Commit graph

3192 commits

Author SHA1 Message Date
Benjamin Bannier
345fc31dcc Merge remote-tracking branch 'origin/topic/bbannier/ci-centos8-stream-eol' 2024-06-11 15:11:52 +02:00
Arne Welzel
1e3b5ee68b Merge remote-tracking branch 'origin/topic/timw/civetweb-shutdown-data-race'
* origin/topic/timw/civetweb-shutdown-data-race:
  Suppress a known data race during civetweb shutdown
2024-06-11 12:01:10 +02:00
Arne Welzel
3081a40a2a Merge remote-tracking branch 'origin/topic/awelzel/asan-coverage-fixes'
* origin/topic/awelzel/asan-coverage-fixes:
  Bump cmake for -fprofile-update=atomic usage
  cirrus: Unset CCACHE_BASEDIR for asan/coverage build
2024-06-11 11:03:14 +02:00
Tim Wojtulewicz
3f6b9ab167 Merge remote-tracking branch 'origin/topic/timw/telemetry-bind-address'
* origin/topic/timw/telemetry-bind-address:
  Add Telemetry::metrics_address option
2024-06-07 09:29:09 -07:00
Tim Wojtulewicz
2cb284a352 Merge remote-tracking branch 'origin/topic/timw/dont-require-jq'
* origin/topic/timw/dont-require-jq:
  Change prometheus test to check for require jq
2024-06-06 18:08:44 -07:00
Tim Wojtulewicz
16d39b9978 Merge remote-tracking branch 'origin/topic/timw/zeekctl-check-telemetry'
* origin/topic/timw/zeekctl-check-telemetry:
  Check for 'zeekctl check' before trying to start up prometheus
2024-06-06 18:07:02 -07:00
Tim Wojtulewicz
66e3d8c2e4 Merge remote-tracking branch 'origin/topic/timw/telemetry-follow-up'
* origin/topic/timw/telemetry-follow-up:
  Switch to zeek fork of prometheus-cpp
  Remove unnecessary shared_from_this on instrument classes
  Restore label_names field in MetricOpts record
  Change how we count FDs on Linux to fix zeekctl stop issues
  Update zeekctl tests for telemetry rework
  Use forward declarations of prometheus-cpp types in telemetry::Manager
  Add prometheus-cpp files to install set for plugins to use
  Fix a memory leak with the CivetWeb callbacks in telemetry
  Fix a bunch of copy-instead-of-move findings from Coverity
  Move telmetry label names out of opts records, into main metric records
  Ensure the order of label values matches the label names
  Remove prefix column from telemetry.log
  Fix race condition by pre-building the cluster json data for services.json
  Set running_under_test for scripts.base.frameworks.logging.telemetry test
2024-06-04 14:17:05 -07:00
Tim Wojtulewicz
07d845b558 Merge remote-tracking branch 'origin/topic/awelzel/stevesmoot-reporter-error-updates'
* origin/topic/awelzel/stevesmoot-reporter-error-updates:
  Update reporter.bif to describe special case of errors in init
2024-06-04 11:36:23 -07:00
Tim Wojtulewicz
e7b0a0a887 Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.Jun24'
* origin/topic/vern/script-opt-maint.Jun24:
  script optimization baseline tweaks due to recent minor changes
  updated list of BiFs for script optimization
  addressed some Coverity nits
  improved error cascade for invalid attributes
2024-06-04 10:36:57 -07:00
Tim Wojtulewicz
29d66ec197 Merge branch 'topic/timw/prometheus-cpp-3'
* topic/timw/prometheus-cpp-3: (35 commits)
  Update docs submodule [nomail] [skip ci]
  Add type aliases for instrument and family shared_ptrs
  Update NEWS for double and is_sum changes
  Remove is_sum arguments from counters and gauges
  Change all instruments to only handle doubles
  Add comment to telemetry::Manager::InitPostScript
  Remove all of the ZEEK_METRICS_ environment variables
  Fix header comments in scripts/policy/frameworks/telemetry/prometheus.zeek
  Change all prometheus #includes to use angle brackets
  Update zeekctl submodule for metrics_port node.cfg option
  Regenerate docs [nomail]
  Remove the is_sum argument from BIF histogram creation methods
  Update NEWS for Telemetry rework
  Remove Telemetry::metrics_export_prefixes option
  Validate that label names are constant in non-zeek metrics
  Avoid calling Collect() in counter/gauge Value() methods if not needed
  Fix some determinism issues with btests
  Temporarily disable the scripts/base/frameworks/telemetry/internal-metrics btest
  Fix the scripts.policy.frameworks.telemetry.prometheus btest to use the service discovery endpoint
  Btest updates due to recent changes
  ...
