Commit graph

2206 commits

Author SHA1 Message Date
Robin Sommer
ea6b62f586 Merge remote-tracking branch 'origin/topic/jsiwek/const'
* origin/topic/jsiwek/const:
  Make const variables actually constant.  Addresses #922.

Closes #922.
2012-12-14 14:56:37 -08:00
Robin Sommer
7a2901ec6b Fixing checksums in test trace because Bro now reports them. :-) 2012-12-14 14:48:16 -08:00
Robin Sommer
3438a8d8f9 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Trick for parallelizing input framework unit tests.
  Maybe fix reliability of a unit test that relies on when statements.
  Remove unused attributes
2012-12-12 14:26:45 -08:00
Robin Sommer
b867333c2e Merge remote-tracking branch 'origin/topic/jsiwek/gtp'
* origin/topic/jsiwek/gtp:
  Change binpac exceptions in AYIYA/GTP analyzers to do protocol_violation
  Add GTP tunnel analyzer memory leak unit test.
  Add GPRS Tunnelling Protocol (GTPv1) decapsulation.

Closes #690.
2012-12-10 14:48:18 -08:00
Robin Sommer
e8482fef99 Updating CHANGES and VERSION. 2012-12-08 12:05:32 -08:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
2012-12-05 16:56:54 -08:00
Robin Sommer
90fc5c97e5 Reporting warnings if kill/waitpid fail in communication system. Also
replace bzero with memset(). Patches from Bill Parker.
2012-12-05 15:50:15 -08:00
Robin Sommer
4877f8344d Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  ok, this one is a bit... embarrassing.
  Fix segfault: uninitialized identifiers w/ &synchronized (addresses #66)
  Bad record constructor initializers now give an error (addresses #34).
  Invalid vector indices now generate error message (addresses #24).
  Bump CPack RPM package requirement to python >= 2.6.0.
  Interpreter exceptions occurring in "when" blocks are now handled.
2012-12-05 14:39:26 -08:00
Robin Sommer
05e6289719 Catching out-of-memory in patricia tree code.
Based on patch by Bill Parker.
2012-12-03 15:42:43 -08:00
Robin Sommer
63d43e6545 Renaming ASCII writer filter option 'only_single_header_row' to 'tsv'.
Also clarifying usage.

Closes #912.
2012-12-03 14:40:38 -08:00
Robin Sommer
d9f90fcac0 Merge remote-tracking branch 'origin/topic/jsiwek/table-attribute-fixes'
* origin/topic/jsiwek/table-attribute-fixes:
  Fix various bugs with table/set attributes.

Closes #866.
2012-12-03 14:11:44 -08:00
Robin Sommer
d4792dc7fe Merge remote-tracking branch 'origin/topic/jsiwek/table-init-container-ctors'
* origin/topic/jsiwek/table-init-container-ctors:
  Add test of record() constructor to table initializer unit test.
  Fix table(), set(), vector() constructors in table initializer lists.

Closes #5.
2012-12-03 14:10:17 -08:00
Robin Sommer
1298f2e974 Merge remote-tracking branch 'origin/topic/jsiwek/hook'
* origin/topic/jsiwek/hook:
  Change hook calls to only be allowed when preceded by "hook" keyword.
  Clarification in hook documentation.
  Hook functions now directly callable instead of w/ "hook" statements.

Closes #918.
2012-12-03 14:07:22 -08:00
Robin Sommer
a259155e0f Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Slightly fix up file name extraction from Content-Disposition headers.
  Quick pass over unit tests, adding -b flag to bro so they run faster.
  Fixed a DNS attribute issue (reported by Matt Thompson).
2012-12-03 14:00:48 -08:00
Robin Sommer
7245aa5977 Adding NEWS placeholder for hooks and CSV mode. 2012-11-23 19:40:12 -08:00
Robin Sommer
a5e237f50c The ASCII writer now supports a filter config option
'only_single_header_row' that turns the output into CSV format.

In that mode all meta data is skipped except for a single header line
with the fields names. Example:

    local my_filter: Log::Filter = [$name = "my-filter", $writer = Log::WRITER_ASCII, $config = table(["only_single_header_row"] = "T")];

Contributed by Carsten Langer.
2012-11-23 19:38:53 -08:00
Robin Sommer
3357746857 Merge remote-tracking branch 'origin/topic/jsiwek/composite-table-index-fix'
* origin/topic/jsiwek/composite-table-index-fix:
  Fix ambiguity between composite table index and record ctor expressions.

