Commit graph

1290 commits

Author SHA1 Message Date
Daniel Thayer
32d7c96cd4 Update test and baseline for a recent doc test fix 2013-10-25 15:11:20 -05:00
Robin Sommer
8ce3865bd2 Updating baselines for packet filter changes. 2013-10-24 14:31:23 -07:00
Robin Sommer
26c01468f5 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  temporary osx mavericks libc++ issue workaround.
  Change test of identify_data BIF to ignore charset.
2013-10-24 13:07:49 -07:00
Seth Hall
ccc7b7669d Merge remote-tracking branch 'origin/topic/seth/fix-packetfilter-log'
* origin/topic/seth/fix-packetfilter-log:
  Hack to make sure that the starting BPF filter is logged on clusters.
2013-10-24 15:36:17 -04:00
Seth Hall
af6e44589f Hack to make sure that the starting BPF filter is logged on clusters. 2013-10-24 14:55:37 -04:00
Jon Siwek
eab886fb84 Change test of identify_data BIF to ignore charset.
It may vary with libmagic version.
2013-10-23 16:51:55 -05:00
Robin Sommer
08e6b6b4b4 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix record coercion tolerance of optional fields.
  Add NEWS about incompatible local.bro changes, addresses BIT-1047.
  Fix minor formatting problem in NEWS.
2013-10-23 09:50:47 -07:00
Jon Siwek
7e95755ce5 Fix record coercion tolerance of optional fields.
There were cases where coercing a record value with an uninitialized
field could cause a null pointer dereference even though the field
can validly be unset since it has &optional.
2013-10-23 11:37:23 -05:00
Daniel Thayer
9374a7d584 Fix typos and formatting in the policy/protocols docs
Also updated a test related to these changes, and adjusted line numbers.
2013-10-21 02:34:28 -05:00
Daniel Thayer
24da7ab839 Fix typos and formatting in the policy/frameworks docs
Also updated some tests related to these changes.
2013-10-21 01:23:08 -05:00
Robin Sommer
8bfb81ca6f Moving the SQLite examples into separate Bro files to turn them into
sphinx-btest tests.

It's hard to make sure these are actually working as expected, but the
tests now at least make sure things parse correctly.
2013-10-18 14:18:33 -07:00
Robin Sommer
1759e0d687 Updating test baseline. 2013-10-18 13:59:56 -07:00
Robin Sommer
615cca8baa Merge remote-tracking branch 'origin/topic/dnthayer/doc-changes-for-2.2'
Snapshotting the work in this branch. I'll merge it again later as we
get closer to the release.

* origin/topic/dnthayer/doc-changes-for-2.2: (29 commits)
  Add README files for base/protocols
  Fix incorrect uses of reST directives
  Fix typos and formatting in the BiFs docs
  Fix typos and formatting in the base/utils docs
  Fix typos and formatting in the other protocol docs
  Fix typos and formatting in the ssl protocol docs
  Fix typos and formatting in the http protocol docs
  Fix typos and formatting in the ftp protocol docs
  Fix typos and formatting in the dns protocol docs
  Fix typos and formatting in the dhcp protocol docs
  Adjust line numbers to match changes in conn/main.bro
  Fix typos and formatting in the conn protocol docs
  Update FreeBSD install instructions
  Improvements to file analysis docs
  Add README files for most Bro frameworks
  Fix typos and formatting in various other framework docs
  Fix typos and formatting in the software framework docs
  Fix typos and formatting in the sumstats docs
  Fix typos and formatting in the packet filter docs
  Fix typos and formatting in the logging framework docs
  ...
2013-10-18 13:49:49 -07:00
Bernhard Amann
363cfb8506 rename the dbname configuration option to tablename.
Sorry for this - I noticed that I named this option quite unfortunately
while writing the documentation.

