Commit graph

5426 commits

Author SHA1 Message Date
Johanna Amann
0aafc8ae6c Merge remote-tracking branch 'origin/topic/vern/type-names'
* origin/topic/vern/type-names:
  regularize deprecation warning
  make DoDescribe protected for a tidier interface mark use of DESC_PORTABLE as deprecated
  when printing a description of a type, use its name if available
2022-05-09 11:15:36 +01:00
Christian Kreibich
8d101f21be Merge branch 'topic/christian/management-consistency-tweaks'
* topic/christian/management-consistency-tweaks:
  Management framework: consistency tweaks in zeek-client, plus test updates
2022-05-06 15:28:48 -07:00
Tim Wojtulewicz
cf51931615 Merge remote-tracking branch 'origin/topic/vern/footprint'
* origin/topic/vern/footprint:
  new environment variable to enable BTests to skip ASAN checks
  skip new BiF test for ASAN CI runs
  btest update to include recursive value that doesn't require a record
  to avoid recursion, track all aggregates, not just records isolate the internal methods
  simpler public calling interface for computing footprint
  use stack-based set to prevent infinite recursion rather than a static one
  change value_footprint() to val_footprint() to be more similar to val_size()
  make including count of container elements non-optional
  btest for mutually-recursive case
  fix for tracking footprints of mutually-recursive records
  added value_footprint() and global_container_footprints() BiFs
2022-05-06 11:32:49 -07:00
Christian Kreibich
8c76af6ab9 Management framework: consistency tweaks in zeek-client, plus test updates
A minor changeset that reflects zeek-client updates, with some effects on
its output and hence test cases.
2022-05-06 11:22:48 -07:00
Christian Kreibich
7198c847e8 Merge branch 'topic/christian/management-get-config'
* topic/christian/management-get-config:
  Management framework: add get_configuration_request/response transaction
2022-05-05 18:10:46 -07:00
Vern Paxson
a387157ead skip new BiF test for ASAN CI runs 2022-05-05 17:07:46 -07:00
Vern Paxson
d5f60cfaba btest update to include recursive value that doesn't require a record 2022-05-05 16:55:03 -07:00
Christian Kreibich
001de561fc Management framework: add get_configuration_request/response transaction
Includes submodule bumps for Broker (to pull in better handling of data
structures that are difficult to unserialize in Python), zeek-client (for the
get-config command), and a commit hash update for the external testsuite.
2022-05-05 16:09:21 -07:00
Tim Wojtulewicz
1d1cad95c9 Merge remote-tracking branch 'origin/topic/vern/zam-maint-01May22'
* origin/topic/vern/zam-maint-01May22:
  fix for coverage reporting for functions that use "when" statements
  ZAM maintenance for recent changes and some newly exercised corner cases
2022-05-04 11:58:02 -07:00
Vern Paxson
690a4590b7 test suite updates for refined script coverage, use of new BiF to speed startup 2022-05-03 12:36:50 -07:00
Johanna Amann
42bc6db359 Merge remote-tracking branch 'origin/master' into topic/johanna/bloomfilter 2022-05-03 16:43:36 +01:00
Vern Paxson
f7581437d9 fix for sets containing recursive records 2022-05-02 13:19:58 -07:00
Vern Paxson
7a9c6c476e ZAM maintenance for recent changes and some newly exercised corner cases 2022-05-01 14:33:58 -07:00
Vern Paxson
edf276520a make including count of container elements non-optional 2022-04-29 09:03:35 -07:00
Vern Paxson
b670046a69 btest for mutually-recursive case 2022-04-29 08:44:58 -07:00
Vern Paxson
cbb18207dc when printing a description of a type, use its name if available 2022-04-28 18:23:02 -07:00
Vern Paxson
16c37034de added value_footprint() and global_container_footprints() BiFs 2022-04-28 16:42:14 -07:00
Dominik Charousset
a8196cf4fb Fix formatting 2022-04-27 23:02:27 +02:00
Dominik Charousset
02608df99c Canonify intel.log in read-file-dist-cluster test 2022-04-27 23:02:27 +02:00
Dominik Charousset
4ea1a593a9 Port Zeek to latest Broker API 2022-04-27 23:02:27 +02:00
Tim Wojtulewicz
e8f833b8a6 Store all mappings in a single map instead of split by type
This opens up the possibility of storing other request types outside
of T_A, T_PTR and T_TXT without requiring redoing the caching. It
also fixes the caching code in DNS_Mapping, adding a version number
to the start of the cache file so the cache structure can be modified
and old caches invalidated more easily.
2022-04-22 13:10:37 -07:00
Christian Kreibich
2d73edb04c Merge branch 'topic/christian/management-print-cmd'
* topic/christian/management-print-cmd:
  Management framework: bump external testsuite
  Management framework: allow selecting cluster nodes in get_id_value
  Management framework: minor tweaks to logging component
  Management framework: bump zeek-client to pull in get-id-value command
  Avoid whitespace around function type strings in JSON rendering
  Management framework: improve handling of node run states
  Management framework: add get_id_value dispatch
  Management framework: allow dispatching "actions" on cluster nodes.
  Management framework: some renaming to avoid the term "data cluster"
  Management framework: allow agents to communicate with cluster nodes
2022-04-18 16:40:49 -07:00
Christian Kreibich
e2d0db73a5 Management framework: bump external testsuite 2022-04-18 13:11:03 -07:00
Christian Kreibich
337c7267e0 Management framework: allow agents to communicate with cluster nodes
This provides Broker-level plumbing that allows agents to reach out to their
managed Zeek nodes and collect responses.