Cool.

Closes #80.
2012-11-23 18:25:04 -08:00
Robin Sommer
0096ebdd6b Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix some warnings from sphinx when building docs.
2012-11-23 18:21:41 -08:00
Robin Sommer
5508a5bb80 Merge remote-tracking branch 'origin/topic/dnthayer/bytes-to-double'
* origin/topic/dnthayer/bytes-to-double:
  Portability improvement (data alignment issues)
  Add test cases for the bytestring_to_double BIF
  Add a new BIF "bytestring_to_double"

Closes #908.
2012-11-14 13:20:46 -08:00
Robin Sommer
759faa255c Merge remote-tracking branch 'origin/topic/jsiwek/modbus-fixes'
* origin/topic/jsiwek/modbus-fixes:
  Remove byte count parameter from modbus events carrying register arrays
  Adjust modbus register array parsing.
  Adjustments to modbus test cases.

Closes #917.
2012-11-13 20:01:23 -08:00
Robin Sommer
590f764440 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix lookup_hostname BIF (and memory leak in it).

Thanks!
2012-11-08 16:22:34 -08:00
Robin Sommer
6c70b11cea Fixing/extending modbus tests. 2012-11-05 17:10:28 -08:00
Robin Sommer
a6216969e6 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Script in base for detecting cases of checksum offloading.
2012-11-05 13:59:30 -08:00
Robin Sommer
4fab70ecce Merge remote-tracking branch 'vlad/topic/vladg/dns_txt_queries'
* vlad/topic/vladg/dns_txt_queries:
  Add detection rate threshold for MHR.
  Make sure lookup_hostname_txt isn't checking lookup_hostname's cache for answers.
  A couple of lookup_hostname_txt fixes.

Reverting the earlier function-join during merging.
2012-11-05 13:40:24 -08:00
Robin Sommer
dfebb82238 Merge remote-tracking branch 'vlad/topic/vladg/dns_txt_queries'
* vlad/topic/vladg/dns_txt_queries:
  DNS TXT support

I've tweaked it a little bit, still seems to work ...

I'd like to add a test for this but I'n not quite sure how to do that.
We'd have to hardcode a destination server that then'd be contacted
each time the test-suite runs.
2012-11-01 10:38:36 -07:00
Robin Sommer
55006240ae Merge remote-tracking branch 'origin/topic/dnthayer/installing-bro'
* origin/topic/dnthayer/installing-bro:
  Add version-specific upgrade info
  Move upgrade instructions to INSTALL document
  Reorganize install documentation

Closes #910.
2012-10-31 14:32:00 -07:00
Robin Sommer
b85baed95e Merge remote-tracking branch 'origin/topic/dnthayer/alarms-mail'
* origin/topic/dnthayer/alarms-mail:
  Rename the alarm summary mail variable
  Change alarm summary email interval to 24hrs

Closes #824.
2012-10-31 14:28:49 -07:00
Robin Sommer
9ec2bfe59f Merge remote-tracking branch 'origin/topic/seth/pppoe'
Looks like the code in this function is getting ready for some
refactoring. Leaving that for another time though ...

Closes #909.

* origin/topic/seth/pppoe:
  Adding a test for PPPoE support.
  Adding PPPoE support to Bro.
2012-10-24 16:05:17 -07:00
Robin Sommer
ae38aad2bb Adding missing &redef for some TCP options.
Reported by Carsten Langer.

Closes #905.
Closes #906.
Closes #907.
2012-10-24 15:41:27 -07:00
Robin Sommer
7ddbca8b35 Merge remote-tracking branch 'origin/topic/jsiwek/subnet-literal-const'
* origin/topic/jsiwek/subnet-literal-const:
  Add parsing rules for IPv4/IPv6 subnet literal constants, addresses #888

Closes #888.
2012-10-24 15:37:49 -07:00
Robin Sommer
5716545cfa Merge remote-tracking branch 'origin/topic/seth/strptime'
* origin/topic/seth/strptime:
  Added a BiF to wrap the strptime function.

Closes #904.
2012-10-19 15:13:25 -07:00
Robin Sommer
b9811e87e5 Merge remote-tracking branch 'origin/topic/jsiwek/ipv6-sigs'
* origin/topic/jsiwek/ipv6-sigs:
  Add IPv6 support to signature header conditions.

