Commit graph

3790 commits

Author SHA1 Message Date
Evan Typanski
9f2fb47f48 Merge remote-tracking branch 'origin/topic/etyp/redis-analyzer'
* origin/topic/etyp/redis-analyzer:
  spicy-redis: Add NEWS entry
  spicy-redis: Separate error replies from success
  spicy-redis: Cleanup scripts and tests
  spciy-redis: Bring Redis analyzer into Zeek proper
  spicy-redis: Abort parsing if server data comes first
  spicy-redis: Add recursion depth to server data
  spicy-redis: Make client data only accept bulk strings
  spicy-redis: Add dpd signature and clean pcaps
  spicy-redis: Add some commands and touch up parsing
  spicy-redis: Add some script logic for logging
  spicy-redis: Separate client/server
  spicy-redis: Touchup logging and Spicy issues
  spicy-redis: Add synchronization and pipeline support
  spicy-redis: Begin Spicy Redis analyzer
2025-05-27 10:20:00 -04:00
Arne Welzel
cef63e871e Merge remote-tracking branch 'origin/topic/awelzel/fix-no-zero-timestamp-metadata'
* origin/topic/awelzel/fix-no-zero-timestamp-metadata:
  btest: Add test for Cluster::hello zero-timestamp
  EventMgr/Enqueue: Add automatic timestamp metadata to local events, only
  cluster and broker: Propagate zero-timestamp as metadata, too.
2025-05-26 16:08:58 +02:00
Tim Wojtulewicz
f996f661b6 Merge remote-tracking branch 'origin/topic/timw/redis-connection-failure'
* origin/topic/timw/redis-connection-failure:
  Redis: bump version of hiredis required
  Redis: return proper error if connection fails
2025-05-23 12:13:51 -07:00
Arne Welzel
d929392a76 Merge remote-tracking branch 'origin/topic/awelzel/4177-4178-custom-event-metadata-part-1'
* origin/topic/awelzel/4177-4178-custom-event-metadata-part-1:
  Event: Move meta after args
  Event: Use IntrusivePtr to manage obj refcount
  btest/zam: Update for new EventMetadata bifs
  broker and cluster: Switch to new Enqueue() API
  Event/zeek.bif: Add EventMetadata current() and current_values() accessors
  Event: Deprecate default network timestamp metadata
  Event: Store timestamp in metadata vector
  EventRegistry/zeek.bif/init-bare: Add event metadata infrastructure
  EventMgr: Add CurrentEvent() accessor
2025-05-23 21:02:28 +02:00
Tim Wojtulewicz
57b618ee4a Merge remote-tracking branch 'origin/topic/timw/remove-findclangtidy'
* origin/topic/timw/remove-findclangtidy:
  Remove FindClangTidy.cmake, update cmake submodule
2025-05-23 08:32:13 -07:00
Tim Wojtulewicz
bb17d9e4d6 Merge remote-tracking branch 'origin/topic/timw/sqlite-cluster-test-followup'
* origin/topic/timw/sqlite-cluster-test-followup:
  SQLite: Add TODO note about possibly using sqlite3_busy_timeout
  SQLite: Fix typo in variable name causing pragmas not to retry on busy
  SQLite: Use tableval iteration instead of ToMap for pragmas
  SQLite: Fix logging/error messages around executing pragmas
2025-05-22 16:55:20 -07:00
Tim Wojtulewicz
6b104f3e22 Merge remote-tracking branch 'origin/topic/timw/fix-sqlite-btest-output'
* origin/topic/timw/fix-sqlite-btest-output:
  Update baseline of sqlite-basic btest after recent changes
2025-05-21 12:47:16 -07:00
Tim Wojtulewicz
