Commit graph

609 commits

Author SHA1 Message Date
Johanna Amann
6d612ced3d Mark one-parameter constructors as explicit & use override where possible
This commit marks (hopefully) ever one-parameter constructor as explicit.

It also uses override in (hopefully) all circumstances where a virtual
method is overridden.

There are a very few other minor changes - most of them were necessary
to get everything to compile (like one additional constructor). In one
case I changed an implicit operation to an explicit string conversion -
I think the automatically chosen conversion was much more convoluted.

This took longer than I want to admit but not as long as I feared :)
2018-03-27 07:17:32 -07:00
Jon Siwek
d6d7f33f5c Clean up PortManager class, mark PortVal ctors deprecated.
Moved PortVal ctors back to public API, but deprecated, just in
case it helps give any external code a chance to adapt.
2017-12-12 11:35:55 -06:00
Jon Siwek
1e4964de77 Preallocate all possible PortVals.
The performance benefit is small (maybe ~1% at most), however, it's a
trivial change without downsides.
2017-12-11 15:29:28 -06:00
Robin Sommer
3adad5e19a Fix some Coverity warnings. 2016-08-02 11:38:29 -07:00
Robin Sommer
b698cfc2ce Fixing memory leak in changed table expiration code. 2016-06-15 09:09:27 -07:00
Robin Sommer
9da02ecae4 Merge branch 'topic/jgras/expire-redef' of https://github.com/J-Gras/bro
Extended error handling a bit, and increased serialization
data format version.
2016-06-14 17:22:25 -07:00
Jan Grashoefer
8a87055fcc Fixed table expiration evaluation.
The expiration attribute expression is now evaluated for every use. Thus
later adjustments of the value (e.g. by redefining a const) will now
take effect. Values less than 0 will disable expiration.
2016-06-13 21:01:46 +02:00
Robin Sommer
35686fb93a Fixing Coverity warning.
Addresses CID 1356116.
2016-05-29 11:02:39 -07:00
Robin Sommer
4f9cb6912a Fix for a table refering to a expire function that's not defined.
I was hoping to report this right at startup through a static check
but turns out we don't have the right machinery in place for that.
That would need to be done after the AST has been finalized, but our
AST traversal code can't iterate over types. So instead I've changed
this so that it's still being reported at runtime but at least
doesn't crash Bro anymore.

Closes BIT-1597.
2016-05-23 12:48:34 -07:00
Robin Sommer
50945a6359 Fixing a few Coverity warnings. 2016-05-23 08:25:11 -07:00
Johanna Amann
0ac1a81388 Merge branch 'topic/johanna/filter_subnet_table' of https://github.com/J-Gras/bro into topic/johanna/filter_subnet_table
* 'topic/johanna/filter_subnet_table' of https://github.com/J-Gras/bro:
  Fixed &read_expire for subnet-indexed tables
  Added &read_expire testcase for subnet tables

Includes a bit of refactoring of commit code & code related to the
feature.
2016-03-17 21:26:57 -07:00
Jan Grashoefer
d5034ccc19 Fixed &read_expire for subnet-indexed tables 2016-03-17 19:56:25 +01:00
Johanna Amann
a6cb85d86a Add filter_subnet_table bif
This bif works similar to the matching_subnet bif. The difference is
that, instead of returning a vector of the subnets that match, we return
a filtered view of the original set/table only containing the changed
subnets.

This commit also fixes a small bug in TableVal::UpdateTimestamp
(ReadOperation only has to be called when LoggingAccess() is true).
2016-03-16 15:50:13 -07:00
Robin Sommer
3957091e1b Renaming config.h to bro-config.h.
A couple times now I had this conflicting with files of the same name
in other projects.
2015-07-28 11:57:04 -07:00
Jon Siwek
bb15754427 BIT-1373: fix vector index assignment ref count bug. 2015-04-21 10:05:38 -05:00
Jon Siwek
ff61737212 Simplify a conditional with equivalent branches. 2014-09-02 16:29:52 -05:00
Jon Siwek
bfaa082aee Fix a reference counting bug in ListVal ctor. 2014-06-25 10:44:57 -05:00
Robin Sommer
ba229f798d Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix use-after-free in some cases of reassigning a table index.
2014-06-10 18:17:04 -07:00
Jon Siwek
e616554ab8 Fix use-after-free in some cases of reassigning a table index.
Specifically observed when redef'ing the same index of a table that uses
subnets as indices, though the bug seems like it applies more generally
to anytime TableVal::Assign is provided with just the HashKey parameter
and not the index Val.

Addresses BIT-1202.
2014-06-10 13:38:32 -05:00
Jon Siwek
782615e9dd Remove unused Val::attribs member. 2014-04-23 10:44:47 -05:00
Robin Sommer
806851a21e Don't include locations into serialization when cloning values.
This should save some memory, see BIT-1161.
2014-03-30 20:20:06 +02:00
Jon Siwek
70131b5c84 Refactor SerializationFormat::EndWrite and ChunkedIO::Chunk mem mgmt.
SerializationFormat::EndWrite now transfers ownership of the buffer
to the caller instead of doing a memcpy.

