d2f1d5fc Merge remote-tracking branch 'origin/master' into topic/bernhard/input-threads 2012-03-14 12:28:53 -07:00
Jon Siwek
bf3f184a01 Change IPv6 literal constant syntax to require encasing square brackets
This is to avoid ambiguity between compressed hex notation and
module namespacing, both which use "::". E.g.: "aaaa::bbbb" could
be an identifier or an IPv6 address, but "[aaaa::bbbb]" is now
clearly the address.

Also added IPv6 mixed notation to allow an IPv4 dotted-decimal
address to be specified in the lower 32-bits.
2012-03-13 13:47:07 -05:00
Bernhard Amann
92555badd4 cleanup, more sanity tests, a little bit more documentation 2012-03-11 20:43:26 -07:00
Bernhard Amann
cd78005d09 Merge remote-tracking branch 'origin/master' into topic/bernhard/input-threads 2012-03-07 13:43:48 -08:00
Bernhard Amann
7076c64a5e Merge remote-tracking branch 'origin/topic/robin/log-threads' into topic/bernhard/input-threads
(and move a little bit of functionality from ascii reader to backend)

Conflicts:
	src/threading/Manager.cc
2012-03-07 13:42:49 -08:00
Robin Sommer
fd1cc49d67 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Standardized on the &default function for SSL constants.
2012-03-01 08:31:52 -08:00
Seth Hall
87ad77cc10 Standardized on the &default function for SSL constants. 2012-02-29 22:34:31 -05:00
Seth Hall
b3764dcad5 Cleaned up dead code from the old SSL analyzers. (Reported by Julien Sentier) 2012-02-29 09:43:37 -05:00
Bernhard Amann
417542f283 Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads
Seems to work -- all test pass.
But there are thread-safety issues at the moment, because the constructors of IPAddr and IPPrefix are not thread-safe, but needed by workers.

Conflicts:
	src/logging/Manager.cc
2012-02-27 22:59:08 -08:00
Jon Siwek
e07470c7f1 Remove connection compressor (addresses #559). 2012-02-27 11:35:25 -06:00
Robin Sommer
4ef8607e60 Merge remote-tracking branch 'origin/topic/dnthayer/ftp-ipv6'
* origin/topic/dnthayer/ftp-ipv6:
  Add test case for FTP over IPv4
  Fix IPv6 URLs
  Add a test for FTP over IPv6
  Update FTP EPSV response processing for IPv6
  Fix parsing of FTP EPRT command and EPSV response

Conflicts:
	src/bro.bif

Closes #778.
2012-02-24 15:00:41 -08:00
Bernhard Amann
7e5f733826 raw input reader for seth, which can simply read a file into string-events given a line separator. 2012-02-22 09:44:45 -08:00
Daniel Thayer
d61fad4f9e Fix IPv6 URLs 2012-02-17 10:55:17 -06:00
Bernhard Amann
91943c2655 * rework script interface, add autostart stream flag that starts up a stream automatically when first filter has been added ( probably the most common use case )
* change internal reader interface again
* remove some quite embarassing bugs that must have been in the interface for rather long
* add different read methods to script & internal interface (like normal, streaming, etc). Not implemented in ascii reader yet.
2012-02-16 15:03:20 -08:00
Bernhard Amann
84883348ec interface documentation.
to a big part stolen from the logging framework
2012-02-16 11:27:10 -08:00
Daniel Thayer
2f2509fdce Merge remote-tracking branch 'origin/topic/v6-addr' into topic/dnthayer/ftp-ipv6 2012-02-15 16:29:31 -06:00
Robin Sommer
7458ebf385 Checkpoint after pass. 2012-02-15 13:07:08 -08:00
Bernhard Amann
88233efb2c It works. Even including all unit tests.
But: there are still a few places where I am sure that there are race conditions & memory leaks & I do not really like the current interface & I have to add a few more messages between the front and backend.

But - it works :)
2012-02-13 22:29:55 -08:00
Jon Siwek
808f3915e5 Merge branch 'master' into topic/v6-addr 2012-02-13 16:01:33 -06:00
Bernhard Amann
4e868d282d Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-13 02:37:02 -08:00
Daniel Thayer
74899e29fe Update FTP EPSV response processing for IPv6 2012-02-10 16:55:15 -06:00
Robin Sommer
357cdd3f8d Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix minor typos in the documentation
  Fix compiler warning about Brofiler ctor init list order.
2012-02-10 00:04:02 -08:00
Daniel Thayer
a28e671f8d Fix minor typos in the documentation 2012-02-08 14:16:29 -06:00
Jon Siwek
26731b1b58 Fix missing optional field access in webapp signature_match handler. 2012-02-08 10:37:00 -06:00
Bernhard Amann
f6c6387c52 Merge branch 'topic/bernhard/input' into topic/bernhard/input-threads
most stuff is inplace, logging framework needs a few changes merged before continuing here...

Conflicts:
	src/CMakeLists.txt
	src/LogMgr.h
	src/logging/Manager.cc
	src/main.cc
2012-02-06 10:54:07 -08:00
Jon Siwek
2e2f8f5d06 Merge branch 'master' into topic/v6-addr
Conflicts:
	src/bro.bif
2012-02-06 11:06:55 -06:00
Jon Siwek
b3f1f45082 Remove --enable-brov6 flag, IPv6 now supported by default.
Internally, all BROv6 preprocessor switches were removed and
addr/subnet representations wrapped in the new IPAddr/IPPrefix classes.

