Commit graph

17337 commits

Author SHA1 Message Date
Robin Sommer
1aff02ea96 Merge remote-tracking branch 'origin/topic/jsiwek/debug-flags'
* origin/topic/jsiwek/debug-flags:
  Workaround for FreeBSD CMake port missing debug flags
2011-08-12 23:37:12 -07:00
Robin Sommer
045fd4690b Merge remote-tracking branch 'origin/topic/seth/piped_exec-update'
* origin/topic/seth/piped_exec-update:
  piped_exec can now write nulls in the "to_write" argument.
2011-08-12 23:35:15 -07:00
Jon Siwek
6f060a58d6 Fix vector initialization for lists of records with optional types.
If possible the list elements now get promoted to the yield type of the
vector.  There was also a problem with the value returned by the record
constructor expression's eval being completely unref'd since the vector
element assignment function doesn't ref the element -- so I changed it
to ref values if they just constructed before assigning them to the
vector.

Addresses #485.
2011-08-12 23:25:01 -07:00
Jon Siwek
560685f1c6 Fix redef'ing records with &default empty set fields.
Attributes have state to track whether they're in a record and should
apply to a record field, but this state wasn't being set for TypeDecls
that are part of a redef'd record.

Closes #460
2011-08-12 23:24:49 -07:00
Gregor Maier
03a73899a9 Fix ConnSize_Analyzer with ConnCompressor.
The num_pkts and num_bytes_ip in endpoint are optional and
should only be assigned to if ConnSize_Anlyzer is active.
2011-08-12 23:24:44 -07:00
Jon Siwek
00de88f4cb Fix reporter using part of the actual message as a format string
When not reporting via events, the final contents of the message buffer
after formatting was being used as a format string to fprintf instead of
writing out the actual string.
2011-08-12 23:24:44 -07:00
Robin Sommer
33b064bdb2 Fixing reporter's location tracking.
Closes #492.
2011-08-12 22:39:36 -07:00
Robin Sommer
46d3570bf5 Turning DNS errors into a warning.
It seems these errors aren't Bro's fault, and in any case it's clearly
not an internal error. This should finally solve the problem in #255.

Closes #255.
2011-08-12 22:29:38 -07:00
Robin Sommer
cb31fd3bb9 Logging's path_func now receives the log record as argument.
Closes #555.
2011-08-12 22:18:45 -07:00
Robin Sommer
c436930acf Functions can now be logged.
The function's code is rendered as ASCII and included as a string.
Closes #506.

Note that I'm not sure if the formatting is as desired: should the LFs
and tabs be rendered as \xXX or removed?.
2011-08-12 22:15:57 -07:00
Gregor Maier
65921bc61d Bugfix: an #ifdef BROv6 was missing in the tunnel code 2011-08-12 21:42:47 -07:00
Gregor Maier
95d84da1b0 Set c$conn (for logging) in new_connection() event.
c$conn was originally set in connection_established(), which is only
used by TCP connections, and in connection_state_remove(). Using
new_connection() allows us to have c$conn available for any connection
and for any script that wants to extend logging to conn.log.
2011-08-11 15:29:54 -07:00
Gregor Maier
eacfbea3fe (Semiautomatically) convert the comments in bare-init.bro into autodoc ones.
With manual tuning were it made sense.
2011-08-11 14:25:34 -07:00
Gregor Maier
fe5624fb06 Add ConnSize_Analyzer's fields to conn.log 2011-08-11 12:21:42 -07:00
Gregor Maier
88f7db927e SSH base scripts: make sure ConnSizeAnalyzer variables are available before using them. 2011-08-11 12:20:38 -07:00
Gregor Maier
6ba9a43d0f Merge remote-tracking branch 'origin/master' into fastpath 2011-08-11 12:16:59 -07:00
Seth Hall
cc258b29aa Single character bugfix for hostname notice email extension. 2011-08-11 15:16:32 -04:00
Gregor Maier
9ea6a7e563 Fix ConnSize_Analyzer with ConnCompressor.
The num_pkts and num_bytes_ip in endpoint are optional and
should only be assigned to if ConnSize_Anlyzer is active.
2011-08-11 12:15:03 -07:00
Gregor Maier
42e3ce809b Merge branch 'master' into fastpath 2011-08-11 12:07:20 -07:00
Seth Hall
240ae9790b Small updates for notice framework.
- New ACTION_ADD_GEODATA to add geodata to notices in an extension
  field named remote_location.