2024-05-31 14:18:48 -07:00
Christian Kreibich
1d4a169dd4 Merge branch 'topic/christian/analyzer-lookup-bifs'
* topic/christian/analyzer-lookup-bifs:
  More precise error reporting for the disable_analyzer() BiF
  Add btests for the lookup_connection_analyzer_id() BiF.
  Add BiF for looking up a connection's numeric protocol analyzer IDs
2024-05-31 09:37:52 -07:00
Tim Wojtulewicz
c04e503c92 Merge remote-tracking branch 'origin/topic/vern/add-del-expr'
* origin/topic/vern/add-del-expr:
  removing now-vestigial "add" and "delete" statements
  script optimization support for "add" and "delete" being expressions
  "add" and "delete" are now expressions rather than statements
  bug fix for dealing with illegal types of initializers
  added a space when rendering some expressions so they're more readable
2024-05-29 13:49:10 -07:00
Johanna Amann
03b358f6d1 Merge branch 'files_pe_timestamp_sync' of https://github.com/mvhensbergen/zeek
* 'files_pe_timestamp_sync' of https://github.com/mvhensbergen/zeek:
  Don't hardcode values
  Add btest for timestamp check
  Copy timestamp from file object
2024-05-29 14:16:31 +01:00
Tim Wojtulewicz
d86e73376b Merge remote-tracking branch 'origin/topic/timw/fix-coverage-part-trois'
* origin/topic/timw/fix-coverage-part-trois:
  CI: Revert part of 2bde82ffa2 to fix coverage builds
2024-05-28 13:06:03 -07:00
Christian Kreibich
e6b41defa0 Merge branch 'topic/christian/fix-zeekygen-quic-warning'
* topic/christian/fix-zeekygen-quic-warning:
  Fix Zeekygen warning for QUIC::unrecognized_version event
2024-05-24 15:04:38 -07:00
Tim Wojtulewicz
47dd834bdb Merge remote-tracking branch 'origin/topic/johanna/tls-new-groups-and-consts'
* origin/topic/johanna/tls-new-groups-and-consts:
  Update TLS consts, mainly new named curves.
2024-05-24 10:49:42 -07:00
Tim Wojtulewicz
afc89c0480 Merge remote-tracking branch 'origin/topic/timw/fix-coverage-part-deux'
* origin/topic/timw/fix-coverage-part-deux:
  CI: Remove --enable-werror for asan builds
  CI: Run coverage builds for PRs, but only upload on master
  Coverage: Ignore a few errors during generation
  Coverage: don't bother ignoring non-existent bro.dir files
  CI: Re-enable coverage
  CI: Switch asan build back to gcc
  Update cmake submodule [nomail]
  CI: Avoid divide by zero error when generating coverage files
2024-05-21 16:23:23 -07:00
Tim Wojtulewicz
04c8a6bde7 Merge remote-tracking branch 'origin/topic/vern/smb-filtering'
* origin/topic/vern/smb-filtering:
  Fix for suppressing SMB logging of previously-logged files
2024-05-20 15:54:19 -07:00
Tim Wojtulewicz
1a0fffd714 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump Spicy to latest dev snapshot
2024-05-17 08:56:45 -07:00
Tim Wojtulewicz
87870f8345 Merge remote-tracking branch 'origin/topic/vern/zam-subnet-fix'
* origin/topic/vern/zam-subnet-fix:
  Fix for ZAM inlining of nested function calls with the same parameter names
  Fixed ZAM logic error in canonicalizing specialized min/max instructions
  Fixed order-of-evaluation bug in ZAM Subnet-To-Addr instruction
  "-a zam" BTest baseline update reflecting recent Spicy baseline change
2024-05-16 11:09:33 -07:00
Tim Wojtulewicz
237f4c39a4 Merge branch 'topic/timw/no-spicy-head-on-releases'
* topic/timw/no-spicy-head-on-releases:
  CI: Disable spicy_head task for release branches
2024-05-16 09:35:06 -07:00
Tim Wojtulewicz
a4d7587bca Merge remote-tracking branch 'origin/topic/timw/fix-coverage-build'
* origin/topic/timw/fix-coverage-build:
  CI: Use llvm-cov-18 on Cirrus for building coverage data
2024-05-15 20:00:58 -07:00
Tim Wojtulewicz
8337b5f018 Merge remote-tracking branch 'origin/topic/timw/ubuntu-24-sanitizers'
* origin/topic/timw/ubuntu-24-sanitizers:
  CI: Use clang-18 on Ubuntu 24 for sanitizers builds, enable TSan builds
  CI: Add clang-18 to Ubuntu 24.04 VM
2024-05-13 17:40:52 -07:00
Robin Sommer
e5fa105a1f
Merge remote-tracking branch 'origin/topic/robin/spicy-gh-1657'
* origin/topic/robin/spicy-gh-1657:
  Apply missing fix for https://github.com/zeek/spicy/pull/1723.
