Commit graph

18851 commits

Author SHA1 Message Date
Evan Typanski
64443e5e5a Handle more Redis RESP3 protocol pieces
This passes the "minimum protocol version" along in the reply and adds
support for attributes, which were added relatively recently.
2025-07-01 14:14:15 -04:00
Evan Typanski
b34d3ff2f0 Stringify all Redis-RESP serialized data 2025-07-01 14:14:15 -04:00
Evan Typanski
a4ce682bc9 Handle Redis protocol message separately
Closes #4504

Messages are not typical responses, so they need special handling. This
is different between RESP2 and 3, so this is the first instance where
the script layer needs to tell the difference.
2025-07-01 14:14:15 -04:00
Evan Typanski
8b914f4714 Add Redis analyzer array stringification
This was going to be how "message" server data was handled, but that
ended up being bad. Regardless, this is probably nice to have.
2025-07-01 10:23:57 -04:00
Benjamin Bannier
e3b0d1d2be Merge branch 'topic/bbannier/bump-pre-commit-hooks' 2025-07-01 11:09:23 +02:00
Benjamin Bannier
b9eabbabba Bump pre-commit hooks 2025-07-01 10:39:47 +02:00
Arne Welzel
6d272038fe Merge remote-tracking branch 'origin/topic/timw/4617-reset-expire-time-on-overwrite'
* origin/topic/timw/4617-reset-expire-time-on-overwrite:
  SQLite: Reset expiration time on overwrite
2025-07-01 09:20:58 +02:00
zeek-bot
7a19e4e7d3 Update doc submodule [nomail] [skip ci] 2025-07-01 00:28:16 +00:00
Tim Wojtulewicz
fd7259f436 SQLite: Reset expiration time on overwrite 2025-06-30 14:41:10 -07:00
Tim Wojtulewicz
5daa83bfa4 Merge remote-tracking branch 'origin/topic/bbannier/readability-isolate-declaration'
* origin/topic/bbannier/readability-isolate-declaration:
  Make clang-tidy warnings report as errors to cause CI build to fail
  Fix a clang-tidy finding in cluster telemetry code
  Fix clang-tidy readability-isolate-declaration warnings
2025-06-30 14:19:37 -07:00
Tim Wojtulewicz
79959310a6 Make clang-tidy warnings report as errors to cause CI build to fail 2025-06-30 14:19:06 -07:00
Tim Wojtulewicz
1bc39cb541 Fix a clang-tidy finding in cluster telemetry code 2025-06-30 14:19:06 -07:00
Benjamin Bannier
627c3ad726 Fix clang-tidy readability-isolate-declaration warnings
I missed one of these in review so a machine is probably better at
catching them.

I fixed the existing instances which where largely in code which look
dated. Where possible I slightly reorganized the code so we do not have
to leave values uninitialized, but did not touch up anything else.
2025-06-30 14:19:06 -07:00
Arne Welzel
c725311d07 Merge remote-tracking branch 'origin/topic/awelzel/cluster-log-websocket-application-name'
* origin/topic/awelzel/cluster-log-websocket-application-name:
  cluster/WebSocket: Include X-Application-Name in cluster.log
2025-06-30 17:56:19 +02:00
Arne Welzel
1d931b5a2f cluster/WebSocket: Include X-Application-Name in cluster.log
A bit ad-hoc formatting for the log, but that's mostly because cluster.log
only has message field and I don't think having a dedicated application_name
column is worth it. That could also be added by custom scripts if it's really
wanted for a given deployment.
2025-06-30 17:55:24 +02:00
Arne Welzel
5847a2d32e Merge remote-tracking branch 'origin/topic/awelzel/cluster-telemetry-follow-up'
* origin/topic/awelzel/cluster-telemetry-follow-up:
  Bump cluster test suite
  cluster/Telemetry: Cache CallExpr locations
  cluster/Telemetry: Avoid unneeded StringVal() construction
  Val: Switch TablePatternMatcher to std::string_view
  RE: Add MatchAll() and MatchSet() for std::string_view
  cluster/websocket: Fix and test for invalid X-Application-Name
  cluster/telemetry: Move topic_normalization redef to zeromq
2025-06-30 13:30:04 +02:00
Arne Welzel
42ed82824e Bump cluster test suite
Since zeek/zeek#4552, metrics are labeled with node, not endpoint,
adapt the tests for that.
2025-06-30 13:22:31 +02:00
Arne Welzel
73e55fa909 cluster/Telemetry: Cache CallExpr locations 2025-06-30 13:22:31 +02:00
Arne Welzel
be8b4747c4 cluster/Telemetry: Avoid unneeded StringVal() construction 2025-06-30 13:22:31 +02:00
Arne Welzel
dad5ccd622 Val: Switch TablePatternMatcher to std::string_view
...and add TableVal::LookupPattern(std::string_view sv).
2025-06-30 13:22:31 +02:00
Arne Welzel
dce51b99e5 RE: Add MatchAll() and MatchSet() for std::string_view 2025-06-30 13:22:31 +02:00
Arne Welzel
5c6a6d9427 cluster/websocket: Fix and test for invalid X-Application-Name 2025-06-30 13:22:31 +02:00
zeek-bot
e79ae5a1d9 Update doc submodule [nomail] [skip ci] 2025-06-27 00:19:29 +00:00
Johanna Amann
2bb47d8d9a Spicy SSL analyzer: move unknown version out of possible range
This moves the negotiated version outside of the possible range of
protocol values. I don't think it was possible to cause a problem with
this in the past - but this approach seems safer.
2025-06-26 20:26:02 +01:00
Johanna Amann
2ce0d4f73b Spicy SSL analyzer: move exceptions to &requires & throw
This commit changes exception handling in a couple of places, to prefer
the use of &requires and throw.
2025-06-26 20:26:02 +01:00
Johanna Amann
dbeadc65ba Merge remote-tracking branch 'origin/topic/johanna/gh-4547'
* origin/topic/johanna/gh-4547:
  Spicy SSL analyzer: make record layer version parsing more strict
2025-06-26 20:21:54 +01:00
Arne Welzel
222f34b4ac Bump cluster testuite for endpoint to node renaming 2025-06-26 19:22:09 +02:00
Arne Welzel
3cd6e1ca06 Merge remote-tracking branch 'origin/topic/vern/if-coverage'
* origin/topic/vern/if-coverage:
  extend script coverage profiling to track whether conditionals evaluate to true/false
2025-06-26 18:49:42 +02:00
Johanna Amann
74b847a122 Spicy SSL analyzer: make record layer version parsing more strict
The Spicy based SSL analyzer was, so far, more permissive with the
record layer versions that it would accept.

