Commit graph

13262 commits

Author SHA1 Message Date
Julien Sentier
b84fd05912 Better use of operators priorities 2012-02-24 15:39:49 -08:00
Julien Sentier
c2ee15b09f protection from bad frees on unallocated strings 2012-02-24 15:39:49 -08:00
Robin Sommer
2eeac54857 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Add to_subnet bif (fixes #782).
  Refactor IPAddr v4 initialization from string. (fixes #775)

Closes #782.
Closes #775.
Closes #784.
2012-02-24 15:26:18 -08:00
Robin Sommer
3323692771 Merge remote-tracking branch 'origin/topic/jsiwek/ipaddr-refactoring'
* origin/topic/jsiwek/ipaddr-refactoring:
  Refactoring various usages of new IPAddr class.

Conflicts:
	src/bro.bif

Closes #784.
2012-02-24 15:21:57 -08:00
Robin Sommer
33777f13c5 Merge branch 'master' of ssh://git.bro-ids.org/bro 2012-02-24 15:04:06 -08:00
Robin Sommer
4ef8607e60 Merge remote-tracking branch 'origin/topic/dnthayer/ftp-ipv6'
* origin/topic/dnthayer/ftp-ipv6:
  Add test case for FTP over IPv4
  Fix IPv6 URLs
  Add a test for FTP over IPv6
  Update FTP EPSV response processing for IPv6
  Fix parsing of FTP EPRT command and EPSV response

Conflicts:
	src/bro.bif

Closes #778.
2012-02-24 15:00:41 -08:00
Jon Siwek
b552979011 Raise minimum required CMake version to 2.6.3 2012-02-24 13:14:49 -06:00
Jon Siwek
32aabe8432 Add to_subnet bif (fixes #782).
Also fix IPAddr::Mask/ReverseMask not allowing argument of 0.

And clarified return value of to_addr bif when the input string
does not parse into a valid IP address.
2012-02-24 12:34:29 -06:00
Bernhard Amann
d553a3c6f6 fix strange bug when using predicates and events at the same time on a tablefilter.
Testcase is now more involved.
2012-02-23 15:30:39 -08:00
Jon Siwek
14ccd6436f Update/add tests for broccoli IPv6 addr/subnet support (addresses #448) 2012-02-23 16:55:19 -06:00
Bernhard Amann
d81607c3e9 fix empty field bug in threaded version 2012-02-23 14:36:04 -08:00
Jon Siwek
c84394d07f Refactor IPAddr v4 initialization from string. (fixes #775)
Revived code from old dotted_to_addr function to parse the
dotted address string directly instead of canonicalizing and
passing to inet_pton.
2012-02-22 15:44:05 -06:00
Jon Siwek
d7dafe2fe2 Refactoring various usages of new IPAddr class.
Reducing number of places that internal representation was exposed
via GetBytes/CopyIPv6.

Also fixed a bug in remask_addr bif.
2012-02-22 14:45:44 -06:00
Bernhard Amann
93fac7a4be fix one of the bugs seth found in the input framework.
(bug in PutTable when the table contained only one element and that element should not be wrapped into a record)
2012-02-22 10:46:35 -08:00
Bernhard Amann
7e5f733826 raw input reader for seth, which can simply read a file into string-events given a line separator. 2012-02-22 09:44:45 -08:00
Bernhard Amann
531189b5fd try to make ascii reader a little bit more robust to failure - mainly ignore messages after a reader has disabled itself 2012-02-22 08:56:45 -08:00
Robin Sommer
d887eb3178 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  GeoIP installation documentation update.
  Decrease strictness of parsing IPv4 strings into addrs. (fixes #775)
  Fix memory leak in DNS manager (fixes #777).

Closes #777.
2012-02-22 05:28:29 -08:00
Seth Hall
c0839cb945 GeoIP installation documentation update. 2012-02-21 16:13:08 -05:00
Daniel Thayer
96df1bac40 Add test case for FTP over IPv4 2012-02-21 11:18:43 -06:00
Bernhard Amann
d5b413c4e7 reduce number of needed hash operations 2012-02-20 17:13:41 -08:00
Bernhard Amann
edd30da082 better testcase & fix a few bugs (that took way too long to find). 2012-02-20 15:30:21 -08:00
Daniel Thayer
8e32e89ce4 Merge remote-tracking branch 'origin/master' into topic/icmp6
Conflicts:
	src/ICMP.cc
	src/net_util.cc
	src/net_util.h
2012-02-20 17:18:55 -06:00
Bernhard Amann
fe5b376d28 ...and update for table event testcase after fix. 2012-02-20 13:23:25 -08:00
Bernhard Amann
4f57817b1a ...forgotten in last commit. 2012-02-20 13:20:29 -08:00
Bernhard Amann
4126b458ca Automatic file re-refresh and streaming works.
* simple testcase for file refresh (check for changes) and streaming reads
* add events for simple put and delete operations
* fix bugs in table filter events (type for first element was wrong)
* and I think a couple of other small bugs
2012-02-20 13:18:15 -08:00
Jon Siwek
b66b74e5dc Decrease strictness of parsing IPv4 strings into addrs. (fixes #775)
IPv4 strings in dotted-decimal format with decimal parts containing
leading zeroes now parse better.
2012-02-20 14:28:42 -06:00
Jon Siwek
1f7bfbb83c Fix memory leak in DNS manager (fixes #777). 2012-02-20 11:56:21 -06:00
Robin Sommer
52cfec8830 Merge remote-tracking branch 'origin/topic/robin/v6-addr-merge' into topic/robin/v6-addr-merge 2012-02-17 18:40:38 -08:00
Robin Sommer
14cd6c155c Merge branch 'master' into topic/robin/v6-addr-merge 2012-02-17 17:48:07 -08:00
Robin Sommer
b3333a7da2 Reverting loopback change which doesn't seem to fully work. 2012-02-17 17:46:51 -08:00
Robin Sommer
0e3934b196 Updating NEWS. 2012-02-17 15:39:59 -08:00
Robin Sommer
7ab36dbf8f Updating NEWS. 2012-02-17 15:36:12 -08:00
Robin Sommer
1f0b88041a Changing ARP detection to always kick in even if no analyzer is
activated.

