Commit graph

215 commits

Author SHA1 Message Date
Robin Sommer
d8aece07d7 Merge remote-tracking branch 'origin/topic/jsiwek/raw_output'
* origin/topic/jsiwek/raw_output:
  Fix &raw_output and enable_raw_output interpretation of NUL characters
2011-08-03 16:27:52 -07:00
Jon Siwek
648e1bda26 Fix &raw_output and enable_raw_output interpretation of NUL characters
When using a `print` statement to write to a file that has raw output
enabled, NUL characters in string are no longer interpreted into "\0",
no newline is appended afterwards, and each argument to `print` is
written to the file without any additional separation.

(Re)Assigning to identifiers with the &raw_output attribute should also
now correctly apply the attribute to the file value being assigned.

Note that the write_file BiF should already be capable of raw string
data to a file, expect it bypasses the print_hook event.

Addresses #474
2011-08-03 10:51:40 -05:00
Jon Siwek
d6d34f3a1f Fix PktSrc::Statistics returning bogus stats.
When reading from trace files, 'dropped' and 'link' fields are now
just zeroed.

When reading from an interface, the values filled in by pcap_stats()
are now only used when that function indicates success.

Closes #500.
2011-08-01 16:49:43 -05:00
Robin Sommer
0e5bc16a60 Merge remote-tracking branch 'origin/topic/jsiwek/mask_addr_rval'
* origin/topic/jsiwek/mask_addr_rval:
  mask_addr bif now returns subnet (addresses #512)
2011-07-28 17:11:15 -07:00
Jon Siwek
19dab4fdda Add new piped_exec BiF.
And changing email_notice_to() function in notice framework to
interface with sendmail through it.
2011-07-27 13:52:24 -05:00
Jon Siwek
b6a371f32d mask_addr bif now returns subnet (addresses #512) 2011-07-23 16:45:29 -05:00
Robin Sommer
8bacb6eb3d New BiF record_field_vals() that returns the fields of a record in a
table with meta-information.

Example:

type r: record {
	a: count;
	b: string &default="Foo";
	c: double &optional;
	d: string &log;
};

event bro_init()
{
    local x: r = [$a=42, $d="Bar"];
    print record_fields(x);
}

This prints:

  {
  [a] = [type_name=record, log=F, value=42, default_val=<uninitialized>]
  [b] = [type_name=record, log=F, value=<uninitialized>, default_val=Foo],
  [c] = [type_name=record, log=F, value=<uninitialized>, default_val=<uninitialized>],
  [d] = [type_name=record, log=T, value=Bar, default_val=<uninitialized>],
  }

This is one more step in Seth's quest for full inspection support. :-)
2011-07-07 19:56:48 -07:00
Robin Sommer
9709b1d522 Merge remote branch 'origin/topic/robin/reporting'
* origin/topic/robin/reporting:
  Syslog BiF now goes through the reporter as well.
  Avoiding infinite loops when an error message handlers triggers errors itself.
  Renaming the Logger to Reporter.
  Overhauling the internal reporting of messages to the user.

Updating a bunch of tests/baselines as well.

Conflicts:
	aux/broccoli
	policy.old/alarm.bro
	policy/all.bro
	policy/bro.init
	policy/frameworks/notice/weird.bro
	policy/notice.bro
	src/SSL-binpac.cc
	src/bro.bif
	src/main.cc
2011-07-01 13:59:21 -07:00
Jon Siwek
90196b4dc8 Fix bifs.unique_id-rnd test failing because of wc output formatting 2011-06-10 13:27:08 -05:00
Robin Sommer
8266709e20 A new bif unique_id(prefix) that returns a string that's unique across
Bro instaces with high probablity.

"prefix" is a string that will be prepended to the returned ID.
2011-06-07 17:57:22 -07:00
Seth Hall
c5a19f7cdc Fixed another do_split bug and included a test for the fix. 2011-04-22 08:00:28 -04:00
Robin Sommer
c80cd26e17 Merge remote branch 'origin/topic/seth/decode-nbns-names'
* origin/topic/seth/decode-nbns-names:
  Updates and tests for netbios name BiF.
2011-04-21 19:49:24 -07:00
Seth Hall
c564f545c0 Updates and tests for netbios name BiF.
* New BiF named: decode_netbios_name_type
* \x01 and \x02 are now decoded because I saw those
  bytes being actively used in names.
2011-04-20 15:59:11 -04:00
Seth Hall
cba5766bc8 Fixed the do_split bug and added a test.
* do_split was having a problem if there was another match
  after the end of the number of separators.  It would only
  return the match up to the point of the next match instead
  of the rest of the string.
2011-04-19 22:24:46 -04:00
Robin Sommer
a4a47c3df1 Merge remote branch 'origin/topic/seth/count_to_addr'
* origin/topic/seth/count_to_addr:
  Adjusting BiF name to indicate v4 addresses only.
  count_to_addr function
2011-04-19 15:52:16 -07:00