As a first event, it establishes Management::Node::API::notify_agent_hello,
to notify the agent when the cluster node is ready to communicate.

Also a bit of comment rewording to replace use of "data cluster" with simply
"cluster", to avoid ambiguity with data nodes in SumStats, and expansion of
test-all-policy.zeek and related/dependent tests, since we're introducing new
scripts.
2022-04-15 18:51:54 -07:00
Christian Kreibich
2d93a19f45 Expand plugin.reporter-hook testcase to verify -NN output 2022-04-14 15:20:08 -07:00
Tim Wojtulewicz
a3b022ed98 Merge remote-tracking branch 'origin/topic/robin/loads-sigs-path'
* origin/topic/robin/loads-sigs-path:
  Re-instantiate providing location information to `LoadFile` hooks.
2022-04-14 10:13:35 -07:00
Robin Sommer
445903f808
Add tests exercising dictionary iteration during modification.
These are some of the reproducers from #2017 and #2032 by Arne Welzel.
2022-04-14 11:12:11 +02:00
Robin Sommer
fccb9ccab0
Re-instantiate providing location information to LoadFile hooks.
#1835 subtly changed the semantics of the `LoadFile` plugin hook to no
longer have the current script location available for signature files
being loaded through `@load-sigs`. This was undocumented behavior, so
it's technically not a regression, but since at least one external
plugin is depending on it, this change restores the old behavior.
2022-04-14 10:43:21 +02:00
Tim Wojtulewicz
2c9296120e Merge remote-tracking branch 'ynadji/add-enum-to-int-ordering-test'
* ynadji/add-enum-to-int-ordering-test:
  Add test to ensure enum_to_int's return values are ordered
2022-04-13 10:53:07 -07:00
Yacin Nadji
8e225efd57 Add test to ensure enum_to_int's return values are ordered 2022-04-11 13:10:36 -04:00
Tim Wojtulewicz
d0e13a1e79 Merge remote-tracking branch 'origin/topic/vern/table-attr-fixes'
* origin/topic/vern/table-attr-fixes:
  updates for btests - new cases to check, new baselines
  updates for btests - new cases to check, new baselines
  fix for ill-formed (complex) &default function
  type-checking for use of empty table constructors in expressions
  catch empty constructors used for type inference suppress repeated error messages
  factoring to make checking of &default attributes externally accessible
  bug fix for empty table constructors with &default attributes (plus a typo)
2022-04-05 18:05:15 -07:00
Vern Paxson
84dc430e00 fix & btest for ZAM bug with inlined nested loop 2022-04-01 14:04:50 -07:00
Vern Paxson
77007eccf8 updates for btests - new cases to check, new baselines 2022-03-31 20:42:54 -07:00
Vern Paxson
16a16948a1 updates for ZAM optimization 2022-03-23 15:36:36 -07:00
Vern Paxson
1f27edf756 btest tweaks I overlooked 2022-03-23 15:36:35 -07:00
Vern Paxson
ae75635c5a new btests to cover extended functionality & associatd errors 2022-03-23 15:36:35 -07:00
Vern Paxson
64775a8192 updates to btests to support switch to expression-based initialization 2022-03-23 15:36:35 -07:00
Tim Wojtulewicz
c299301372 Update zeek-testing-private hash [nomail] [skip ci] 2022-03-22 13:12:12 -07:00
Tim Wojtulewicz
2386b650cd Merge remote-tracking branch 'ynadji/raw_bytes_to_v6_addr'
* ynadji/raw_bytes_to_v6_addr:
  add raw_bytes_to_v6_addr in docs when raw_bytes_to_v4_addr is present
  Zero out bytes by default for consistent return value on error
  Add tests for raw_bytes_to_v6_addr
  Add raw_bytes_to_v6_addr function
2022-03-10 11:09:49 -07:00
Yacin Nadji
a2320ffe88 Zero out bytes by default for consistent return value on error 2022-03-09 11:15:48 -05:00
Yacin Nadji
45ab85c09e Add tests for raw_bytes_to_v6_addr 2022-03-08 17:50:26 -05:00
Johanna Amann
ff4f3f359c Merge remote-tracking branch 'origin/topic/vern/rec-constr-check'
* origin/topic/vern/rec-constr-check:
  associated btest
  fix base scripts to include mandatory fields in record constructors
  restored record constructor checking for missing-but-mandatory fields
2022-03-02 13:49:31 +00:00
Johanna Amann
f264a9eccf Merge remote-tracking branch 'origin/topic/christian/gh-1982'
* origin/topic/christian/gh-1982:
  The is_num(), is_alpha(), and is_alnum() BiFs now return F on empty string
  Expand testcases around is_num(), is_alpha(), is_alnum(), is_ascii() BiFs
  Clarify is_ascii() BiF docstring re behavior on empty strings
  Fix minor indentation bugs in strings.bif
2022-03-02 08:25:41 +00:00
Johanna Amann
d38923cfcf Merge remote-tracking branch 'origin/topic/johanna/tls12-decryption'
Documentation is missing and will be added in the next couple of hours.