1862e66097 Merge remote-tracking branch 'origin/topic/timw/sqlite-cluster-test'
* origin/topic/timw/sqlite-cluster-test:
  SQLite: Move integrity_check to pragma table
  SQLite: Add backend option for pragma timeout
  SQLite: Rename tuning_params to pragma_commands, move running pragmas to utility method
  SQLite: Retry pragma statements at startup to avoid contention
  SQLite: Check for locked database as well as busy databases
  SQLite: Fix some string-sizing issues
  SQLite: Run pragmas on connection before creating table
  SQLite: Add busy_timeout pragma to default options
  Prefix sqlite-based btests with sqlite- to match redis tests
  Add sqlite cluster storage btest
2025-05-21 09:41:15 -07:00
Arne Welzel
891338194f Merge remote-tracking branch 'origin/topic/awelzel/fixup-detect-sql-injection-zeekygen-comment'
* origin/topic/awelzel/fixup-detect-sql-injection-zeekygen-comment:
  http/detect-sql-injection: Fix zeekygen comment
  btest/coverage/test-all-policy-zeekygen: Load test-all-policy with zeekygen enabled
2025-05-21 13:39:07 +02:00
Tim Wojtulewicz
c596556036 Merge remote-tracking branch 'origin/topic/timw/3913-parse-port-invalid-read'
* origin/topic/timw/3913-parse-port-invalid-read:
  Add extra input files to ftp fuzzer corpus
  Use bool instead of int flag in FTP analyzer's parse_eftp method
  Fix undefined behavior in FTP analyzer's parse_port method
  Fix invalid-read in FTP analyzer's parse_port method
2025-05-20 12:02:18 -07:00
Arne Welzel
ec744024d3 Merge remote-tracking branch 'origin/topic/awelzel/btest-cluster-layout-replacement'
* origin/topic/awelzel/btest-cluster-layout-replacement:
  btest remaining: Use generic cluster-layout.zeek
  btest/frameworks/logging: Use generic cluster-layout.zeek
  btest/files/x509: Use generic cluster-layout.zeek
  btest/frameworks/notice: Use generic cluster-layout.zeek
  btest/policy: Use generic cluster-layout.zeek
  btest/frameworks/intel: Use generic cluster-layout.zeek
  btest/frameworks/sumstats: Use generic cluster-layout.zeek
  btest/frameworks/cluster: Use generic cluster-layout.zeek
  btest/frameworks/config: Use generic cluster-layout.zeek
  btest/broker: Use generic cluster-layout.zeek
  btest/cluster: Use generic cluster-layout.zeek
  testing/btest/Files: Add generic broker/cluster-layout.zeek
2025-05-20 20:30:47 +02:00
Arne Welzel
906b91dca8 Merge remote-tracking branch 'origin/topic/vern/http-sqli-replacement'
* origin/topic/vern/http-sqli-replacement:
  site/local: Switch to detect-sql-injection
  Add a revised script for detecting HTTP SQL injection, deprecate original
2025-05-20 16:26:13 +02:00
Tim Wojtulewicz
ddeecabc1e Merge remote-tracking branch 'origin/topic/awelzel/event-trace-fix-operator-equals'
* origin/topic/awelzel/event-trace-fix-operator-equals:
  EventTrace: Fix operator==() UBSAN downcast error
2025-05-19 12:33:08 -07:00
Christian Kreibich
fdecfba6b4 Merge branch 'smoot-improve-from_json' of github.com:/stevesmoot/zeek
* 'smoot-improve-from_json' of github.com:/stevesmoot/zeek:
  update baseline for zam
  Update src/zeek.bif
  Change from_json to return an error rather than print it.
