Commit graph

6667 commits

Author SHA1 Message Date
Jon Siwek
d8c716ae17 Merge branch 'master' into topic/jsiwek/filter-rotation 2011-09-08 13:01:00 -05:00
Robin Sommer
db8ab89c3a Merge remote branch 'origin/topic/jsiwek/misc-doc-fixes'
* origin/topic/jsiwek/misc-doc-fixes:
  More tweaks to generated script docs.
  Various changes to documentation framework.

Closes #598.
2011-09-08 09:07:20 -07:00
Robin Sommer
c2501cec51 Merge remote branch 'origin/topic/gilbert/rand-pool'
* origin/topic/gilbert/rand-pool:
  Updating tests.
  Updated uid pools to use integer values instead of strings.
  Updating tests.
  Test no longer relevant.  Need a way to generate and test collisions.
  A few minor tweaks to make code less braindead.  Fixed-length piece of pool name now only used to hash when determinism is not required; otherwise, whole pool name is used.  Note that collisions between pool name hashes will lead to sensitivity to initialization order within the UID generator.
  Testing long (>32 character) pool names.
  Simple test to verify various pools are not affecting each other.
  Some working code.  Adds UID pools classified by string.  Just compiles and runs; need to go back through and make sure this code is actually doing what I want it to do.

Note, I've removed the collision detection. Seems unlikely to occur
and even if, it's not really that bad.
2011-09-07 16:17:59 -07:00
Robin Sommer
f868af101c Potential fix for #588. 2011-09-07 11:08:33 -07:00
Jon Siwek
d2bf33ee19 Merge branch 'master' into topic/jsiwek/filter-rotation 2011-09-07 12:30:47 -05:00
Jon Siwek
95ed192088 More tweaks to generated script docs.
- The "private interface" section is still tracked, but no longer rendered.
  We can judge the usefulness of it later and add back if there's demand.

- Documentation of event handlers was being treated the same as event
  declarations.  Now handlers are tracked separately, but not currently
  rendered in the generated doc output since usefulness is questionable.
2011-09-07 11:33:08 -05:00
Jon Siwek
80e154ba3c Various changes to documentation framework.
- Reorganize top-level 'doc' Makefile target so submodules can easily
  add their own doc-generating routines to it.  e.g. the Bro project
  makes a placeholder 'doc' target, then adds 'restdoc', 'sphinxdoc';
  later Broccoli can add it's own target as a dependency for generating
  API docs.

- Fixed generated docs for BIFs not being organized under a base/
  subdirectory like the original source files.

- Fixed documentation style for function parameters not applying to
  functions declared as record fields.

- Misc. script documentation tweaks to address warnings given by Sphinx.
2011-09-07 10:02:15 -05:00
Seth Hall
eda2245e9e Merge remote-tracking branch 'origin/topic/seth/pf_ring_support'
* origin/topic/seth/pf_ring_support:
  Added pf_ring load balancing support to the scripting layer.
2011-09-06 15:20:22 -04:00
Gilbert Clark gc355804@ohio.edu
3953b851e5 Merge branch 'master' into topic/gilbert/rand-pool
Conflicts:
	testing/btest/Baseline/istate.events-ssl/receiver.http.log
	testing/btest/Baseline/istate.events-ssl/sender.http.log
	testing/btest/Baseline/istate.events/receiver.http.log
	testing/btest/Baseline/istate.events/sender.http.log
	testing/btest/Baseline/scripts.base.protocols.smtp.basic/smtp.log
2011-09-05 11:40:34 -07:00
Robin Sommer
630c256a72 Merge remote branch 'origin/topic/gilbert/ascii-header'
* origin/topic/gilbert/ascii-header:
  Updated tests; removed net type from type conversion code.
  Updated header format (see #558)
  Header modification to LogWriterAscii to make it easier for scripts to understand bro log files.

Notes:

    - I've refactored the code a bit, also adapting the style a bit.
      Also edited the header format slightly.

    - I'm skipping the testing/btest/profiles directory, which seems
      unrelated.

    - I'm also skipping the baseline updates as they weren't
      up-to-date anymore. Will update them in a subsequent commit.
2011-09-04 12:12:08 -07:00
Seth Hall
31efa3d828 HTTP analyzer is now enabled with any of the HTTP events. 2011-09-04 09:51:16 -07:00
Gregor Maier
a9155aceb2 Fix missing format string that caused some segfaults (v2)
My previous fix wasn't enough.
2011-09-04 09:50:21 -07:00
Gregor Maier
b6923dc55a Fix missing format string that caused some segfaults.
Binpac exceptions caught in Analyzer.cc are passed to Reporter::Weird
and from there to Reporter::WeirdHelper. WeirdHelper has var args, to
support passing them on to DoLog, but there were no forced format
strings. Since the binpac exception can contain network data which can
contain %-characters, that caused segfaults.
2011-09-04 09:50:07 -07:00
Gregor Maier
5b6cc7fe0f Print time interval with 6 decimal places, same as we do for time vals. 2011-09-04 09:49:35 -07:00
Robin Sommer
29e9183f5b Merge remote branch 'origin/topic/jsiwek/nested-record-coerce-fix'
* origin/topic/jsiwek/nested-record-coerce-fix:
  Fix for a case where nested records weren't coerced even though possible.

