Commit graph

6667 commits

Author SHA1 Message Date
Jon Siwek
bc1c3ea28a Allow reading from interface without additional script arguments.
Reading from an interface like `bro -i en0` no longer expects to
start reading stdin for a script to load.  Explicitly passing in
'-' as an additional command line argument still allows reading a
script from stdin.

Closes #561
2011-08-17 20:38:20 -05:00
Jon Siwek
1730496d12 Remove the 'net' type from Bro (addresses #535).
Incremented the serialization data format version in the process.
2011-08-17 19:03:34 -05:00
Jon Siwek
d412aa9d63 Fix H3 assumption of an 8-bit byte/char.
The hash function was internally casting the void* data argument into an
unsigned char* and then using values from that to index another internal
array that's dimensioned based on the assumption of 256 values possible
for an unsigned char (8-bit chars/bytes).  This is probably a correct
assumption most of the time, but should be safer to use the limits as
defined in standard headers to get it right for the particular
system/compiler.

There was an unused uint8* casted variable in HashKey::HashBytes that
seemed like it might have been meant to be passed to H3's hash function
as an unfinished attempt to solve the 8-bit byte assumption problem, but
that doesn't seem as good as taking care of that internally in H3 so
users of the API are only concerned with byte sizes as reported by
`sizeof`.  Removing the unused variable addresses #530.

Also a minor tweak to an hmac_md5 call that was casting away const from
one argument (which doesn't match the prototype).
2011-08-17 15:03:18 -05:00
Gregor Maier
4214d8d905 Fixing memleak in tunnel code. 2011-08-17 07:31:25 -07:00
Gregor Maier
08dc84a250 Tunnel decapsulation bugfix when FlipRoles is called.
If FlipRoles() is called the conn_val in Conn.cc gets Unref'ed and thus
my tunnel_partent RecordVal was lost. Fixing this.
2011-08-16 20:41:36 -07:00
Jon Siwek
e37430ef66 Merge branch 'master' into topic/jsiwek/reorg-followup 2011-08-16 09:52:05 -05:00
Robin Sommer
63eac6c174 Reclassifying more DNS manager errors.
Closes #461.
2011-08-15 21:10:30 -07:00
Robin Sommer
f9cd97d78d Fixing ref'counting problem. 2011-08-15 20:56:59 -07:00
Gilbert Clark gc355804@ohio.edu
7bea71a2c2 Updated uid pools to use integer values instead of strings. 2011-08-15 15:47:39 -07:00
Jon Siwek
33fce8a71d Misc. doc/script/test cleanup.
- fixing some Metrics::add_data() call signatures
- slight refactors to cluster framework @if and adding a NONE NodeType for
  so local_node_type() will return that instead of just emitting an error
  when cluster mode isn't enabled
- `make restdoc` target now uses bro's bare-mode
- bro scripts generated from bifs now really only live in the build/src/base/
  directory and changed the DocSourcesList.cmake to dynamically figure out
  what bifs exist by looking in src/ instead of build/src/
- add some missing @load dependencies
2011-08-15 17:29:41 -05:00
Jon Siwek
41dd0b98e9 Merge branch 'master' into topic/jsiwek/reorg-followup
Conflicts:
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/frameworks/metrics/main.bro
	scripts/base/frameworks/notice/actions/email_admin.bro
	scripts/base/frameworks/notice/weird.bro
	scripts/base/protocols/mime/file-hash.bro
	scripts/base/protocols/mime/file-ident.bro
	scripts/policy/frameworks/communication/listen-clear.bro
	scripts/policy/frameworks/communication/listen-ssl.bro
	scripts/policy/frameworks/control/controller.bro
	scripts/policy/frameworks/metrics/http-example.bro
	scripts/policy/frameworks/metrics/ssl-example.bro
	scripts/policy/protocols/conn/scan.bro
	src/CMakeLists.txt
2011-08-15 15:34:25 -05:00
Gregor Maier
ae1eb5379b Merge branch 'master', remote-tracking branch 'origin' into topic/gregor/tunnel 2011-08-15 13:33:14 -07:00
Gilbert Clark gc355804@ohio.edu
d46525dcca Merge branch 'master' into topic/gilbert/rand-pool 2011-08-14 22:21:59 -07:00
Gilbert Clark gc355804@ohio.edu
b723ecd0e0 Header modification to LogWriterAscii to make it easier for scripts to
understand bro log files.
2011-08-13 21:10:51 -07:00
Robin Sommer
1ca9def9e6 Merge remote-tracking branch 'origin/topic/jsiwek/autodoc-fixes'
* origin/topic/jsiwek/autodoc-fixes:
  Update doc sources and touch up a few script comments.
  Fixes for script auto-documentation.