Some script-layer changes of note:

- dns_AAAA_reply event signature changed: the string representation
  of an IPv6 addr is easily derived from the addr value, it doesn't
  need to be another parameter.  This event also now generated directly
  by the DNS analyzer instead of being "faked" into a dns_A_reply event.

- removed addr_to_count BIF.  It used to return the host-order
  count representation of IPv4 addresses only.  To make it more
  generic, we might later add a BIF to return a vector of counts
  in order to support IPv6.

- changed the result of enclosing addr variables in vertical pipes
  (e.g. |my_addr|) to return the bit-width of the address type which
  is 128 for IPv6 and 32 for IPv4.  It used to function the same
  way as addr_to_count mentioned above.

- remove bro_has_ipv6 BIF
2012-02-03 16:46:58 -06:00
Seth Hall
600d015dab One more very minor change I forgot to commit. 2012-02-03 16:27:51 -05:00
Seth Hall
2cd88ee4f6 Merge remote-tracking branch 'origin/topic/bernhard/software'
* origin/topic/bernhard/software:
  change software framework interface again. At the moment everything should worl.
  start reworking interface of software framework. working apart from detect-webapps.bro, which direcly manipulates a no longer available interface...
  after talking to seth - change host_a field in record back to host.
  forgotten policy files.
  Software framework stores ports for server software.
2012-02-03 16:17:04 -05:00
Robin Sommer
6a3b41b84d Bugfix caught by test-suite. 2012-01-25 17:45:26 -08:00
Robin Sommer
b649ade9ba Merge remote-tracking branch 'origin/topic/bif_cleanup'
* origin/topic/bif_cleanup:
  Give mode2string a more generic name.
  Change some BiF return values from bool to any.
  Perform type checking on count-to-port conversion.
  Remove redundant connection_record() BiF.
  Remove redundant active_connection() BiF.
  Make exit() parameterizable.
  to_port() now parses a string instead of a count.

Closes #684.
2012-01-25 16:48:00 -08:00
Bernhard Amann
eacdffff90 Merge remote-tracking branch 'origin/master' into topic/bernhard/software
Conflicts:
	scripts/base/frameworks/software/main.bro
	scripts/policy/protocols/ftp/software.bro
2012-01-20 12:51:58 -08:00
Seth Hall
5b04789ab8 Fixed a bug resulting in over-logging of detected webapps. 2012-01-20 11:22:15 -05:00
Matthias Vallentin
6c255d13ff Merge remote-tracking branch 'origin/master' into topic/bif_cleanup
Conflicts:
	src/bro.bif
2012-01-18 14:56:53 -08:00
Bernhard Amann
d476e9f3f4 Merge remote-tracking branch 'origin/master' into topic/bernhard/input 2012-01-12 11:07:12 -08:00
Robin Sommer
71eaae8539 Fixing typos 2012-01-10 19:09:30 -08:00
Robin Sommer
3d2dc5f5fc Merge remote-tracking branch 'origin/topic/script-reference'
* origin/topic/script-reference: (50 commits)
  A few updates for the FAQ.
  Fixing some doc warnings.
  Forgot to add protocol identifier support for TLS 1.2
  Finished SSL & syslog autodocs.
  Adding the draft SSL extension type next_protocol_negotiation.
  Fix some documentation errors.
  Tweaks.
  A set of script-reference polishing.
  fixed a couple typos in comments
  Add summary documentation to bif files.
  Add ssl and syslog script documentation
  Add Conn and DNS protocol script documentation. (fixes #731)
  Small updates to the default local.bro.
  Documentation updates for HTTP & IRC scripts.
  SSH&FTP Documentation updates.
  Fixing a warning from the documentation generation.
  This completes framework documentation package 4.
  Minor notice documentation tweaks.
  Fix some malformed Broxygen xref roles.
  Minor doc tweaks to init-bare.bro.
  ...

Conflicts:
	aux/broccoli
	aux/broctl
	src/bro.bif
	src/strings.bif

Includes:

    - Updated baselines for autodoc tests.
    - Now excluding stats.bro from external texts, it's not stable.
2012-01-10 14:00:44 -08:00
Bernhard Amann
3138f015ce Merge remote-tracking branch 'origin/master' into topic/bernhard/input 2012-01-10 11:33:26 -08:00
Robin Sommer
b284dd25cf Merge remote-tracking branch 'origin/master' 2012-01-10 10:46:49 -08:00
Robin Sommer
66be86da61 Fixing coverage failures.
Friendly reminder: please run test-suite before pushing things
upstream for merges ...
2012-01-10 10:43:28 -08:00
Robin Sommer
82b1ee0720 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Change SFTP/SCP log rotators to use 4-digit year in filenames (fixes #745).
  Adding back the stats.bro file.

Closes #745.
Closes #656.
2012-01-10 09:49:58 -08:00
Seth Hall
86a1cbca82 A few more tiny documentation updates commited to the wrong branch. :) 2012-01-10 10:49:10 -05:00
Jon Siwek
f921a4d5db Change SFTP/SCP log rotators to use 4-digit year in filenames (fixes #745). 2012-01-10 09:38:17 -06:00
Seth Hall
727e626bb4 Added an option for filtering out urls before they are turned into HTTP::Incorrect_File_Type notices 2012-01-10 10:38:12 -05:00
Seth Hall
048516c605 Adding back the stats.bro file.
Closes #656
2012-01-10 09:10:45 -05:00
Seth Hall
4de670a10e Fixing some doc warnings. 2012-01-10 01:30:55 -05:00
Seth Hall
9b6373584c Forgot to add protocol identifier support for TLS 1.2 2012-01-10 01:09:35 -05:00