Closes #774.
Closes #880.
2012-10-19 15:06:00 -07:00
Robin Sommer
c7b39efe85 Merge remote-tracking branch 'origin/topic/jsiwek/gridftp'
* origin/topic/jsiwek/gridftp:
  Change how "gridftp" gets added to service field of connection records.

Closes #891.
2012-10-19 14:49:38 -07:00
Robin Sommer
5e12a53ae5 Merge remote-tracking branch 'origin/topic/jsiwek/gridftp'
* origin/topic/jsiwek/gridftp:
  Add memory leak unit test for GridFTP.
  Enable GridFTP detection by default.  Track/log SSL client certs.
  Add analyzer for GSI mechanism of GSSAPI FTP AUTH method.
  Add an example of a GridFTP data channel detection script.
2012-10-12 10:43:16 -07:00
Robin Sommer
503412e472 Merge remote-tracking branch 'origin/topic/bernhard/input-end-of-data'
* origin/topic/bernhard/input-end-of-data:
  rename the update_finished event to end_of_data and make it fire in more cases.

Closes #894.
2012-10-12 09:48:58 -07:00
Robin Sommer
c24fa2cd01 Merge remote-tracking branch 'origin/topic/jsiwek/config-options'
* origin/topic/jsiwek/config-options:
  Teach --disable-dataseries/--disable-elasticsearch to ./configure.
  Add --with-curl option to ./configure, addresses #877.

Closes #877.
2012-10-12 09:37:12 -07:00
Robin Sommer
ebec0f4484 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  ...and forgotten debug-output, sorry (was already merged in some other internal repositories before I noticed)
  and another bug in the input framework: config table does not work (is not transmitted to the readers) because the initialization was done the wrong way round.
2012-10-12 09:33:15 -07:00
Robin Sommer
296686d5ca Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix a problem with non-manager cluster nodes applying Notice::policy.
2012-10-08 10:10:53 -07:00
Robin Sommer
14de9e675e Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Redo the "how to upgrade" FAQ.
  Add general FAQ entry about upgrading Bro.
2012-10-03 16:05:01 -07:00
Robin Sommer
1290ed6b95 Merge remote-tracking branch 'origin/topic/jsiwek/delay-teredo-confirm'
* origin/topic/jsiwek/delay-teredo-confirm:
  Add new Tunnel::delay_teredo_confirmation option, default to true.

Closes #890.
2012-10-03 16:01:42 -07:00
Robin Sommer
6ae8ac310a Merge remote-tracking branch 'origin/topic/matthias/libcurl-fix'
* origin/topic/matthias/libcurl-fix:
  Use second granularity for ElasticSearch timeouts.
  Fix compile issues with older versions of libcurl.
2012-10-02 12:07:26 -07:00
Robin Sommer
4d7eabc2a9 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Small but important fix for the input framework. BroStrings were constructed without a final \0 - which means that strings read by the input framework are unusable by basically all internal functions (like to_count).
2012-10-02 12:02:59 -07:00
Robin Sommer
906a34e3b3 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Reliability adjustments to istate tests with network communication.
2012-09-29 14:09:27 -07:00
Robin Sommer
bf62a6e673 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Uncomment some previously-broken tests
  Fix parsing of integers
  Serialize language.when unit test with the "comm" group.
2012-09-25 14:22:23 -07:00
Robin Sommer
958c3d74d6 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix race condition in language/when.bro test
2012-09-24 16:24:49 -07:00
Robin Sommer
73115dd334 Updating CHANGES and VERSION. 2012-09-24 11:15:43 -07:00
Robin Sommer
7e3f06fca3 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix the "-=" operator for intervals
  Fix "!=" operator for subnets
  Add sleeps to configuration_update test for better reliability.
  Fix a segfault when iterating over a set
2012-09-06 23:24:13 -07:00
Robin Sommer
b915db86d5 Updating CHANGES and VERSION. 2012-08-28 16:47:49 -07:00
Robin Sommer
e4b7ffa8ac Updating CHANGES and VERSION. 2012-08-28 16:44:30 -07:00
Robin Sommer
a24abddc5f Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Remove automatic use of gperftools on non-Linux systems.
  Fix uninitialized value for 'is_partial' in TCP analyzer.
  parse 64-bit consts correctly.
  on 32-bit machines only unsigned long longs are 64-bits long. Not just unsigned longs...
2012-08-28 16:35:06 -07:00