The patch also removes the dbname configuration option from the sqlite
input reader - it was not used there at all anymore (and I did not notice
that).
2013-10-17 12:24:40 -07:00
Daniel Thayer
fe60404f0f Fix typos and formatting in the http protocol docs
Also adjusted line numbers in scripting doc due to changes in http/main.bro
2013-10-16 13:13:53 -05:00
Daniel Thayer
f0f1918954 Merge remote-tracking branch 'origin/master' into topic/dnthayer/doc-changes-for-2.2 2013-10-14 17:26:52 -05:00
Daniel Thayer
1d23f055ba Add check for sqlite3 command to tests that require it 2013-10-14 15:05:06 -05:00
Robin Sommer
2e05978210 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Add check for curl command to active-http.test

I've moved the check from TEST-EXEC to TEST-REQUIRES. I think it's
fine to just skip the test if curl is not available.
2013-10-14 09:27:14 -07:00
Daniel Thayer
fdb6d190b8 Add check for curl command to active-http.test
Added a check if the curl command is available when running the
active-http.test so that it fails more quickly and with a clear error
message if it's not available.
2013-10-13 20:31:48 -05:00
Daniel Thayer
93c1073673 Merge remote-tracking branch 'origin/master' into topic/dnthayer/doc-changes-for-2.2 2013-10-11 23:16:57 -05:00
Jon Siwek
ee01a67e06 Improve Broxygen end-of-sentence detection.
This is used to display short summaries for things based on the first
sentence in the comments for it, but wouldn't work well when e.g. a
filename is used there.
2013-10-11 13:27:04 -05:00
Daniel Thayer
bd47115c84 Convert File Analysis examples to using btest sphinx
Converted hard-coded examples in the File Analysis framework document
to using btest sphinx.
2013-10-09 23:41:37 -05:00
Robin Sommer
364cdb8604 Updating Sphinx tests for manual. 2013-10-07 16:48:38 -07:00
Jon Siwek
9c2a3124e0 Merge branch 'master' into topic/jsiwek/coverity 2013-09-23 14:55:46 -05:00
Robin Sommer
d070b01828 Updating baselines for doc changes. 2013-09-20 14:38:45 -07:00
Robin Sommer
589a0239be Merge remote-tracking branch 'origin/topic/srunnels/documentation'
* origin/topic/srunnels/documentation:
  Spelling corrections.
  Include a better description for detect-MHR.bro
  Rewrite the MHR detection description.
  Spelling corrections.
  Update the lines included from events.bif.bro.
2013-09-20 14:36:55 -07:00
Jon Siwek
1750e351c4 Prevent division/modulo by zero in scripts.
Integral/floating-point division/modulo by zero in C++ is undefined
behavior, so to prevent such cases in a script from crashing Bro,
they're now reported as an error (with script location information) and
the event handler in which it occurred returns immediately.
2013-09-20 16:36:00 -05:00
Bernhard Amann
c40a97156a make client and server random available on script-level.
Patch by ewust

Addresses BIT-950
2013-09-11 12:39:23 -07:00
Jon Siwek
4e8ba6eaa2 Fix signatures that use identifiers of type table. 2013-09-05 13:01:40 -05:00
Jon Siwek
7799a86a7f Adjust HLL cluster leak test so leaks trigger a failure. 2013-09-04 16:53:58 -05:00
Jon Siwek
3939b629ae Adjust DNS memory leak test to actually fail if there's a leak. 2013-09-04 16:49:04 -05:00
Jon Siwek
62de5678f7 Fix memory leak in DNS TXT lookups. 2013-09-04 16:47:44 -05:00
Robin Sommer
2392a29b7f Redoing doc.sphinx baselines. 2013-08-31 18:10:09 -07:00
Robin Sommer
ac66db286a Merge remote-tracking branch 'origin/topic/documentation'
I'm merging in the documentation branch to avoid that it keeps getting
out of sync. We still need to work on this a bit more, I'll summarize
in a mail.

