zeek-dev December 2013

zeek-dev@lists.zeek.org

90 discussions

[Bro-Dev] [JIRA] (BIT-1097) Unexpected string indexing behavior

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1097?page=com.atlassian.jira.p… ] Jon Siwek edited comment on BIT-1097 at 12/4/13 2:30 PM: --------------------------------------------------------- {quote} how does one get "everything until the end of the string"? Python has a[5:] for that. {quote} {{a[5:|a|]}} ? I.e. {{a[5:]}} is like {{a[5:len(a)]}} in Python. Probably wouldn't be hard to add the shorthand, I can take a look. was (Author: jsiwek): {quote} how does one get "everything until the end of the string"? Python has a[5:] for that. {quote} {{a[5:|5|]}} ? I.e. {{a[5:]}} is like {{a[5:len(a)]}} in Python. Probably wouldn't be hard to add the shorthand, I can take a look. > Unexpected string indexing behavior > ----------------------------------- > > Key: BIT-1097 > URL: https://bro-tracker.atlassian.net/browse/BIT-1097 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.2 > Reporter: Robin Sommer > > Playing with string indexing/slicing, I'm seeing some (I think) non-intuitive behavior: > {code} > global s = "012345"; > print "A"; > print s[1:-1]; > print s[1:-2]; > print s[1:-3]; > print s[1:-4]; > print s[1:-5]; > print s[1:-6]; > print s[1:-7]; > print s[1:-8]; > print s[1:-9]; > print ""; > print "B"; > print s[-1:-1]; > print s[-1:-2]; > print s[-1:-3]; > print s[-1:-4]; > {code} > This prints: > {code} > A > 12345 > 1234 > 123 > 12 > 1 > 12345 > 12345 > 12345 > B > 5 > 5 > 5 > {code} > I would instead have expected: > (1) A to print empty lines for all cases with the 2nd index <= -6? > (2) B to print empty lines for all cases with the 2nd index <= -2? > So, is this intentional? -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

[Bro-Dev] [JIRA] (BIT-1097) Unexpected string indexing behavior

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1097?page=com.atlassian.jira.p… ] Jon Siwek commented on BIT-1097: -------------------------------- {quote} how does one get "everything until the end of the string"? Python has a[5:] for that. {quote} {{a[5:|5|]}} ? I.e. {{a[5:]}} is like {{a[5:len(a)]}} in Python. Probably wouldn't be hard to add the shorthand, I can take a look. > Unexpected string indexing behavior > ----------------------------------- > > Key: BIT-1097 > URL: https://bro-tracker.atlassian.net/browse/BIT-1097 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.2 > Reporter: Robin Sommer > > Playing with string indexing/slicing, I'm seeing some (I think) non-intuitive behavior: > {code} > global s = "012345"; > print "A"; > print s[1:-1]; > print s[1:-2]; > print s[1:-3]; > print s[1:-4]; > print s[1:-5]; > print s[1:-6]; > print s[1:-7]; > print s[1:-8]; > print s[1:-9]; > print ""; > print "B"; > print s[-1:-1]; > print s[-1:-2]; > print s[-1:-3]; > print s[-1:-4]; > {code} > This prints: > {code} > A > 12345 > 1234 > 123 > 12 > 1 > 12345 > 12345 > 12345 > B > 5 > 5 > 5 > {code} > I would instead have expected: > (1) A to print empty lines for all cases with the 2nd index <= -6? > (2) B to print empty lines for all cases with the 2nd index <= -2? > So, is this intentional? -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

[Bro-Dev] [JIRA] (BIT-1101) Merge topic/bernhard/ssl_ciphers_vector

by Bernhard Amann (JIRA)

Bernhard Amann created BIT-1101: ----------------------------------- Summary: Merge topic/bernhard/ssl_ciphers_vector Key: BIT-1101 URL: https://bro-tracker.atlassian.net/browse/BIT-1101 Project: Bro Issue Tracker Issue Type: Improvement Components: Bro Affects Versions: git/master Reporter: Bernhard Amann Fix For: 2.3 topic/bernhard/ssl_ciphers_vector changes ciphers in the ssl_client_hello from a set into a vector. This preserves the ordering of the cipher suites the client sent, allowing e.g. better client fingerprinting. -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