- Loading extend-email/hostnames by default now that it only
  does anything when the ACTION_EMAIL action is applied (finally).
2011-08-11 14:59:01 -04:00
Gregor Maier
7ea0646f30 Make reference to the other script a link 2011-08-11 10:31:36 -07:00
Jon Siwek
351b13d1c8 Fix more bare-mode @load dependency problems 2011-08-11 11:47:12 -05:00
Jon Siwek
521f54c4f0 Fix check_for_unused_event_handlers option.
The format string given to the reporter warning call wasn't printing
the handler names.  Also changed it so that each warning message has
the full context of the warning.
2011-08-11 11:34:42 -05:00
Jon Siwek
59e5fc5633 Merge branch 'master' into topic/jsiwek/reorg-followup
Conflicts:
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/protocols/ssh/main.bro
2011-08-11 10:56:20 -05:00
Jon Siwek
ed281fb634 Fixing some more bare-mode @load dependency issues 2011-08-11 10:49:41 -05:00
Jon Siwek
c3fb0ea035 Reorganizing btest/policy directory to match new scripts/ organization
Addresses #545
2011-08-11 10:43:11 -05:00
Seth Hall
423769c61d Updates to local.bro 2011-08-11 08:26:40 -04:00
Seth Hall
b45c175147 Split out more SMTP analysis functionality. 2011-08-11 08:26:20 -04:00
Seth Hall
d201215359 Added the profiling script. 2011-08-11 01:37:57 -04:00
Seth Hall
9c2273b7a7 Updates for SSH scripts. 2011-08-11 01:35:50 -04:00
Seth Hall
9a06cece67 ConnSize analyzer is turned on by default now. 2011-08-11 01:32:31 -04:00
Seth Hall
6f50e362db Updates for the build system and site local scripts for cluster. 2011-08-11 01:32:05 -04:00
Jon Siwek
2eea193d79 Update default/bare loaded scripts test and test-all-policy coverage. 2011-08-10 20:34:49 -05:00
Jon Siwek
f517d0e0ad Merge branch 'master' into topic/jsiwek/reorg-followup 2011-08-10 19:59:18 -05:00
Jon Siwek
7b07a19cd6 bro scripts generated from bifs now install to $prefix/share/bro/base/
Addresses #545
2011-08-10 19:05:03 -05:00
Jon Siwek
ac257c7a6d Change/fix some cluster script error reporting.
The main script now uses the Reporter::error BIF instead of scheduling
a reporter_error event to report an invalid node name.  The later only
works if the reporter framework is loaded, but the BIF will do the right
thing and use stderr if there's no event handler.

I also @if'd out most of the setup-connections script when the node is
invalid because that's what the cluster/__load__.bro would normally do.
2011-08-10 16:29:52 -05:00
Jon Siwek
9e7934dc32 Normalize some intra-package @loads 2011-08-10 16:06:05 -05:00
Gregor Maier
d0a67dc8bf Tweaking tunnel decapsulation.
Changing names to comply with "Bro Scripting Conventions"
Tweaking documentation.
2011-08-10 13:47:02 -07:00
Jon Siwek
fae54dc8f0 Normalizing base.bro script naming as main.bro 2011-08-10 15:40:28 -05:00
Jon Siwek
47500ceef4 Add a test that checks each individual script can be loaded in bare-mode.
Fixed most @load dependency issues in the process.  The test is still
failing in a "known" way due to hot.conn.bro and scan.bro.

Adressess #545
2011-08-10 15:38:21 -05:00
Gregor Maier
1a565fadfe Merge remote-tracking branch 'origin/topic/jsiwek/autodoc-fixes' into topic/gregor/tunnel 2011-08-10 12:26:13 -07:00
Seth Hall
8e7a76b548 HTTP now uses the extract_filename_from_content_disposition function. 2011-08-10 13:37:58 -04:00
Seth Hall
adc486c673 Merge remote-tracking branch 'origin/topic/jsiwek/smtp-refactor'
- While updating, I did some further work on the branch.

- New function in the base/utils/files for extracting filenames
  from content-dispositions.

- New script for entity excerpt extraction if you aren't interested
  in full extraction.  The data goes a log field too.

- Some renaming and reorganization of types.

- Updated tests to work with new code.

* origin/topic/jsiwek/smtp-refactor:
  Make the doc.coverage test happy.
  SMTP script refactor. (addresses #509)

Conflicts:
	doc/scripts/DocSourcesList.cmake
	policy/protocols/smtp/__load__.bro
	policy/protocols/smtp/base/__load__.bro
2011-08-10 13:34:31 -04:00
Jon Siwek
38f7c5007d Fix reporter using part of the actual message as a format string
When not reporting via events, the final contents of the message buffer
after formatting was being used as a format string to fprintf instead of
writing out the actual string.
2011-08-10 12:28:36 -05:00
Jon Siwek
b783732f7d Workaround for FreeBSD CMake port missing debug flags 2011-08-09 13:34:12 -05:00
Gilbert Clark gc355804@ohio.edu
8feae0b7a7 Test no longer relevant. Need a way to generate and test collisions. 2011-08-09 09:47:47 -07:00
Gilbert Clark gc355804@ohio.edu
e21feb8487 A few minor tweaks to make code less braindead. Fixed-length piece of pool name now only used to hash when determinism is not required; otherwise,
whole pool name is used.  Note that collisions between pool name hashes will lead to sensitivity to initialization order within the UID generator.
2011-08-09 09:44:31 -07:00
Seth Hall
78e69a0bc8 Cluster nodes aren't in fact inherently controllable.
- This @load needs to move to broctl.
2011-08-09 11:15:49 -04:00
Seth Hall
5f61c9bde9 New variable in utils/site for mapping address to defined local subnet.
- Site::local_nets_table[1.2.3.4] might yield "1.2.0.0/16" if that
  subnet is defined in the Site::local_nets variable.
2011-08-09 11:15:07 -04:00
Seth Hall
29425c29e2 Communication framework updates now that communications can be enabled dynamically. 2011-08-09 11:13:36 -04:00