ChunkedIO::Chunk is no longer a POD type, hopefully the ctor/dtor
make it easier to manage its associated memory.  It also now
tracks how to deallocate its buffer (i.e. delete vs. free).
2014-03-18 14:42:38 -05:00
Robin Sommer
7774af7518 Merge remote-tracking branch 'origin/topic/bernhard/ticket-1144'
* origin/topic/bernhard/ticket-1144:
  Allow iterating over bif functions with result type vector of any.

BIT-1144 #merged
2014-03-03 16:35:00 -08:00
Bernhard Amann
b3bd509b3f Allow iterating over bif functions with result type vector of any.
This changes the internal type that is used to signal that a vector
is unspecified from any to void.

I tried to verify that the behavior of Bro is still the same. After
a lot of playing around, I think everything still should worl as before.

However, it might be good for someone to take a look at this.

addresses BIT-1144
2014-02-25 15:30:29 -08:00
Bernhard Amann
09c2491896 Remove unused and potentially unsafe function ListVal::IncludedInString 2014-02-24 08:14:34 -08:00
Jon Siwek
54ebe98458 Fix table &default reference counting for record ctor expressions. 2013-12-05 14:23:32 -06:00
Jon Siwek
7e95755ce5 Fix record coercion tolerance of optional fields.
There were cases where coercing a record value with an uninitialized
field could cause a null pointer dereference even though the field
can validly be unset since it has &optional.
2013-10-23 11:37:23 -05:00
Jon Siwek
b828a6ddc7 Review usage of Reporter::InternalError, addresses BIT-1045.
Replaced some with InternalWarning or InternalAnalyzerError, the later
being a new method which signals the analyzer to not process further
input.  Some usages I just removed if they didn't make sense or clearly
couldn't happen.  Also did some minor refactors of related code while
reviewing/exploring ways to get rid of InternalError usages.

Also, for TCP content file write failures there's a new event:
"contents_file_write_failure".
2013-10-10 14:45:06 -05:00
Jon Siwek
775ec6795e Fix uninitialized (or unused) fields. 2013-09-27 10:13:52 -05:00
Jon Siwek
64f3bef96d Remove logically dead code. 2013-09-25 13:37:46 -05:00
Jon Siwek
daf5d0d098 Improve return value checking and error handling. 2013-09-24 17:38:22 -05:00
Jon Siwek
e4e7c78925 Remove unused variable assignments, dead code. 2013-09-23 16:57:31 -05:00
Jon Siwek
a316878d01 Add checks to avoid improper negative values use. 2013-09-17 16:42:48 -05:00
Jon Siwek
33a7e96268 Fix another function val reference counting bug.
Now that functions get unref'd in the val dtor in order to free mem of
unserialized functions, it's important to ref a function when creating a
val from a pre-existing function so it's not prematurely free'd.
2013-09-13 12:51:24 -05:00
Jon Siwek
c3a4454892 Fix significant memory leak.
Particularly, unserializing a function is frequent and leaked.
2013-09-10 16:10:10 -05:00
Jon Siwek
0b5a75a463 Fix mem leak in failing table initialization case.
Specifically that case looked like tables that have a compound index
and an element assignment fails due to a type mismatch.
2013-09-05 16:09:52 -05:00
Jon Siwek
75d469532c Fix mem leak when unserializing table entry fails.
Shouldn't happen in practice.
2013-09-05 15:40:10 -05:00
Robin Sommer
eb637f9f3e Merge remote-tracking branch 'origin/master' into topic/robin/plugins
Thanks to git this merge was less troublesome that I was afraid it
would be. Not all tests pass yet though (and file hashes have changed
unfortunately).

Conflicts:
	cmake
	doc/scripts/DocSourcesList.cmake
	scripts/base/init-bare.bro
	scripts/base/protocols/ftp/main.bro
	scripts/base/protocols/irc/dcc-send.bro
	scripts/test-all-policy.bro
	src/AnalyzerTags.h
	src/CMakeLists.txt
	src/analyzer/Analyzer.cc
	src/analyzer/protocol/file/File.cc
	src/analyzer/protocol/file/File.h
	src/analyzer/protocol/http/HTTP.cc
	src/analyzer/protocol/http/HTTP.h
	src/analyzer/protocol/mime/MIME.cc
	src/event.bif
	src/main.cc
	src/util-config.h.in
	testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
	testing/btest/Baseline/istate.events-ssl/receiver.http.log
	testing/btest/Baseline/istate.events-ssl/sender.http.log
	testing/btest/Baseline/istate.events/receiver.http.log
	testing/btest/Baseline/istate.events/sender.http.log
2013-05-16 17:58:48 -07:00
Jon Siwek
6a7a242db9 Table lookups return copy of non-const &default vals (addresses #981).
This prevents unintentional modifications to the &default value itself.
2013-05-03 11:22:15 -05:00
Jon Siwek
7069f679c3 Fix record coercion for default inner record fields (addresses #973). 2013-04-23 09:57:55 -05:00
Robin Sommer
af1809aaa3 First prototype of new analyzer framework.
This is a larger internal change that moves the analyzer
infrastructure to a more flexible model where the available analyzers
don't need to be hardcoded at compile time anymore. While currently
they actually still are, this will in the future enable external
analyzer plugins. For now, it does already add the capability to
dynamically enable/disable analyzers from script-land, replacing the
old Analyzer::Available() methods.