2025-05-19 11:06:29 -07:00
Arne Welzel
eb15997cc3 Merge remote-tracking branch 'origin/topic/awelzel/event-trace-mgr-destructor-fclose'
* origin/topic/awelzel/event-trace-mgr-destructor-fclose:
  btest/core: Add event-trace test
  zeek-setup: Free event_trace_mgr after generating trace
  EventTraceMgr: Rename etm to event_trace_mgr
  EventTraceMgr: Move fclose() to destructor
2025-05-19 20:02:12 +02:00
Tim Wojtulewicz
cc79afd24f Merge remote-tracking branch 'origin/topic/timw/include-cleanup-part-2'
* origin/topic/timw/include-cleanup-part-2:
  Remove unnecessary #includes in script_opt
  Remove unnecessary #includes in telemetry and supervisor
  Remove unnecessary #includes in cluster/broker/iosource/probabilistic/session
  Remove unnecessary #includes in zeekygen and base plugin files
  Remove unnecessary #includes in input/logging/threading
  Remove unnecessary #includes in analyzer/packet analyzer/file analyzer source files
  Remove unnecessary #includes in analyzer/packet analyzer/file analyzer headers
  Remove unnecessary #includes in base files in repo
2025-05-19 10:26:05 -07:00
Tim Wojtulewicz
224be5a951 Merge remote-tracking branch 'origin/topic/timw/rename-ci-github-labels'
* origin/topic/timw/rename-ci-github-labels:
  Rename CI-related github labels for PRs
2025-05-19 09:44:10 -07:00
Tim Wojtulewicz
9683e88795 Merge remote-tracking branch 'origin/topic/timw/include-cleanup-part-1'
* origin/topic/timw/include-cleanup-part-1:
  Remove including <cinttypes> from util.h
  Remove telemetry #includes from OpaqueVal.h
  Reduce includes in plugin/Component.h
  Remove zeek/Stats.h include from NetVar.h
  Include StmtBase/StmtEnums in Func.h instead of Stmt.h
  Use modern names for standard headers
  Remove fix for CentOS 7 from TCP_Flags.h
  Fix usage of std::string in http analyzer
  Reorder top section of net_util.h to batch includes together
  Use quotes instead of <> for zeek includes
  Fix Obj.h include in IntrusivePtr.h to have full path
2025-05-16 10:27:46 -07:00
Arne Welzel
4691e2c51b Merge remote-tracking branch 'origin/topic/vern/event-trace-on-exit'
* origin/topic/vern/event-trace-on-exit:
  Generate --event-trace output explicitly rather than in EventTraceMgr destructor
2025-05-16 13:40:04 +02:00
Tim Wojtulewicz
6833088cde Merge remote-tracking branch 'origin/topic/timw/disallow-blind-searching-for-krb5-on-macos'
* origin/topic/timw/disallow-blind-searching-for-krb5-on-macos:
  Require non-system version of libkrb5 on macOS
2025-05-15 12:15:57 -07:00
Arne Welzel
e40aac30f4 Merge remote-tracking branch 'origin/topic/awelzel/bump-ixwebsocket-11.4.6'
* origin/topic/awelzel/bump-ixwebsocket-11.4.6:
  IXWebSocket: Point at upstream, bump to v11.4.6
2025-05-15 16:44:30 +02:00
Johanna Amann
9d3e39581e Merge branch 'topic/jgras/pop3-stls-dpd' of https://github.com/J-Gras/zeek
* 'topic/jgras/pop3-stls-dpd' of https://github.com/J-Gras/zeek:
  Add STLS command to POP3 DPD signature
2025-05-15 10:23:43 +01:00
Arne Welzel
2255fa23b8 Merge remote-tracking branch 'origin/topic/vern/zam-aggr-change-in-loop'
* origin/topic/vern/zam-aggr-change-in-loop:
  fix for ZAM optimization when an aggregate is modified inside of a loop
2025-05-13 19:50:56 +02:00
Tim Wojtulewicz
5aa6734042 Merge remote-tracking branch 'origin/topic/timw/allow-macos-libkrb5'
* origin/topic/timw/allow-macos-libkrb5:
  Allow macOS to search for libkrb5, but disallow system version of library
2025-05-13 10:03:55 -07:00
Arne Welzel
8f60d37ad0 Merge remote-tracking branch 'origin/topic/awelzel/4440-websocket-pong-timeout'
