Commit graph

16055 commits

Author SHA1 Message Date
Jon Siwek
9851591317 Tunnel support performance optimization.
Looks better to allocate Encapsulation objects on-demand when tunnels
are discovered rather than always have an automatic, empty one for
every packet.
2012-06-04 16:14:30 -05:00
Jon Siwek
47c2fda88e Merge branch 'master' into topic/tunnels 2012-06-04 11:09:45 -05:00
Vlad Grigorescu
5915a2d304 Minor documentation formatting change 2012-06-03 23:02:07 -04:00
Vlad Grigorescu
bf852b51f5 Minor documentation formatting change 2012-06-03 23:01:18 -04:00
Vlad Grigorescu
3d8b86c00a Minor documentation formatting change 2012-06-03 23:00:10 -04:00
Vlad Grigorescu
360d7e2eda Minor documentation formatting change 2012-06-03 22:59:29 -04:00
Vlad Grigorescu
b3216906fe Minor documentation formatting change 2012-06-03 22:56:38 -04:00
Vlad Grigorescu
d09fc15b2d Minor documentation formatting change 2012-06-03 22:54:19 -04:00
Vlad Grigorescu
c8e770a499 Some basic documentation in doc/logging-elasticsearch.rst 2012-06-03 22:51:21 -04:00
Vlad Grigorescu
7bee0b0d8e Added sending messages to ElasticSearch over HTTP. 2012-06-03 22:07:20 -04:00
Vlad Grigorescu
95f000738b ElasticSearch log writer implementation test 1 - writes out JSON to file instead of sending it over HTTP for now. 2012-06-03 12:40:09 -04:00
Daniel Thayer
6e5eb187dd Improve "fmt" BIF documentation comment
Also update test cases for fmt.
2012-06-01 18:11:46 -05:00
Daniel Thayer
6292083b74 Improve tests of the type_name BIF 2012-06-01 16:23:40 -05:00
Daniel Thayer
2b0db01874 Improve test cases for "order" BIF
Also fixed some comments and error messages in the "order" BIF.
2012-06-01 15:50:49 -05:00
Daniel Thayer
2eddaffc90 Fix documentation of sort BIF and add more tests 2012-06-01 14:24:42 -05:00
Jon Siwek
dd4dd0ca6e Add @load-sigs directive for loading signature files (addresses #551). 2012-06-01 14:10:23 -05:00
Daniel Thayer
19e3f2ee56 Fix documentation for system_env BIF 2012-06-01 13:12:55 -05:00
Daniel Thayer
3b2ac75e91 Deprecate the parse_dotted_addr BIF (use to_addr instead) 2012-06-01 12:36:30 -05:00
Daniel Thayer
13f0711af5 Merge remote-tracking branch 'origin/master' into topic/dnthayer/bif-tests 2012-06-01 10:59:38 -05:00
Daniel Thayer
5f8cbf8a51 Change alarm summary email interval to 24hrs 2012-05-31 17:30:48 -05:00
Robin Sommer
c5ae071500 Updating submodule(s).
[nomail]
2012-05-31 14:27:50 -07:00
Robin Sommer
36de4bf3f3 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Change Input::update_finished lookup to happen at init time.
  Fix format specifier on RemoteSerializer::Connect.
2012-05-31 14:27:36 -07:00
Bernhard Amann
85e29a9471 Documentation 2012-05-31 14:26:25 -07:00
Jon Siwek
9fb0065696 Merge branch 'master' into topic/tunnels
Conflicts:
	scripts/base/init-bare.bro
	src/Conn.cc
	src/Conn.h
	src/Sessions.cc
	src/Sessions.h
	src/const.bif
	src/types.bif
2012-05-31 16:13:14 -05:00
Jon Siwek
eeb1609768 Change Input::update_finished lookup to happen at init time.
Also going through the internal_handler() function will set the
event as "used" (i.e. it's marked as being raised somewhere) and
fixes the core.check-unused-event-handlers test failure
(addresses #823).
2012-05-31 15:32:28 -05:00
Daniel Thayer
2c62b98b5b Improve tests for to_port and type_name BIFs 2012-05-31 15:19:11 -05:00
Daniel Thayer
5f16a29aea Improve tests for sort, order, and system_env BIFs 2012-05-31 12:49:59 -05:00
Jon Siwek
60875adfc5 Fix format specifier on RemoteSerializer::Connect.
This caused 32-bit systems to show a warning at compile-time, and
fail when connecting to peers.
2012-05-31 11:31:01 -05:00
Robin Sommer
be0316ee29 Fixes for running tests in parallel. 2012-05-30 19:26:43 -07:00
Robin Sommer
f34ebb7b60 Updating submodule(s).
[nomail]
2012-05-30 19:12:54 -07:00
Robin Sommer
c0e0481af2 Merge branch 'topic/robin/input-threads-merge'
* topic/robin/input-threads-merge: (130 commits)
  And now it even compiles after my earlier changes.
  A set of input framework refactoring, cleanup, and polishing.
  another small memory leak in ascii reader:
  and another small memory leak when using streaming reads.
  fix another memory lead (when updating tables).
  Input framework merge in progress.
  filters have been called streams for eternity. And I always was too lazy to change it everywhere...
  reactivate network_time check in threading manager. previously this line made all input framework tests fail - it works now. Some of the other recent changes of the threading manager must have fixed that problem.
  fix up the executeraw test - now it works for the first time and does not always fail
  baselines for the autostart removal.
  remove last remnants of autostart, which has been removed for quite a while.
  make input framework source (hopefully) adhere to the usual indentation style. No functional changes.
  fix two memory leaks which occured when one used filters.
  update description to current interface.
  rename a couple of structures and make the names in manager fit the api more.
  fix memory leak in tables and vectors that are read into tables
  fix missing get call for heart beat in benchmark reader.
  fix heart_beat_interval -- initialization in constructor does not work anymore (probably due to change in init ordering?)
  fix memory leak for tables... nearly completely.
  fix a couple more leaks. But - still leaking quite a lot with tables.
  ...
2012-05-30 19:12:18 -07:00
Robin Sommer
e9354284eb Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Remove unnecessary assert in ICMP analyzer (addresses #822).
  Improve script debugger backtrace and print commands.
2012-05-30 17:06:36 -07:00
Robin Sommer
14ea780176 And now it even compiles after my earlier changes. 2012-05-30 16:45:19 -07:00
Robin Sommer
b2b8df0ddd Merge remote-tracking branch 'origin/topic/bernhard/input-threads-merge' into topic/robin/input-threads-merge
* origin/topic/bernhard/input-threads-merge:
  another small memory leak in ascii reader:
2012-05-30 16:39:35 -07:00
Robin Sommer
fc907c0090 A set of input framework refactoring, cleanup, and polishing. 2012-05-30 16:38:08 -07:00
Daniel Thayer
17155a103d Fix the join_string_vec BIF and add more tests 2012-05-30 16:50:43 -05:00
Daniel Thayer
6869e1aadc Add more tests for previously-untested BIFs 2012-05-30 16:30:50 -05:00
Bernhard Amann
65b50ab2da another small memory leak in ascii reader:
on re-read istream instance was re-created but not freed before.
2012-05-30 10:16:05 -07:00
Jon Siwek
0aecca979e Remove unnecessary assert in ICMP analyzer (addresses #822).
The ICMP/ICMPv6 analyzers function correctly when full packets have
not been captured, but everything up to and including the ICMP header
is there (e.g. the functions that inspect ICMP error message context
correctly check the caplen to see if more info can be extracted).