Closes #571.
2011-09-04 09:00:45 -07:00
Robin Sommer
0d202962bc Merge remote branch 'origin/topic/jsiwek/ascii-log-rotate-fix'
* origin/topic/jsiwek/ascii-log-rotate-fix:
  Change ASCII writer to delay creation of log after rotation until next write.

Closes #570.
2011-09-04 09:00:28 -07:00
Robin Sommer
ccad24b685 Merge remote branch 'origin/topic/jsiwek/snaplen'
* origin/topic/jsiwek/snaplen:
  Change default snaplen to 65535, add -l/--snaplen command line option.

Closes #447.
2011-09-04 08:59:48 -07:00
Robin Sommer
d97297b6ce Small tweaks to recent commits. 2011-09-04 08:21:02 -07:00
Seth Hall
fe53091cd1 Merge commit '2e853a3'
* commit '2e853a3':
  Change presentation of enum val to include namespace.
2011-09-02 15:04:25 -04:00
Seth Hall
771f8bc910 Added pf_ring load balancing support to the scripting layer.
- If the misc/pf-ring-load-balancing script is loaded, the correct
  environment variables will be set to enable automatic flow based
  load balancing used pf_ring if Bro is built against the pf_ring
  libpcap wrapper.  Loading the script on non-Linux OSs or when Bro
  isn't linked against the correct libpcap has no known side effects
  since the script just sets environment variables.

- Added a BiF named setenv for setting environment variables.
2011-09-02 10:43:32 -04:00
Seth Hall
1726aee4e9 Merge remote-tracking branch 'origin/topic/jsiwek/reporter-fatal-bif'
* origin/topic/jsiwek/reporter-fatal-bif:
  Add a Reporter::fatal BIF.
2011-09-01 10:52:39 -04:00
Jon Siwek
2e853a3892 Change presentation of enum val to include namespace.
Enum vals now add their full identifier string, including module
namespace to ODescs.
2011-08-31 10:57:19 -05:00
Jon Siwek
a38c45b8bf Merge branch 'master' into fastpath 2011-08-31 10:41:07 -05:00
Seth Hall
c67c1e8ba6 Merge remote-tracking branch 'origin/topic/jsiwek/geoip-fixes'
* origin/topic/jsiwek/geoip-fixes:
  Fixes for GeoIP support (addresses #538).
2011-08-31 10:29:39 -04:00
Seth Hall
96c0a07027 Merge remote-tracking branch 'origin/topic/jsiwek/scp-log-pp'
* origin/topic/jsiwek/scp-log-pp:
  Add a log postprocessing function that can SCP rotated logs to remote hosts.
2011-08-31 10:22:08 -04:00
Seth Hall
203f00060c Merge remote-tracking branch 'origin/topic/jsiwek/mail-alarms'
* origin/topic/jsiwek/mail-alarms:
  Finish capability of emailing bulk alarm logs at a configurable interval.
2011-08-31 09:16:55 -04:00
Seth Hall
fed6d76488 HTTP analyzer is now enabled with any of the HTTP events. 2011-08-31 01:16:43 -04:00
Jon Siwek
13a09aa488 Fixes for GeoIP support (addresses #538).
- Missing GeoIP databases now generate warnings/errors that go through
  the reporter framework instead of hitting GeoIP's internal use of
  stderr

- lookup_location now just queries for country code if the city database
  was not loaded, which gets rid of invalid database type errors.

- lookup_location now leaves missing fields uninitialized in the
  returned geo_location record value.  Updated existing scripts to
  check for initialized fields in geo_location records before use.