2024-05-13 16:39:15 +02:00
Robin Sommer
0edc115ffc
Merge remote-tracking branch 'origin/topic/robin/revert-deferred'
Includes Spicy bump.

* origin/topic/robin/revert-deferred:
  Spicy: Update for https://github.com/zeek/spicy/pull/1738.
2024-05-13 12:20:21 +02:00
Tim Wojtulewicz
a9649026ae Merge remote-tracking branch 'origin/topic/timw/ci-ubuntu-24-lts'
* origin/topic/timw/ci-ubuntu-24-lts:
  CI: Update asan and ubsan tasks to use Ubuntu 22.04 VM
  CI: Replace Ubuntu 23.10 with Ubuntu 24.04
2024-05-10 10:19:53 -07:00
Robin Sommer
82be6425e6
Merge remote-tracking branch 'origin/topic/robin/gh-3561-forward-to-udp'
* origin/topic/robin/gh-3561-forward-to-udp:
  Update docs.
  Add explicit children life-cycle management method to analyzers.
  Spicy: Support UDP in Spicy's `protocol_*` runtime functions.
  Add method to analyzer to retrieve direct child by name.
  Extend PIA's `FirstPacket` API.
  Spicy: Prepare for supporting forwarding to protocols other than TCP.
2024-05-10 11:15:20 +02:00
Tim Wojtulewicz
b2e4fbe58d Merge remote-tracking branch 'origin/topic/vern/gen-zam-multi-files'
* origin/topic/vern/gen-zam-multi-files:
  enable ZAM operation specifications to reside in multiple files (not yet used)
2024-05-08 13:09:35 -07:00
Tim Wojtulewicz
2c46d3139c Merge remote-tracking branch 'origin/topic/timw/3417-packet-analysis-detail'
* origin/topic/timw/3417-packet-analysis-detail:
  Move packet_analysis::Dispatcher to detail namespace
2024-05-08 09:55:16 -07:00
Tim Wojtulewicz
554294bb84 Merge remote-tracking branch 'origin/topic/vern/ssh-half-duplex'
* origin/topic/vern/ssh-half-duplex:
  make SSH analyzer robust to half-duplex connections
2024-05-07 12:02:43 -07:00
Tim Wojtulewicz
29f5a49baf Merge remote-tracking branch 'origin/topic/christian/private_address_clarification'
* origin/topic/christian/private_address_clarification:
  Clarify membership in the Site::private_address_space prefix list. [skip ci]
2024-05-07 10:26:50 -07:00
Tim Wojtulewicz
d463141ded Merge remote-tracking branch 'origin/topic/christian/fix-zeekygen-crash'
* origin/topic/christian/fix-zeekygen-crash:
  Avoid segfault when generating Zeekygen docs on Zeek-internal identifiers.
  Add btest for Zeekygen docs extraction on identifiers defined by the Zeek core.
2024-05-07 10:26:19 -07:00
Robin Sommer
9c1ecd205c
Updating CHANGES and VERSION, and bump Spicy and docs. 2024-05-07 10:03:17 +02:00
Tim Wojtulewicz
fc0d4d2216 Merge remote-tracking branch 'origin/topic/timw/update-broker'
* origin/topic/timw/update-broker:
  Update broker submodule [nomail]
2024-05-06 17:00:01 -07:00
Tim Wojtulewicz
fb0dab2fb2 Merge remote-tracking branch 'origin/topic/timw/3389-tuning-defaults-deprecation'
* origin/topic/timw/3389-tuning-defaults-deprecation:
  Move the options from policy/tuning/defaults to actual Zeek defaults, deprecate that package
2024-05-06 11:16:34 -07:00
Tim Wojtulewicz
cdcd83c8cc Merge remote-tracking branch 'origin/topic/vern/val-footprint-strings'
* origin/topic/vern/val-footprint-strings:
  refine Val "footprint" to equate long strings with multiple objects
2024-05-02 19:01:06 -07:00
Tim Wojtulewicz
404c756286 Merge remote-tracking branch 'origin/topic/timw/const-rulematcher'
* origin/topic/timw/const-rulematcher:
  Constify classes in RuleMatcher, fixes c++20 build failure
2024-05-02 10:21:55 -07:00
Tim Wojtulewicz
d7e30d9ee2 Merge remote-tracking branch 'origin/topic/johanna/gh-3700'
* origin/topic/johanna/gh-3700:
  Fix cid propagation into files.log
2024-04-29 09:09:41 -07:00
Tim Wojtulewicz
522bce8d58 Merge remote-tracking branch 'origin/topic/vern/script-opt.May24'
* origin/topic/vern/script-opt.May24:
  factored BTest constants into globals to prevent premature ZAM optimization when testing
  addressed minor issues flagged by Coverity
2024-04-29 09:08:28 -07:00
Tim Wojtulewicz
19702b06e7 Merge remote-tracking branch 'origin/topic/timw/val-avoid-type-casting'
* origin/topic/timw/val-avoid-type-casting:
