diff --git a/NEWS b/NEWS index e726382b58..ff3c5be3dc 100644 --- a/NEWS +++ b/NEWS @@ -64,6 +64,13 @@ Changed Functionality but mainly for providing comparisons, which is why this is not a breaking change. +- The tuning/defaults policy has been deprecated and will be removed in + v7.1. This policy was already being loaded by default via local.zeek. The + settings contained within have become the overall defaults for Zeek now, + instead of having to load the policy. The two changes here are that fragments + now timeout after 5 minutes by default instead of no timeout, and extracted + files now have a default size limit of 100MB instead of unlimited. + Removed Functionality --------------------- diff --git a/scripts/base/files/extract/main.zeek b/scripts/base/files/extract/main.zeek index 24cdb151c9..13d4317d30 100644 --- a/scripts/base/files/extract/main.zeek +++ b/scripts/base/files/extract/main.zeek @@ -8,8 +8,8 @@ export { const prefix = "./extract_files/" &redef; ## The default max size for extracted files (they won't exceed this - ## number of bytes). A value of zero means unlimited. - option default_limit = 0; + ## number of bytes). A value of zero means unlimited. Defaults to 100MB. + option default_limit = 104857600; ## This setting configures if the file extract limit is inclusive ## of missing bytes. By default, missing bytes do count towards the diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index dd0371ab09..7f2cf73646 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -1491,7 +1491,7 @@ const rpc_timeout = 24 sec &redef; ## How long to hold onto fragments for possible reassembly. A value of 0.0 ## means "forever", which resists evasion, but can lead to state accrual. -const frag_timeout = 0.0 sec &redef; +const frag_timeout = 5 min &redef; ## Whether to use the ``ConnSize`` analyzer to count the number of packets and ## IP-level bytes transferred by each endpoint. If true, these values are diff --git a/scripts/policy/tuning/defaults/__load__.zeek b/scripts/policy/tuning/defaults/__load__.zeek index 2b574a6845..09bacaace3 100644 --- a/scripts/policy/tuning/defaults/__load__.zeek +++ b/scripts/policy/tuning/defaults/__load__.zeek @@ -1,3 +1 @@ -@load ./packet-fragments -@load ./warnings -@load ./extracted_file_limits +@deprecated "Remove in v7.1 The policy/tuning/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; diff --git a/scripts/policy/tuning/defaults/extracted_file_limits.zeek b/scripts/policy/tuning/defaults/extracted_file_limits.zeek index 8e2731b99e..09bacaace3 100644 --- a/scripts/policy/tuning/defaults/extracted_file_limits.zeek +++ b/scripts/policy/tuning/defaults/extracted_file_limits.zeek @@ -1,4 +1 @@ -@load base/files/extract - -# 100 MB. -redef FileExtract::default_limit = 104857600; +@deprecated "Remove in v7.1 The policy/tuning/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; diff --git a/scripts/policy/tuning/defaults/packet-fragments.zeek b/scripts/policy/tuning/defaults/packet-fragments.zeek index 7ae0e4363c..09bacaace3 100644 --- a/scripts/policy/tuning/defaults/packet-fragments.zeek +++ b/scripts/policy/tuning/defaults/packet-fragments.zeek @@ -1,12 +1 @@ -# Capture TCP fragments, but not UDP (or ICMP), since those are a lot more -# common due to high-volume, fragmenting protocols such as NFS :-(. - -# This normally isn't used because of the default open packet filter -# but we set it anyway in case the user is using a packet filter. -# Note: This was removed because the default model now is to have a wide -# open packet filter. -#redef capture_filters += { ["frag"] = "(ip[6:2] & 0x3fff != 0) and tcp" }; - -## Shorten the fragment timeout from never expiring to expiring fragments after -## five minutes. -redef frag_timeout = 5 min; +@deprecated "Remove in v7.1 The policy/tuning/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; diff --git a/scripts/policy/tuning/defaults/warnings.zeek b/scripts/policy/tuning/defaults/warnings.zeek index 0220fc78de..09bacaace3 100644 --- a/scripts/policy/tuning/defaults/warnings.zeek +++ b/scripts/policy/tuning/defaults/warnings.zeek @@ -1,11 +1 @@ -##! This file is meant to print messages on stdout for settings that would be -##! good to set in most cases or other things that could be done to achieve -##! better detection. - -@load base/utils/site - -event zeek_init() &priority=-10 - { - if ( |Site::local_nets| == 0 ) - print "WARNING: No Site::local_nets have been defined. It's usually a good idea to define your local networks."; - } +@deprecated "Remove in v7.1 The policy/tuning/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; diff --git a/scripts/site/local.zeek b/scripts/site/local.zeek index 6935c6c4d0..328c823975 100644 --- a/scripts/site/local.zeek +++ b/scripts/site/local.zeek @@ -9,9 +9,6 @@ redef digest_salt = "Please change this value."; # This script logs which scripts were loaded during each run. @load misc/loaded-scripts -# Apply the default tuning scripts for common tuning settings. -@load tuning/defaults - # Estimate and log capture loss. @load misc/capture-loss diff --git a/testing/btest/Baseline/coverage.bare-mode-errors/errors b/testing/btest/Baseline/coverage.bare-mode-errors/errors index b1bb951e92..96bd73c166 100644 --- a/testing/btest/Baseline/coverage.bare-mode-errors/errors +++ b/testing/btest/Baseline/coverage.bare-mode-errors/errors @@ -1,2 +1,15 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### NOTE: This file has been sorted with diff-sort. +warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/__load__.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/warnings.zeek, line 1: deprecated script loaded from command line arguments "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; diff --git a/testing/btest/Baseline/coverage.test-all-policy-cluster/.stderr b/testing/btest/Baseline/coverage.test-all-policy-cluster/.stderr index bff9a64e41..c27d68e2df 100644 --- a/testing/btest/Baseline/coverage.test-all-policy-cluster/.stderr +++ b/testing/btest/Baseline/coverage.test-all-policy-cluster/.stderr @@ -1,5 +1,21 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; received termination signal +warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; received termination signal +warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; received termination signal +warning in <...>/__load__.zeek, line 1: deprecated script loaded from <...>/__load__.zeek:2 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/extracted_file_limits.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:147 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/packet-fragments.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:148 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; +warning in <...>/warnings.zeek, line 1: deprecated script loaded from <...>/test-all-policy.zeek:149 "Remove in v7.1 The policy<...>/defaults package is deprecated. The options set here are now the defaults for Zeek in general."; received termination signal diff --git a/testing/btest/Baseline/spicy.file-analyzer-nested/output-max b/testing/btest/Baseline/spicy.file-analyzer-nested/output-max index f973bfca9d..79eb90c938 100644 --- a/testing/btest/Baseline/spicy.file-analyzer-nested/output-max +++ b/testing/btest/Baseline/spicy.file-analyzer-nested/output-max @@ -1,7 +1,7 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. data3, FyjjRu4ARLzpsPLhNh, data3, Fz3QLf4Bn4qaQwyUdk, -depth warning, FyjjRu4ARLzpsPLhNh, [chunk_event=, stream_event=, extract_filename=, extract_limit=0, extract_limit_includes_missing=T], 2 -depth warning, Fz3QLf4Bn4qaQwyUdk, [chunk_event=, stream_event=, extract_filename=, extract_limit=0, extract_limit_includes_missing=T], 2 +depth warning, FyjjRu4ARLzpsPLhNh, [chunk_event=, stream_event=, extract_filename=, extract_limit=104857600, extract_limit_includes_missing=T], 2 +depth warning, Fz3QLf4Bn4qaQwyUdk, [chunk_event=, stream_event=, extract_filename=, extract_limit=104857600, extract_limit_includes_missing=T], 2 data2, F2Qpmk14ATv4vFSEsi, from 1:hello world data1, FcRmxz1fPbKQEgGGUi, hello world