The "Should have been caught earlier already." comment may have referred
to NetSessions::CheckHeaderTrunc, which works as intended to catch cases
where the ICMP header is not there in full, but then the assert was
still not correctly formulated for that...

Also changed the ICMP checksum calculation to not occur when the full
packet has not been captured, which seems consistent with what the UDP
analysis does.
2012-05-29 17:29:11 -05:00
Jon Siwek
0c5afc59f7 Improve script debugger backtrace and print commands.
Stack trace context descriptions are no longer limited to 1024 chars
and better error messages are relayed when the arguments to print
commands fail to parse (e.g. an "unknown identifier" was given).
2012-05-29 14:51:45 -05:00
Daniel Thayer
15689ce005 Add more tests for previously-untested BIFs 2012-05-29 14:04:36 -05:00
Bernhard Amann
1416d5404d and another small memory leak when using streaming reads. 2012-05-29 10:35:56 -07:00
Bernhard Amann
f4864c69af fix another memory lead (when updating tables).
Adjust twotables testcase - now it is faster. Shorten the output
-- because of threading, the results did not always come out in
the same order (it depends on which thread manages to sneak in
the results into the queue earlier).
2012-05-29 09:21:16 -07:00
Robin Sommer
b37f9e38f6 Input framework merge in progress. 2012-05-25 16:16:53 -07:00
Bernhard Amann
658b188dff filters have been called streams for eternity. And I always was too
lazy to change it everywhere...

Fix that.
2012-05-25 16:11:30 -07:00
Daniel Thayer
1059d9aa75 Add more tests for previously-untested BIFs 2012-05-25 17:15:29 -05:00
Robin Sommer
61ce9b5412 Checkpoint - all src/ except src/input 2012-05-25 14:05:50 -07:00
Bernhard Amann
24173807ea reactivate network_time check in threading manager. previously this
line made all input framework tests fail - it works now. Some of the
other recent changes of the threading manager must have fixed that
problem.

This was easy :)
2012-05-25 11:35:56 -07:00
Bernhard Amann
4de6d76488 fix up the executeraw test - now it works for the first time and does not always fail 2012-05-25 11:30:18 -07:00
Bernhard Amann
96a7e068f0 baselines for the autostart removal. 2012-05-25 11:29:57 -07:00