Commit graph

226 commits

Author SHA1 Message Date
Justin Azoff
b730874ea1 problem: for loops over empty tables are slow.
This change doubles the performance of for loops over empty tables.

A bro binary that prints out this size shows for
testing/external/bro-testing/2009-M57-day11-18.trace, for loops are run
over tables of size:

11477 for size 0
8371 for size 1
1227 for size 3
239 for size 2
141 for size 6
57 for size 5
10 for size 4
5 for size 7
2 for size 13
2 for size 8
2 for size 11
1 for size 9

~53% of the for loops were across an empty table.  These loops come from
things like the for loop in the http script over c$http_state$pending

This change prevents the creation of an iteration cookie entirely if the
table is empty.

Using this test script:

    const scan_ports: table[port] of count = { };

    local x = 0;
    while ( x < 20000000 ) {
        for(p in scan_ports) {
        }
        ++x;
    }

$ time bro.orig -b ___bench.bro

real    0m10.732s
user    0m10.415s
sys     0m0.113s

$ time bro.nocookie -b ___bench.bro

real    0m4.694s
user    0m4.464s
sys     0m0.086s
2017-12-07 17:15:14 -05:00
Johanna Amann
990726b514 Fix crash when deleting non existing record member.
Addresses BIT-1519
2016-01-12 15:02:20 -08:00
Robin Sommer
3957091e1b Renaming config.h to bro-config.h.
A couple times now I had this conflicting with files of the same name
in other projects.
2015-07-28 11:57:04 -07:00
Jon Siwek
b42706f0b5 BIT-1384: Remove -O (optimize scripts) command-line option. 2015-04-27 14:45:02 -05:00
Jon Siwek
062baefde0 Add 'while' statement to Bro language. 2015-02-13 11:26:54 -06:00
Jon Siwek
3521a92a00 Detect functions that try to bind variables from an outer scope.
And raise an error saying that's not supported.
Addresses BIT-1233.
2014-08-22 16:49:10 -05:00
Jon Siwek
b828a6ddc7 Review usage of Reporter::InternalError, addresses BIT-1045.
Replaced some with InternalWarning or InternalAnalyzerError, the later
being a new method which signals the analyzer to not process further
input.  Some usages I just removed if they didn't make sense or clearly
couldn't happen.  Also did some minor refactors of related code while
reviewing/exploring ways to get rid of InternalError usages.

Also, for TCP content file write failures there's a new event:
"contents_file_write_failure".
2013-10-10 14:45:06 -05:00
Jon Siwek
e4e7c78925 Remove unused variable assignments, dead code. 2013-09-23 16:57:31 -05:00
Jon Siwek
0b97343ff7 Fix various potential memory leaks.
Though I expect most not to be exercised in practice.
2013-09-12 15:23:52 -05:00
Robin Sommer
c780bfdb48 Merge remote-tracking branch 'origin/topic/jsiwek/ticket-932'
* origin/topic/jsiwek/ticket-932:
  Fix uninitialized locals in event/hook handlers from having a value.

Closes #932.
2013-01-23 15:17:55 -08:00
Robin Sommer
dcd675280e Merge remote-tracking branch 'origin/topic/jsiwek/no-switch-fallthrough'
* origin/topic/jsiwek/no-switch-fallthrough:
  Add "fallthrough" keyword, require a flow statement to end case blocks.
  Disable automatic case fallthrough in switch stmts.  Addresses #754.

I've added a test for the error case where no break/fallthrough/return
is given.

Closes #754.
2013-01-23 14:41:23 -08:00
Jon Siwek
0a69b87f03 Fix uninitialized locals in event/hook handlers from having a value.
Since values for local variables are referenced by offset within a Frame
(not by identifier name), and event/hook handler bodies share a common
Frame, the value offsets for local variables in different handlers may
overlap.  This meant locals in a handler without an initialization may
actually end up referring to the value of a previous handler's local
that has the same Frame offset.  When executing the body, that can
possibly result in a type-conflict error or give give unexpected
results instead of a "use of uninitialized value" error.

This patch makes it so uninitialized locals do always refer to a null
value before executing the body of a event/hook handler, so that using
them without assigning a value within the body will connsistently give
a "use of uninitialized value" error.

Addresses #932.
2013-01-17 15:21:50 -06:00
Jon Siwek
be71a42f4c Add "fallthrough" keyword, require a flow statement to end case blocks.
Case blocks in switch statements now must end in a break, return, or
fallthrough statement to give best mix of safety, readability, and
flexibility.

The new fallthrough keyword explicitly allows control to be passed to the
next case block in a switch statement.

Addresses #754.
2013-01-16 16:37:50 -06:00
Jon Siwek
8695053e27 Disable automatic case fallthrough in switch stmts. Addresses #754.
Case bodies now don't require a "break" statement to prevent fallthrough
to case bodies below.  Empty case bodies generate an error message at
parse-time to help indicate the absence of automatic fallthrough; to
associate multiple values with a case, use "case 1, 2:" instead of
"case 1: case 2:".
2013-01-11 11:43:15 -06:00
Robin Sommer
037085605c Merge remote-tracking branch 'origin/topic/jsiwek/ticket-923'
* origin/topic/jsiwek/ticket-923:
  Improve error for invalid use of types as values (addresses #923).

Close 923.
2012-12-20 15:21:27 -08:00
Jon Siwek
939a64b73a Finish implementation of script-layer switch statement. Addresses #754.
They behave like C-style switches except case labels can be comprised
of multiple literal constants delimited by commas.  Only atomic types
are allowed for now.  Case label bodies that don't execute a "return"
or "break" statement will fall through to subsequent cases.  A default
case label is allowed.
2012-12-20 12:49:50 -06:00
Jon Siwek
378ee699ff Hook functions now directly callable instead of w/ "hook" statements.
The return value of the call is an implicit boolean value of T if all
hook handlers ran, or F if one hook handler exited as a result of a
break statement and potentially prevented other handlers from running.

