Commit graph

18601 commits

Author SHA1 Message Date
Arne Welzel
7664bb6913 cmake: Bump submodule for removal of NEED_KRB5_H 2023-08-28 11:53:48 +02:00
Arne Welzel
33875c7bf0 zeek-config.h: Drop NEED_KRB5_H
This is unused in the Zeek tree after the previous commit, remove it
from zeek-config.h
2023-08-28 11:31:05 +02:00
Arne Welzel
18ae12f9e3 File: Drop krb5.h include
It looks as if krb5.h was only ever needed together with OpenSSL, then
OpenSSL includes were removed, but the krb5.h ones stayed around.

References:
610d081c4b
d7c10ca7c3
2023-08-28 11:31:05 +02:00
zeek-bot
8822555240 Update doc submodule [nomail] [skip ci] 2023-08-26 00:22:12 +00:00
Arne Welzel
de65671a0a Merge remote-tracking branch 'origin/topic/vern/GH-3191'
* origin/topic/vern/GH-3191:
  BTests for any/vector-of-any fixes
  fixes for vector assignments involving "any"/"vector of any" types
2023-08-25 21:43:03 +02:00
zeek-bot
b63e8fb544 Update doc submodule [nomail] [skip ci] 2023-08-25 00:31:47 +00:00
Vern Paxson
8e5dac3900 BTests for any/vector-of-any fixes 2023-08-24 15:49:13 -07:00
Vern Paxson
d70a0fae85 fixes for vector assignments involving "any"/"vector of any" types 2023-08-24 15:48:00 -07:00
Tim Wojtulewicz
ae03d591b8 Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.Aug23'
* origin/topic/vern/script-opt-maint.Aug23:
  updated notes regarding "-O gen-C++" maintenance
  "-O gen-C++" support for "assert" statements
  addressed some nits re "-O gen-C++" script optimization
  fixes for compiling lambdas to C++
  fixes to avoid ambiguities in analyzing captures for script optimization
  disambiguate lambdas by adding scoping and consideration of captures
  addressed performance and correctness issues flagged by Coverity
2023-08-24 12:17:55 -07:00
Vern Paxson
1473149579 updated notes regarding "-O gen-C++" maintenance 2023-08-24 11:47:01 -07:00
Vern Paxson
81a9745fb3 "-O gen-C++" support for "assert" statements 2023-08-24 11:46:59 -07:00
Arne Welzel
9bbc3a55d4 Merge remote-tracking branch 'origin/topic/awelzel/serial-ppp-0x9'
* origin/topic/awelzel/serial-ppp-0x9:
  PPP: Add PPP analyzer to handle LINKTYPE_PPP (0x9)
2023-08-24 13:49:33 +02:00
zeek-bot
d5d600b360 Update doc submodule [nomail] [skip ci] 2023-08-24 00:16:53 +00:00
Tim Wojtulewicz
39478ebc78 Merge remote-tracking branch 'origin/topic/timw/python37-builds'
* origin/topic/timw/python37-builds:
  CI: Force alpine image to rebuild
  CI: Install python3.8 on older distros
  CI: Remove Ubuntu 18 build (EOL)
2023-08-23 13:05:14 -07:00
Tim Wojtulewicz
8d5b9a9293 CI: Force alpine image to rebuild 2023-08-23 11:12:19 -07:00
Tim Wojtulewicz
5b5a771339 CI: Install python3.8 on older distros 2023-08-23 09:49:36 -07:00
Tim Wojtulewicz
56ec2dfeba CI: Remove Ubuntu 18 build (EOL) 2023-08-23 09:49:36 -07:00
Arne Welzel
ee12a7a6e7 PPP: Add PPP analyzer to handle LINKTYPE_PPP (0x9)
Using pcaps from https://interop.seemann.io/ as samples for QUIC protocol
data didn't produce a conn.log for the contained data. `tcpdump -r`
and Wireshark do show the contained IP/UDP packets. Teach Zeek how
to handle link type DLT_PPP 0x09 using a new PPP analyzer based on the
PPPSerial analyzer code.

Usual update to files/x509 baseline after adding new analyzer due
to enum values changing.
2023-08-23 16:41:19 +02:00
Johanna Amann
70c76977cf Merge remote-tracking branch 'origin/topic/johanna/gh-3242'
* origin/topic/johanna/gh-3242:
  Community-id: load main script in notice script, fix notice script
2023-08-23 12:46:21 +01:00
Johanna Amann
4156c4764a Community-id: load main script in notice script, fix notice script
This change makes the community-id script that adds the community id to
notice.log automatically load the main script if this was not already
loaded.

In the past, the script just did not perform any action if the main
script was not loaded.

This change also makes the notice script respect the seed/base64
settings that were set in the main script.

Fixes GH-3242
2023-08-22 15:09:47 +01:00
Robin Sommer
e8292be0ce
Merge remote-tracking branch 'origin/topic/robin/spicy-export-extensions'
* origin/topic/robin/spicy-export-extensions:
  [Spicy] Clean up representation of EVT record fields.
  [Spicy] Extend functionality of `export` in EVT files.
  [Spicy] Refactor parsing of `export` in EVT files.
2023-08-22 15:04:05 +02:00
Robin Sommer
36a6770e98
[Spicy] Clean up representation of EVT record fields. 2023-08-21 10:26:25 +02:00
Robin Sommer
cdadd934ce
[Spicy] Extend functionality of export in EVT files.
We now support selecting which fields of a unit type get exported into
the automatically created Zeek record; as well as selecting which
fields get a `&log` attribute added automatically to either all fields
or to selected fields.

