Commit graph

13262 commits

Author SHA1 Message Date
Robin Sommer
cb81ce88b2 Merge branch 'master' into fastpath.
Conflicts:
	src/ConnCompressor.cc
2011-08-17 16:22:01 -07:00
Jon Siwek
d412aa9d63 Fix H3 assumption of an 8-bit byte/char.
The hash function was internally casting the void* data argument into an
unsigned char* and then using values from that to index another internal
array that's dimensioned based on the assumption of 256 values possible
for an unsigned char (8-bit chars/bytes).  This is probably a correct
assumption most of the time, but should be safer to use the limits as
defined in standard headers to get it right for the particular
system/compiler.

There was an unused uint8* casted variable in HashKey::HashBytes that
seemed like it might have been meant to be passed to H3's hash function
as an unfinished attempt to solve the 8-bit byte assumption problem, but
that doesn't seem as good as taking care of that internally in H3 so
users of the API are only concerned with byte sizes as reported by
`sizeof`.  Removing the unused variable addresses #530.

Also a minor tweak to an hmac_md5 call that was casting away const from
one argument (which doesn't match the prototype).
2011-08-17 15:03:18 -05:00
Gregor Maier
4214d8d905 Fixing memleak in tunnel code. 2011-08-17 07:31:25 -07:00
Gregor Maier
08dc84a250 Tunnel decapsulation bugfix when FlipRoles is called.
If FlipRoles() is called the conn_val in Conn.cc gets Unref'ed and thus
my tunnel_partent RecordVal was lost. Fixing this.
2011-08-16 20:41:36 -07:00
Seth Hall
82f94881c0 Improvements to metrics. SSH bruteforcing detection now done with metrics framework. 2011-08-16 11:47:49 -04:00
Jon Siwek
e37430ef66 Merge branch 'master' into topic/jsiwek/reorg-followup 2011-08-16 09:52:05 -05:00
Seth Hall
8286fdeea1 Updates for SQL injection attack detection to match the metrics framework updates. 2011-08-16 08:28:08 -04:00
Robin Sommer
79601ca0c3 Merge branch 'master' of ssh://git.bro-ids.org/bro 2011-08-15 21:11:55 -07:00
Robin Sommer
63eac6c174 Reclassifying more DNS manager errors.
Closes #461.
2011-08-15 21:10:30 -07:00
Robin Sommer
f9cd97d78d Fixing ref'counting problem. 2011-08-15 20:56:59 -07:00
Gilbert Clark gc355804@ohio.edu
bb0deea52f Merge remote-tracking branch 'origin/master' into topic/gilbert/rand-pool 2011-08-15 15:55:10 -07:00
Gilbert Clark gc355804@ohio.edu
7bea71a2c2 Updated uid pools to use integer values instead of strings. 2011-08-15 15:47:39 -07:00
Jon Siwek
33fce8a71d Misc. doc/script/test cleanup.
- fixing some Metrics::add_data() call signatures
- slight refactors to cluster framework @if and adding a NONE NodeType for
  so local_node_type() will return that instead of just emitting an error
  when cluster mode isn't enabled
- `make restdoc` target now uses bro's bare-mode
- bro scripts generated from bifs now really only live in the build/src/base/
  directory and changed the DocSourcesList.cmake to dynamically figure out
  what bifs exist by looking in src/ instead of build/src/
- add some missing @load dependencies
2011-08-15 17:29:41 -05:00
Jon Siwek
41dd0b98e9 Merge branch 'master' into topic/jsiwek/reorg-followup
Conflicts:
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/frameworks/metrics/main.bro
	scripts/base/frameworks/notice/actions/email_admin.bro
	scripts/base/frameworks/notice/weird.bro
	scripts/base/protocols/mime/file-hash.bro
	scripts/base/protocols/mime/file-ident.bro
	scripts/policy/frameworks/communication/listen-clear.bro
	scripts/policy/frameworks/communication/listen-ssl.bro
	scripts/policy/frameworks/control/controller.bro
	scripts/policy/frameworks/metrics/http-example.bro
	scripts/policy/frameworks/metrics/ssl-example.bro
	scripts/policy/protocols/conn/scan.bro
	src/CMakeLists.txt
2011-08-15 15:34:25 -05:00
Gregor Maier
ae1eb5379b Merge branch 'master', remote-tracking branch 'origin' into topic/gregor/tunnel 2011-08-15 13:33:14 -07:00
Seth Hall
3919a35b9b Metrics framework update. Mostly to make metrics work on clusters.
- Metrics now work on cluster deployments with no caveats.  It should be
  completely transparent.  Intermediate updates to speed some detection
  will come later.
2011-08-15 15:57:48 -04:00
Gilbert Clark gc355804@ohio.edu
d46525dcca Merge branch 'master' into topic/gilbert/rand-pool 2011-08-14 22:21:59 -07:00
Gilbert Clark gc355804@ohio.edu
066ca80ab4 Updating tests. 2011-08-14 22:16:46 -07:00
Gilbert Clark gc355804@ohio.edu
ad35902bdb Merge branch 'master' into topic/gilbert/rand-pool 2011-08-14 21:56:05 -07:00
Gilbert Clark gc355804@ohio.edu
b723ecd0e0 Header modification to LogWriterAscii to make it easier for scripts to
understand bro log files.
2011-08-13 21:10:51 -07:00
Robin Sommer
2af9d9bc20 Updating submodule(s). 2011-08-13 12:15:13 -07:00
Robin Sommer
2ca791f110 Updating submodule(s). 2011-08-13 12:09:32 -07:00
Robin Sommer
1ca9def9e6 Merge remote-tracking branch 'origin/topic/jsiwek/autodoc-fixes'
* origin/topic/jsiwek/autodoc-fixes:
  Update doc sources and touch up a few script comments.
  Fixes for script auto-documentation.

