Commit graph

3495 commits

Author SHA1 Message Date
Robin Sommer
9301589219 Merge remote-tracking branch 'origin/topic/jsiwek/switch-statement'
* origin/topic/jsiwek/switch-statement:
  Finish implementation of script-layer switch statement.  Addresses #754.

Closes #754.
2012-12-20 15:13:30 -08:00
Jon Siwek
55c515d50a Add array-style index accessor for strings. Addresses #422.
The index expression can take up to two indices for the start and end
index of the substring to return (e.g. "mystring[1,3]").  Negative
indices are allowed, with -1 representing the last character in the
string.  The indexing is not cyclic -- if the starting index is >= the
length of the string an empty string is returned, and if the ending
index is >= the length of the string then it's interpreted as the last
index of the string.  Assigning to substrings accessed like this isn't
allowed.
2012-12-20 17:13:06 -06:00
Robin Sommer
ca8a8b09fa Merge remote-tracking branch 'origin/topic/jsiwek/ticket-730'
* origin/topic/jsiwek/ticket-730:
  Fix a case where c$resp$size is misrepresented.  Addresses #730.

Closes #730.
2012-12-20 14:53:43 -08:00
Jon Siwek
939a64b73a Finish implementation of script-layer switch statement. Addresses #754.
They behave like C-style switches except case labels can be comprised
of multiple literal constants delimited by commas.  Only atomic types
are allowed for now.  Case label bodies that don't execute a "return"
or "break" statement will fall through to subsequent cases.  A default
case label is allowed.
2012-12-20 12:49:50 -06:00
Scott Runnels
cce5565d63 Merge remote-tracking branch 'origin/master' into topic/documentation 2012-12-19 23:20:52 -05:00
Scott Runnels
7dc4fd34d3 Merge remote-tracking branch 'origin/master' into topic/documentation 2012-12-19 22:54:23 -05:00
Jon Siwek
98663fd534 Fix return value of hook calls that have no handlers.
For this case, the return value is always true.
2012-12-18 15:31:50 -06:00
Jon Siwek
4a09c12882 Fix to_port() BIF for port strings with a port number of zero. 2012-12-18 15:08:18 -06:00
Jon Siwek
2f0c698ed5 Improve error for invalid use of types as values (addresses #923).
This scripting error can now generate an error message at parse-time
instead of run-time and also includes location information.
2012-12-18 14:31:39 -06:00
Seth Hall
69b7ce12d2 API updates for metrics framework.
- Removed default logging.  Now a function is available for the new
  $period_finished filter field to get the same behavior for logging
  named Metrics::write_log.

- Added index rollups for getting multiple metrics result values
  as the same time.
2012-12-18 01:08:59 -05:00
Seth Hall
69030fdff3 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-17 10:00:34 -05:00
Jon Siwek
81ae68be16 Fix a case where c$resp$size is misrepresented. Addresses #730.
That field is based on TCP sequence numbers and on seeing a SYN followed
by a failed RST injection response, the initial sequence number tracked
the value in the injection (most likely zero) instead of value in
subsequent SYN response.  This could make c$resp$size be set to large
values when it's not really.

Also removed some dead code paths.
2012-12-14 17:08:50 -06:00
Robin Sommer
ea6b62f586 Merge remote-tracking branch 'origin/topic/jsiwek/const'
* origin/topic/jsiwek/const:
  Make const variables actually constant.  Addresses #922.

Closes #922.
2012-12-14 14:56:37 -08:00
Robin Sommer
7a2901ec6b Fixing checksums in test trace because Bro now reports them. :-) 2012-12-14 14:48:16 -08:00
Matthias Vallentin
69d8d29fbd Add new unit test for opaque serialization.
One Bro begins a computation, another finishes it.

