Commit graph

3486 commits

Author SHA1 Message Date
Arne Welzel
4f8a6a1dfc Merge remote-tracking branch 'origin/topic/awelzel/4177-4178-custom-event-metadata-prework'
* origin/topic/awelzel/4177-4178-custom-event-metadata-prework:
  Event/EventMgr: protected to private
  EventHandler: Deprecate Call(args, no_remote, ts), add Call(args)
  EventHandler: Header cleanup
  EventMgr: Do not cache current event attributes
  EventMgr: Drop src_val
  Event: Header cleanup
2025-03-31 14:22:17 +02:00
Tim Wojtulewicz
edbe8f0831 Merge remote-tracking branch 'origin/topic/timw/pass-tags-for-storage-events'
* origin/topic/timw/pass-tags-for-storage-events:
  Make storage events take a tag for the backend instead of a string
  Add move constructor to Tag class
2025-03-27 16:12:53 -07:00
Tim Wojtulewicz
ed47eedd6a Merge remote-tracking branch 'origin/topic/timw/storage-timeout-testing'
* origin/topic/timw/storage-timeout-testing:
  Fix handling of timeout conditions from storage backends
  Reformat plugin.storage btest to be more consistent with other storage tests
2025-03-27 14:10:39 -07:00
Christian Kreibich
656e88eaa8 Merge branch 'topic/christian/unexperimental-quic-histories'
* topic/christian/unexperimental-quic-histories:
  Remove "experimental" from the QUIC history field's comment string [skip ci]
2025-03-27 12:41:03 -07:00
Arne Welzel
acab4236e2 Merge remote-tracking branch 'origin/topic/awelzel/zeromq-no-fprintf-at-overload'
* origin/topic/awelzel/zeromq-no-fprintf-at-overload:
  cluster/zeromq: Improve XPUB stall behavior, add a metric
2025-03-26 14:24:02 +01:00
Arne Welzel
cd9b37e4a5 Merge remote-tracking branch 'origin/topic/awelzel/4309-telemetry-collect-calbacks'
* origin/topic/awelzel/4309-telemetry-collect-calbacks:
  telemetry: Run callbacks at collect time
2025-03-26 14:08:40 +01:00
Arne Welzel
33d7e5a7bf Merge remote-tracking branch 'origin/topic/awelzel/zeromq-unsubscription-visibility'
* origin/topic/awelzel/zeromq-unsubscription-visibility:
  cluster/OnLoop: Add metric for queue stalling instead of fprintf
  btest/cluster/websocket: ZeroMQ backend test
  cluster/OnLoop: Switch to condition variable
  cluster/zeromq: Fix node_topic() and nodeid_topic()
  cluster/websocket: Fix null deref at WebSocket server shutdown
  btest/cluster/websocket: Harden multi-client tests
  cluster/zeromq: Fix unsubscription visibility
2025-03-24 19:46:20 +01:00
Tim Wojtulewicz
bc38dbcc99 Merge remote-tracking branch 'origin/topic/timw/storage-framework-followup'
* origin/topic/timw/storage-framework-followup:
  Redis: Handle other errors from requests, fix KEY_EXISTS for put operations
  SQLite: handle existing keys when overwrite=F correctly
  Remove unnecessary type aliases from storage btests
  Avoid thread-leak in scripts.base.frameworks.file-analysis.bifs.enable-disable btest
  Fix data-race with calling DBG_LOG from a separate thread
  Fix data-race with ReturnCode objects in Sqlite::DoExpire
