Commit graph

4091 commits

Author SHA1 Message Date
Robin Sommer
da0ea67453 Fixing btests.
- When Bro is given a PRNG seed, it now uses its own internal random
  number generator that produces consistent results across sytems.
  Note that this internal generator isn't very good, so it should only
  be used for testing purposes.

- The BTest configuration now sets the environemnt variables TZ=UTC
  and LANG=C to ensure consistent results.

- Fixing doc markup in logging.bro.

- Updating baselines.
2011-04-21 19:31:44 -07:00
Jon Siwek
4373565373 Merge branch 'master' into topic/jsiwek/doc-framework 2011-04-21 11:09:58 -05:00
Robin Sommer
13a492091f Merge remote branch 'origin/topic/robin/logging-internals'
Includes some additional cleanup.
2011-04-20 21:30:41 -07:00
Jon Siwek
c472931eb9 Fixing example.bro's auto-reST generation baseline test.
Adds a diff canonifier that skips diffing the places where example.bro
may use MutableVal derivatives (e.g. sets/tables), which don't always
generate the same ordering in the reST docs across runs.
2011-04-20 20:09:33 -05:00
Seth Hall
c564f545c0 Updates and tests for netbios name BiF.
* New BiF named: decode_netbios_name_type
* \x01 and \x02 are now decoded because I saw those
  bytes being actively used in names.
2011-04-20 15:59:11 -04:00
Seth Hall
cba5766bc8 Fixed the do_split bug and added a test.
* do_split was having a problem if there was another match
  after the end of the number of separators.  It would only
  return the match up to the point of the next match instead
  of the rest of the string.
2011-04-19 22:24:46 -04:00
Robin Sommer
5a6311d360 Implementing a VectorCoerceExpr.
Turns out we didn't have that yet.

I don't remember who implemented vectors originally, but he does owe
us all round at Jupiter ...
2011-04-19 16:58:18 -07:00
Robin Sommer
b3b5a73113 Fixing problem with optional fields. 2011-04-19 16:22:40 -07:00
Robin Sommer
a4a47c3df1 Merge remote branch 'origin/topic/seth/count_to_addr'
* origin/topic/seth/count_to_addr:
  Adjusting BiF name to indicate v4 addresses only.
  count_to_addr function
2011-04-19 15:52:16 -07:00
Robin Sommer
e7bde27f2d Merge remote branch 'origin/topic/jsiwek/doc-framework' 2011-04-18 14:54:23 -07:00
Seth Hall
dfd9b40466 count_to_addr function
* Updates to_count to cope with 64bit ints.
* Adds count_to_addr which will turn a count into an IPv4 address.
* Includes tests.
2011-04-18 15:22:48 -04:00
Robin Sommer
29b0d0d1d9 Files can now be logged; their filename will be written out. 2011-04-17 20:52:18 -07:00
Robin Sommer
65016dc5e8 Updating istate tests.
Some still don't pass:

    - events-ssl doesn't work; not clear yet why, there may be some
      problem with SSL connections.

    - broccoli needs the changes topic/jsiwek/64bit-val-fix, plus
    adaption of the protocol version.

    - pybroccoli crashes even with the 64bit-val-fix changes. Reason
      unclear.
2011-04-17 19:53:56 -07:00
Robin Sommer
c132506203 Merge branch 'topic/robin/record-table-default' into topic/robin/logging-internals
Includes additional fixes for the &default attribute's type checking.
2011-04-17 12:03:58 -07:00
Robin Sommer
09d37b2026 Fixing logging filter "include" and "exclude" options. 2011-04-17 11:14:07 -07:00
Robin Sommer
58f86ae55d Fixing bug with records sometimes unnecessarily coerced on assignment. 2011-04-17 10:42:51 -07:00
Jon Siwek
515b96685a Fix generated docs displaying "func" for events in identifier summary table. 2011-04-11 10:32:07 -05:00
Jon Siwek
0a14cd11f6 Move generated script doc for "private interface" to bottom of page. 2011-04-11 10:29:41 -05:00
Jon Siwek
af54714839 Add tests for auto-generating reST from bro scripts. 2011-04-08 12:02:03 -05:00
Robin Sommer
0a97a9e82a Fixing attributes to allow &default in tables/sets to be associated
with the field.

This works now:

    type X: record {
        a: table[string] of bool &default=table( ["foo"] = T );
        b: table[string] of bool &default=table();
        c: set[string] &default=set("A", "B", "C");
        d: set[string] &default=set();
    };

I think previously the intend was to associate &default with the
table/set (i.e., define the default value for non-existing indices).
However, that was already not working: the error checking was
reporting type mismatches. So, this shouldn't break anything and make
things more consistent.
2011-04-05 16:20:27 -07:00
Robin Sommer
bc39f9f048 Porting the istate tests to btest.
Note that currently most of them don't pass because (i) the code
adding the environment variable for seeding the RNG has not been
merged into master yet; and (2) Broccoli to Bro communication is
currently broken because of the int64 problem. Once these are fixed,
then baselines need to be recreated and checked.

Therefore, the istate tests aren't activated in btest.cfg yet.
2011-03-29 21:46:06 -07:00
Robin Sommer
3562682ac9 Merge remote branch 'origin/topic/appleman/unittests'
Note that I've shifted things around a little bit. The traces are now
in Traces/* (capital T), and the known-hosts-test in policy/*.
Scripts/ was meant just for helper shell scripts for the testing
framework. Also, I've not yet included "policy" in btest.cfg as a
TestDir because the corresponding script is not yet in master.

