Commit graph

413 commits

Author SHA1 Message Date
Robin Sommer
f1e132cd1a Adding missing script. 2011-12-07 10:28:56 -08:00
Robin Sommer
3c2fa085d4 Adapting diff-all so that it expands globs in both current and
baseline directory.

This way, it now spots if a Baseline file isn't produced anymore.

Closes #677.
2011-12-07 10:03:44 -08:00
Robin Sommer
f59c766858 Portability fix for new patch. 2011-12-02 17:00:08 -08:00
Robin Sommer
1e45910b25 Merge remote-tracking branch 'origin/topic/jsiwek/bro-log-suffix'
* origin/topic/jsiwek/bro-log-suffix:
  Teach LogWriterAscii to use BRO_LOG_SUFFIX env. var. (addresses #704)

Closes #704.
2011-12-02 16:52:18 -08:00
Robin Sommer
03b7ebfb5b Merge remote-tracking branch 'origin/topic/jsiwek/fix-dns-double-free'
* origin/topic/jsiwek/fix-dns-double-free:
  Fix double-free of DNS_Mgr_Request object (addresses #661)

Closes #661.
2011-12-01 16:40:07 -08:00
Robin Sommer
df3ae4b30d Merge remote-tracking branch 'origin/topic/jsiwek/remote-log-peer'
* origin/topic/jsiwek/remote-log-peer:
  Add a remote_log_peer event which contains an event_peer record param.

Closes #493.
2011-12-01 16:02:11 -08:00
Jon Siwek
edc0a451f8 Teach LogWriterAscii to use BRO_LOG_SUFFIX env. var. (addresses #704) 2011-12-01 16:18:56 -06:00
Jon Siwek
0c8b5a712d Add a remote_log_peer event which contains an event_peer record param.
Addresses #493.
2011-12-01 14:07:08 -06:00
Jon Siwek
2913a990c4 Merge branch 'master' into fastpath 2011-12-01 09:12:42 -06:00
Jon Siwek
4444c56a94 Fix double-free of DNS_Mgr_Request object (addresses #661)
In DNS::Resolve, they could be deleted once from where they were
stored in the nb_dns_info cookie and once again from where they
were stored in the DNS_Mgr::requests list.  Before commit
bd9c937236, they were only deleted
from the requests list, so this commit reverts to that behavior
without any leaks being reported by the core/leaks tests.
2011-11-30 13:31:54 -06:00
Jon Siwek
9be652f8ff Rearrange packet filter and dpd documentation. 2011-11-30 10:13:20 -06:00
Robin Sommer
ebd15cf12e Fixing ASCII logger to escape the unset-field place-holder if written
out literally.
2011-11-29 17:01:47 -08:00
Jon Siwek
305621672f Teach Broxygen the .. bro:see:: directive 2011-11-19 07:19:57 -06:00
Jon Siwek
5227eb73c8 Teach Broxygen :bro:see: role for referencing any identifier in Bro domain. 2011-11-17 16:55:51 -06:00
Robin Sommer
7696c8b365 Merge remote-tracking branch 'origin/topic/jsiwek/require-libmagic-libz'
* origin/topic/jsiwek/require-libmagic-libz:
  Promote libz and libmagic to required dependencies.

Conflicts:
	doc/quickstart.rst

Closes #674
2011-11-15 17:08:24 -08:00
Robin Sommer
8de3614afa Merge remote-tracking branch 'origin/topic/jsiwek/custom-b64-alphabet'
* origin/topic/jsiwek/custom-b64-alphabet:
  Add decode_base64_custom BiF to allow alternate base64 alphabets.

Simplified the code a little bit.