Syntax:

- To export only selected fields:

    export Foo::X with { field1, field3 };

- To export all but selected fields:

    export Foo::X without { field2, field3 };

- To `&log` all fields:

    export Foo::X &log;

- To `&log` only selected fields:

    export Foo::X with { field1 &log, field3 }; # exports (only) field1 and field3, and marks field1 for logging

Syntax is still subject to change.

Closes #3218.
Closes #3219.
2023-08-21 10:26:25 +02:00
Arne Welzel
f5c339f246 Merge remote-tracking branch 'origin/topic/awelzel/shfmt-py-pin-to-latest'
* origin/topic/awelzel/shfmt-py-pin-to-latest:
  pre-commit: Pin to latest shfmt-py version
2023-08-17 16:35:45 +02:00
Arne Welzel
3082902d32 pre-commit: Pin to latest shfmt-py version
This allows users to run shfmt-py with Python > 3.9. Also drop
the explicit Python version for the setup-python action.
2023-08-17 16:30:50 +02:00
Vern Paxson
4928e074d4 addressed some nits re "-O gen-C++" script optimization 2023-08-16 17:04:39 -07:00
Vern Paxson
6af0014a7b fixes for compiling lambdas to C++ 2023-08-16 17:03:37 -07:00
Vern Paxson
4991693a9c fixes to avoid ambiguities in analyzing captures for script optimization 2023-08-16 17:00:57 -07:00
Vern Paxson
3e0f814635 disambiguate lambdas by adding scoping and consideration of captures 2023-08-16 16:58:05 -07:00
Vern Paxson
3925ff4592 addressed performance and correctness issues flagged by Coverity 2023-08-15 16:07:49 -07:00
Johanna Amann
61296ce052 Update broker submodule [nomail] 2023-08-15 17:40:40 +01:00
Johanna Amann
0b8b81f426 Merge remote-tracking branch 'origin/topic/johanna/posix_spawn'
* origin/topic/johanna/posix_spawn:
  Raw reader: better error handling for posix_spawn
  Raw reader: use posix_spawn instead of fork + exec
2023-08-15 17:34:25 +01:00
Tim Wojtulewicz
5637643798 Merge remote-tracking branch 'origin/topic/timw/pre-commit-python-version'
* origin/topic/timw/pre-commit-python-version:
  Force pre-commit to use python 3.9
2023-08-15 09:20:09 -07:00
Tim Wojtulewicz
97c2d195cc Force pre-commit to use python 3.9 2023-08-15 09:18:45 -07:00
Tim Wojtulewicz
9357a5879b Merge remote-tracking branch 'origin/topic/timw/update-zeek-aux'
* origin/topic/timw/update-zeek-aux:
  CI: update freebsd to 13.2 and 12.4
  Update zeek-aux submodule [nomail]
2023-08-14 11:18:28 -07:00
Tim Wojtulewicz
6761aebef7 CI: update freebsd to 13.2 and 12.4 2023-08-14 11:17:39 -07:00
Tim Wojtulewicz
4dce283a04 Update zeek-aux submodule [nomail] 2023-08-14 11:17:39 -07:00
zeek-bot
c9277bda74 Update doc submodule [nomail] [skip ci] 2023-08-12 00:25:28 +00:00
Tim Wojtulewicz
6bfe78fbcb Update docs submodule [nomail] 2023-08-11 10:36:45 -07:00
Tim Wojtulewicz
e8ef169b27 Merge remote-tracking branch 'origin/topic/timw/3059-set-vector-conversion'
* origin/topic/timw/3059-set-vector-conversion:
  Fix conversion with record types
  Add conversion between set and vector using 'as' keyword
  Add std::move for a couple of variables passed by value
2023-08-11 10:35:06 -07:00
Tim Wojtulewicz
7137a267ad Merge remote-tracking branch 'origin/topic/timw/modbus-overflow'
* origin/topic/timw/modbus-overflow:
  Modbus: Add early return in case of data being too short to parse
2023-08-11 09:52:38 -07:00
Robin Sommer
83029ecafc
[Spicy] Refactor parsing of export in EVT files.
Moving that into its own function and preparing for storing additional
information.
2023-08-11 12:42:55 +02:00
Tim Wojtulewicz
d6ccb85c4c Modbus: Add early return in case of data being too short to parse 2023-08-10 18:06:58 -07:00
Tim Wojtulewicz
fe9926e538 Fix conversion with record types 2023-08-10 13:42:23 -07:00
Johanna Amann
fdd3c55d42 Raw reader: better error handling for posix_spawn
Addressed feedback in GH-3216
2023-08-10 13:20:29 +01:00
Tim Wojtulewicz
af9e852c28 Add conversion between set and vector using 'as' keyword 2023-08-09 14:41:54 -07:00
Tim Wojtulewicz
4022573d48 Merge remote-tracking branch 'origin/topic/bbannier/issue-3177'
* origin/topic/bbannier/issue-3177:
  Explicitly link Zeek executable against Spicy libraries in binary packaging mode.
2023-08-09 09:08:47 -07:00
Johanna Amann
e97f63dbbe Raw reader: use posix_spawn instead of fork + exec
This commit switchexisd the Raw reader to use posix_spawn, instead of
the combination of fork + exec. This should be much more efficient, and
also makes the code smaller, and easier to read and understand.
2023-08-09 16:51:47 +01:00
Benjamin Bannier
26a6bc7dfe Explicitly link Zeek executable against Spicy libraries in binary packaging mode.
Closes #3177.
2023-08-09 11:31:27 +02:00
zeek-bot
646b301b65 Update doc submodule [nomail] [skip ci] 2023-08-09 00:19:23 +00:00