* origin/topic/appleman/unittests:
  Test, trace file, and baseline for testing the known-services policy script
  Baseline for KNOWN-HOSTS tesT
  Initial drop of known-hosts unit test, with tracefile and directory structure, as well as c ouple of files pulled from Robin's logging branch.
2011-03-29 21:43:34 -07:00
Robin Sommer
1cbde793d8 Merge branch 'topic/robin/extend-records' into topic/robin/logging-internals
Includes some fixes for using &log with record-extension.
2011-03-28 18:56:19 -07:00
Robin Sommer
38a1aa5a34 &log keyword, and vector logging.
The &log keyword now operates as discussed:

    - When associated with individual record fields, it defines them
      as being logged.

    - When associated with a complete record type, it defines all fields
      to be logged.

    - When associated with a record extension, it defines all added
      fields to be logged.

    Note that for nested record types, the inner fields must likewise
    be declared with &log. Consequently, conn_id is now declared with
    &log in bro.init.

Vectors are now allowed to be logged and will be recorded as an
ordered set of items.
2011-03-28 18:14:05 -07:00
Don Appleman
ebb4eb552a Test, trace file, and baseline for testing the known-services policy script 2011-03-25 16:17:27 -05:00
Don Appleman
c81f1889a5 Baseline for KNOWN-HOSTS tesT 2011-03-24 13:28:48 -05:00
Robin Sommer
0f854315e9 New test. 2011-03-10 18:18:58 -08:00
Robin Sommer
871561939b Updating baselines. 2011-03-09 19:42:24 -08:00
Robin Sommer
89e8ea7353 Enums are now logged with their ID names, not anymore with their
numerical values.
2011-03-09 18:06:50 -08:00
Robin Sommer
52c54859b6 Bugfix: the header line was ending with a separator.
Test baselines needed adaption as well.
2011-03-09 16:55:29 -08:00
Robin Sommer
b69ecff3ee More options for the ASCII writer.
# The prefix for the header line if included.
	const header_prefix = "# " &redef;

	# The string to use for empty string fields.
	const empty_field = "" &redef;

	# The string to use for an unset optional field.
	const unset_field = "-" &redef;
2011-03-09 16:52:46 -08:00
Robin Sommer
cb9e0a5d5a If a field value contains the separator, that is now escape with hex
characters.
2011-03-09 16:26:11 -08:00
Robin Sommer
c6d20dbfdf Adding a few options to the ASCII writer.
module LogAscii;

export {
	# Output everything to stdout rather than into files. This is primarily
	# for testing purposes.
	const output_to_stdout = F &redef;

	# The separator between fields.
	const separator = "\t" &redef;

	# True to include a header line with column names.
	const include_header = T &redef;
}
2011-03-08 21:44:46 -08:00
Robin Sommer
26eab74ecc The ASCII writer can now deal with /dev/* paths.
It will not longer try to add a ".log" extension.
2011-03-08 17:59:05 -08:00
Robin Sommer
5d8b9f2e74 New function Log::get_filter() that allows to retrieve previously
installed filter by name.

This filter can then be modified and reinstalled via add_filter(),
which will replace the old one with the same name.
2011-03-08 17:31:46 -08:00
Robin Sommer
b8ee425e0d Adding test for per-file rotation. 2011-03-08 16:33:06 -08:00
Robin Sommer
51f9cb2ac5 Updating test baseline after fixing an older bug in previous commit. 2011-03-08 16:26:31 -08:00
Robin Sommer
d6cef16f77 Rotation support.
This follows rather closely how rotation currently works in
rotate-logs.bro. logging.bro now defines:

        # Default rotation interval; zero disables rotation.
        const default_rotation_interval = 0secs &redef;

        # Default naming suffix format.
        const default_rotation_date_format = "%y-%m-%d_%H.%M.%S" &redef;

        # Default postprocessor for writers outputting into files.
        const default_rotation_postprocessor = "" &redef;

        # Default function to construct the name of the rotated file.
        # The default implementation includes
        # default_rotation_date_format into the file name.
        global default_rotation_path_func: function(info: RotationInfo) : string &redef;

Writer support for rotation is optional, usually it will only make
sense for file-based writers.

TODO: Currently, there's no way to customize rotation on a per file
basis, there are only the global defaults as described above.
Individual customization is coming next.
2011-03-06 19:32:44 -08:00
Robin Sommer
90af0d06c3 A first test for remote logging.
Needs the updated btest, which has two new scripts for running
processes in the background.
2011-03-03 21:47:08 -08:00
Robin Sommer
ab15437339 Working on the logging API exposed to scripts.
- Moving all functions into the Log::* namespace, using the recent
  bifcl updates. Moved logging-specific stuff to logging.bif.

- Log::create_stream() now takes a record Log::Stream as its second
  argument, which specifies columns and (optionally) the event.

- All the internal BiFs are now called "Log::__<something>", with
  script-level wrappers "Log::<something>". That first allows to add
  additional code at the script-level, and second makes things better
  comprehendible as now all relevant functionality is collected (and
  later documetned) in policy/logging.bro.

- New function Log::flush(id), which does the obvious assuming the
  writer supports it.

- add_default_filter() is now called implicitly with every
  create_stream(). Seems that we usually want that functionality, and
  when not, remove_default_filter() gets rid of it.

- The namespace of a stream's ID is now used as the default "path"
  (e.g., if the namespace is SSH, the default log file is "ssh.log").

- Updated policy/test-logging.bro as well as the btest tests according
  to these changes.
2011-02-27 15:09:37 -08:00
Robin Sommer
f02e465c92 Tests for the logging functionality, including a basic btest
configuration.
2011-02-21 18:29:41 -08:00