Conflicts:
	scripts/base/frameworks/logging/main.bro
2011-08-13 12:09:13 -07:00
Jon Siwek
a3147033e2 Update doc sources and touch up a few script comments. 2011-08-13 09:45:42 -05:00
Jon Siwek
2a9ea6b8ba Merge branch 'master' into topic/jsiwek/autodoc-fixes
Conflicts:
	scripts/CMakeLists.txt
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/frameworks/communication/__load__.bro
	scripts/base/frameworks/metrics/conn-example.bro
	scripts/base/frameworks/metrics/http-example.bro
	scripts/site/local.bro
2011-08-13 09:31:06 -05:00
Robin Sommer
1aff02ea96 Merge remote-tracking branch 'origin/topic/jsiwek/debug-flags'
* origin/topic/jsiwek/debug-flags:
  Workaround for FreeBSD CMake port missing debug flags
2011-08-12 23:37:12 -07:00
Robin Sommer
045fd4690b Merge remote-tracking branch 'origin/topic/seth/piped_exec-update'
* origin/topic/seth/piped_exec-update:
  piped_exec can now write nulls in the "to_write" argument.
2011-08-12 23:35:15 -07:00
Jon Siwek
6f060a58d6 Fix vector initialization for lists of records with optional types.
If possible the list elements now get promoted to the yield type of the
vector.  There was also a problem with the value returned by the record
constructor expression's eval being completely unref'd since the vector
element assignment function doesn't ref the element -- so I changed it
to ref values if they just constructed before assigning them to the
vector.

Addresses #485.
2011-08-12 23:25:01 -07:00
Jon Siwek
560685f1c6 Fix redef'ing records with &default empty set fields.
Attributes have state to track whether they're in a record and should
apply to a record field, but this state wasn't being set for TypeDecls
that are part of a redef'd record.