Conflicts:
	scripts/base/frameworks/logging/main.bro
2011-08-13 12:09:13 -07:00
Jon Siwek
2a9ea6b8ba Merge branch 'master' into topic/jsiwek/autodoc-fixes
Conflicts:
	scripts/CMakeLists.txt
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/frameworks/communication/__load__.bro
	scripts/base/frameworks/metrics/conn-example.bro
	scripts/base/frameworks/metrics/http-example.bro
	scripts/site/local.bro
2011-08-13 09:31:06 -05:00
Robin Sommer
045fd4690b Merge remote-tracking branch 'origin/topic/seth/piped_exec-update'
* origin/topic/seth/piped_exec-update:
  piped_exec can now write nulls in the "to_write" argument.
2011-08-12 23:35:15 -07:00
Jon Siwek
6f060a58d6 Fix vector initialization for lists of records with optional types.
If possible the list elements now get promoted to the yield type of the
vector.  There was also a problem with the value returned by the record
constructor expression's eval being completely unref'd since the vector
element assignment function doesn't ref the element -- so I changed it
to ref values if they just constructed before assigning them to the
vector.

Addresses #485.
2011-08-12 23:25:01 -07:00
Jon Siwek
560685f1c6 Fix redef'ing records with &default empty set fields.
Attributes have state to track whether they're in a record and should
apply to a record field, but this state wasn't being set for TypeDecls
that are part of a redef'd record.

Closes #460
2011-08-12 23:24:49 -07:00
Gregor Maier
03a73899a9 Fix ConnSize_Analyzer with ConnCompressor.
The num_pkts and num_bytes_ip in endpoint are optional and
should only be assigned to if ConnSize_Anlyzer is active.
2011-08-12 23:24:44 -07:00
Jon Siwek
00de88f4cb Fix reporter using part of the actual message as a format string
When not reporting via events, the final contents of the message buffer
after formatting was being used as a format string to fprintf instead of
writing out the actual string.
2011-08-12 23:24:44 -07:00
Robin Sommer
33b064bdb2 Fixing reporter's location tracking.
Closes #492.
2011-08-12 22:39:36 -07:00
Robin Sommer
46d3570bf5 Turning DNS errors into a warning.
It seems these errors aren't Bro's fault, and in any case it's clearly
not an internal error. This should finally solve the problem in #255.

Closes #255.
2011-08-12 22:29:38 -07:00
Robin Sommer
cb31fd3bb9 Logging's path_func now receives the log record as argument.
Closes #555.
2011-08-12 22:18:45 -07:00
Robin Sommer
c436930acf Functions can now be logged.
The function's code is rendered as ASCII and included as a string.
Closes #506.

Note that I'm not sure if the formatting is as desired: should the LFs
and tabs be rendered as \xXX or removed?.
2011-08-12 22:15:57 -07:00
Gregor Maier
65921bc61d Bugfix: an #ifdef BROv6 was missing in the tunnel code 2011-08-12 21:42:47 -07:00
Jon Siwek
521f54c4f0 Fix check_for_unused_event_handlers option.
The format string given to the reporter warning call wasn't printing
the handler names.  Also changed it so that each warning message has
the full context of the warning.
2011-08-11 11:34:42 -05:00
Jon Siwek
7b07a19cd6 bro scripts generated from bifs now install to $prefix/share/bro/base/
Addresses #545
2011-08-10 19:05:03 -05:00
Gregor Maier
d0a67dc8bf Tweaking tunnel decapsulation.
Changing names to comply with "Bro Scripting Conventions"
Tweaking documentation.
2011-08-10 13:47:02 -07:00
Gregor Maier
1a565fadfe Merge remote-tracking branch 'origin/topic/jsiwek/autodoc-fixes' into topic/gregor/tunnel 2011-08-10 12:26:13 -07:00
Gilbert Clark gc355804@ohio.edu
e21feb8487 A few minor tweaks to make code less braindead. Fixed-length piece of pool name now only used to hash when determinism is not required; otherwise,
whole pool name is used.  Note that collisions between pool name hashes will lead to sensitivity to initialization order within the UID generator.
2011-08-09 09:44:31 -07:00
Seth Hall
3437220fe3 piped_exec can now write nulls in the "to_write" argument.
- Additional test for testing writing null values.
2011-08-09 09:51:03 -04:00
Gilbert Clark gc355804@ohio.edu
9322c063cc Some working code. Adds UID pools classified by string. Just compiles
and runs; need to go back through and make sure this code is actually
doing what I want it to do.

