Commit graph

3252 commits

Author SHA1 Message Date
Tim Wojtulewicz
ba91de59b0 Merge remote-tracking branch 'mp/topic/mp-corelight/update-docker-env-syntax'
* mp/topic/mp-corelight/update-docker-env-syntax:
  Update Dockerfile to avoid LegacyKeyValueFormat warning
2024-09-12 09:18:56 +02:00
Johanna Amann
899f7297d7 Merge remote-tracking branch 'origin/topic/timw/remove-negative-timestamp-test'
* origin/topic/timw/remove-negative-timestamp-test:
  Remove core.negative-time btest
2024-09-12 08:53:00 +02:00
Johanna Amann
a0ff0fb18b Merge remote-tracking branch 'origin/topic/johanna/reformat-spicy-ssl'
* origin/topic/johanna/reformat-spicy-ssl:
  Bump spicy-format to 0.16.2
  Bump spicy-format to 0.16.1
  Spicy SSL: reformat with new version of spicy format
2024-09-12 08:51:22 +02:00
Johanna Amann
743e2a3663 Merge remote-tracking branch 'origin/topic/johanna/spicy-tls'
* origin/topic/johanna/spicy-tls: (31 commits)
  Spicy SSL: don't turn on compilation of Spicy SSL analyzer in all cases
  Spicy SSL analyzer - address feedback
  Spicy TLS: re-enable test and update test comments
  Spicy SSL: Skip private test suite for now.
  Spicy SSL - finish SSLv2 implementation
  Spicy TLS: SSLv2 client hello support.
  Spicy TLS - full test suite pass
  Spicy TLS - refactoring and partial connection fix
  Spicy SSL - run spicy-format
  Spicy-TLS: address review feedback re convert-functions
  Spicy TLS: address review feedback & run spicy-lint
  Spicy TLS: disable debug prints
  Add configure option to enable/disable spicy SSL
  Spicy TLS: inout/reference updates for recent spicy changes
  Spicy TLS: parse OCSP replies in TLS extension
  Spicy TLS: generate same file IDs as binpac analyzer
  Spicy TLS: skip CI; run performance tests
  Spicy TLS: fix parsing of no-extension hellos, port registration
  Spicy TLS: Re-enable starttls for RDP
  Spicy TLS: rename the analyzer to SSL
  ...
2024-09-11 16:59:17 +02:00
Arne Welzel
ede4e661cd Merge remote-tracking branch 'origin/topic/awelzel/script-opt-less-includes'
* origin/topic/awelzel/script-opt-less-includes:
  script_opt/ZAM/IterInfo.h: Add missing Dict.h dependency
  script_opt/ZAM: ZBody.h / Support.h: Cleanup includes, use forward declarations
  script_opt/ZAM/Profile: Remove Zeek header includes
  script_opt: Extend Support.h to break include dependencies
  script_opt: Do not include ZBody.h in ZAM/Validate.cc
2024-09-09 13:25:33 +02:00
Arne Welzel
a339cfa4c0 Merge remote-tracking branch 'origin/topic/awelzel/3919-ldap-logs-missing'
* origin/topic/awelzel/3919-ldap-logs-missing:
  btest/ldap: Add regression test for #3919
2024-09-06 19:17:49 +02:00
Arne Welzel
b9ca50c6bb Merge remote-tracking branch 'origin/topic/awelzel/add-postgresql-parser'
* origin/topic/awelzel/add-postgresql-parser:
  postgresql: Simplify SSL buffering and forwarding
  postgresql: Initial parser implementation
2024-09-06 17:47:52 +02:00
Arne Welzel
2907d9feee Merge remote-tracking branch 'origin/topic/awelzel/add-spicy-format'
* origin/topic/awelzel/add-spicy-format:
  testing/external: Update private baselines
  analyzer/syslog: Reformat with spicy-format
  analyzer/finger: Reformat with spicy-format
  scripts/spicy: Reformat with spicy-format
  pre-commit: Add spicy-format
2024-09-05 19:19:49 +02:00
Tim Wojtulewicz
d4a646cd21 Merge remote-tracking branch 'origin/topic/timw/dns-opcode-check'
* origin/topic/timw/dns-opcode-check:
  Check for netbios to avoid reporting extra bad DNS opcodes
  Add weird for unhandled opcodes in DNS analyzer
2024-09-04 14:53:31 -07:00
Tim Wojtulewicz
cd10bd3747 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-09-03 09:04:03 -07:00
Benjamin Bannier
dffef94d4d Merge branch 'topic/bbannier/bump-clang-format' 2024-09-03 10:18:39 +02:00
Arne Welzel