[Bro-Dev] [JIRA] (BIT-1101) Merge topic/bernhard/ssl_ciphers_vector

by Bernhard Amann (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1101?page=com.atlassian.jira.p… ] Bernhard Amann updated BIT-1101: -------------------------------- Status: Merge Request (was: Open) > Merge topic/bernhard/ssl_ciphers_vector > --------------------------------------- > > Key: BIT-1101 > URL: https://bro-tracker.atlassian.net/browse/BIT-1101 > Project: Bro Issue Tracker > Issue Type: Improvement > Components: Bro > Affects Versions: git/master > Reporter: Bernhard Amann > Fix For: 2.3 > > > topic/bernhard/ssl_ciphers_vector changes ciphers in the ssl_client_hello from a set into a vector. This preserves the ordering of the cipher suites the client sent, allowing e.g. better client fingerprinting. -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

[Bro-Dev] [JIRA] (BIT-1097) Unexpected string indexing behavior

by Robin Sommer (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1097?page=com.atlassian.jira.p… ] Robin Sommer commented on BIT-1097: ----------------------------------- yeah, looks better, but I think it's now missing another piece: with the changed semantics for the end position, how does one get "everything until the end of the string"? Python has {{a[5:]}} for that. > Unexpected string indexing behavior > ----------------------------------- > > Key: BIT-1097 > URL: https://bro-tracker.atlassian.net/browse/BIT-1097 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.2 > Reporter: Robin Sommer > > Playing with string indexing/slicing, I'm seeing some (I think) non-intuitive behavior: > {code} > global s = "012345"; > print "A"; > print s[1:-1]; > print s[1:-2]; > print s[1:-3]; > print s[1:-4]; > print s[1:-5]; > print s[1:-6]; > print s[1:-7]; > print s[1:-8]; > print s[1:-9]; > print ""; > print "B"; > print s[-1:-1]; > print s[-1:-2]; > print s[-1:-3]; > print s[-1:-4]; > {code} > This prints: > {code} > A > 12345 > 1234 > 123 > 12 > 1 > 12345 > 12345 > 12345 > B > 5 > 5 > 5 > {code} > I would instead have expected: > (1) A to print empty lines for all cases with the 2nd index <= -6? > (2) B to print empty lines for all cases with the 2nd index <= -2? > So, is this intentional? -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

Re: [Bro-Dev] [Bro-Commits] [git/broccoli] topic/jsiwek/broccoli-vectors: Add support for consuming events w/ vector args. (de39868)

by Robin Sommer

What's the motivation for adding vector support? Is that needed for something specific? On Tue, Dec 03, 2013 at 09:34 -0800, Jonathan Siwek wrote: > a user would need. And that doesn't seem worth getting in to for now. Agreed, I don't think it's worth spending too much time on beefing up Broccoli further given that we want to replace it anyways. Also, Broccoli can't recreate pointer structures, as Bro does; which is more important for compound types. That's one part of the reason why support isn't there. Robin -- Robin Sommer * Phone +1 (510) 722-6541 * robin(a)icir.org ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org/robin

7 years, 1 month

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ------------ ------------ ---------- ---------- ------------- ---------- ----------------------------------- BIT-1100 [1] Bro,Broccoli Jon Siwek - 2013-12-03 2.3 Normal topic/jsiwek/broccoli-vectors [2] BIT-1098 [3] Bro,Broccoli Jon Siwek - 2013-11-25 2.3 Normal topic/jsiwek/broxygen [4] BIT-1097 [5] Bro Robin Sommer - 2013-12-03 - Normal Unexpected string indexing behavior Open Fastpath Commits ====================== Commit Component Author Date Summary ----------- ----------- --------- ---------- -------------------------------------------------- 2ea6011 [6] bro Jon Siwek 2013-12-03 Improve a unit test involving 'when' conditionals. [1] BIT-1100 https://bro-tracker.atlassian.net/browse/BIT-1100 [2] broccoli-vectors https://github.com/bro/bro,broccoli/tree/topic/jsiwek/broccoli-vectors [3] BIT-1098 https://bro-tracker.atlassian.net/browse/BIT-1098 [4] broxygen https://github.com/bro/bro,broccoli/tree/topic/jsiwek/broxygen [5] BIT-1097 https://bro-tracker.atlassian.net/browse/BIT-1097 [6] 2ea6011 https://github.com/bro/bro/commit/2ea6011186e91dff37c639667b1604d837363908