- Fixed support for GeoIP's IPv6 API and databases
2011-08-30 17:02:07 -05:00
Gilbert Clark gc355804@ohio.edu
97b7140332 Merge remote-tracking branch 'origin/master' into topic/gilbert/rand-pool
Conflicts:
	testing/btest/Baseline/core.vlan-mpls/conn.log
	testing/btest/btest.cfg
2011-08-30 11:59:59 -07:00
Gilbert Clark gc355804@ohio.edu
728c0b5b35 Updated tests; removed net type from type conversion code. 2011-08-30 11:40:50 -07:00
Gilbert Clark gc355804@ohio.edu
5b6329577f Merge remote-tracking branch 'origin/master' into topic/gilbert/ascii-header
Conflicts:
	testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
	testing/btest/Baseline/core.vlan-mpls/conn.log
	testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.test.log
	testing/btest/Baseline/policy.frameworks.logging.types/ssh.log
	testing/btest/btest.cfg
2011-08-30 11:25:55 -07:00
Gilbert Clark gc355804@ohio.edu
3b411b69f3 Updated header format (see #558) 2011-08-30 11:20:28 -07:00
Jon Siwek
0ae1d8a359 Change default snaplen to 65535, add -l/--snaplen command line option.
Addresses #447.
2011-08-29 15:47:48 -05:00
Jon Siwek
263ef2bfc9 Add an optional Log::RotationControl to Log::Filter records.
This allows for the RotationControl to be automatically added to the
Log::rotation_control table for the filter's (writer, path) when it is
added to a stream via Log::add_filter.  Log::remove_filter now also
removes any RotationControl's associated with the filter from the
Log::rotation_control table.
2011-08-26 14:36:56 -05:00
Jon Siwek
f08ef8350a Fix for a case where nested records weren't coerced even though possible. 2011-08-26 13:59:51 -05:00
Seth Hall
fc5f22cb5d Merge remote-tracking branch 'origin/topic/jsiwek/reorg-followup' 2011-08-25 16:44:31 -04:00
Jon Siwek
31e70e447d Add a Reporter::fatal BIF.
This can be used from a Bro script to cause Bro to exit with non-zero
status and a message to stderr.  Uses of the exit() BIF in scripts
for terminating Bro because of an error were replaced with this one,
which addresses #564.
2011-08-25 13:13:39 -05:00
Jon Siwek
38e562dd30 Change ASCII writer to delay creation of log after rotation until next write.
When a given log was rotated, a new log was opened immediately.  If that
log was never written to again, those empty logs perpetually rotate, too.
This change makes it so a log won't be created for a given rotation interval
if there was nothing written to it in that interval.
2011-08-25 10:00:40 -05:00
Jon Siwek
8c9c6f3f00 Finish capability of emailing bulk alarm logs at a configurable interval.
Also added a BiF for getting the current Bro version string.
2011-08-25 09:41:05 -05:00
Gregor Maier
b90b5a667c Fix missing format string that caused some segfaults (v2)
My previous fix wasn't enough.
2011-08-24 13:44:41 -07:00
Gregor Maier
d3e4d5b631 Fix missing format string that caused some segfaults.
Binpac exceptions caught in Analyzer.cc are passed to Reporter::Weird
and from there to Reporter::WeirdHelper. WeirdHelper has var args, to
support passing them on to DoLog, but there were no forced format
strings. Since the binpac exception can contain network data which can
contain %-characters, that caused segfaults.
2011-08-23 22:37:27 -07:00
Gregor Maier
1936989422 Fix compile error due to typo. 2011-08-23 20:46:33 -07:00
Gregor Maier
5594f98ec7 Merge remote-tracking branch 'origin/fastpath' into topic/gregor/tunnel 2011-08-23 20:40:43 -07:00
Gregor Maier
28b417381c Print time interval with 6 decimal places, same as we do for time vals. 2011-08-23 20:33:17 -07:00
Gregor Maier
f3a92ec30b Minor fixes for possible leaks on uncommon code path or on initialization. 2011-08-23 20:28:11 -07:00
Gregor Maier
bdf4b1cbcb Hotfix: Excessive memory usage of SSL analyzer on connections with gaps.
The SSL analyzer used excessive amounts of memory after a gap. We fix
this by tracking whether there was gap and not delivering any more data
if there was.
2011-08-23 20:03:12 -07:00
Robin Sommer
03d41818e0 Fix for the CompHash fix. 2011-08-19 19:01:14 -07:00
Robin Sommer
2636ec4679 Fixing key size calculation in composite hash code. 2011-08-18 14:12:32 -07:00
Robin Sommer
27ccc77463 Merge remote-tracking branch 'origin/topic/jsiwek/remove-net-type'
* origin/topic/jsiwek/remove-net-type:
  Remove the 'net' type from Bro (addresses #535).

Closes #535.
2011-08-18 10:02:16 -07:00
Robin Sommer
ecaa05073e Merge remote-tracking branch 'origin/topic/jsiwek/h3-byte-size'
* origin/topic/jsiwek/h3-byte-size:
  Fix H3 assumption of an 8-bit byte/char.

Closes #530.
2011-08-18 09:54:59 -07:00