Closes #460
2011-08-12 23:24:49 -07:00
Gregor Maier
03a73899a9 Fix ConnSize_Analyzer with ConnCompressor.
The num_pkts and num_bytes_ip in endpoint are optional and
should only be assigned to if ConnSize_Anlyzer is active.
2011-08-12 23:24:44 -07:00
Jon Siwek
00de88f4cb Fix reporter using part of the actual message as a format string
When not reporting via events, the final contents of the message buffer
after formatting was being used as a format string to fprintf instead of
writing out the actual string.
2011-08-12 23:24:44 -07:00
Robin Sommer
33b064bdb2 Fixing reporter's location tracking.
Closes #492.
2011-08-12 22:39:36 -07:00
Robin Sommer
46d3570bf5 Turning DNS errors into a warning.
It seems these errors aren't Bro's fault, and in any case it's clearly
not an internal error. This should finally solve the problem in #255.

Closes #255.
2011-08-12 22:29:38 -07:00
Robin Sommer
cb31fd3bb9 Logging's path_func now receives the log record as argument.
Closes #555.
2011-08-12 22:18:45 -07:00
Robin Sommer
c436930acf Functions can now be logged.
The function's code is rendered as ASCII and included as a string.
Closes #506.

Note that I'm not sure if the formatting is as desired: should the LFs
and tabs be rendered as \xXX or removed?.
2011-08-12 22:15:57 -07:00
Gregor Maier
65921bc61d Bugfix: an #ifdef BROv6 was missing in the tunnel code 2011-08-12 21:42:47 -07:00
Gregor Maier
95d84da1b0 Set c$conn (for logging) in new_connection() event.
c$conn was originally set in connection_established(), which is only
used by TCP connections, and in connection_state_remove(). Using
new_connection() allows us to have c$conn available for any connection
and for any script that wants to extend logging to conn.log.
2011-08-11 15:29:54 -07:00
Gregor Maier
eacfbea3fe (Semiautomatically) convert the comments in bare-init.bro into autodoc ones.
With manual tuning were it made sense.
2011-08-11 14:25:34 -07:00
Gregor Maier
fe5624fb06 Add ConnSize_Analyzer's fields to conn.log 2011-08-11 12:21:42 -07:00
Gregor Maier
88f7db927e SSH base scripts: make sure ConnSizeAnalyzer variables are available before using them. 2011-08-11 12:20:38 -07:00
Gregor Maier
6ba9a43d0f Merge remote-tracking branch 'origin/master' into fastpath 2011-08-11 12:16:59 -07:00
Seth Hall
cc258b29aa Single character bugfix for hostname notice email extension. 2011-08-11 15:16:32 -04:00
Gregor Maier
9ea6a7e563 Fix ConnSize_Analyzer with ConnCompressor.
The num_pkts and num_bytes_ip in endpoint are optional and
should only be assigned to if ConnSize_Anlyzer is active.
2011-08-11 12:15:03 -07:00
Gregor Maier
42e3ce809b Merge branch 'master' into fastpath 2011-08-11 12:07:20 -07:00
Seth Hall
240ae9790b Small updates for notice framework.
- New ACTION_ADD_GEODATA to add geodata to notices in an extension
  field named remote_location.

- Loading extend-email/hostnames by default now that it only
  does anything when the ACTION_EMAIL action is applied (finally).
2011-08-11 14:59:01 -04:00
Gregor Maier
7ea0646f30 Make reference to the other script a link 2011-08-11 10:31:36 -07:00
Jon Siwek
351b13d1c8 Fix more bare-mode @load dependency problems 2011-08-11 11:47:12 -05:00
Jon Siwek
521f54c4f0 Fix check_for_unused_event_handlers option.
The format string given to the reporter warning call wasn't printing
the handler names.  Also changed it so that each warning message has
the full context of the warning.
2011-08-11 11:34:42 -05:00
Jon Siwek
59e5fc5633 Merge branch 'master' into topic/jsiwek/reorg-followup
Conflicts:
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/protocols/ssh/main.bro
2011-08-11 10:56:20 -05:00
Jon Siwek
ed281fb634 Fixing some more bare-mode @load dependency issues 2011-08-11 10:49:41 -05:00