  Avoid calling typecasts in Val when we have direct access to the underlying value object
2024-04-29 09:06:39 -07:00
Tim Wojtulewicz
ad6d70d4e6 Merge remote-tracking branch 'pbcullen/topic/pbcullen/shadow-file-handling'
* pbcullen/topic/pbcullen/shadow-file-handling:
  reformat changes
  Gracefully handle empty/missing shadow file
2024-04-26 12:29:28 -07:00
Christian Kreibich
7fdbb73511 Merge branch 'topic/christian/3671-fix-icmp-caplen-violations'
* topic/christian/3671-fix-icmp-caplen-violations:
  Factor in caplens in ICMPAnalyzer::DeliverPacket length calculations
2024-04-26 11:18:34 -07:00
Tim Wojtulewicz
c7a21c18c8 Merge remote-tracking branch 'origin/topic/vern/ZAM-perf.Apr24'
* origin/topic/vern/ZAM-perf.Apr24: (27 commits)
  BTest updates for changes due to use of ZAM BiF replacements
  rewrite of ZAM optimization of BiFs and script functions/idioms
  flag base script as being known to ZAM optimization
  ZAM optimization for constructing records w/ fields initialized to network_time
  factor some functionality used by BiFs to make accessible to ZAM instructions
  factor script optimization Expr AST nodes out of main AST header
  new internal AST node for expression idioms with corresponding ZAM built-ins
  streamlining of expressions only used for script optimization
  reordering of expressions to match main usage vs. script-optimization extras
  support for conditional expressions transforming into interal has-elements expr
  make same_expr() functionality accessible as a utility
  unify functionality across EqExpr and RelExpr classes
  introduce notions of script functions/BiFs that are (1) foldable, (2) replaceable
  optimization of scripting idioms - min/max, has-elements
  hooks for ZAM optimization of calls to particular functions
  shift ZAM maintenance monitoring of new BiFs to a BTest so it automatically runs
  make externally available the expression used for initializating a record field
  record field initialization optimization: do coercions at compile-time if applicable
  $ZAM_PROFILE_ALL set tells ZAM to profile function bodies even if not executed
  performance speed-up for SMB base scripts
  ...
2024-04-25 09:16:13 -07:00
Tim Wojtulewicz
cbf9ff47e8 Merge remote-tracking branch 'origin/topic/timw/3662-ignore-disabled-writer-frontends'
* origin/topic/timw/3662-ignore-disabled-writer-frontends:
  Don't attempt to stop or flush disabled writer frontends
2024-04-22 17:08:33 -07:00
Tim Wojtulewicz
4f9049278b Merge remote-tracking branch 'origin/topic/timw/3593-smb-multi-request-header'
* origin/topic/timw/3593-smb-multi-request-header:
  Allow SMB_TCP record to contain multiple protocol identifiers/headers
2024-04-22 15:56:02 -07:00
Tim Wojtulewicz
5aa18287f1 Merge remote-tracking branch 'origin/topic/timw/3456-when-unknown-capture'
* origin/topic/timw/3456-when-unknown-capture:
  Check for valid identifier in WhenStmt::Describe
2024-04-22 15:16:16 -07:00
Tim Wojtulewicz
d566961da5 Merge remote-tracking branch 'pbcullen/topic/pbcullen/remove_exclude'
* pbcullen/topic/pbcullen/remove_exclude:
  Update core.pcap.filter-warning baseline
  Add PacketFilter::remove_exclude function
2024-04-18 09:03:57 -07:00
Christian Kreibich
d09584e52e Merge branch 'topic/christian/localversion'
* topic/christian/localversion:
  Parse and store localversion string
  Remove commented-out code
  Check ZEEK_VERSION_LOCAL for dashes
  Update version string btests for localversion
  Modify version parsing for localversion
  Update version used by spicyz
  Update build script
  Support for configurable localversion
2024-04-17 15:00:11 -07:00
Tim Wojtulewicz
9c668212ff Merge remote-tracking branch 'origin/topic/vern/zam-while-fix'
* origin/topic/vern/zam-while-fix:
  fix for ZAM optimization of "while" loops
2024-04-17 14:34:03 -07:00
Tim Wojtulewicz
1563814c4a Merge remote-tracking branch 'origin/topic/johanna/opensuse-leap-15.6-ci'
* origin/topic/johanna/opensuse-leap-15.6-ci:
  Add Opensuse leap 15.6 to CI
2024-04-17 09:21:12 -07:00