cdae755a0c Bump zeek-aux for zeek/zeek-aux#57 2024-09-03 10:03:22 +02:00
Arne Welzel
c27e18631c Merge branch 'fix-http-password-capture' of https://github.com/p-l-/zeek
* 'fix-http-password-capture' of https://github.com/p-l-/zeek:
  http: fix password capture when enabled
2024-08-30 18:56:48 +02:00
Arne Welzel
435770f99a Merge remote-tracking branch 'origin/topic/awelzel/no-broker-mgr-active'
* origin/topic/awelzel/no-broker-mgr-active:
  RunState: Drop broker_mgr->Active() usage
2024-08-30 15:39:06 +02:00
Johanna Amann
d89c0d1ef7 Merge remote-tracking branch 'origin/topic/johanna/fix-ssl2-client-hello-version-parsing'
* origin/topic/johanna/fix-ssl2-client-hello-version-parsing:
  Fix parsing of version field in SSLv2 client hello
2024-08-27 13:31:12 +01:00
Arne Welzel
45b33bf5c1 Merge remote-tracking branch 'origin/topic/awelzel/no-child-analyzer-on-finished-connections'
* origin/topic/awelzel/no-child-analyzer-on-finished-connections:
  Analyzer: Do not add child analyzers when finished
2024-08-23 14:19:00 +02:00
Arne Welzel
4a4cbf2576 Merge remote-tracking branch 'origin/topic/awelzel/tcp-reassembler-undelivered-data-match-bool-bool-bool-confusion'
* origin/topic/awelzel/tcp-reassembler-undelivered-data-match-bool-bool-bool-confusion:
  TCP_Reassembler: Fix IsOrig() position in Match() call
2024-08-23 09:41:07 +02:00
Johanna Amann
2f07ca9e7f Merge remote-tracking branch 'origin/topic/johanna/ssl-history-also-for-sslv2-not-only-for-things-that-use-the-more-modern-handshake'
* origin/topic/johanna/ssl-history-also-for-sslv2-not-only-for-things-that-use-the-more-modern-handshake:
  Make ssl_history work for SSLv2 handshakes/connections
2024-08-20 11:40:20 +01:00
Arne Welzel
5ac5f5f24f Merge remote-tracking branch 'origin/topic/awelzel/broker-deprecate-valp-list-interface'
* origin/topic/awelzel/broker-deprecate-valp-list-interface:
  broker: Deprecate MakeEvent(ValPList*)
  Span: Remove deduction guideline for Iter, Iter, include cleanup
2024-08-20 10:11:11 +02:00
Tim Wojtulewicz
00c2e9afce Merge remote-tracking branch 'J-Gras/topic/jgras/remove-wrapper-analyzer'
* J-Gras/topic/jgras/remove-wrapper-analyzer:
  Remove unused wrapper packet analyzer
2024-08-16 09:06:51 -07:00
Arne Welzel
f21da04c3e Merge remote-tracking branch 'origin/topic/etyp/dns-tkey'
* origin/topic/etyp/dns-tkey:
  Add DNS TKEY event
2024-08-16 16:51:58 +02:00
Arne Welzel
ec1088c3ef Merge remote-tracking branch 'origin/topic/vern/zam-regularization'
* origin/topic/vern/zam-regularization: (33 commits)
  simpler and more robust identification of function parameters for AST profiling
  fixes to limit AST traversal in the face of recursive types
  address some script optimization compiler warnings under Linux
  fix for -O C++ construction of variable names that use multiple module namespaces
  fix for script optimization of "opaque" values that are run-time constants
  fix for script optimization of nested switch statements
  script optimization fix for complex "in" expressions in conditionals
  updates to typos allow-list reflecting ZAM regularization changes
  BTest updates for ZAM regularization changes
  convert new ZAM operations to use typed operands
  complete migration of ZAM to use only public ZVal methods
  "-O validate-ZAM" option to validate generated ZAM instructions
  internal option to suppress control-flow optimization
  exposing some functionality for greater flexibility in structuring run-time execution
  rework ZAM compilation of type switches to leverage value switches
  add tracking of control flow information
  factoring of ZAM operation specifications into separate files
  updates to ZAM operations / gen-zam regularization, other than the operations themselves
  type-checking fix for vector-of-string operations
  ZVal constructor for booleans
  ...