  Fix data race with calling run_state::network_time from a separate thread
  Add NEWS entry for Storage, reduce CHANGES spam
  Fix Coverity findings in the SQLite backend
  Remove inclusion of non-existent expected-lite path during dynamic plugin builds
  Squash code from OperationResultCallback into ResultCallback
  Add hiredis to generate-docs workflow to enable Redis backend
2025-03-21 11:57:17 -07:00
Tim Wojtulewicz
458bf762f1 Add NEWS entry for Storage, reduce CHANGES spam 2025-03-21 11:56:27 -07:00
Arne Welzel
0a6429d447 Merge remote-tracking branch 'origin/topic/awelzel/btest-bg-run-sleep-0'
* origin/topic/awelzel/btest-bg-run-sleep-0:
  testing/btest: Remove btest-bg-run sleep 1
2025-03-21 09:45:15 +01:00
Tim Wojtulewicz
0b590c575e Merge remote-tracking branch 'origin/topic/awelzel/allow-terminate-processing-from-non-main-thread'
* origin/topic/awelzel/allow-terminate-processing-from-non-main-thread:
  util: Fix terminate_processing() called from non-main thread
2025-03-19 12:47:48 -07:00
Tim Wojtulewicz
38484b6dc6 Merge remote-tracking branch 'origin/topic/vern/CPP-maint.Mar25'
* origin/topic/vern/CPP-maint.Mar25:
  minor baseline updates for -O gen-C++
  -O gen-C++ support for pattern-to-pattern comparison
  -O gen-C++ support for pattern vector comparisons
  -O gen-C++ support for type expressions
2025-03-19 12:46:52 -07:00
Tim Wojtulewicz
ba28dfe87e Merge remote-tracking branch 'origin/topic/timw/run-macos-ci-tests-as-root'
* origin/topic/timw/run-macos-ci-tests-as-root:
  CI: Run btests on macOS under sudo
2025-03-19 11:58:55 -07:00
Arne Welzel
f4d7243365 Merge remote-tracking branch 'origin/topic/awelzel/bump-zeekjs-0-16-0'
* origin/topic/awelzel/bump-zeekjs-0-16-0:
  Bump zeekjs to v0.16.0
2025-03-19 19:57:16 +01:00
Christian Kreibich
637baefd2c Merge branch 'topic/christian/is_valid_subnet'
* topic/christian/is_valid_subnet:
  Minor typo/markup fixes in NEWS.
  Add is_valid_subnet BiF
  Add btests for has_valid_octets() and normalize_mac()
2025-03-19 10:11:02 -07:00
Johanna Amann
7626039635 Merge remote-tracking branch 'origin/topic/johanna/ssh-server-banners-can-be-wild'
* origin/topic/johanna/ssh-server-banners-can-be-wild:
  SSH analyzer - tiny aesthetic fixes
  SSH: make banner parsing more robust
  SSH: split banner into client/server parts
2025-03-19 15:31:35 +00:00
Tim Wojtulewicz
cb5e3d0054 Merge remote-tracking branch 'origin/topic/timw/vntag-in-vlan'
* origin/topic/timw/vntag-in-vlan:
  Add analyzer registration from VLAN to VNTAG
2025-03-18 11:52:19 -07:00
Tim Wojtulewicz
d9af6d0270 Update src/3rdparty submodule [nomail] 2025-03-18 11:47:50 -07:00
Tim Wojtulewicz
e92f41e737 Updating CHANGES and VERSION. 2025-03-18 11:44:38 -07:00
Robin Sommer
3d25328204
Merge remote-tracking branch 'origin/topic/robin/gh-4250-vec-allocator'
* origin/topic/robin/gh-4250-vec-allocator:
  Spicy: Fix passing vectors to Zeek.
