Commit graph

71 commits

Author SHA1 Message Date
Tim Wojtulewicz
c32566420a Use single-character version of string find() (performance-faster-string-find) 2020-02-11 11:02:08 -08:00
Tim Wojtulewicz
54752ef9a1 Deprecate the internal int/uint types in favor of the cstdint types they were based on 2019-08-12 13:50:07 -07:00
Tim Wojtulewicz
6144f459e1 Mark List::append/insert deprecated in favor of push_back/push_front for consistency with Queue 2019-07-22 09:47:43 -07:00
Jon Siwek
b6862c5c59 Add methods to queue events without handler existence check
Added ConnectionEventFast() and QueueEventFast() methods to avoid
redundant event handler existence checks.

It's common practice for caller to already check for event handler
existence before doing all the work of constructing the arguments, so
it's desirable to not have to check for existence again.

E.g. going through ConnectionEvent() means 3 existence checks:
one you do yourself before calling it, one in ConnectionEvent(), and then
another in QueueEvent().

The existence check itself can be more than a few operations sometimes
as it needs to check a few flags that determine if it's enabled, has
a local body, or has any remote receivers in the old comm. system or
has been flagged as something to publish in the new comm. system.
2019-04-11 20:30:25 -07:00
Jon Siwek
8bc65f09ec Cleanup/improve PList usage and Event API
Majority of PLists are now created as automatic/stack objects,
rather than on heap and initialized either with the known-capacity
reserved upfront or directly from an initializer_list (so there's no
wasted slack in the memory that gets allocated for lists containing
a fixed/known number of elements).

Added versions of the ConnectionEvent/QueueEvent methods that take
a val_list by value.

Added a move ctor/assign-operator to Plists to allow passing them
around without having to copy the underlying array of pointers.
2019-04-11 20:30:25 -07:00
Jon Siwek
2982765128 Pre-allocate and re-use Vals for bool, int, count, enum and empty string 2019-01-09 18:29:23 -06:00
Jon Siwek
c2b18849f8 Fix IRC names command parsing 2018-09-12 19:47:57 -05:00
Justin Azoff
43b2b9806e add a max_line_length flag to ContentLine_Analyzer
In ContentLine_Analyzer, prevent excessively long lines being assembled.
The line length will default to just under 16MB, but can be overriden on
a per-analyzer basis.  This is done for the finger,ident, and irc
analyzers.
2017-11-03 16:25:26 -04:00
Robin Sommer
9a7a024f6e Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Add missing break; in StartTLS case of IRC analyzer.
2016-02-13 10:48:45 -08:00
Johanna Amann
baa3cd986c Merge branch 'master' of https://github.com/marktayl/bro
* 'master' of https://github.com/marktayl/bro:
  Better multi-space separator handling.

Also tweak multi-space separator handline some more and add test-case
triggering the new behavior.
2016-02-12 18:55:25 -08:00
Mark Taylor
886ba6e823 Better multi-space separator handling.
1) IRC spec indicates "one or more spaces" separating parameters, so be better at handling multiple space separators.
2) Have "length" track against "myline", since it continues to be used against it.
3) "WHO" command's parameters are optional.
2016-02-12 15:14:19 -05:00
Johanna Amann
9d1a764ef7 Merge branch 'master' of https://github.com/marktayl/bro
* 'master' of https://github.com/marktayl/bro:
  Allow IRC commands to not have parameters.

Also update test baseline.
2016-02-10 21:30:39 -08:00
Mark Taylor
2ae80640cb Allow IRC commands to not have parameters.
When testing against irc-dcc-send.trace, I didn't see an irc_quit_message event generated for the QUIT command at the end of the trace, but rather a weird.log "irc_invalid_line" for the packet: the IRC packet parser wasn't allowing commands without parameters.
2016-02-10 12:50:30 -05:00
Dirk Leinenbach
6b5fd442f0 fix memory leaks in find_all() and IRC analyzer 2016-02-08 14:20:47 -08:00
Mark Taylor
e0e7a14031 Removed duplicate parameter for IRC "QUIT" event handler. 2016-02-05 19:26:04 -05:00
Johanna Amann
2e0c2035c9 Add missing break; in StartTLS case of IRC analyzer.
The missing break did not cause any issues besides one extra
(unspecialized) event being fired in addition to the actual
starttls event.

Found by Aaron Eppert
2016-02-04 12:35:54 -08:00
Mark Taylor
e3d196ed7d Correct irc_privmsg_message handling.
Due to a logic bug, once an "irc_privmsg_message" event handler is created, *all* IRC events were routed down the code path, generally creating a Weird("irc_invalid_privmsg_message_format") event and terminating the inspection.
2016-01-27 14:54:48 -05:00
Robin Sommer
0ba6bec710 Merge remote-tracking branch 'origin/topic/johanna/irc-starttls'
* origin/topic/johanna/irc-starttls:
  StartTLS support for IRC

BIT-1513 #merged
2015-12-18 11:20:59 -08:00
Johanna Amann
5a8eac521c StartTLS support for IRC 2015-07-29 11:47:59 -07:00
Seth Hall
1e43dfc46a Fix the irc_reply event for certain server message types. 2013-11-08 16:49:03 -05:00
Robin Sommer
4bc2ba60c9 Rename analyzer/protocols -> analyzer/protocol 2013-04-19 15:50:57 -07:00
Renamed from src/analyzer/protocols/irc/IRC.cc (Browse further)