2024-08-16 12:10:33 +02:00
Arne Welzel
ac5cbcc43e Merge remote-tracking branch 'origin/topic/vern/cpp-init'
* origin/topic/vern/cpp-init:
  Func: Add SetCapturesVec()
  marked some recently added BTests as not suitable for -O gen-C++ testing
  robustness improvements for -O gen-C++ generation of lambdas / "when"s
  speedups for compilation of initializers in -O gen-C++ generated code
  fixes for -O gen-C++ generation of floating point constants
  -O gen-C++ fix for dealing with use of more than one module qualifier
  header tweaks to provide gen-C++ script optimization with more flexibility
  fix for script optimization of constants of type "opaque"
  fix for script optimization of "in" operations
  some minor tidying of -O gen-C++ sources
2024-08-15 10:30:48 +02:00
Arne Welzel
52d51f2c63 Merge remote-tracking branch 'origin/topic/awelzel/3880-mysql-caching-sha2-password-successful'
* origin/topic/awelzel/3880-mysql-caching-sha2-password-successful:
  mysql: Implement and test COM_CHANGE_USER
  mysql: Remove auth plugin state
  mysql: Handle server connection phase separately from command phase
2024-08-14 20:12:39 +02:00
Arne Welzel
44a3ed676b Merge remote-tracking branch 'jgras/topic/jgras/packet-analyzer-history-rework'
* jgras/topic/jgras/packet-analyzer-history-rework:
  Deprecate old unknown_protocol event signature
  Use raw pointer for packet analyzer history
  Update external baselines for analyzer history
  Update btest baselines for analyzer history
  Add packet analyzer history
2024-08-13 12:37:41 +02:00
Arne Welzel
f943366e8e Merge remote-tracking branch 'origin/topic/awelzel/spicyz-add-back-port-ports-message'
* origin/topic/awelzel/spicyz-add-back-port-ports-message:
  spicyz: Add back message about removed support for port / ports in evt
2024-08-12 11:07:40 +02:00
Arne Welzel
32cbe953ba Merge remote-tracking branch 'origin/topic/awelzel/rule-parse-fix-coverity-leak'
* origin/topic/awelzel/rule-parse-fix-coverity-leak:
  rule-parse: Remove id_to_str() lookup to squelch coverity warning
2024-08-09 20:57:40 +02:00
Arne Welzel
39a9b64219 Merge remote-tracking branch 'origin/topic/timw/remove-cluster-interface-field-zeekctl'
* origin/topic/timw/remove-cluster-interface-field-zeekctl:
  Update zeekctl submodule
2024-08-08 10:44:51 +02:00
Tim Wojtulewicz
6041f74601 Merge remote-tracking branch 'origin/topic/timw/7.1-deprecation-removal'
* origin/topic/timw/7.1-deprecation-removal:
  Remove deprecated port/ports fields for spicy analyzers
  Remove deprecated Cluster::Node::interface field
  Remove deprecated signature definition format
  Return an error if GLOBAL:: prefix is used
  Remove deprecated BloomFilter serialization methods
  Remove deprecated OpaqueVal serialization methods
  Remove deprecated DECLARE_OPAQUE_VALUE macro
  Make TypePtr::Capture member variables private
  Remove deprecated Trigger constructor
  Remove deprecated Controller::auto_assign_ports and Controller::auto_assign_start_port
  Remove deprecated load-balacing policy script
  Remove deprecated prometheus telemetry policy script
  Remove deprecated policy/tuning/default package