Scripts don't need to declare hooks with an explicit return type of bool
(internally, that's assumed), and any values given to (optional) return
statements in handler definitions are just ignored.

Addresses #918.
2012-11-26 17:09:29 -06:00
Jon Siwek
e0fb9eb2b2 Add new function flavor called a "hook".
This new flavor of function behaves like a "synchronous event".
See documentation for more details on usage.
2012-11-15 13:45:13 -06:00
Daniel Thayer
63a550fa9e Fix a segfault when iterating over a set
When iterating over a set with a "for" loop, bro would segfault
when the number of index variables was less than required.
Example:  for ( [c1,c2] in s1 ) ...
where s1 is defined as set[addr,port,count].
2012-09-05 12:00:21 -05:00
Robin Sommer
848ae2355e Merge remote-tracking branch 'origin/topic/jsiwek/brofiler'
* origin/topic/jsiwek/brofiler:
  Fix superfluous/duplicate data getting in to testing coverage log.
  Add "# @no-test" tag to blacklist statements from test coverage analysis.
  Test coverage integration for external tests and complete suite.
  Integrate Bro script coverage profiling with the btest suite.
  Add simple profiling class to accumulate Stmt usage stats across runs.

Renaming environment variable BROFILER_FILE to BRO_PROFILER_FILE for
consistency. Yeah, I know, such a nice name! :)
2012-01-25 17:12:37 -08:00
Jon Siwek
8f8290c852 Add simple profiling class to accumulate Stmt usage stats across runs.
Use the BROFILER_FILE environment variable to point to a file in
which Stmt usage statistics from Bro script-layer can be output.

This should be able to be used to check Bro script coverage that
that e.g. the entire test suite covers.
2011-11-27 15:57:18 -06:00
Jon Siwek
495e987938 Remove $Id$ tags 2011-08-04 15:21:18 -05:00
Jon Siwek
648e1bda26 Fix &raw_output and enable_raw_output interpretation of NUL characters
When using a `print` statement to write to a file that has raw output
enabled, NUL characters in string are no longer interpreted into "\0",
no newline is appended afterwards, and each argument to `print` is
written to the file without any additional separation.

(Re)Assigning to identifiers with the &raw_output attribute should also
now correctly apply the attribute to the file value being assigned.

Note that the write_file BiF should already be capable of raw string
data to a file, expect it bypasses the print_hook event.

Addresses #474
2011-08-03 10:51:40 -05:00
Robin Sommer
66e2c3b623 Renaming the Logger to Reporter.
Also changing output to not include timestamps when we haven't started
processing packets yet.
2011-07-01 09:22:33 -07:00
Robin Sommer
93894eed9b Overhauling the internal reporting of messages to the user.
The Logger class is now in charge of reporting all errors, warnings,
informational messages, weirds, and syslogs. All other components
route their messages through the global bro_logger singleton.

The Logger class comes with these reporting methods:

    void Message(const char* fmt, ...);
    void Warning(const char* fmt, ...);
    void Error(const char* fmt, ...);
    void FatalError(const char* fmt, ...); // Terminate Bro.
    void Weird(const char* name);
    [ .. some more Weird() variants ... ]
    void Syslog(const char* fmt, ...);
    void InternalWarning(const char* fmt, ...);
    void InternalError(const char* fmt, ...); // Terminates Bro.

See Logger.h for more information on these.

Generally, the reporting now works as follows:

    - All non-fatal message are reported in one of two ways:

        (1) At startup (i.e., before we start processing packets),
            they are logged to stderr.

        (2) During processing, they turn into events:

            event log_message%(msg: string, location: string%);
            event log_warning%(msg: string, location: string%);
            event log_error%(msg: string, location: string%);

            The script level can then handle them as desired.

            If we don't have an event handler, we fall back to
            reporting on stderr.

    - All fatal errors are logged to stderr and Bro terminates
      immediately.

    - Syslog(msg) directly syslogs, but doesn't do anything else.

The three main types of messages can also be generated on the
scripting layer via new Log::* bifs:

    Log::error(msg: string);
    Log::warning(msg: string);
    Log::message(msg: string);

These pass through the bro_logger as well and thus are handled in the
same way. Their output includes location information.

More changes:

    - Removed the alarm statement and the alarm_hook event.

    - Adapted lots of locations to use the bro_logger, including some
      of the messages that were previously either just written to
      stdout, or even funneled through the alarm mechanism.

    - No distinction anymore between Error() and RunTime(). There's
      now only one class of errors; the line was quite blurred already
      anyway.

    - util.h: all the error()/warn()/message()/run_time()/pinpoint()
      functions are gone. Use the bro_logger instead now.

    - Script errors are formatted a bit differently due to the
      changes. What I've seen so far looks ok to me, but let me know
      if there's something odd.

Notes:

    - The default handlers for the new log_* events are just dummy
      implementations for now since we need to integrate all this into
      the new scripts anyway.

    - I'm not too happy with the names of the Logger class and its
      instance bro_logger. We now have a LogMgr as well, which makes
      this all a bit confusing. But I didn't have a good idea for
      better names so I stuck with them for now.

      Perhaps we should merge Logger and LogMgr?
2011-06-25 16:40:54 -07:00
Robin Sommer
61757ac78b Initial import of svn+ssh:://svn.icir.org/bro/trunk/bro as of r7088 2010-09-27 20:42:30 -07:00