Commit graph

15 commits

Author SHA1 Message Date
Robin Sommer
5f7aed6687 Merge remote-tracking branch 'origin/topic/jsiwek/http-multipart-byteranges'
* origin/topic/jsiwek/http-multipart-byteranges:
  Teach HTTP parser to derive content length of multipart/byteranges bodies.

Closes #448.
2011-09-28 17:40:36 -07:00
Robin Sommer
4d6a90ce89 Merge remote-tracking branch 'origin/topic/jsiwek/http-1xx-replies'
* origin/topic/jsiwek/http-1xx-replies:
  Change logging of HTTP 1xx responses to occur in their own columns.
  Fix handling of HTTP 1xx response codes (addresses #411).
2011-09-28 17:10:40 -07:00
Jon Siwek
64e821624b Fix handling of HTTP 1xx response codes (addresses #411).
Changed the parser to not treat 1xx response codes as a final answer
to an unanswered request -- a later response is still expected.

The scripting layer will also not finish a request-reply pair when
seeing 1xx's, instead it logs both the 1xx and final response messages
with associated information of the current request as they're seen.
2011-09-26 17:37:29 -05:00
Jon Siwek
ee30268164 Teach HTTP parser to derive content length of multipart/byteranges bodies.
Addresses #488.
2011-09-23 10:31:20 -05:00
Jon Siwek
495e987938 Remove $Id$ tags 2011-08-04 15:21:18 -05:00
Robin Sommer
9709b1d522 Merge remote branch 'origin/topic/robin/reporting'
* origin/topic/robin/reporting:
  Syslog BiF now goes through the reporter as well.
  Avoiding infinite loops when an error message handlers triggers errors itself.
  Renaming the Logger to Reporter.
  Overhauling the internal reporting of messages to the user.

Updating a bunch of tests/baselines as well.

Conflicts:
	aux/broccoli
	policy.old/alarm.bro
	policy/all.bro
	policy/bro.init
	policy/frameworks/notice/weird.bro
	policy/notice.bro
	src/SSL-binpac.cc
	src/bro.bif
	src/main.cc
2011-07-01 13:59:21 -07:00
Robin Sommer
66e2c3b623 Renaming the Logger to Reporter.
Also changing output to not include timestamps when we haven't started
processing packets yet.
2011-07-01 09:22:33 -07:00
Robin Sommer
27aa30c683 Work-around for bug in HTTP analyzer.
See #488 for more information.
2011-06-30 22:44:09 -07:00
Robin Sommer
93894eed9b Overhauling the internal reporting of messages to the user.
The Logger class is now in charge of reporting all errors, warnings,
informational messages, weirds, and syslogs. All other components
route their messages through the global bro_logger singleton.

The Logger class comes with these reporting methods:

    void Message(const char* fmt, ...);
    void Warning(const char* fmt, ...);
    void Error(const char* fmt, ...);
    void FatalError(const char* fmt, ...); // Terminate Bro.
    void Weird(const char* name);
    [ .. some more Weird() variants ... ]
    void Syslog(const char* fmt, ...);
    void InternalWarning(const char* fmt, ...);
    void InternalError(const char* fmt, ...); // Terminates Bro.

See Logger.h for more information on these.

Generally, the reporting now works as follows:

    - All non-fatal message are reported in one of two ways:

        (1) At startup (i.e., before we start processing packets),
            they are logged to stderr.

        (2) During processing, they turn into events:

            event log_message%(msg: string, location: string%);
            event log_warning%(msg: string, location: string%);
            event log_error%(msg: string, location: string%);

            The script level can then handle them as desired.

            If we don't have an event handler, we fall back to
            reporting on stderr.

    - All fatal errors are logged to stderr and Bro terminates
      immediately.

    - Syslog(msg) directly syslogs, but doesn't do anything else.

The three main types of messages can also be generated on the
scripting layer via new Log::* bifs:

    Log::error(msg: string);
    Log::warning(msg: string);
    Log::message(msg: string);

These pass through the bro_logger as well and thus are handled in the
same way. Their output includes location information.

More changes:

    - Removed the alarm statement and the alarm_hook event.

    - Adapted lots of locations to use the bro_logger, including some
      of the messages that were previously either just written to
      stdout, or even funneled through the alarm mechanism.

    - No distinction anymore between Error() and RunTime(). There's
      now only one class of errors; the line was quite blurred already
      anyway.

    - util.h: all the error()/warn()/message()/run_time()/pinpoint()
      functions are gone. Use the bro_logger instead now.

    - Script errors are formatted a bit differently due to the
      changes. What I've seen so far looks ok to me, but let me know
      if there's something odd.

Notes:

    - The default handlers for the new log_* events are just dummy
      implementations for now since we need to integrate all this into
      the new scripts anyway.

    - I'm not too happy with the names of the Logger class and its
      instance bro_logger. We now have a LogMgr as well, which makes
      this all a bit confusing. But I didn't have a good idea for
      better names so I stuck with them for now.

      Perhaps we should merge Logger and LogMgr?
2011-06-25 16:40:54 -07:00
Robin Sommer
b01aa66fe6 Fixing some more format strings. 2011-04-27 21:31:23 -07:00
Robin Sommer
714289bd13 Changing the HTTP's analyzers internals to use 64-bit integers.
(Gregor Maier).

This is the patch from #326, plus some cleanup.
2011-04-27 21:25:51 -07:00
Robin Sommer
a3a075174b Merging in 'topic/robin/cleanup-rewriter'.
Removing everything related to trace rewriting.

(I wasn't too careful in ensuring that I catch everything in the
scripts; Seth is working on those anyway.)

(Merging by cherry-picking the corresponding commit, as the branch was
accidentally made off of the logging stuff).
2011-04-01 15:23:50 -07:00
Gregor Maier
f79ea244fa Support namespaces / modules in bif. Checkpoint.
(now actually commiting all the files)

This change is actually two-fold:
a) bif's now accept module XYZ; statements and module::ID for
   function, const, event, enum, etc. declartation
b) Added C++-namespaces to variables, functions, etc. that are declared
   in bif but accessed from C++
   This required some (lightweight) re-factoring of the C++ codes.
   Note, event's don't have their own C++ namespace yet, since this
   would require a rather huge re-factoring.

Compiles and passes test suite.
New namespace feature not tested yet.
Documentation to follow.
2011-02-11 09:37:23 -08:00
Robin Sommer
9cea6c5b01 Some small tweaks to the HTTP analyzer.
From ticket #339.
2011-01-20 13:54:54 -08:00
Robin Sommer
61757ac78b Initial import of svn+ssh:://svn.icir.org/bro/trunk/bro as of r7088 2010-09-27 20:42:30 -07:00