Commit graph

1206 commits

Author SHA1 Message Date
Jon Siwek
69bd46b3af Fix coverage unit tests due to added file analysis scripts. 2013-01-16 12:08:09 -06:00
Bernhard Amann
8f71186bf7 no, you will never guess from where I copied this file... 2013-01-15 16:23:48 -08:00
Bernhard Amann
3415b5fcbe make sqlite support more or less work for logging and input
* add support for &type_column for reading
* add basic tests for logging & input
* clean up a bit
* add support for tables for reading (untested)
2013-01-15 16:01:30 -08:00
Jon Siwek
8695053e27 Disable automatic case fallthrough in switch stmts. Addresses #754.
Case bodies now don't require a "break" statement to prevent fallthrough
to case bodies below.  Empty case bodies generate an error message at
parse-time to help indicate the absence of automatic fallthrough; to
associate multiple values with a case, use "case 1, 2:" instead of
"case 1: case 2:".
2013-01-11 11:43:15 -06:00
Scott Runnels
546be58ded Merge remote-tracking branch 'origin/master' into topic/documentation 2013-01-09 13:32:00 -05:00
Scott Runnels
c453c228cb Iteration over vectors. 2013-01-08 15:31:56 -05:00
Scott Runnels
7d583b6b78 Vector declarations and explanations, including btests 2013-01-08 14:47:39 -05:00
Jon Siwek
8b46bbb1c0 Change substring index notation to use a colon (addresses #422).
String slice notation is written as `s[1:2]` instead of `s[1, 2]`
because the later is ambiguous with composite index types.
2013-01-07 13:29:05 -06:00
Seth Hall
89bc65f23c Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2013-01-04 20:49:37 -05:00
Scott Runnels
b8c31458ff Local variables. Baselines and data_type_local.bro btest-able script. 2013-01-03 17:03:45 -05:00
Robin Sommer
5e3c286490 Merge remote-tracking branch 'origin/topic/jsiwek/string-indexing'
* origin/topic/jsiwek/string-indexing:
  Add array-style index accessor for strings.  Addresses #422.

Closes #422.
2012-12-20 17:43:26 -08:00
Robin Sommer
da90976170 Merge remote-tracking branch 'origin/topic/matthias/opaque'
* origin/topic/matthias/opaque:
  Add new unit test for opaque serialization.
  Migrate entropy testing to opaque.
  C++ify RandTest.*
  Fix a hard-to-spot bug.
  Use more descriptive error message.
  Fix the fix :-/.
  Fix initialization of hash values.
  Be clearer about delegation.
  Implement serialization of opaque types.
  Update hash BiF documentation.
  Migrate free SHA* functions to SHA*Val::digest().
  Add missing type name that caused failing tests.
  Update base scripts and unit tests.
  Simplify hash function BiFs.
  Add support for opaque hash values.
  Adapt BiF & Bro parser to handle opaque types.
  More lexer/parser work.
  Implement equivalence relation for opaque types.
  Support basic serialization of opaque.
  Add opaque type to lexer, parser, and BroType.

Closes #925

Conflicts:
	aux/broccoli
2012-12-20 16:30:22 -08:00
Robin Sommer
037085605c Merge remote-tracking branch 'origin/topic/jsiwek/ticket-923'
* origin/topic/jsiwek/ticket-923:
  Improve error for invalid use of types as values (addresses #923).

Close 923.
2012-12-20 15:21:27 -08:00
Robin Sommer
9301589219 Merge remote-tracking branch 'origin/topic/jsiwek/switch-statement'
* origin/topic/jsiwek/switch-statement:
  Finish implementation of script-layer switch statement.  Addresses #754.

