zeek-dev April 2013

zeek-dev@lists.zeek.org

45 discussions

[Bro-Dev] #974: segmentation fault with schedule statement

by Bro Tracker

#974: segmentation fault with schedule statement ------------------------+--------------------- Reporter: dmandelb | Type: Problem Status: new | Priority: Low Milestone: Bro2.2 | Component: Bro Version: git/master | Keywords: ------------------------+--------------------- A schedule statement in global scope reliably causes a segmentation fault for me: {{{ $ cat test.bro event foo() { print("Foo!"); } schedule 1 sec { foo() }; $ bro test.bro Segmentation fault }}} I understand if the schedule statement should be in a bro_init event instead, I think an error message would be better than a segfault. -- Ticket URL: <http://tracker.bro.org/bro/ticket/974> Bro Tracker <http://tracker.bro.org/bro> Bro Issue Tracker

8 years, 3 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

8 years, 3 months

Re: [Bro-Dev] #927: topic/seth/metrics-merge: Metrics framework updates

by Bro Tracker

#927: topic/seth/metrics-merge: Metrics framework updates ----------------------------+------------------------ Reporter: seth | Owner: robin Type: Merge Request | Status: assigned Priority: Normal | Milestone: Bro2.2 Component: Bro | Version: git/master Resolution: | Keywords: ----------------------------+------------------------ Changes (by seth): * owner: seth => robin * type: Task => Merge Request Comment: Ready to merge. There is some problem with the coverage.bare-mode-errors test though and I need to stop messing with it, I just can't figure out the problem. Here's the output I get (seems to be some dependency issue): {{{ +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 37: no such field in record (SumStats::rv$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 40: no such field in record (SumStats::rv$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 47: no such field in record (SumStats::rv1?$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 48: no such field in record (SumStats::rv2?$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 50: no such field in record (SumStats::result$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 50: no such field in record (SumStats::rv1$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 52: no such field in record (SumStats::result$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins/././variance.bro, line 52: no such field in record (SumStats::rv2$average) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins /./std-dev.bro, line 20: no such field in record (SumStats::rv?$variance) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins /./std-dev.bro, line 21 and double: type mismatch (SumStats::rv$<error> and double) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins /./std-dev.bro, line 21: argument type mismatch in function call (sqrt(SumStats::rv$<error>)) +error in /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins /./std-dev.bro, line 21: no such field in record (SumStats::rv$variance) +error in double and /Users/seth/bro/bro.work8/scripts/base/frameworks/sumstats/./plugins /./std-dev.bro, line 21: arithmetic mixed with non-arithmetic (double and SumStats::rv$<error>) }}} There are equivalently named branches in the test suite repositories, but I left some issues in those unfixed because I'm not sure why they changed. They were mostly related to conn.log changes. -- Ticket URL: <http://tracker.bro.org/bro/ticket/927#comment:2> Bro Tracker <http://tracker.bro.org/bro> Bro Issue Tracker

8 years, 3 months

[Bro-Dev] Support for HTTP body extraction of originator

by Matthias Vallentin

The current HTTP body extraction mechanism only allows for recording responses: event http_entity_data(c: connection, is_orig: bool,... { # Client body extraction is not currently supported in this script. if ( is_orig ) return; Does anyone recall the reason for this? Later in the script, we have: local suffix = fmt("%s_%d.dat", is_orig ? "orig" : "resp", \ c$http_state$current_response); So simply removing the is_orig check readily enables extraction of HTTP request bodies, and also correctly tags the extraction file with "orig" or "resp". The current workaround at this point is to copy the entire event handler for http_entity_data and simply invert the above check, which is redundant and inefficient. Here's my suggestion: we'd introduce an enum that specifies the direction, e.g., ORIG, RESP, BOTH. Users can then decide what they'd like to have recorded. Matthias

8 years, 3 months

Re: [Bro-Dev] [Bro-Commits] [git/bro] topic/bernhard/topk: implement topk. (c21c18e)

by Matthias Vallentin

> This is _completely_ untested. It compiles. It will probably do > nothing else (well, besides crashing Bro). What algorithm do you use? Based on my own research, I found that we should use the Space-Saving algorithm that typically comes in the form of the Stream-Summary data structure. Matthias

8 years, 3 months

[Bro-Dev] would a patch for #981 be accepted?

by David Mandelberg

Hi, Is http://tracker.bro.org/bro/ticket/981 a bug, or did I misunderstand how the language is supposed to work? If I write a patch, would it be accepted (assuming it's of good quality)? I'm not sure if I'll be able to write the patch yet, but I'm trying to get a sense of how to move forward. -- David Eric Mandelberg / dseomn http://david.mandelberg.org/ Fri Apr 19 13:06:18 EDT 2013

