Commit graph

16596 commits

Author SHA1 Message Date
Arne Welzel
4f084b0b9a ssh: Fallback to client or server selected version for parsing
In half-duplex setups (or when client/server coalesce the SSH version
line with the KEX packet, get_version() would return UNK as version,
causing a protocol violation. Make this slightly more robust by using
and setting the version which either side had set to continue parsing.

For the special case of SSH-1.99, select SSH-2.0. We could try to peak
into the payload following the packet length field and check for
a KEX_INIT type byte to select SSH2 as a heuristic, but not sure how
to accomplish this.

Slight regression fix for 3769ed6c66
which started to require visibility for client and server version
rather than just the client's version.
2024-06-12 16:30:18 +02:00
Arne Welzel
a0e0b7161f ssh: Revert half-duplex robustness
This reverts part of commit a0888b7e36 due
to inhibiting analyzer violations when parsing non SSH traffic when
the &restofdata path is entered.

@J-Gras reported the analyzer not being disabled when sending HTTP
traffic on port 22.

This adds the verbose analyzer.log baselines such that future improvements
of these scenarios become visible.
2024-06-12 16:28:50 +02:00
Benjamin Bannier
345fc31dcc Merge remote-tracking branch 'origin/topic/bbannier/ci-centos8-stream-eol' 2024-06-11 15:11:52 +02:00
Benjamin Bannier
20eeb6dbf6 Drop EOL centos8-stream in CI 2024-06-11 14:48:35 +02:00
Arne Welzel
1e3b5ee68b Merge remote-tracking branch 'origin/topic/timw/civetweb-shutdown-data-race'
* origin/topic/timw/civetweb-shutdown-data-race:
  Suppress a known data race during civetweb shutdown
2024-06-11 12:01:10 +02:00
Arne Welzel
3081a40a2a Merge remote-tracking branch 'origin/topic/awelzel/asan-coverage-fixes'
* origin/topic/awelzel/asan-coverage-fixes:
  Bump cmake for -fprofile-update=atomic usage
  cirrus: Unset CCACHE_BASEDIR for asan/coverage build
2024-06-11 11:03:14 +02:00
Arne Welzel
8bf3d3c7fc Bump cmake for -fprofile-update=atomic usage 2024-06-11 08:58:21 +02:00
Arne Welzel
f228cf878a cirrus: Unset CCACHE_BASEDIR for asan/coverage build
When CCACHE_BASEDIR is set, ccache will rewrite absolute paths to
relative paths in order to allow compilation in different source
directories. We do not need this feature on Cirrus (the checkout
is always in /zeek) and using absolute paths avoids
confusion/normalization needs for the gcov -p results.