* origin/topic/awelzel/4440-websocket-pong-timeout:
  btest/cluster/websocket: Update tests for new event signature
  cluster/websocket: Propagate code and reason to websocket_client_lost()
  cluster/websocket: Support configurable ping interval
  IXWebSocket: Bump to improve O^2 rxbuf erase()
2025-05-13 18:58:54 +02:00
Tim Wojtulewicz
912356deac Merge remote-tracking branch 'origin/topic/bbannier/fix-spicy-main'
* origin/topic/bbannier/fix-spicy-main:
  Fix clang-tidy `bugprone-inc-dec-in-conditions` report in Spicy plugins glue compiler
  Fix clang-tidy `performance-enum-size` reports in Spicy plugin's glue compiler
  Remove unneeded copies in Spicy plugin glue compiler
  Adjust for renamed function flavor in Spicy development version
2025-05-12 11:33:54 -07:00
Arne Welzel
6b6c3dbbb7 Merge remote-tracking branch 'origin/topic/justin/file_analysis_speedup'
* origin/topic/justin/file_analysis_speedup:
  speed up file analysis, remove IncrementByteCount
2025-05-09 17:25:55 +02:00
Arne Welzel
20ada619c5 Updating submodules binpac, broker and zeek-aux [nomail] 2025-05-09 09:52:20 +02:00
Tim Wojtulewicz
957098af1c Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2025-05-08 15:14:37 -07:00
Christian Kreibich
8d79429555 Merge branch 'topic/christian/fix-broker-peering-overflows-metric'
* topic/christian/fix-broker-peering-overflows-metric:
  Bugfix: accurately track Broker buffer overflows w/ multiple peerings
2025-05-08 15:07:39 -07:00
Tim Wojtulewicz
2c17c85f55 Merge branch 'topic/timw/switch-broker-error-to-error'
* topic/timw/switch-broker-error-to-error:
  Downgrade broker clone FatalError to an Error
2025-05-08 13:47:06 -07:00
Arne Welzel
7583651bec Merge remote-tracking branch 'origin/topic/awelzel/ci-fedora-42'
* origin/topic/awelzel/ci-fedora-42:
  probabilistic/BitVector: Add include <cstdint>
  Bump spicy to fix build with GCC 15.1
  CI: Drop fedora-40
  CI: Add fedora-42
2025-05-08 13:19:30 +02:00
Arne Welzel
60efc7741d Merge branch 'gcc15' of https://github.com/i2z1/zeek
* 'gcc15' of https://github.com/i2z1/zeek:
  Include cstdint header to support uint8_t/uint64_t in GCC 15+
2025-05-08 09:25:28 +02:00
Tim Wojtulewicz
1dfbd33929 Merge remote-tracking branch 'origin/topic/timw/storage-timeout-option'
* origin/topic/timw/storage-timeout-option:
  Move options to redis backend options instead of module-level options
  Add operation_timeout and command_timeout storage backend options
2025-05-07 15:39:35 -07:00
Tim Wojtulewicz
507974a1d8 Merge remote-tracking branch 'origin/topic/christian/news-fix'
* origin/topic/christian/news-fix:
  Fix Broker metrics naming bugs that snuck in w/ last-minute renaming [skip ci]
2025-05-07 14:09:52 -07:00
Tim Wojtulewicz
6f8924596f Merge remote-tracking branch 'origin/topic/johanna/fix-failed-service-logging'
* origin/topic/johanna/fix-failed-service-logging:
  Fix policy/protocols/conn/failed-service-logging.zeek
2025-05-07 10:29:54 -07:00
Arne Welzel
8089f5bed4 Merge remote-tracking branch 'origin/topic/awelzel/more-terminate-while-queueing-hardening'
* origin/topic/awelzel/more-terminate-while-queueing-hardening:
  btest/cluster/generic/publish-any: Apply Christian's fix from broker/publish-any
  wstest/terminate-while-queueing: Patch close_socket()
2025-05-07 17:24:04 +02:00
Tim Wojtulewicz
d7b31f5b44 Merge remote-tracking branch 'origin/topic/timw/storage-is-connected-bif'
* origin/topic/timw/storage-is-connected-bif:
  Add Storage::is_connected BIF
  Move cast_handle from storage-async.bif to BackendHandleVal static method