Without that, we get "unknown_protocol" weird for ARP, which doesn't
seem right.
2012-02-17 13:24:47 -08:00
Robin Sommer
be3fb5fb81 Merge remote-tracking branch 'origin/topic/jsiwek/v6-dns-name-lookup' into topic/robin/v6-addr-merge
* origin/topic/jsiwek/v6-dns-name-lookup:
  DNS name lookups performed by Bro now also query AAAA records.

Conflicts:
	src/DNS_Mgr.cc
2012-02-17 10:39:24 -08:00
Jon Siwek
06e59e1398 Fix IPAddr/IPPrefix serialization bugs. (all unit tests pass) 2012-02-17 12:01:00 -06:00
Jon Siwek
c227563baf Fix compile error. 2012-02-17 12:00:35 -06:00
Daniel Thayer
d61fad4f9e Fix IPv6 URLs 2012-02-17 10:55:17 -06:00
Robin Sommer
5565e19e57 Merge remote-tracking branch 'origin/topic/v6-addr' into topic/v6-addr-merge
Conflicts:
	src/DNS_Mgr.cc
	src/Expr.cc
	src/bro.bif
2012-02-16 20:50:46 -08:00
Robin Sommer
94b9644da7 Working on merging the v6-addr branch. This is checkpoint, tests don't
pass yet.

Changes:

- Gave IPAddress/IPPrefix methods AsString() so that one doesn't need
  to cast to get a string represenation.

- Val::AsAddr()/AsSubnet() return references rather than pointers. I
  find that more intuitive.

- ODesc/Serializer/SerializationFormat get methods to support
  IPAddress/IPPrefix directly.

- Reformatted the comments in IPAddr.h from /// to /** style.

- Given IPPrefix a Contains() method.

- A bit of cleanup.
2012-02-16 20:39:16 -08:00
Bernhard Amann
d21a450f36 add streaming reads & automatic re-reading of files to ascii reader.
completely untested, but compiles & old tests still work
2012-02-16 15:40:07 -08:00
Bernhard Amann
91943c2655 * rework script interface, add autostart stream flag that starts up a stream automatically when first filter has been added ( probably the most common use case )
* change internal reader interface again
* remove some quite embarassing bugs that must have been in the interface for rather long
* add different read methods to script & internal interface (like normal, streaming, etc). Not implemented in ascii reader yet.
2012-02-16 15:03:20 -08:00
Daniel Thayer
278704f7a3 Add a test for FTP over IPv6 2012-02-16 15:17:55 -06:00
Bernhard Amann
de149ff55e Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-16 11:32:19 -08:00
Bernhard Amann
bc6ebe53cc remove unnecessary error function from manger 2012-02-16 11:31:30 -08:00
Bernhard Amann
84883348ec interface documentation.
to a big part stolen from the logging framework
2012-02-16 11:27:10 -08:00
Daniel Thayer
6d98008d07 Merge remote-tracking branch 'origin/topic/v6-addr' into topic/dnthayer/ftp-ipv6 2012-02-16 13:22:53 -06:00
Jon Siwek
93fa116738 Various tweaks/refactor of new IPAddr class usages or IPv6 related code.
- non-binpac DNS analyzer now also generates dns_a6_reply event
- ExpectedConn class refactored to use IPAddr's
- BinaryExpr::AddrFold simplified
- IP_Hdr src/dst address accessor methods changed to construct IPAddr
  objects on the fly from ip4/ip6 members.

Addresses #770.
2012-02-16 11:27:22 -06:00
Seth Hall
430cd9b146 Initial rework of packet filter framework.
- Large rework on packet filter framework to make many things easier.
   - Removed the PacketFilter::all_packets variable because it was confusing.
   - New variable (PacketFilter::enable_auto_protocol_capture_filters) to re-enable the old filtering model of only sniffing ports for analyzed protocols.
   - In progress plugin model for adding filtering mechanisms.
   - New default single item for capture_filters = { ["default"] = PacketFilter::default_capture_filter };
   - Mechanism and helper functions to "shunt" traffic with filters.

- Created the Protocols framework to assist with reworking how base protocol scripts are registered with DPD and other things.
   - Protocols framework creates BPF filters for registered analyzers. (if using PacketFilter framework in that mode).
2012-02-16 11:14:57 -05:00
Bernhard Amann
a850cc5992 make filter removal and stream closure asynchronous. 2012-02-15 15:14:04 -08:00
Daniel Thayer
2f2509fdce Merge remote-tracking branch 'origin/topic/v6-addr' into topic/dnthayer/ftp-ipv6 2012-02-15 16:29:31 -06:00