(This commit also fixes a problem with the serialization OpaqueVals.)
2012-12-14 13:05:31 -08:00
Matthias Vallentin
b9d05f56d0 Migrate entropy testing to opaque. 2012-12-13 19:28:19 -08:00
Jon Siwek
290c2a0b4d Make const variables actually constant. Addresses #922.
Both local and global variables declared with "const" could be modified,
but now expressions that would modify them should generate an error
message at parse-time.
2012-12-13 15:05:29 -06:00
Matthias Vallentin
3ba85567f4 Merge branch 'master' into topic/matthias/opaque
Conflicts:
	aux/broctl
2012-12-13 11:03:17 -08:00
Jon Siwek
f6d5da423c Fix record constructors in table initializer indices. Addresses #660.
For an index expression list, ListExpr::InitVal() passed the TypeList
to Expr::InitVal() for each expression element in the list instead of
the type for that element.  This made RecordConstructorExpr::InitVal()
complain since it expects a RecordType and not a TypeList with a
RecordType element as an argument.  In most other cases, Expr::InitVal()
worked because check_and_promote() "flattens" the list to a single type.
2012-12-12 14:52:08 -06:00
Matthias Vallentin
816965f3c7 Merge remote-tracking branch 'origin/master' into topic/matthias/opaque 2012-12-11 16:32:01 -08:00
Matthias Vallentin
30bab14dbf Update base scripts and unit tests. 2012-12-11 16:26:17 -08:00
Jon Siwek
43ed437daa Trick for parallelizing input framework unit tests.
Instead of loading listen.bro to block until files are read, just read
a pcap file in pseudo-realtime.  Seems to work well.
2012-12-11 17:06:54 -06:00
Jon Siwek
aff5898442 Maybe fix reliability of a unit test that relies on when statements. 2012-12-11 16:26:01 -06:00
Robin Sommer
b867333c2e Merge remote-tracking branch 'origin/topic/jsiwek/gtp'
* origin/topic/jsiwek/gtp:
  Change binpac exceptions in AYIYA/GTP analyzers to do protocol_violation
  Add GTP tunnel analyzer memory leak unit test.
  Add GPRS Tunnelling Protocol (GTPv1) decapsulation.

Closes #690.
2012-12-10 14:48:18 -08:00
Robin Sommer
e2d20cb7bc Changing the HTTP parser to accept methods that align with the RFC. 2012-12-07 19:42:03 -08:00
Seth Hall
dda36672ac Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-06 11:07:35 -05:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
2012-12-05 16:56:54 -08:00
Robin Sommer
177c014cb7 Merge remote-tracking branch 'vlad/topic/vladg/http-verbs'
* vlad/topic/vladg/http-verbs:
  A test for HTTP methods, including some horribly illegal requests.
  Remove hardcoded HTTP verbs from the analyzer (#741)

I added a "bad_HTTP_request" weird for HTTP request lines that don't
have more than a single word.

Closes #741.
2012-12-05 15:27:42 -08:00
Bernhard Amann
3973cb1075 Merge remote-tracking branch 'origin/fastpath' into fastpath 2012-12-05 12:42:02 -08:00
Bernhard Amann
d367e227c1 ok, this one is a bit... embarrassing.
Delete the correct entry in case of error. Fixes a segfault when the faulty
data is of type string and not the last field of the input...
2012-12-05 12:40:00 -08:00
Jon Siwek
f403e537ec Fix segfault: uninitialized identifiers w/ &synchronized (addresses #66)
Synchronization of state between connecting peers now skips over
identifiers that aren't initialized with a value yet.  If they're
assigned a value later, that will be synchronized like usual.
2012-12-05 12:36:09 -06:00
Jon Siwek
32239ea633 Bad record constructor initializers now give an error (addresses #34).
As opposed to a segfault.
2012-12-04 16:29:23 -06:00
Jon Siwek
75278af8a1 Invalid vector indices now generate error message (addresses #24).
The error/behavior is the same as accessing tables at invalid indices.
2012-12-04 15:22:16 -06:00
Jon Siwek
f7440375f1 Interpreter exceptions occurring in "when" blocks are now handled.
The scripting error that caused the exception is still reported, but
it no longer causes Bro to terminate.  Addresses #779
2012-12-04 12:38:09 -06:00
Seth Hall
3af4517e2a Adding an $end time for result values to measure the length of time a measurement took. 2012-12-04 11:04:01 -05:00
Seth Hall
d61d175a04 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-04 00:17:43 -05:00
Robin Sommer
63d43e6545 Renaming ASCII writer filter option 'only_single_header_row' to 'tsv'.
Also clarifying usage.