Closes #670.
2011-11-15 17:03:23 -08:00
Seth Hall
d14349a6f8 Merge remote-tracking branch 'origin/master' into fastpath 2011-11-14 16:06:44 -05:00
Seth Hall
b12d2c768e Tiny bugfix for http file extraction along with test. 2011-11-14 15:24:15 -05:00
Jon Siwek
5865bf3850 Add decode_base64_custom BiF to allow alternate base64 alphabets.
Addresses #670
2011-11-11 13:48:11 -06:00
Jon Siwek
d750c3ba74 Promote libz and libmagic to required dependencies. 2011-11-11 12:39:00 -06:00
Robin Sommer
9aef0c0f5a Fixing packet filter test.
Adapting the IPv6 one as well, though I believe that's already
broken anyway ...
2011-11-03 17:42:06 -07:00
Robin Sommer
5b79d2b15f Baseline updates.
Also a small tweak to the genDocSourcesList.sh as I was seein
non-consistent output order.
2011-10-26 15:27:03 -07:00
Seth Hall
098134d2fa Updated unit test baselines.
- Some (all?) of the DNS servers aren't being detected
  anymore because the test tracefile isn't long enough.
  Logging servers is delayed a 5 minutes in case a better
  result comes in.
2011-10-26 09:36:04 -04:00
Robin Sommer
4cdff8ffd8 Extending .gitignore other external test-suites as well. 2011-10-25 16:33:17 -07:00
Seth Hall
3d6d75b647 Updating test baselines for recent changes. 2011-10-25 14:51:32 -04:00
Seth Hall
320739e183 Updated/fixed MSIE version parsing in the software framework. 2011-10-25 09:30:06 -04:00
Robin Sommer
c8dfdb4492 Merge remote-tracking branch 'origin/topic/robin/interpreter-exceptions'
* origin/topic/robin/interpreter-exceptions:
  Adding test for new error handling.
  Experimental code to better handle interpreter errors.

This seems to work fine and it catches some potentially nasty crashes
so I'm merging it in even though it's not the final word on error
handling yet. #646 tracks the work scheduled for later.
2011-10-21 10:35:32 -07:00
Jon Siwek
24f3eb7fc2 Fix test failure due to some platforms joining stderr/stdout differently. 2011-10-17 13:53:10 -05:00
Jon Siwek
556b88e322 Tweaking notice suppression disable and notice policy order tests.
They should be less sensitive to script-layer changes now.
2011-10-14 10:47:32 -05:00
Robin Sommer
c81d428256 Adding test for new error handling. 2011-10-09 20:41:55 -07:00
Robin Sommer
bd9c937236 Fixing DNS memory leaks.
Some of the changes only clean up at termination to make perftools
happt, but there were some "real" leaks as well.

This fixes all DNS leaks I could reproducem, including most likely
what's reported in #534. Closing #534.

I'm also adding a new btest subdir core/leaks with tests requiring
perftools support. These don't compare against base lines but abort
whenever perftools reports a leak (with stack information to track it
down). Right now, these are passing.
2011-10-09 17:00:57 -07:00
Seth Hall
0803df2e14 Changed communication option from listen_encrypted to listen_ssl.
- Robin pointed out that SSL is providing authentication
  as well as encryption so listen_ssl is a more
  proper variable name.
2011-10-07 23:57:08 -04:00
Seth Hall
6d67f7830d Added to the likely_server_ports set for protocols with analyzers.
- Updated some tests since Bro is getting the direction
  correct now.

- Updated BPF filter test since I added a few ports to IRC
  as well.
2011-10-07 13:44:28 -04:00
Seth Hall
da9b8cc283 Modification to the Communication framework API.
- Simplified the communication API and made it easier to change
  to encrypted connections by not having separate variables to
  define encrypted and unencrypted ports.

- Now, to enable listening without configuring nodes just
  load the frameworks/communication/listen script.