Note: Added new function unique_id_from(pool: string, prefix: string)
that allows the user to explicitly specify a randomness pool to use when
generating unique IDs.
2011-08-08 22:12:40 -07:00
Jon Siwek
4ac6d0ae2e Fixes for script auto-documentation.
- Fixing the parts of the `make restdoc` and `make doc` process that were
  broken by the last Bro script re-organization

- Generated documentation for Bro scripts derived from BiFs now use the
  original BiF source file as the "original source file" link

- Renaming of the internal POLICYDEST definition and other misc places that
  refer to "policy" scripts; that terminology doesn't make total sense now

- Added a documentation blacklist reminder test that will fail if there's
  scripts that are blacklisted from being documentated because they're still
  in progress

- Some minor Bro script changes to fix small @load dependency errors

Addresses #543
2011-08-08 19:50:45 -05:00
Robin Sommer
d7075aa17a Fixing compiler warning. 2011-08-08 16:31:33 -07:00
Robin Sommer
bbb0b855a2 Merge branch 'topic/robin/rotation-pp'
* topic/robin/rotation-pp:
  Adding a default_path_func that makes the default naming scheme script-level controlled.
  Reworking logging's postprocessor logic.

Conflicts:
	scripts/base/frameworks/logging/main.bro
	testing/btest/policy/frameworks/logging/rotate-custom.bro
2011-08-08 16:14:54 -07:00
Robin Sommer
103396f6d3 Communication must now be enabled explicitly.
The communication subsystem is now disabled until a new BiF,
enable_communication(), is called. The base scripts do this
automatically when either a Communication::Node is defined, or Bro is
asked to listen for incoming connections.
2011-08-08 13:49:50 -07:00
Seth Hall
c4f4df6a79 Renaming the default loaded "init" scripts and added command line arg for "bare-mode"
- bro.init was renamed to base/init-bare.bro and base/all.bro
  was renamed to init-default.bro.

- To run in "bare mode" with only the init-bare.bro and no other
  scripts from base/, use either -b or --bare-mode.

- The environment variable to run in "bare mode" has been removed.
2011-08-08 13:40:43 -04:00
Gregor Maier
cd592203a0 Remvoing old tunnel code (encap_hdr_size and udp_tunnels). 2011-08-07 13:55:46 -07:00
Gregor Maier
b0ac4882bd Merge branch 'master' into topic/gregor/tunnel
* master: (21 commits)
  Fixing default policy search path.
  Small tweaks for doc generation.
  The hostname notice email extension now only add hostnames for emailed noticed.
  Attempt at cleaning up doc generation.
  Hopefully the last major script reorganization.
  Updating submodule(s).
  Fixing compiler warning.
  Fixing crash in memory profiling.
  Fix compiler warning.
  Fixing memory (and CPU) leak in log writer.
  Fixing missing sync in cluster setup.
  Update script doc-generation README.
  Omission of bro.init from doc generation fixed.
  Fixing docstrings to make docutils happy.
  Updated submodules to current master
  Updating submodule(s).
  Updating submodule(s).
  Fix genDocSourcesList script lack of explicit sorting
  Fix &raw_output and enable_raw_output interpretation of NUL characters
  Fix PktSrc::Statistics returning bogus stats.
  ...

Conflicts:
	scripts/base/bro.init
2011-08-07 09:59:30 -07:00
Gregor Maier
5ed3ec2f38 Finishing tunnel decapsulation support in C++ core.
Policy script is next.
2011-08-07 09:49:41 -07:00
Seth Hall
e60213ac11 Fixing default policy search path. 2011-08-06 00:46:12 -04:00
Seth Hall
d6a67f7c1f Merge branch 'master' of ssh://git.bro-ids.org/bro
Conflicts:
	scripts/base/frameworks/control/main.bro
2011-08-05 23:11:40 -04:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization.
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
2011-08-05 23:09:53 -04:00
Robin Sommer
e2d9a57947 Merge remote-tracking branch 'remotes/origin/topic/robin/logging-fix'
* remotes/origin/topic/robin/logging-fix:
  Fixing crash in memory profiling.
  Fix compiler warning.
  Fixing memory (and CPU) leak in log writer.
  Fixing missing sync in cluster setup.
  Updating submodule(s).
2011-08-05 19:07:59 -07:00
Robin Sommer
e92b0dc3b2 Fixing compiler warning. 2011-08-05 18:12:36 -07:00
Robin Sommer
9fafe286c1 Fixing crash in memory profiling. 2011-08-05 12:45:05 -07:00
Robin Sommer
9adefcfbd4 Fix compiler warning. 2011-08-05 12:20:09 -07:00
Robin Sommer
eb508fae52 Fixing memory (and CPU) leak in log writer.
There was larger bug with remote logging when local writing was
disabled, as in the cluster.

Also fixing a number of smaller "potential" leaks.
2011-08-05 12:02:25 -07:00
Gregor Maier
8910cd2dca Adding support to de-capsulate tunnels. Checkpoint.
Re-organizing code. Adding UDP tunnel handlers.
Using policy level redef'able consts to tune behavior. UDP port settings
not working yet.
2011-08-04 15:25:13 -07:00