Hi,
I believe I came across a minor bug in the 0.94 and 0.97 bro code. I'm still new to this project, so it is possible the problem is a user error.
In short, when TCP_Connection::SetContentsFile is called with the CONTENTS_BOTH value as the direction, the BroFile object reference counter needs to be incremented else one will encounter an internal reference count error. (or something similar, I don't recall the exact message). In the 0.94 build the program would immediately exit.
Notes:
- below is a temporary work around that i added. I'm not that familiar with the bro code so I imagine there are other solutions and I'm not recommending one over another.
- here is an outline/fragment of a bro script to generate the error.
event connection_established( c: connection )
{
# 1. see if appropriate protocol/port is being used
local filename: string;
local f : file;
# 2. NOTE: construct appropriate filename here
f = open(filename);
set_contents_file(c$id,CONTENTS_BOTH,f);
}
Please let me know if you'd like additional information.
John
//-----------------------------------------------------------------------