There are three major parts going into this:

    - A new plugin infrastructure in src/plugin. This is independent
      of analyzers and will eventually support plugins for other parts
      of Bro as well (think: readers and writers). The goal is that
      plugins can be alternatively compiled in statically or loadead
      dynamically at runtime from a shared library. While the latter
      isn't there yet, there'll be almost no code change for a plugin
      to make it dynamic later (hopefully :)

    - New analyzer infrastructure in src/analyzer. I've moved a number
      of analyzer-related classes here, including Analyzer and DPM;
      the latter now renamed to Analyzer::Manager. More will move here
      later. Currently, there's only one plugin here, which provides
      *all* existing analyzers. We can modularize this further in the
      future (or not).

    - A new script interface in base/framework/analyzer. I think that
      this will eventually replace the dpm framework, but for now
      that's still there as well, though some parts have moved over.

I've also remove the dpd_config table; ports are now configured via
the analyzer framework. For exmaple, for SSH:

    const ports = { 22/tcp } &redef;

    event bro_init() &priority=5
        {
        ...
        Analyzer::register_for_ports(Analyzer::ANALYZER_SSH, ports);
        }

As you can see, the old ANALYZER_SSH constants have more into an enum
in the Analyzer namespace.

This is all hardly tested right now, and not everything works yet.
There's also a lot more cleanup to do (moving more classes around;
removing no longer used functionality; documenting script and C++
interfaces; regression tests). But it seems to generally work with a
small trace at least.

The debug stream "dpm" shows more about the loaded/enabled analyzers.

A new option -N lists loaded plugins and what they provide (including
those compiled in statically; i.e., right now it outputs all the
analyzers).

This is all not cast-in-stone yet, for some things we need to see if
they make sense this way. Feedback welcome.
2013-03-26 11:05:38 -07:00
Bernhard Amann
8f259f866d change vector assignment operator and remove unnecessary argument (expr) 2013-03-06 14:08:06 -08:00
Robin Sommer
da90976170 Merge remote-tracking branch 'origin/topic/matthias/opaque'
* origin/topic/matthias/opaque:
  Add new unit test for opaque serialization.
  Migrate entropy testing to opaque.
  C++ify RandTest.*
  Fix a hard-to-spot bug.
  Use more descriptive error message.
  Fix the fix :-/.
  Fix initialization of hash values.
  Be clearer about delegation.
  Implement serialization of opaque types.
  Update hash BiF documentation.
  Migrate free SHA* functions to SHA*Val::digest().
  Add missing type name that caused failing tests.
  Update base scripts and unit tests.
  Simplify hash function BiFs.
  Add support for opaque hash values.
  Adapt BiF & Bro parser to handle opaque types.
  More lexer/parser work.
  Implement equivalence relation for opaque types.
  Support basic serialization of opaque.
  Add opaque type to lexer, parser, and BroType.

Closes #925

Conflicts:
	aux/broccoli
2012-12-20 16:30:22 -08:00
Jon Siwek
939a64b73a Finish implementation of script-layer switch statement. Addresses #754.
They behave like C-style switches except case labels can be comprised
of multiple literal constants delimited by commas.  Only atomic types
are allowed for now.  Case label bodies that don't execute a "return"
or "break" statement will fall through to subsequent cases.  A default
case label is allowed.
2012-12-20 12:49:50 -06:00
Matthias Vallentin
69d8d29fbd Add new unit test for opaque serialization.
One Bro begins a computation, another finishes it.

(This commit also fixes a problem with the serialization OpaqueVals.)
2012-12-14 13:05:31 -08:00
Matthias Vallentin
238cffaac4 Implement serialization of opaque types.
This means that, conceptually, incremental hash computations now can start at
one node and finish at another one.
2012-12-12 14:44:28 -08:00
Matthias Vallentin
816965f3c7 Merge remote-tracking branch 'origin/master' into topic/matthias/opaque 2012-12-11 16:32:01 -08:00
Matthias Vallentin
624003f036 Add support for opaque hash values. 2012-12-11 16:25:11 -08:00
Robin Sommer
d4792dc7fe Merge remote-tracking branch 'origin/topic/jsiwek/table-init-container-ctors'
* origin/topic/jsiwek/table-init-container-ctors:
  Add test of record() constructor to table initializer unit test.
  Fix table(), set(), vector() constructors in table initializer lists.

Closes #5.
2012-12-03 14:10:17 -08:00
Jon Siwek
a0590b2140 Fix table(), set(), vector() constructors in table initializer lists.
Also adds type checking of yield values to table() constructor and
fixes the type checking of yield values in vector() constructor.

Addresses #5.
2012-11-28 14:19:48 -06:00