2025-03-18 09:08:50 +01:00
Tim Wojtulewicz
43f108bb71 Merge remote-tracking branch 'origin/topic/timw/ci-macos-sequoia'
* origin/topic/timw/ci-macos-sequoia:
  ci/init-external-repo.sh: Use regex to match macos cirrus task
  CI: Change macOS runner to Sequoia
2025-03-17 11:55:27 -07:00
Arne Welzel
1b655836be Merge remote-tracking branch 'origin/topic/awelzel/ci-generate-docs-run-pre-commit'
* origin/topic/awelzel/ci-generate-docs-run-pre-commit:
  github/generate-docs: Run pre-commit
  cluster/backends/zeromq: Fix rst link in docs
2025-03-12 13:11:18 +01:00
Arne Welzel
bb58148c64 Merge remote-tracking branch 'origin/topic/awelzel/4136-cluster-websocket-support'
* origin/topic/awelzel/4136-cluster-websocket-support:
  ci/opensuse-tumpleweed: Bust cache
  ci/macos/prepare: Install python@3 explicitly
  cluster/websocket: Implement WebSocket server
  cluster/websocket: Add IXWebsocket submodule
  ci/alpine: Install openssl package for testing
  ci: Install websockets from pip for all distros
  auxil/libunistd: Bump for ssize_t typedef
  auxil/broker: Bump to latest master version
  cluster/zeromq: Catch log_push.send() exception
  cluster/zeromq: Catch exceptions as const zmq::error_t&
  cluster/zeromq: No assert on inproc handling
  cluster/zeromq: Support configuring IO threads for proxy thread
  cluster/zeromq: Move variable lookups from DoInit() to DoInitPostScript()
  cluster/zeromq: Handle EINTR at shutdown
  cluster/zeromq: Queue one message at a time
  cluster/Backend: Queue a single message only
  cluster/zeromq: Adapt for OnLoopProcess changes
  cluster/ThreadedBackend: Switch to OnLoopProcess
  cluster/OnLoop: Introduce helper template class
  serializer/broker: Expose to_broker_event() and to_zeek_event()
2025-03-11 10:51:09 +01:00
Arne Welzel
db28ff04e2 Merge remote-tracking branch 'origin/topic/awelzel/javascript-separate-thread'
* origin/topic/awelzel/javascript-separate-thread:
  btest/javascript: Add file_sniff() and file_state_remove() test
  Bump zeekjs to v0.15.0
2025-03-10 19:42:36 +01:00
Tim Wojtulewicz
e8d91c8227 Merge remote-tracking branch 'origin/topic/timw/ci-macos-upgrade-pip'
* origin/topic/timw/ci-macos-upgrade-pip:
  CI: Unconditionally upgrade pip on macOS
2025-03-10 08:29:04 -07:00
Tim Wojtulewicz
8ed503314d Merge remote-tracking branch 'origin/topic/timw/fix-double-to-docs'
* origin/topic/timw/fix-double-to-docs:
  Fix return types in docs for double_to_count and double_to_int
2025-03-10 06:11:56 -07:00
Evan Typanski
c8f8bbaccb Merge remote-tracking branch 'origin/topic/etyp/print-type-const'
* origin/topic/etyp/print-type-const:
  Fix printing type constants like `double`
2025-03-07 13:14:22 -05:00
Tim Wojtulewicz
62a3119678 Merge remote-tracking branch 'origin/topic/timw/iwyu-clang-tidy'
* origin/topic/timw/iwyu-clang-tidy:
  Fix indentation in .clang-tidy
  Remove existing hand-written clang-tidy setup
  Add ability to enable iwyu and clang-tidy at configure time
2025-03-07 11:02:39 -07:00
Tim Wojtulewicz
81f7e77801 Merge remote-tracking branch 'origin/topic/timw/4266-tunnel-ip-proto'
* origin/topic/timw/4266-tunnel-ip-proto:
  Set ip_proto when creating new tunnel encapsulations
2025-03-06 16:42:03 -07:00
Johanna Amann
6fcd02b3a4 Merge remote-tracking branch 'origin/topic/johanna/gh-4251-discussion'
* origin/topic/johanna/gh-4251-discussion:
  Add two protocol mismatch testcases
  Remove violating t panalyzer from services field again
2025-03-06 13:12:51 +00:00
Arne Welzel
86fd9c4e0d Merge remote-tracking branch 'origin/topic/awelzel/4216-no-more-parse-time-dns-resolutions'
* origin/topic/awelzel/4216-no-more-parse-time-dns-resolutions:
  ZAM: bif-tracking updates for blocking_lookup_hostname()