2025-05-07 08:16:59 -07:00
Arne Welzel
135acc7c6d Merge remote-tracking branch 'origin/topic/awelzel/fix-flaky-terminate-while-queueing'
* origin/topic/awelzel/fix-flaky-terminate-while-queueing:
  cluster/websocket: Stop and wait for reply thread during Terminate()
2025-05-07 13:22:13 +02:00
Arne Welzel
3be7a9ce91 Merge remote-tracking branch 'origin/topic/awelzel/double-commented-btest-lines'
* origin/topic/awelzel/double-commented-btest-lines:
  testing/btest: Fix double commented @TEST- lines
2025-05-06 14:21:03 +02:00
Arne Welzel
4afb0ffeeb Merge remote-tracking branch 'origin/topic/awelzel/4420-simeon-breaking-websockets'
* origin/topic/awelzel/4420-simeon-breaking-websockets:
  Websocket: Close onloop during Terminate()
  OnLoop: notify_all() instead of notify_one()
2025-05-06 14:20:38 +02:00
Tim Wojtulewicz
0393e4b84a Merge remote-tracking branch 'XueSongTap/master'
* XueSongTap/master:
  Add baseline for find_first test, update comments, and reorder function imports
  Add find_first string function
2025-05-05 13:40:40 -07:00
Tim Wojtulewicz
f9aa9a430d Merge remote-tracking branch 'origin/topic/timw/storage-check-redis-server-version'
* origin/topic/timw/storage-check-redis-server-version:
  Add commands to the static methods for the Redis implementation
  Redis: Check server version when connecting
2025-05-05 11:12:09 -07:00
Tim Wojtulewicz
58d71d2fa3 Merge remote-tracking branch 'origin/topic/timw/storage-redis-expire-string-view'
* origin/topic/timw/storage-redis-expire-string-view:
  Use std::string_view in Redis::DoExpire to avoid copies
2025-05-05 10:44:51 -07:00
Arne Welzel
50ac8d1468 Merge remote-tracking branch 'origin/topic/awelzel/4405-quic-fragmented-crypto'
* origin/topic/awelzel/4405-quic-fragmented-crypto:
  Bump external/zeek-testing
  QUIC: Extract reset_crypto() function
  QUIC: Rename ConnectionIDInfo to Context
  QUIC: Switch initial_destination_conn_id to optional
  QUIC: Use initial destination conn_id for decryption
  QUIC: Handle CRYPTO frames across multiple INITIAL packets
  QUIC: Do not consume EncryptedLongPacketPayload
  QUIC: Fix ACK frame parsing
2025-05-05 14:40:59 +02:00
Arne Welzel
d655c64e0b Merge remote-tracking branch 'origin/topic/awelzel/event-publish-hook'
* origin/topic/awelzel/event-publish-hook:
  NEWS: Add HookPublishEvent() note
  btest/plugin: Test for PublishEventHook()
  broker and cluster: Wire up HookPublishEvent
  plugin: Add HookPublishEvent hook
2025-04-30 17:57:46 +02:00
Arne Welzel
f8b75426ee Merge remote-tracking branch 'origin/topic/awelzel/bif-tracking-no-zeromq'
* origin/topic/awelzel/bif-tracking-no-zeromq:
  ZAM-bif-tracking: Remove ZeroMQ dependency
2025-04-30 17:23:22 +02:00
Tim Wojtulewicz
e56de061f9 Merge remote-tracking branch 'origin/topic/vern/zam-inlining-temps'
* origin/topic/vern/zam-inlining-temps:
  fixed incorrect ZAM optimization of expressions seen in single-statement inlined functions
2025-04-29 17:50:39 -07:00
Tim Wojtulewicz
2cf8497bf7 Merge remote-tracking branch 'origin/topic/timw/update-ct-ca-lists'
* origin/topic/timw/update-ct-ca-lists:
  External tests: add removed logs to CT list to prevent baseline changes
  Update Mozilla CA list and CT list to NSS 3.110
2025-04-29 08:53:04 -07:00
Arne Welzel
d5e1dc27c6 Merge branch 'topic/mohan/intel-event-groups' of https://github.com/Mohan-Dhawan/zeek
* 'topic/mohan/intel-event-groups' of https://github.com/Mohan-Dhawan/zeek:
  coalesce smtp handlers for ADDR
  Add fine-grained groups for Intel events
2025-04-29 15:00:58 +02:00