  Remove deprecated time machine settings
  Remove deprecated json NullDoubleWriter class
  Remove deprecated modbus event definitions
  Remove Connection::AppendAddl
  Remove STMT_ANY statement type
  Remove EventRegistry::Used and EventRegistry::SetUsed
2024-08-07 12:20:44 -07:00
Arne Welzel
97fa7cdc0a Merge remote-tracking branch 'origin/topic/awelzel/ldap-fix-uint8-shift'
* origin/topic/awelzel/ldap-fix-uint8-shift:
  ldap: Promote uint8 to uint64 before shifting
2024-08-07 14:11:30 +02:00
Arne Welzel
2c62ecf57d Merge remote-tracking branch 'origin/topic/awelzel/ci-ubuntu-24-new-ccache'
* origin/topic/awelzel/ci-ubuntu-24-new-ccache:
  ci/ubuntu-24.04: Use ccache 4.10.2
2024-08-07 11:43:33 +02:00
Arne Welzel
b0df736ba7 Merge remote-tracking branch 'origin/topic/awelzel/threading-manager-metrics-follow-up'
* origin/topic/awelzel/threading-manager-metrics-follow-up:
  telemetry/Manager: Check RegisterFd() return value
  telemetry/Manager: Track sent_in and sent_out totals without callback
  threading/Manager: Switch inf bucket from infinity() to max()
  threading/Manager: "lt" to "le" and do not break
2024-08-07 10:55:13 +02:00
Arne Welzel
c845c7cce0 Merge remote-tracking branch 'origin/topic/awelzel/3860-ldap-fuzzer'
* origin/topic/awelzel/3860-ldap-fuzzer:
  Bump auxil/spicy to latest development snapshot
  spicy/runtime-support: Switch ParameterMismatch::_fmt to static
  coverage/lcov_html: Ignore testing/btest/.tmp
  cirrus: Do not disable Spicy for sanitizer builds
  ldap: Avoid unset m$opcode
  fuzzers: Add LDAP fuzzing
2024-08-06 20:09:09 +02:00
Tim Wojtulewicz
d52ec28c89 Merge remote-tracking branch 'origin/topic/timw/dont-install-empty-zam-dirs'
* origin/topic/timw/dont-install-empty-zam-dirs:
  Don't install empty ZAM directories
2024-08-06 09:02:31 -07:00
Tim Wojtulewicz
25f65a705f Updating CHANGES and VERSION. 2024-08-05 14:40:31 -07:00
Tim Wojtulewicz
3c3853dc7d Merge remote-tracking branch 'origin/topic/timw/telemetry-threading'
* origin/topic/timw/telemetry-threading:
  Process metric callbacks from the main-loop thread
2024-08-02 15:50:47 -07:00
Tim Wojtulewicz
4c0c7581c8 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-07-26 10:12:04 -07:00
Arne Welzel
152bbbd680 Merge remote-tracking branch 'origin/topic/awelzel/3853-ldap-spnego-ntlmssp'
* origin/topic/awelzel/3853-ldap-spnego-ntlmssp:
  ldap: Recognize SASL+SPNEGO+NTLMSSP
2024-07-26 15:14:52 +02:00
Tim Wojtulewicz
a40da34915 Merge remote-tracking branch 'botovq/opaque_x509_algor'
* botovq/opaque_x509_algor:
  Use accessor to reach into X509_ALGOR
2024-07-25 09:19:31 -07:00
Arne Welzel
93a430ce15 Merge remote-tracking branch 'origin/topic/awelzel/mysql-amazing-pp-issue-2716-additions'
* origin/topic/awelzel/mysql-amazing-pp-issue-2716-additions:
  mysql: Simplify length computation
  mysql: Improve date and time parsing
  btest/mysql: Clean query-attr.pcapng
  mysql: Support non-string query attributes
  btest/mysql: Add pcap with non-string query attributes
  mysql: Introduce mysql_ssl_request event
  mysql: Fix EOFIfLegacyThenResultSet
