Commit graph

121 commits

Author SHA1 Message Date
Seth Hall
0c97c3c1de Several final fixes for PacketFilter framework.
- Fixed how the dpd_* variables are written.

- Fixed a bug with the shunting code.

- Updated a few tests.
2012-05-02 21:16:30 -04:00
Seth Hall
77694cc884 The app metrics break interval is now configurable. 2012-03-28 16:06:09 -04:00
Seth Hall
df6a180023 Some scripts for collecting connection stats and "app" stats.
- App stats are considered stats for applications on the internet.
  Services like facebook, youtube, etc.
2012-03-28 15:52:20 -04:00
Robin Sommer
71eaae8539 Fixing typos 2012-01-10 19:09:30 -08:00
Robin Sommer
3d2dc5f5fc Merge remote-tracking branch 'origin/topic/script-reference'
* origin/topic/script-reference: (50 commits)
  A few updates for the FAQ.
  Fixing some doc warnings.
  Forgot to add protocol identifier support for TLS 1.2
  Finished SSL & syslog autodocs.
  Adding the draft SSL extension type next_protocol_negotiation.
  Fix some documentation errors.
  Tweaks.
  A set of script-reference polishing.
  fixed a couple typos in comments
  Add summary documentation to bif files.
  Add ssl and syslog script documentation
  Add Conn and DNS protocol script documentation. (fixes #731)
  Small updates to the default local.bro.
  Documentation updates for HTTP & IRC scripts.
  SSH&FTP Documentation updates.
  Fixing a warning from the documentation generation.
  This completes framework documentation package 4.
  Minor notice documentation tweaks.
  Fix some malformed Broxygen xref roles.
  Minor doc tweaks to init-bare.bro.
  ...

Conflicts:
	aux/broccoli
	aux/broctl
	src/bro.bif
	src/strings.bif

Includes:

    - Updated baselines for autodoc tests.
    - Now excluding stats.bro from external texts, it's not stable.
2012-01-10 14:00:44 -08:00
Robin Sommer
b284dd25cf Merge remote-tracking branch 'origin/master' 2012-01-10 10:46:49 -08:00
Robin Sommer
82b1ee0720 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Change SFTP/SCP log rotators to use 4-digit year in filenames (fixes #745).
  Adding back the stats.bro file.

Closes #745.
Closes #656.
2012-01-10 09:49:58 -08:00
Seth Hall
86a1cbca82 A few more tiny documentation updates commited to the wrong branch. :) 2012-01-10 10:49:10 -05:00
Seth Hall
048516c605 Adding back the stats.bro file.
Closes #656
2012-01-10 09:10:45 -05:00
Jon Siwek
cc1459ef35 Fix some malformed Broxygen xref roles. 2011-12-16 14:30:36 -06:00
Seth Hall
8661abe9d9 Small script refinements and documentation updates. 2011-10-21 13:58:58 -04:00
Seth Hall
38bd2cc085 Documentation fix that was breaking a test. 2011-10-07 13:29:56 -04:00
Seth Hall
36dbaa5b92 Loaded scripts is indented with spaces now and makes more sense to look at.
- Updated a test to make it pass again.
2011-09-29 15:53:54 -04:00
Seth Hall
6b52ca5222 Small changes for the capture-loss script make the output more understandable. 2011-09-28 11:19:15 -04:00
Seth Hall
6db77dc285 Ported the capture-loss script back into Bro.
- I removed the byte loss estimate since everything indicated that
  it could frequently be inaccurate.

- It has it's own logging stream now.  Notices are only used
  when too much loss has been detected (CaptureLoss::Too_Much_Loss)

- The gap_report event isn't used anymore.  I'm scheduling events
  to get the same effect by using the get_gap_summary BiF to
  collect the gap summary on demand.
2011-09-28 00:08:53 -04:00
Seth Hall
3bf98548f7 The script level pf_ring support isn't working so removing it. 2011-09-08 02:28:04 -04:00
Seth Hall
eda2245e9e Merge remote-tracking branch 'origin/topic/seth/pf_ring_support'
* origin/topic/seth/pf_ring_support:
  Added pf_ring load balancing support to the scripting layer.
2011-09-06 15:20:22 -04:00
Seth Hall
11c437faa3 Logging framework update and mass Log::ID renaming.
- Log path's are generated in the scripting land
  now.  The default Log stream ID to path string
  mapping works like this:
    - Notice::LOG -> "notice"
    - Notice::POLICY_LOG -> "notice_policy"
    - TestModule::LOG -> "test_module"

- Logging streams updated across all of the shipped
  scripts to be more user friendly.  Instead of
  the logging stream ID HTTP::HTTP, we now have
  HTTP::LOG, etc.

- The priorities on some bro_init handlers have
  been adjusted to make the process of applying
  filters or disabling streams easier for users.
2011-09-03 01:10:17 -04:00
Seth Hall
771f8bc910 Added pf_ring load balancing support to the scripting layer.
- If the misc/pf-ring-load-balancing script is loaded, the correct
  environment variables will be set to enable automatic flow based
  load balancing used pf_ring if Bro is built against the pf_ring
  libpcap wrapper.  Loading the script on non-Linux OSs or when Bro
  isn't linked against the correct libpcap has no known side effects
  since the script just sets environment variables.

- Added a BiF named setenv for setting environment variables.
2011-09-02 10:43:32 -04:00
Seth Hall
d201215359 Added the profiling script. 2011-08-11 01:37:57 -04:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization.
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
2011-08-05 23:09:53 -04:00