Closes #754.
2012-12-20 15:13:30 -08:00
Jon Siwek
55c515d50a Add array-style index accessor for strings. Addresses #422.
The index expression can take up to two indices for the start and end
index of the substring to return (e.g. "mystring[1,3]").  Negative
indices are allowed, with -1 representing the last character in the
string.  The indexing is not cyclic -- if the starting index is >= the
length of the string an empty string is returned, and if the ending
index is >= the length of the string then it's interpreted as the last
index of the string.  Assigning to substrings accessed like this isn't
allowed.
2012-12-20 17:13:06 -06:00
Robin Sommer
ca8a8b09fa Merge remote-tracking branch 'origin/topic/jsiwek/ticket-730'
* origin/topic/jsiwek/ticket-730:
  Fix a case where c$resp$size is misrepresented.  Addresses #730.

Closes #730.
2012-12-20 14:53:43 -08:00
Jon Siwek
939a64b73a Finish implementation of script-layer switch statement. Addresses #754.
They behave like C-style switches except case labels can be comprised
of multiple literal constants delimited by commas.  Only atomic types
are allowed for now.  Case label bodies that don't execute a "return"
or "break" statement will fall through to subsequent cases.  A default
case label is allowed.
2012-12-20 12:49:50 -06:00
Scott Runnels
cce5565d63 Merge remote-tracking branch 'origin/master' into topic/documentation 2012-12-19 23:20:52 -05:00
Scott Runnels
7dc4fd34d3 Merge remote-tracking branch 'origin/master' into topic/documentation 2012-12-19 22:54:23 -05:00
Jon Siwek
98663fd534 Fix return value of hook calls that have no handlers.
For this case, the return value is always true.
2012-12-18 15:31:50 -06:00
Jon Siwek
4a09c12882 Fix to_port() BIF for port strings with a port number of zero. 2012-12-18 15:08:18 -06:00
Jon Siwek
2f0c698ed5 Improve error for invalid use of types as values (addresses #923).
This scripting error can now generate an error message at parse-time
instead of run-time and also includes location information.
2012-12-18 14:31:39 -06:00
Seth Hall
69b7ce12d2 API updates for metrics framework.
- Removed default logging.  Now a function is available for the new
  $period_finished filter field to get the same behavior for logging
  named Metrics::write_log.

- Added index rollups for getting multiple metrics result values
  as the same time.
2012-12-18 01:08:59 -05:00
Seth Hall
69030fdff3 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-17 10:00:34 -05:00
Jon Siwek
81ae68be16 Fix a case where c$resp$size is misrepresented. Addresses #730.
That field is based on TCP sequence numbers and on seeing a SYN followed
by a failed RST injection response, the initial sequence number tracked
the value in the injection (most likely zero) instead of value in
subsequent SYN response.  This could make c$resp$size be set to large
values when it's not really.

Also removed some dead code paths.
2012-12-14 17:08:50 -06:00
Robin Sommer
ea6b62f586 Merge remote-tracking branch 'origin/topic/jsiwek/const'
* origin/topic/jsiwek/const:
  Make const variables actually constant.  Addresses #922.

Closes #922.
2012-12-14 14:56:37 -08:00
Robin Sommer
7a2901ec6b Fixing checksums in test trace because Bro now reports them. :-) 2012-12-14 14:48:16 -08:00
Matthias Vallentin
69d8d29fbd Add new unit test for opaque serialization.
One Bro begins a computation, another finishes it.