- If encrypted listening is desired set the following:
	redef Communication::listen_encrypted=T;

- Accompanying test updates.
2011-10-07 13:29:26 -04:00
Robin Sommer
1ae94aae33 Baseline updates for conn compressor change. 2011-10-07 08:39:44 -07:00
Robin Sommer
9af6c183d2 Updating baselines for recent commits. 2011-10-06 19:04:26 -07:00
Robin Sommer
ea3dffa83c Fixing non-portable regexp match in test.
Also adding site/ to scripts excluded from bare mode check.
2011-10-06 19:04:03 -07:00
Jon Siwek
1cc675e30f Make CompHash computation/recovery for functions deterministic
Functions are now assigned a unique integer on construction which
CompositeHash can base hashes on.  Recovery then just involves
looking up the function pointer associated with that unique number.
2011-10-06 14:29:03 -05:00
Robin Sommer
fe77d385e0 Merge remote-tracking branch 'origin/topic/jsiwek/broctl-tweaks'
* origin/topic/jsiwek/broctl-tweaks:
  Consolidating some node-specific functionality from scripts in broctl repo.
2011-10-05 16:54:39 -07:00
Jon Siwek
88e089864b Consolidating some node-specific functionality from scripts in broctl repo. 2011-10-05 16:33:40 -05:00
Jon Siwek
357341c887 Changing some external testing scripts.
- The absolute path canonifier was overzealously canonifying relevant
  log fields, so it's no longer generally applied to diffing all
  baselines.  I don't think there's any logs that require local
  filesystem path names that aren't already tested by a unit test,
  but if any show up in the future, they can be canonified on a
  case-by-case basis.

- Removed some logs from being diff'd in the diff-all script
  because they're either already covered by a unit test
  (load_scripts.log) or because of difficulty/maintainenance
  tradeoff (prof.log).

Baselines for the external bro-testing repo still need updating.
2011-10-04 10:51:41 -05:00
Jon Siwek
8099640bc3 Fix the way HTTP tests were checking for weirds 2011-09-30 08:21:33 -05:00
Jon Siwek
71dc6b6de3 Fixing unit tests. 2011-09-30 07:53:23 -05:00
Seth Hall
012d8cfc5f Fix for shutdown bug in http scripts.
- The bug was introduced with the recent 1xx update.

- I updated some tests that seemed be written wrong.
2011-09-29 21:25:00 -04:00
Seth Hall
36dbaa5b92 Loaded scripts is indented with spaces now and makes more sense to look at.
- Updated a test to make it pass again.
2011-09-29 15:53:54 -04:00
Robin Sommer
4d6a90ce89 Merge remote-tracking branch 'origin/topic/jsiwek/http-1xx-replies'
* origin/topic/jsiwek/http-1xx-replies:
  Change logging of HTTP 1xx responses to occur in their own columns.
  Fix handling of HTTP 1xx response codes (addresses #411).
2011-09-28 17:10:40 -07:00
Robin Sommer
a84a422240 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Various unit test cleanup.
2011-09-28 16:54:23 -07:00
Jon Siwek
7af3977a50 Change logging of HTTP 1xx responses to occur in their own columns.
Instead of as entirely new log lines (addresses #411).
2011-09-27 14:15:23 -05:00
Jon Siwek
a71ab223c4 Various unit test cleanup.
Updated README and collected coverage-related tests in a common dir.

There are still coverage failures resulting from either the following
scripts not being @load'd in the default bro mode:

base/frameworks/time-machine/notice.bro
base/protocols/http/partial-content.bro
base/protocols/rpc/main.bro

Or the following result in errors when @load'd:

policy/protocols/conn/scan.bro
policy/hot.conn.bro

If these are all scripts-in-progress, can we move them all to live
outside the main scripts/ directory until they're ready?
2011-09-27 12:41:30 -05:00
Jon Siwek
64e821624b Fix handling of HTTP 1xx response codes (addresses #411).
Changed the parser to not treat 1xx response codes as a final answer
to an unanswered request -- a later response is still expected.

The scripting layer will also not finish a request-reply pair when
seeing 1xx's, instead it logs both the 1xx and final response messages
with associated information of the current request as they're seen.
2011-09-26 17:37:29 -05:00