7 years, 1 month

[Bro-Dev] [JIRA] (BIT-1097) Unexpected string indexing behavior

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1097?page=com.atlassian.jira.p… ] Jon Siwek updated BIT-1097: --------------------------- Status: Merge Request (was: Open) > Unexpected string indexing behavior > ----------------------------------- > > Key: BIT-1097 > URL: https://bro-tracker.atlassian.net/browse/BIT-1097 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.2 > Reporter: Robin Sommer > > Playing with string indexing/slicing, I'm seeing some (I think) non-intuitive behavior: > {code} > global s = "012345"; > print "A"; > print s[1:-1]; > print s[1:-2]; > print s[1:-3]; > print s[1:-4]; > print s[1:-5]; > print s[1:-6]; > print s[1:-7]; > print s[1:-8]; > print s[1:-9]; > print ""; > print "B"; > print s[-1:-1]; > print s[-1:-2]; > print s[-1:-3]; > print s[-1:-4]; > {code} > This prints: > {code} > A > 12345 > 1234 > 123 > 12 > 1 > 12345 > 12345 > 12345 > B > 5 > 5 > 5 > {code} > I would instead have expected: > (1) A to print empty lines for all cases with the 2nd index <= -6? > (2) B to print empty lines for all cases with the 2nd index <= -2? > So, is this intentional? -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

[Bro-Dev] [JIRA] (BIT-1097) Unexpected string indexing behavior

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1097?page=com.atlassian.jira.p… ] Jon Siwek commented on BIT-1097: -------------------------------- Looked pretty wrong to me, too. See if topic/jsiwek/string-slicing-fix is better. > Unexpected string indexing behavior > ----------------------------------- > > Key: BIT-1097 > URL: https://bro-tracker.atlassian.net/browse/BIT-1097 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.2 > Reporter: Robin Sommer > > Playing with string indexing/slicing, I'm seeing some (I think) non-intuitive behavior: > {code} > global s = "012345"; > print "A"; > print s[1:-1]; > print s[1:-2]; > print s[1:-3]; > print s[1:-4]; > print s[1:-5]; > print s[1:-6]; > print s[1:-7]; > print s[1:-8]; > print s[1:-9]; > print ""; > print "B"; > print s[-1:-1]; > print s[-1:-2]; > print s[-1:-3]; > print s[-1:-4]; > {code} > This prints: > {code} > A > 12345 > 1234 > 123 > 12 > 1 > 12345 > 12345 > 12345 > B > 5 > 5 > 5 > {code} > I would instead have expected: > (1) A to print empty lines for all cases with the 2nd index <= -6? > (2) B to print empty lines for all cases with the 2nd index <= -2? > So, is this intentional? -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

[Bro-Dev] [JIRA] (BIT-1099) ./build/bro-git-20131129/lib/broctl/plugins/lb_myricom.py

by tyler.schoenke (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1099?page=com.atlassian.jira.p… ] tyler.schoenke commented on BIT-1099: ------------------------------------- Hi Vlad, I thought it was causing the workers to not start, but I am unable to replicate the issue. I would say disregard. Thanks for the explanation of the SNF1 code. Tyler > ./build/bro-git-20131129/lib/broctl/plugins/lb_myricom.py > --------------------------------------------------------- > > Key: BIT-1099 > URL: https://bro-tracker.atlassian.net/browse/BIT-1099 > Project: Bro Issue Tracker > Issue Type: Problem > Components: BroControl > Affects Versions: git/master > Environment: RHEL6 > Myricom 10G > Reporter: tyler.schoenke > Labels: Myricom, RHEL6 > > Hi All, > First, unrelated, thanks for fixing whatever was wrong with PktSrc.cc:222. I was core dumping on that with the Myricom 10G until I upgraded to the latest git version of Bro. > I had been running with my Myricom environment variables configured in .bash_profile, but decided to move them to etc/node.cfg because that feature is now available in Bro 2.2. > When I tried to start the workers, they failed and I got the message to run diag. When I ran diag, I noticed it showed the following. > 28366 snf.0.-1 P (environ) SNF_DATARING_SIZE = 2147483648 (0x80000000) (2048.0 MiB) > 28366 snf.0.-1 P (default) SNF_DESCRING_SIZE = 536870912 (0x20000000) (512.0 MiB) > 28366 snf.0.-1 P (userset) SNF_FLAGS = 257 (0x101) > 28366 snf.0.-1 P (environ) SNF_DEBUG_MASK = 3 (0x3) > 28366 snf.0.-1 P (default) SNF_DEBUG_FILENAME = stderr > Everything looks great except for SNF_FLAGS. Myricom defaults it to 0x1, and that was working when I ran bro from the command line. > I found it was getting set in ./build/bro-git-20131129/lib/broctl/plugins/lb_myricom.py > According to /opt/snf/include/snf.h, the only valid values for SNF_FLAGS are 0x1, 0x2, and 0x300. No possible combination of those will add up to 0x101. I'm guessing that is a typo. If not, please explain why it is defaulted to that, otherwise you may want to default to 0x1. > Thanks, > Tyler -- This message was sent by Atlassian JIRA (v6.2-OD-03#6206)

7 years, 1 month

← Newer
1
2
3
4
5
6
7
8
9
Older →

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

zeek-dev December 2013