(This commit also fixes a problem with the serialization OpaqueVals.)
2012-12-14 13:05:31 -08:00
Matthias Vallentin
b9d05f56d0 Migrate entropy testing to opaque. 2012-12-13 19:28:19 -08:00
Jon Siwek
290c2a0b4d Make const variables actually constant. Addresses #922.
Both local and global variables declared with "const" could be modified,
but now expressions that would modify them should generate an error
message at parse-time.
2012-12-13 15:05:29 -06:00
Matthias Vallentin
3ba85567f4 Merge branch 'master' into topic/matthias/opaque
Conflicts:
	aux/broctl
2012-12-13 11:03:17 -08:00
Jon Siwek
f6d5da423c Fix record constructors in table initializer indices. Addresses #660.
For an index expression list, ListExpr::InitVal() passed the TypeList
to Expr::InitVal() for each expression element in the list instead of
the type for that element.  This made RecordConstructorExpr::InitVal()
complain since it expects a RecordType and not a TypeList with a
RecordType element as an argument.  In most other cases, Expr::InitVal()
worked because check_and_promote() "flattens" the list to a single type.
2012-12-12 14:52:08 -06:00
Matthias Vallentin
816965f3c7 Merge remote-tracking branch 'origin/master' into topic/matthias/opaque 2012-12-11 16:32:01 -08:00
Matthias Vallentin
30bab14dbf Update base scripts and unit tests. 2012-12-11 16:26:17 -08:00
Jon Siwek
43ed437daa Trick for parallelizing input framework unit tests.
Instead of loading listen.bro to block until files are read, just read
a pcap file in pseudo-realtime.  Seems to work well.
2012-12-11 17:06:54 -06:00
Jon Siwek
aff5898442 Maybe fix reliability of a unit test that relies on when statements. 2012-12-11 16:26:01 -06:00
Robin Sommer
b867333c2e Merge remote-tracking branch 'origin/topic/jsiwek/gtp'
* origin/topic/jsiwek/gtp:
  Change binpac exceptions in AYIYA/GTP analyzers to do protocol_violation
  Add GTP tunnel analyzer memory leak unit test.
  Add GPRS Tunnelling Protocol (GTPv1) decapsulation.

Closes #690.
2012-12-10 14:48:18 -08:00
Robin Sommer
e2d20cb7bc Changing the HTTP parser to accept methods that align with the RFC. 2012-12-07 19:42:03 -08:00
Seth Hall
dda36672ac Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-06 11:07:35 -05:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
2012-12-05 16:56:54 -08:00
Robin Sommer
177c014cb7 Merge remote-tracking branch 'vlad/topic/vladg/http-verbs'
* vlad/topic/vladg/http-verbs:
  A test for HTTP methods, including some horribly illegal requests.
  Remove hardcoded HTTP verbs from the analyzer (#741)

I added a "bad_HTTP_request" weird for HTTP request lines that don't
have more than a single word.

Closes #741.
2012-12-05 15:27:42 -08:00
Bernhard Amann
3973cb1075 Merge remote-tracking branch 'origin/fastpath' into fastpath 2012-12-05 12:42:02 -08:00
Bernhard Amann
d367e227c1 ok, this one is a bit... embarrassing.
Delete the correct entry in case of error. Fixes a segfault when the faulty
data is of type string and not the last field of the input...
2012-12-05 12:40:00 -08:00
Jon Siwek
f403e537ec Fix segfault: uninitialized identifiers w/ &synchronized (addresses #66)
Synchronization of state between connecting peers now skips over
identifiers that aren't initialized with a value yet.  If they're
assigned a value later, that will be synchronized like usual.
2012-12-05 12:36:09 -06:00
Jon Siwek
32239ea633 Bad record constructor initializers now give an error (addresses #34).
As opposed to a segfault.
2012-12-04 16:29:23 -06:00
Jon Siwek
75278af8a1 Invalid vector indices now generate error message (addresses #24).
The error/behavior is the same as accessing tables at invalid indices.
2012-12-04 15:22:16 -06:00
Jon Siwek
f7440375f1 Interpreter exceptions occurring in "when" blocks are now handled.
The scripting error that caused the exception is still reported, but
it no longer causes Bro to terminate.  Addresses #779
2012-12-04 12:38:09 -06:00
Seth Hall
3af4517e2a Adding an $end time for result values to measure the length of time a measurement took. 2012-12-04 11:04:01 -05:00
Seth Hall
d61d175a04 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-04 00:17:43 -05:00
Robin Sommer
63d43e6545 Renaming ASCII writer filter option 'only_single_header_row' to 'tsv'.
Also clarifying usage.

Closes #912.
2012-12-03 14:40:38 -08:00