Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
12680 commits 387 branches 195 tags 258 MiB
Commit graph

6667 commits

Author SHA1 Message Date
Bernhard Amann
7e5f733826 raw input reader for seth, which can simply read a file into string-events given a line separator. 2012-02-22 09:44:45 -08:00
Bernhard Amann
531189b5fd try to make ascii reader a little bit more robust to failure - mainly ignore messages after a reader has disabled itself 2012-02-22 08:56:45 -08:00
Bernhard Amann
d5b413c4e7 reduce number of needed hash operations 2012-02-20 17:13:41 -08:00
Bernhard Amann
edd30da082 better testcase & fix a few bugs (that took way too long to find). 2012-02-20 15:30:21 -08:00
Daniel Thayer
8e32e89ce4 Merge remote-tracking branch 'origin/master' into topic/icmp6 
Conflicts:
	src/ICMP.cc
	src/net_util.cc
	src/net_util.h
 2012-02-20 17:18:55 -06:00
Bernhard Amann
4f57817b1a ...forgotten in last commit. 2012-02-20 13:20:29 -08:00
Jon Siwek
b66b74e5dc Decrease strictness of parsing IPv4 strings into addrs. (fixes #775) 
IPv4 strings in dotted-decimal format with decimal parts containing
leading zeroes now parse better.
 2012-02-20 14:28:42 -06:00
Jon Siwek
1f7bfbb83c Fix memory leak in DNS manager (fixes #777). 2012-02-20 11:56:21 -06:00
Robin Sommer
52cfec8830 Merge remote-tracking branch 'origin/topic/robin/v6-addr-merge' into topic/robin/v6-addr-merge 2012-02-17 18:40:38 -08:00
Robin Sommer
b3333a7da2 Reverting loopback change which doesn't seem to fully work. 2012-02-17 17:46:51 -08:00
Robin Sommer
1f0b88041a Changing ARP detection to always kick in even if no analyzer is 
activated.

Without that, we get "unknown_protocol" weird for ARP, which doesn't
seem right.
 2012-02-17 13:24:47 -08:00
Robin Sommer
be3fb5fb81 Merge remote-tracking branch 'origin/topic/jsiwek/v6-dns-name-lookup' into topic/robin/v6-addr-merge 
* origin/topic/jsiwek/v6-dns-name-lookup:
  DNS name lookups performed by Bro now also query AAAA records.

Conflicts:
	src/DNS_Mgr.cc
 2012-02-17 10:39:24 -08:00
Jon Siwek
06e59e1398 Fix IPAddr/IPPrefix serialization bugs. (all unit tests pass) 2012-02-17 12:01:00 -06:00
Jon Siwek
c227563baf Fix compile error. 2012-02-17 12:00:35 -06:00
Robin Sommer
5565e19e57 Merge remote-tracking branch 'origin/topic/v6-addr' into topic/v6-addr-merge 
Conflicts:
	src/DNS_Mgr.cc
	src/Expr.cc
	src/bro.bif
 2012-02-16 20:50:46 -08:00
Robin Sommer
94b9644da7 Working on merging the v6-addr branch. This is checkpoint, tests don't 
pass yet.

Changes:

- Gave IPAddress/IPPrefix methods AsString() so that one doesn't need
  to cast to get a string represenation.

- Val::AsAddr()/AsSubnet() return references rather than pointers. I
  find that more intuitive.

- ODesc/Serializer/SerializationFormat get methods to support
  IPAddress/IPPrefix directly.

- Reformatted the comments in IPAddr.h from /// to /** style.

- Given IPPrefix a Contains() method.

- A bit of cleanup.
 2012-02-16 20:39:16 -08:00
Bernhard Amann
d21a450f36 add streaming reads & automatic re-reading of files to ascii reader. 
completely untested, but compiles & old tests still work
 2012-02-16 15:40:07 -08:00
Bernhard Amann
91943c2655 * rework script interface, add autostart stream flag that starts up a stream automatically when first filter has been added ( probably the most common use case ) 
* change internal reader interface again
* remove some quite embarassing bugs that must have been in the interface for rather long
* add different read methods to script & internal interface (like normal, streaming, etc). Not implemented in ascii reader yet.
 2012-02-16 15:03:20 -08:00
Bernhard Amann
de149ff55e Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-16 11:32:19 -08:00
Bernhard Amann
bc6ebe53cc remove unnecessary error function from manger 2012-02-16 11:31:30 -08:00
Bernhard Amann
84883348ec interface documentation. 
to a big part stolen from the logging framework
 2012-02-16 11:27:10 -08:00
Daniel Thayer
6d98008d07 Merge remote-tracking branch 'origin/topic/v6-addr' into topic/dnthayer/ftp-ipv6 2012-02-16 13:22:53 -06:00
Jon Siwek
93fa116738 Various tweaks/refactor of new IPAddr class usages or IPv6 related code. 
- non-binpac DNS analyzer now also generates dns_a6_reply event
- ExpectedConn class refactored to use IPAddr's
- BinaryExpr::AddrFold simplified
- IP_Hdr src/dst address accessor methods changed to construct IPAddr
  objects on the fly from ip4/ip6 members.