  mysql: Add data parameter to mysql_auth_plugin
  mysql: Add mysql_auth_plugin, mysql_auth_more_data and mysql_auth_switch_request events
  mysql: AuthSwitchRequest: &enforce a 0xfe / 254 status
  mysql: Make auth_plugin_ a std::string
  mysql: Fix auth_plugin_data_part2 length computation
  Refactored connection phase state handling
  Add support for "auth switch" and "query attrs"
  Add support for parsing the "caching_sha2_password" auth plugin
2024-07-25 12:18:31 +02:00
Tim Wojtulewicz
6527850487 Merge remote-tracking branch 'origin/topic/timw/format-binpac-output-code'
* origin/topic/timw/format-binpac-output-code:
  Update binpac submodule to better format output code [nomail]
2024-07-24 15:29:08 -07:00
Tim Wojtulewicz
bd208f4c54 Merge remote-tracking branch 'origin/topic/timw/smb2-ioctl-errors'
* origin/topic/timw/smb2-ioctl-errors:
  Update 7.0 NEWS with blurb about multi-PDU parsing causing increased load [nomail] [skip ci]
  Fix handling of zero-length SMB2 error responses
2024-07-24 13:26:07 -07:00
Arne Welzel
52bcc92e40 Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.Aug24'
* origin/topic/vern/script-opt-maint.Aug24:
  minor optimization of boolean comparisons
  fix & regression test for GH-3839 (spurious warnings for "when" constructs)
2024-07-24 11:18:18 +02:00
Christian Kreibich
c9d8ceaafa Merge branch 'topic/christian/bump-zeek-testing-cluster'
* topic/christian/bump-zeek-testing-cluster:
  Bump zeek-testing-cluster to reflect deprecation of prometheus.zeek
2024-07-23 19:18:52 -07:00
Tim Wojtulewicz
cb88f6316c Merge remote-tracking branch 'origin/topic/johanna/update-the-ct-list-and-the-ca-list-again'
* origin/topic/johanna/update-the-ct-list-and-the-ca-list-again:
  Update Mozilla CA list and CT list
2024-07-23 08:54:33 -07:00
Tim Wojtulewicz
da7c3d9138 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-07-23 08:51:55 -07:00
Arne Welzel
6a6a5c3d0d Merge remote-tracking branch 'origin/topic/awelzel/ldap-extended-request-response-starttls'
* origin/topic/awelzel/ldap-extended-request-response-starttls:
  ldap: Add heuristic for wrap tokens
  ldap: Ignore ec/rrc for sealed wrap tokens
  ldap: Add LDAP sample with SASL-SRP mechanism
  ldap: Reintroduce encryption after SASL heuristic
  ldap: Fix assuming GSS-SPNEGO for all bindResponses
  ldap: Implement extended request/response and StartTLS support
2024-07-23 12:39:14 +02:00
Arne Welzel
f4a79fa703 Merge remote-tracking branch 'origin/topic/awelzel/deprecate-prometheus-script'
* origin/topic/awelzel/deprecate-prometheus-script:
  telemetry: Deprecate prometheus.zeek policy script
2024-07-23 10:03:13 +02:00
Arne Welzel
e982a18792 Merge remote-tracking branch 'origin/topic/awelzel/3836-input-create-any-abort-crash'
* origin/topic/awelzel/3836-input-create-any-abort-crash:
  input/Manager: Improve type checks of record fields with type any
2024-07-19 19:51:52 +02:00
Christian Kreibich
0ba80d13b4 Merge branch 'topic/christian/bump-cluster-testsuite'
* topic/christian/bump-cluster-testsuite:
  Bump zeek-testing-cluster to pull in tee SIGPIPE fix
2024-07-17 15:37:29 -07:00