Closes #912.
2012-12-03 14:40:38 -08:00
Robin Sommer
d9f90fcac0 Merge remote-tracking branch 'origin/topic/jsiwek/table-attribute-fixes'
* origin/topic/jsiwek/table-attribute-fixes:
  Fix various bugs with table/set attributes.

Closes #866.
2012-12-03 14:11:44 -08:00
Robin Sommer
d4792dc7fe Merge remote-tracking branch 'origin/topic/jsiwek/table-init-container-ctors'
* origin/topic/jsiwek/table-init-container-ctors:
  Add test of record() constructor to table initializer unit test.
  Fix table(), set(), vector() constructors in table initializer lists.

Closes #5.
2012-12-03 14:10:17 -08:00
Robin Sommer
1298f2e974 Merge remote-tracking branch 'origin/topic/jsiwek/hook'
* origin/topic/jsiwek/hook:
  Change hook calls to only be allowed when preceded by "hook" keyword.
  Clarification in hook documentation.
  Hook functions now directly callable instead of w/ "hook" statements.

Closes #918.
2012-12-03 14:07:22 -08:00
Scott Runnels
d35268a41c Beginning exploration of network centric data types, starting with subnets. 2012-12-01 02:22:52 -05:00
Vlad Grigorescu
318f38df43 A test for HTTP methods, including some horribly illegal requests. 2012-11-30 22:06:54 -05:00
Jon Siwek
95ffb1cf27 Quick pass over unit tests, adding -b flag to bro so they run faster.
Doing this made bifs/ ~3x faster and language/ ~2x faster.
2012-11-30 17:44:36 -06:00
Jon Siwek
4e85fe0454 Change hook calls to only be allowed when preceded by "hook" keyword. 2012-11-30 15:39:00 -06:00
Jon Siwek
cc8f20c104 Merge branch 'master' into topic/jsiwek/gtp 2012-11-29 16:11:27 -06:00
Jon Siwek
f7e07f5f09 Fix various bugs with table/set attributes.
- Identifiers that are initialized with set()/table() constructor
  expressions now inherit attributes from the expression.  Before,
  statements like

     const i: set[string] = set() &redef;

  associated the attribute with the set() constructor, but not the
  "i" identifier, preventing redefinition.  Addresses #866.

- Allow &default attribute to apply to tables initialized as empty
  (via either "{ }" or "table()") or if the expression supplied to it
  can evaluate to a type that's promotable to the same yield type as
  the table.
2012-11-29 15:44:03 -06:00
Jon Siwek
00f7bbda96 Add test of record() constructor to table initializer unit test. 2012-11-28 14:53:36 -06:00
Jon Siwek
a0590b2140 Fix table(), set(), vector() constructors in table initializer lists.
Also adds type checking of yield values to table() constructor and
fixes the type checking of yield values in vector() constructor.

Addresses #5.
2012-11-28 14:19:48 -06:00
Seth Hall
956c23eb66 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-11-28 14:57:42 -05:00
Jon Siwek
378ee699ff Hook functions now directly callable instead of w/ "hook" statements.
The return value of the call is an implicit boolean value of T if all
hook handlers ran, or F if one hook handler exited as a result of a
break statement and potentially prevented other handlers from running.

Scripts don't need to declare hooks with an explicit return type of bool
(internally, that's assumed), and any values given to (optional) return
statements in handler definitions are just ignored.

Addresses #918.
2012-11-26 17:09:29 -06:00