We could consider removing the global CCACHE_BASEDIR, but it'd
bust the ccache of every other task, too.
2024-06-11 08:56:46 +02:00
zeek-bot
d603653495 Update doc submodule [nomail] [skip ci] 2024-06-08 00:11:59 +00:00
Tim Wojtulewicz
753127be6d Suppress a known data race during civetweb shutdown 2024-06-07 11:31:34 -07:00
Tim Wojtulewicz
3f6b9ab167 Merge remote-tracking branch 'origin/topic/timw/telemetry-bind-address'
* origin/topic/timw/telemetry-bind-address:
  Add Telemetry::metrics_address option
2024-06-07 09:29:09 -07:00
Tim Wojtulewicz
d549e3d56a Add Telemetry::metrics_address option 2024-06-07 09:28:27 -07:00
Tim Wojtulewicz
322d223c18 Merge remote-tracking branch 'origin/topic/timw/pic-prometheus-cpp'
* origin/topic/timw/pic-prometheus-cpp:
  Update cmake submodule [nomail]
2024-06-06 18:23:59 -07:00
Tim Wojtulewicz
7a3a2606f0 Update cmake submodule [nomail] 2024-06-06 18:23:31 -07:00
Tim Wojtulewicz
2cb284a352 Merge remote-tracking branch 'origin/topic/timw/dont-require-jq'
* origin/topic/timw/dont-require-jq:
  Change prometheus test to check for require jq
2024-06-06 18:08:44 -07:00
Tim Wojtulewicz
16d39b9978 Merge remote-tracking branch 'origin/topic/timw/zeekctl-check-telemetry'
* origin/topic/timw/zeekctl-check-telemetry:
  Check for 'zeekctl check' before trying to start up prometheus
2024-06-06 18:07:02 -07:00
Tim Wojtulewicz
777b0be03e Check for 'zeekctl check' before trying to start up prometheus 2024-06-06 12:34:46 -07:00
Tim Wojtulewicz
c0f14bdc0b Change prometheus test to check for require jq 2024-06-06 08:53:48 -07:00
Tim Wojtulewicz
7ac703b97d Update cmake submodule [nomail] 2024-06-06 08:20:46 -07:00
zeek-bot
9eb39d6907 Update doc submodule [nomail] [skip ci] 2024-06-05 00:22:15 +00:00
Tim Wojtulewicz
66e3d8c2e4 Merge remote-tracking branch 'origin/topic/timw/telemetry-follow-up'
* origin/topic/timw/telemetry-follow-up:
  Switch to zeek fork of prometheus-cpp
  Remove unnecessary shared_from_this on instrument classes
  Restore label_names field in MetricOpts record
  Change how we count FDs on Linux to fix zeekctl stop issues
  Update zeekctl tests for telemetry rework
  Use forward declarations of prometheus-cpp types in telemetry::Manager
  Add prometheus-cpp files to install set for plugins to use
  Fix a memory leak with the CivetWeb callbacks in telemetry
  Fix a bunch of copy-instead-of-move findings from Coverity
  Move telmetry label names out of opts records, into main metric records
  Ensure the order of label values matches the label names
  Remove prefix column from telemetry.log
  Fix race condition by pre-building the cluster json data for services.json
  Set running_under_test for scripts.base.frameworks.logging.telemetry test
2024-06-04 14:17:05 -07:00
Tim Wojtulewicz
1aebe01e14 Switch to zeek fork of prometheus-cpp 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
2680bac480 Remove unnecessary shared_from_this on instrument classes 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
99e64aa113 Restore label_names field in MetricOpts record 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
1cdca7c1d0 Change how we count FDs on Linux to fix zeekctl stop issues 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
2d6c433dca Update zeekctl tests for telemetry rework 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
9d6ba594b9 Use forward declarations of prometheus-cpp types in telemetry::Manager 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
dd0814c804 Add prometheus-cpp files to install set for plugins to use 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
32fe94f0f8 Fix a memory leak with the CivetWeb callbacks in telemetry 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
65678fbfdb Fix a bunch of copy-instead-of-move findings from Coverity 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
433c257886 Move telmetry label names out of opts records, into main metric records 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
b1578d4ded Ensure the order of label values matches the label names 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
87717fed0a Remove prefix column from telemetry.log 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
f55c0a5292 Fix race condition by pre-building the cluster json data for services.json 2024-06-04 14:14:58 -07:00
Tim Wojtulewicz
00b24b043a Set running_under_test for scripts.base.frameworks.logging.telemetry test 2024-06-04 14:14:57 -07:00
Tim Wojtulewicz
07d845b558 Merge remote-tracking branch 'origin/topic/awelzel/stevesmoot-reporter-error-updates'
* origin/topic/awelzel/stevesmoot-reporter-error-updates:
  Update reporter.bif to describe special case of errors in init
2024-06-04 11:36:23 -07:00
Tim Wojtulewicz
e7b0a0a887 Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.Jun24'
* origin/topic/vern/script-opt-maint.Jun24:
  script optimization baseline tweaks due to recent minor changes
  updated list of BiFs for script optimization
  addressed some Coverity nits
  improved error cascade for invalid attributes
2024-06-04 10:36:57 -07:00
Vern Paxson
0ee28866a1 script optimization baseline tweaks due to recent minor changes 2024-06-04 10:36:36 -07:00
Vern Paxson
50b1f6e013 updated list of BiFs for script optimization 2024-06-04 10:36:36 -07:00
Vern Paxson
aab5324e20 addressed some Coverity nits 2024-06-04 10:36:36 -07:00
Vern Paxson
b0d9a841f5 improved error cascade for invalid attributes 2024-06-04 10:36:36 -07:00
Benjamin Bannier
76c92d6b14 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy' 2024-06-04 12:26:16 +02:00
Smoot
f20d505007 Update reporter.bif to describe special case of errors in init
Originally proposed in zeek/zeek-docs#257, but reverted via
9f9ebde62380a3012a1471d9ff1c1c91c7aa69da.
2024-06-04 11:56:06 +02:00
Benjamin Bannier
8339b40c41 Bump Spicy to latest dev snapshot 2024-06-04 10:27:51 +02:00
Tim Wojtulewicz
29d66ec197 Merge branch 'topic/timw/prometheus-cpp-3'
* topic/timw/prometheus-cpp-3: (35 commits)
  Update docs submodule [nomail] [skip ci]
  Add type aliases for instrument and family shared_ptrs
  Update NEWS for double and is_sum changes
  Remove is_sum arguments from counters and gauges
  Change all instruments to only handle doubles
  Add comment to telemetry::Manager::InitPostScript
  Remove all of the ZEEK_METRICS_ environment variables
  Fix header comments in scripts/policy/frameworks/telemetry/prometheus.zeek
  Change all prometheus #includes to use angle brackets
  Update zeekctl submodule for metrics_port node.cfg option
  Regenerate docs [nomail]
  Remove the is_sum argument from BIF histogram creation methods
  Update NEWS for Telemetry rework
  Remove Telemetry::metrics_export_prefixes option
  Validate that label names are constant in non-zeek metrics
  Avoid calling Collect() in counter/gauge Value() methods if not needed
  Fix some determinism issues with btests
  Temporarily disable the scripts/base/frameworks/telemetry/internal-metrics btest
  Fix the scripts.policy.frameworks.telemetry.prometheus btest to use the service discovery endpoint
  Btest updates due to recent changes
  ...
2024-05-31 14:18:48 -07:00
Tim Wojtulewicz
45de68580a Update docs submodule [nomail] [skip ci] 2024-05-31 13:51:32 -07:00
Tim Wojtulewicz
52e6314f0e Add type aliases for instrument and family shared_ptrs 2024-05-31 13:36:37 -07:00
Tim Wojtulewicz
bbc14cfff0 Update NEWS for double and is_sum changes 2024-05-31 13:36:37 -07:00
Tim Wojtulewicz
93717ca8f8 Remove is_sum arguments from counters and gauges 2024-05-31 13:36:37 -07:00
Tim Wojtulewicz
46ff48c29a Change all instruments to only handle doubles 2024-05-31 13:36:37 -07:00