  scan.l: Deprecate DNS resolutions of hostname literals
  input/zeek-setup: Track parse_only globally
  zeek.bif: Introduce blocking_lookup_hostname()
  btest/dns_mgr: Update run-dnsmasq, use --host-record
2025-03-05 19:24:28 +01:00
Christian Kreibich
c2a7da0044 Update zeekctl submodule to pull in testsuite fix for metrics port 2025-03-04 12:53:17 -08:00
Tim Wojtulewicz
8f0236448b Merge remote-tracking branch 'origin/topic/timw/reformat-cpp-code-in-bison-and-flex-files'
* origin/topic/timw/reformat-cpp-code-in-bison-and-flex-files:
  Reformat embedded C++ code in bison/flex files
2025-03-04 09:34:06 -07:00
Tim Wojtulewicz
a2a30f2a2b Merge remote-tracking branch 'origin/topic/timw/iptunnel-coverity-findings'
* origin/topic/timw/iptunnel-coverity-findings:
  Fix Coverity findings from recent IPTunnel dumping changes
2025-03-04 08:53:04 -07:00
Johanna Amann
dfa011a3ee Merge remote-tracking branch 'origin/topic/johanna/gh-4237'
* origin/topic/johanna/gh-4237:
  RDP: cookie is optional
2025-03-04 13:41:18 +00:00
Arne Welzel
548a12813a Merge branch 'master' of https://github.com/markoverholser/zeek
* 'master' of https://github.com/markoverholser/zeek:
  Update zeek.bif documentation for to_count and to_int
2025-03-04 12:07:22 +01:00
Arne Welzel
a3a08fa0f3 Merge remote-tracking branch 'origin/topic/awelzel/2311-load-plugin-bare-mode'
* origin/topic/awelzel/2311-load-plugin-bare-mode:
  scan.l: Fix @load-plugin scripts loading
  scan.l: Extract switch_to() from load_files()
  ScannedFile: Allow skipping canonicalization
2025-03-04 09:43:53 +01:00
Tim Wojtulewicz
3c16b0720a Merge remote-tracking branch 'origin/topic/timw/few-btest-jobs-for-zam-ci-tasks'
* origin/topic/timw/few-btest-jobs-for-zam-ci-tasks:
  CI: Use the right variable for the number of test jobs for zeekctl_debian11_task tasks
  CI: Use fewer btest jobs for ZAM tasks
2025-02-25 07:30:00 -07:00
Tim Wojtulewicz
66e3232dcc Merge remote-tracking branch 'markoverholser/master'
* markoverholser/master:
  Fix incorrect syntax for static_cast in to_count that I introduced in a previous merge
  Update baselines after changes to to_count and to_int
  fix to_count in zeek.bif to resolve conflict from bbanier's adjustment to static casting of the return from strtoull
  Fix tests in to_count to reflect appropriate function; add tests for 0x-formatted hex values for to_count and to_int
  update BIFs to_int() and to_count() to accept optional 'base' argument; allows more more exotic conversions from hex, octal, binary
  Fixes #4076; update BIFs to_int() and to_count() to accept optional 'base' argument for more easy conversions of strings representing (for example) hexadecimal, octal, or binary numbers
2025-02-24 11:38:11 -07:00
Arne Welzel
3682a42376 Merge remote-tracking branch 'origin/topic/awelzel/get-geneve-options'
* origin/topic/awelzel/get-geneve-options:
  PacketAnalyzer::Geneve: Add get_options()
  packet_analysis: Track data spans of packet analyzers
2025-02-22 12:33:46 -08:00
Benjamin Bannier
0bc0104eb2 Merge remote-tracking branch 'origin/topic/timw/to-int-zam' 2025-02-21 12:24:43 +01:00
Tim Wojtulewicz
bcecc6ea51 Merge remote-tracking branch 'mnhsrj/innerPktResults'
* mnhsrj/innerPktResults:
  Set original/outer packet flags to reflect inner packet results
2025-02-20 16:41:05 -07:00
Tim Wojtulewicz
07a03bbfe9 Merge remote-tracking branch 'origin/topic/bbannier/integer-conversion-error-handling'
* origin/topic/bbannier/integer-conversion-error-handling:
  Also trim trailing spaces in `to_count`/`to_int` inputs
  Align error handling in `to_int` with existing behavior of `to_count`
  Baseline handling of leading/trailing spaces in `to_count`/`to_int`.