Addresses #770.
 2012-02-16 11:27:22 -06:00
Bernhard Amann
a850cc5992 make filter removal and stream closure asynchronous. 2012-02-15 15:14:04 -08:00
Daniel Thayer
2f2509fdce Merge remote-tracking branch 'origin/topic/v6-addr' into topic/dnthayer/ftp-ipv6 2012-02-15 16:29:31 -06:00
Daniel Thayer
ef31099fd7 Merge branch 'master' into topic/icmp6 
Conflicts:
	policy/bro.init
	policy/icmp.bro
	src/Analyzer.cc
	src/AnalyzerTags.h
	src/DPM.cc
	src/ICMP.h
	src/Sessions.cc
	src/event.bif
	src/net_util.cc
 2012-02-15 15:58:53 -06:00
Robin Sommer
7458ebf385 Checkpoint after pass. 2012-02-15 13:07:08 -08:00
Jon Siwek
2ef18e98a2 DNS name lookups performed by Bro now also query AAAA records. 
DNS_Mgr handles combining the results of the A and AAAA queries
for a given hostname such that at the scripting layer, the name
resolution can yield a set with both IPv4 and IPv6 addresses.
 2012-02-15 11:02:18 -06:00
Robin Sommer
1f8b299aaf Shortening file names a bit. 2012-02-14 10:12:09 -08:00
Robin Sommer
e2794c809f Merge remote-tracking branch 'origin/topic/bernhard/log-threads' into topic/robin/log-threads 
* origin/topic/bernhard/log-threads:
  typo
  fix CreateBackend function - the way that the right backend was chosen & backends were initialized did not make sense...
  backend does not need friend access to manager
  move Value and Field from the logging namespace to the threading namespace, because other modules using threading will need them.
  send enum instead of string
  memleak fix.
  make logging framework send the protocol to the writer.
 2012-02-14 10:08:46 -08:00
Bernhard Amann
88233efb2c It works. Even including all unit tests. 
But: there are still a few places where I am sure that there are race conditions & memory leaks & I do not really like the current interface & I have to add a few more messages between the front and backend.

But - it works :)
 2012-02-13 22:29:55 -08:00
Jon Siwek
808f3915e5 Merge branch 'master' into topic/v6-addr 2012-02-13 16:01:33 -06:00
Jon Siwek
0f207c243c Port DNS_Mgr to use new IPAddr class, enable lookups on IPv6 addrs. 
Host lookups still need to be changed to also do AAAA queries.
 2012-02-13 15:57:59 -06:00
Daniel Thayer
c87f82c492 Merge remote-tracking branch 'origin/topic/v6-addr' into topic/dnthayer/ftp-ipv6 2012-02-13 15:39:01 -06:00
Bernhard Amann
4e868d282d Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-13 02:37:02 -08:00
Bernhard Amann
1e4a93c767 Merge remote-tracking branch 'origin/topic/bernhard/log-threads' into topic/bernhard/log-threads 2012-02-13 02:35:10 -08:00
Bernhard Amann
8a6dfee00c Merge remote-tracking branch 'origin/topic/robin/log-threads' into topic/bernhard/log-threads 2012-02-13 02:30:24 -08:00
Robin Sommer
7fcb7b5f17 Save CPU when idle. 
This needs a bit more testing. It may also with the general problem of
high CPU usage with low traffic.
 2012-02-12 13:08:45 -08:00
Robin Sommer
b8ec653ebf Bugfixes. 
- Data queued at termination wasn't written out completely.

    - Fixed some race conditions.

    - Fixing IOSource integration.

    - Fixing setting thread names on Linux.

    - Fixing minor leaks.

All tests now pass for me on Linux in debug and non-debug compiles.

Remaining TODOs:

        - Needs leak check.

        - Test on MacOS and FreeBSD.

        - More testing:
            - High volume traffic.
            - Different platforms.
 2012-02-12 13:07:26 -08:00
Robin Sommer
abb506ec63 Merge branch 'master' into topic/robin/log-threads 2012-02-12 08:50:47 -08:00
Daniel Thayer
74899e29fe Update FTP EPSV response processing for IPv6 2012-02-10 16:55:15 -06:00
Daniel Thayer
c0f05f57a7 Fix a minor typo in documentation 2012-02-09 18:50:21 -06:00
Daniel Thayer
42d6440bb2 Fix parsing of FTP EPRT command and EPSV response 2012-02-09 18:34:41 -06:00
Jon Siwek
086f747bc1 Add counts_to_addr and addr_to_counts conversion BIFs. 2012-02-09 15:32:57 -06:00
Jon Siwek
f945f3c518 Change HashKey threshold for using H3 to 36 bytes. 
This is enough to accommodate using H3 instead of HMAC/MD5 for IPv6
Conn::Key's and performs better since a hash happens for every packet.
 2012-02-09 12:55:55 -06:00
Jon Siwek
303f02d6f8 Inline some IPAddr methods. 2012-02-09 12:53:37 -06:00
Jon Siwek
9ab5180aa9 Fix compiler warning about Brofiler ctor init list order. 2012-02-07 16:25:28 -06:00
Daniel Thayer
31565d6987 Fix the ptr_name_to_addr BiF to work with IPv6 2012-02-07 16:15:13 -06:00
Jon Siwek
5ad0bab9b0 Fix a memory leak that perftools now complains about. 2012-02-07 14:27:40 -06:00
Jon Siwek
6c2351aa74 Merge branch 'topic/v6-addr' of git://git.bro-ids.org/bro into topic/v6-addr 2012-02-07 11:53:27 -06:00