* origin/topic/johanna/tls12-decryption: (24 commits)
  TLS decryption: add test, fix small issues
  Address PR feedback
  TLS decryption: refactoring, more comments, less bare pointers
  Small code fix and test baseline update.
  SSL decryption: refactor TLS12_PRF
  SSL decryption: small style changes, a bit of documentation
  Deprecation and warning fixes
  Clang-format updates
  add missing call to EVP_KDF_CTX_set_params
  TLS decryption: remove payload from ssl_encrypted_data again.
  TLS 1.2 decryption: adapt OpenSSL 3.0 changes for 1.1
  ssl: adapt TLS-PRF to openSSL 3.0
  ssl/analyzer: potentially fix memory leaks caused by bytestrings
  analyzer/ssl: several improvements
  analyzer/ssl: defensive key length check + more debug logging
  testing: feature gate ssl/decryption test
  testing: add ssl/decryption test
  analyzer/ssl: handle missing <openssl/kdf.h>
  analyzer/ssl: silence warning in DTLS analyzer
  analyzer/ssl: move proc-{client,server}-hello into the respective analyzers
  ...
2022-03-02 08:20:39 +00:00
Johanna Amann
590d4aa13e TLS decryption: add test, fix small issues
Add a test loading keys from an external file. Make some debug messages
slightly better and remove unnecessary debug output.
2022-03-01 17:45:11 +00:00
Vern Paxson
b3ff872bd7 associated btest 2022-02-28 17:38:32 -08:00
Christian Kreibich
19bfa071e0 Expand testcases around is_num(), is_alpha(), is_alnum(), is_ascii() BiFs 2022-02-28 13:09:32 -08:00
Christian Kreibich
40fa1a0769 Merge branch 'topic/christian/controller-renaming'
* topic/christian/controller-renaming:
  Bump external cluster testsuite to reflect Management framework reorg
  Bump zeek-client to reflect Management framework reorg
  Reorg of the cluster controller to new "Management framework" layout
2022-02-10 18:10:08 -08:00
Christian Kreibich
59fa19424d Bump external cluster testsuite to reflect Management framework reorg 2022-02-09 18:09:46 -08:00
Christian Kreibich
54aaf3a623 Reorg of the cluster controller to new "Management framework" layout
- This gives the cluster controller and agent the common name "Management
framework" and changes the start directory of the sources from
"policy/frameworks/cluster" to "policy/frameworks/management". This avoids
ambiguity with the existing cluster framework.

- It renames the "ClusterController" and "ClusterAgent" script modules to
"Management::Controller" and "Management::Agent", respectively. This allows us
to anchor tooling common to both controller and agent at the "Management"
module.

- It moves common configuration settings, logging, requests, types, and
utilities to the common "Management" module.

- It removes the explicit "::Types" submodule (so a request/response result is
now a Management::Result, not a Management::Types::Result), which makes
typenames more readable.

- It updates tests that depend on module naming and full set of scripts.
2022-02-09 18:09:42 -08:00