8 years, 3 months

[Bro-Dev] #979: segmentation fault in Expr::Serialize

by Bro Tracker

#979: segmentation fault in Expr::Serialize ------------------------+--------------------- Reporter: dmandelb | Type: Problem Status: new | Priority: Low Milestone: Bro2.2 | Component: Bro Version: git/master | Keywords: ------------------------+--------------------- {{{ $ gdb --args ~/opt/bro/bin/bro -C -r reps/reps/traffic-generator/test- traffic.pcap reps/bro-scripts/bbn-host-characterization.bro GNU gdb (GDB) 7.0.1-debian Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i486-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /home/dmandelb/opt/bro/bin/bro...done. (gdb) r Starting program: /home/dmandelb/opt/bro/bin/bro -C -r reps/reps/traffic- generator/test-traffic.pcap reps/bro-scripts/bbn-host-characterization.bro [Thread debugging using libthread_db enabled] [New Thread 0xb7b27b70 (LWP 3035)] [New Thread 0xb71ffb70 (LWP 3036)] [New Thread 0xb69feb70 (LWP 3037)] [New Thread 0xb5fffb70 (LWP 3038)] Program received signal SIGSEGV, Segmentation fault. 0x00000000 in ?? () (gdb) bt #0 0x00000000 in ?? () #1 0x08301d14 in Expr::Serialize (this=0x8f69ce0, info=0xb60058d4) at /home/dmandelb/bro/src/Expr.cc:184 #2 0x08294b92 in Attributes::DoSerialize (this=0x8f69998, info=0xb60058d4) at /home/dmandelb/bro/src/Attr.cc:512 #3 0x083d4a63 in SerialObj::Serialize (this=0x8f69998, info=0xb60058d4) at /home/dmandelb/bro/src/SerialObj.cc:121 #4 0x08294950 in Attributes::Serialize (this=0x8f69998, info=0xb60058d4) at /home/dmandelb/bro/src/Attr.cc:487 #5 0x0835f111 in ID::DoSerialize (this=0x8f69790, info=0xb60058d4) at /home/dmandelb/bro/src/ID.cc:495 #6 0x083d4a63 in SerialObj::Serialize (this=0x8f69790, info=0xb60058d4) at /home/dmandelb/bro/src/SerialObj.cc:121 #7 0x0835e96e in ID::Serialize (this=0x8f69790, info=0xb60058d4) at /home/dmandelb/bro/src/ID.cc:311 #8 0x083d7af9 in Serializer::Serialize (this=0x85ce3f0, info=0xb60058d4, id=...) at /home/dmandelb/bro/src/Serializer.cc:111 #9 0x0839a133 in PersistenceSerializer::DoIDSerialization (this=0x85ce3f0, status=0xb60058d0, id=0x8f69790) at /home/dmandelb/bro/src/PersistenceSerializer.cc:498 #10 0x08399d06 in PersistenceSerializer::RunSerialization (this=0x85ce3f0, status=0xb60058d0) at /home/dmandelb/bro/src/PersistenceSerializer.cc:405 #11 0x083996ed in PersistenceSerializer::WriteState (this=0x85ce3f0, may_suspend=false) at /home/dmandelb/bro/src/PersistenceSerializer.cc:262 #12 0x08280a2e in done_with_network () at /home/dmandelb/bro/src/main.cc:258 #13 0x08282a2a in main (argc=5, argv=0xbffff2b4) at /home/dmandelb/bro/src/main.cc:1078 (gdb) }}} -- Ticket URL: <http://tracker.bro.org/bro/ticket/979> Bro Tracker <http://tracker.bro.org/bro> Bro Issue Tracker

8 years, 3 months

[Bro-Dev] #978: delete seems to invalidate set iteration

by Bro Tracker

#978: delete seems to invalidate set iteration ------------------------+--------------------- Reporter: dmandelb | Type: Problem Status: new | Priority: Low Milestone: Bro2.2 | Component: Bro Version: git/master | Keywords: ------------------------+--------------------- Deleting an element of a set inside of a for loop iterating over the set seems to cause unpredictable behavior. I think this should either be documented as a known non-feature or fixed. -- Ticket URL: <http://tracker.bro.org/bro/ticket/978> Bro Tracker <http://tracker.bro.org/bro> Bro Issue Tracker

8 years, 3 months

[Bro-Dev] #977: retransmit in connection history

by Bro Tracker

#977: retransmit in connection history -----------------------------+------------------------ Reporter: seth | Owner: Type: Feature Request | Status: new Priority: Low | Milestone: Bro2.2 Component: Bro | Version: git/master Keywords: | -----------------------------+------------------------ In the connection record's $history field, it would be useful to include another character to indicate retransmits sent during the connection. I think that T and t for first orig and resp retransmit respectively would be appropriate. -- Ticket URL: <http://tracker.bro.org/bro/ticket/977> Bro Tracker <http://tracker.bro.org/bro> Bro Issue Tracker

8 years, 3 months

[Bro-Dev] merge status emails?

by Seth Hall

Are those broken? .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/

8 years, 3 months

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

zeek-dev April 2013