  Add error messages to `to_count`/`to_int` baselines
2025-02-20 15:35:34 -07:00
Tim Wojtulewicz
6609269f3c Merge remote-tracking branch 'origin/topic/awelzel/freebsd-14-1-to-14-2'
* origin/topic/awelzel/freebsd-14-1-to-14-2:
  cirrus: Bump FreeBSD 14 task to 14.2
2025-02-18 08:51:40 -07:00
Tim Wojtulewicz
9c41b6d227 Merge remote-tracking branch 'origin/topic/etyp/locals-to-global'
* origin/topic/etyp/locals-to-global:
  Do not export locals
2025-02-14 11:29:29 -08:00
Johanna Amann
fc233fd8d0 Merge remote-tracking branch 'origin/topic/johanna/dpd-changes'
* origin/topic/johanna/dpd-changes:
  DPD: failed services logging alignment
  DPD: update test baselines; change options for external tests.
  DPD: change policy script for service violation logging; add NEWS
  DPD changes - small script fixes and renames.
  Update public and private test suite for DPD changes.
  Allow to track service violations in conn.log.
  Make conn.log service field ordered
  DPD: change handling of pre-confirmation violations, remove max_violations
  DPD: log analyzers that have confirmed
  IRC analyzer - make protocol confirmation more robust.
2025-02-07 07:35:30 +00:00
Arne Welzel
02494d2146 Merge remote-tracking branch 'origin/topic/christian/gh-3595-warnings'
* origin/topic/christian/gh-3595-warnings:
  Downgrade internal errors to reporter warnings in file/directory BiFs
2025-02-06 10:05:22 +01:00
Arne Welzel
fbdefd1451 Merge remote-tracking branch 'origin/topic/awelzel/zeromq-fix-fmt-call-thanks-tsan'
* origin/topic/awelzel/zeromq-fix-fmt-call-thanks-tsan:
  cluster/zeromq: Call DoTerminate() in destructor
  cluster/zeromq: Use lambda for thread trampoline
  cluster/zeromq: Do not call util::fmt() from thread
2025-02-05 16:40:55 +01:00
Arne Welzel
da673d6577 Merge remote-tracking branch 'origin/topic/awelzel/4136-cluster-backend-pre-work'
* origin/topic/awelzel/4136-cluster-backend-pre-work:
  cluster/zeromq: Fix Unsubscribe() bug caused by \x00 prefix
  cluster: Add SubscribeCallback support
  cluster/zeromq: Fix XSUB threading issues
  cluster/zeromq: Use NodeId(), drop my_node_id
  cluster/Backend: Pass node_id via Init()
  cluster/Backend: Make backend event processing customizable
  cluster/broker/Serializer: Fix adaptor to adapter
  cluster/Backend: Do not use const std::string_view&
  cluster/serializer/broker: Fix handler lookup
  broker/Manager: Move name in PublishEvent()
  btest/zeromq/test-bootstrap: Fix port parsing
  EventHandler: Support operator!=
2025-02-05 11:10:36 +01:00
Johanna Amann
5ef6902331 Merge remote-tracking branch 'origin/topic/johanna/jbaggs-ignore-mdns'
* origin/topic/johanna/jbaggs-ignore-mdns:
  IPv6 support for detect-external-names and testcase
  Add  `skip_resp_host_port_pairs` option.
2025-02-05 09:09:01 +00:00