* origin/topic/documentation: (68 commits)
  Going over initial parts of the scripting overview.
  Adding lines in scripting/index.txt. No other change.
  Updating submodule.
  Pass over the Using Bro section.
  Applying doc updates from BIT-1063. (Anthony Verez)
  Breaking lines in using/*.
  More doc reorg, and a light pass over the first 3 sections.
  Starting to put a new structure in place.
  Updating submodule(s).
  Updating submodule(s).
  Adding some temporary testing/demonstration to front page.
  Switching btest to topic/robin/parts branch.
  Basic cross-referencing UIDs between files, btests, and baselines.
  A truly embarassing number of spelling corrections.
  Using redirection with bro-cut.  Include initial btests for this document.
  Corrected a mis-typed RST include.
  Initial start for "Using Bro".
  Spelling corrections.
  Include Notice Policy shortcuts in the Scripting User Manual.
  Notice::policy hooks and tests.
  ...

Conflicts:
	src/3rdparty
2013-08-31 16:07:44 -07:00
Robin Sommer
a8ac7d8a5b Updating tests for HLL merge. 2013-08-31 11:17:49 -07:00
Robin Sommer
41cab5e0dd Updating tests. 2013-08-31 10:47:19 -07:00
Robin Sommer
295987c8d0 Making the confidence configurable. 2013-08-31 10:34:50 -07:00
Robin Sommer
b74bf10565 Going over initial parts of the scripting overview.
I made a light pass over the text. Switched the includes over to the
new btest-include and adapted the other TEXT-EXECs a bit.

Also includes more tweaking all over the Sphinx setup.
2013-08-30 16:23:17 -07:00
Robin Sommer
4dcf8fc0db Merge remote-tracking branch 'origin/topic/bernhard/hyperloglog'
* origin/topic/bernhard/hyperloglog: (32 commits)
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  change plugin after feedback of seth
  Forgot a file. Again. Like always. Basically.
  do away with old file.
  ...
2013-08-30 11:30:05 -07:00
Bernhard Amann
2dd0d057e6 Merge remote-tracking branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/NetVar.cc
	src/NetVar.h
2013-08-30 08:43:47 -07:00
Jon Siwek
dc2e3d6e04 Fix global opaque val segfault, addresses BIT-1071
The opaque types need to be created before scripts are parsed.
2013-08-29 17:17:40 -05:00
Bernhard Amann
4cd20c6375 add clustered leak test for hll. No issues. 2013-08-29 14:01:22 -07:00
Jon Siwek
fb8b78840b Fix bloom filter memory leaks. 2013-08-29 11:24:24 -05:00
Robin Sommer
6373d817a5 Merge remote-tracking branch 'origin/topic/jsiwek/uid'
Thanks!

* origin/topic/jsiwek/uid:
  Add bits_per_uid unit test, addressing BIT0-1016.
  UID optimizations addressing BIT-1016.

BIT-1016 #merged
2013-08-28 18:57:00 -07:00
Bernhard Amann
dc9fd36497 Merge remote branch 'origin/master' into topic/bernhard/hyperloglog 2013-08-28 17:48:59 -07:00
Jon Siwek
7a2972d0e4 Add bits_per_uid unit test, addressing BIT0-1016. 2013-08-28 16:12:11 -05:00
Seth Hall
0592b528ef Merge branch 'master' of ssh://git.bro-ids.org/bro 2013-08-28 00:58:03 -04:00
Seth Hall
2b78922af8 Added a $unique_max field to Reducers for the SumStats::UNIQUE calculation
- Using the new option in scan.bro and the FTP bruteforce detection.
2013-08-28 00:57:44 -04:00
Robin Sommer
f46f692185 Merge remote-tracking branch 'origin/topic/bernhard/hexstr'
BIT-1069 #merged

* origin/topic/bernhard/hexstr:
  add hexstr_to_bytestring bif that does exactly the opposite of bytestring_to_hexstr.
2013-08-27 13:30:25 -07:00
Bernhard Amann
8a5a2b5b39 add hexstr_to_bytestring bif that does exactly the opposite of
bytestring_to_hexstr.
2013-08-27 12:20:03 -07:00