This change brings the parsing of record layer versions in line with the
binpac based analyzer. This behavioral difference was discovered due to
a test that changed with the recent dpd log changes.
2025-06-26 16:57:51 +01:00
Vern Paxson
0255b5d120 extend script coverage profiling to track whether conditionals evaluate to true/false 2025-06-26 16:10:50 +02:00
Arne Welzel
26f5166d7a cluster/telemetry: Move topic_normalization redef to zeromq 2025-06-26 15:22:11 +02:00
Arne Welzel
22958f7cdf Merge remote-tracking branch 'origin/topic/awelzel/1474-cluster-telemetry'
* origin/topic/awelzel/1474-cluster-telemetry:
  btest/cluster/telemetry: Add smoke testing for telemetry
  cluster/WebSocket: Fetch X-Application-Name header as app label
  cluster/WebSocket: Pass X-Application-Name to dispatcher
  broker/WebSocketShim: Add calls to Telemetry hooks
  cluster/WebSocket: Configure telemetry for WebSocket backends
  broker: Hook up generic cluster telemetry
  cluster: Introduce telemetry component

One bug fix removing static from a variable that shouldn't be static.
2025-06-26 14:54:01 +02:00
Johanna Amann
14e801a709 Merge remote-tracking branch 'origin/topic/johanna/gh-4598'
* origin/topic/johanna/gh-4598:
  Only pass session ticket data in ssl_session_ticket_handshake event
2025-06-26 09:59:16 +01:00
zeek-bot
9f16050d0a Update doc submodule [nomail] [skip ci] 2025-06-26 00:26:06 +00:00
Arne Welzel
771c37b6b2 Merge branch 'rename' of https://github.com/bhaskarbhar/zeek
* 'rename' of https://github.com/bhaskarbhar/zeek:
  Update zeek.bif
  Update init-bare.zeek
  Added Baseline
  Renamed
2025-06-25 19:27:13 +02:00
bhaskarbhar
f9c34f29c7
Update zeek.bif 2025-06-25 22:53:29 +05:30
bhaskarbhar
722381366b
Update init-bare.zeek 2025-06-25 22:51:43 +05:30
root
1fba346f5d Added Baseline 2025-06-25 21:22:21 +05:30
root
da89e7ee6e Renamed 2025-06-25 21:10:08 +05:30
Arne Welzel
0e1431eef4 btest/cluster/telemetry: Add smoke testing for telemetry 2025-06-25 17:13:01 +02:00
Arne Welzel
b28e5f261e cluster/WebSocket: Fetch X-Application-Name header as app label 2025-06-25 17:12:59 +02:00
Arne Welzel
2f7d5eaf2a cluster/WebSocket: Pass X-Application-Name to dispatcher
This is going to be used to add labels to telemetry if the
X-Application-Name header is set.
2025-06-25 17:07:29 +02:00
Arne Welzel
6a84237a95 broker/WebSocketShim: Add calls to Telemetry hooks
WebSocket clients with Broker do not use the normal Broker backend, so
we need to add the telemetry invocations explicitly.
2025-06-25 16:59:49 +02:00
Arne Welzel
376e6dba97 cluster/WebSocket: Configure telemetry for WebSocket backends 2025-06-25 16:59:49 +02:00
Arne Welzel
f011e7e667 broker: Hook up generic cluster telemetry 2025-06-25 16:59:49 +02:00
Arne Welzel
4c34274a6c cluster: Introduce telemetry component 2025-06-25 16:59:49 +02:00
Evan Typanski
d3593e0489 Merge remote-tracking branch 'origin/topic/etyp/remove-list'
* origin/topic/etyp/remove-list:
  Remove `list` from Zeek grammar
2025-06-25 10:36:08 -04:00
Arne Welzel
cd934c460b Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples'
* origin/topic/christian/extensible-conntuples:
  btest/plugins: Add test for custom ConnKey factory
  NEWS updates for pluggable connection tuples.
  Add a VLAN-aware flow tuple implementation.
  Deprecate ConnTuple and related APIs.
  Deprecate the old Connection constructor and detail::ConnKey class.
  Switch to virtualized use of new zeek::ConnKey class tree
  Provide a connkey factory for Zeek's default five-tuples.
  Add IP-specific ConnKey implementation.
  Establish plugin infrastructure for ConnKey factories.
  Add new ConnKey abstraction.
2025-06-25 14:17:49 +02:00
Arne Welzel
e7b1b174f0 btest/plugins: Add test for custom ConnKey factory
This just counts DoInits() and adds that information to the conn_id
record, but without including it into the hash. Mostly for smoke
testing.
2025-06-25 13:19:26 +02:00
Christian Kreibich
a040f550f4 NEWS updates for pluggable connection tuples. 2025-06-25 13:19:26 +02:00