Commit graph

16612 commits

Author SHA1 Message Date
Tim Wojtulewicz
522bce8d58 Merge remote-tracking branch 'origin/topic/vern/script-opt.May24'
* origin/topic/vern/script-opt.May24:
  factored BTest constants into globals to prevent premature ZAM optimization when testing
  addressed minor issues flagged by Coverity
2024-04-29 09:08:28 -07:00
Tim Wojtulewicz
19702b06e7 Merge remote-tracking branch 'origin/topic/timw/val-avoid-type-casting'
* origin/topic/timw/val-avoid-type-casting:
  Avoid calling typecasts in Val when we have direct access to the underlying value object
2024-04-29 09:06:39 -07:00
Johanna Amann
2217eab38a Fix cid propagation into files.log
Changes to the connection id were not propagated to files.log in all
cases.

Fixes GH-3700
2024-04-29 14:13:19 +01:00
Johanna Amann
07c84fddbc Update broker submodule
[nomail]
2024-04-29 13:56:58 +01:00
Robin Sommer
cee92cbf6b
Spicy: Cleanup some runtime code. 2024-04-29 08:38:53 +02:00
Robin Sommer
5a74db30ef
Spicy: Map Spicy's Protocol enum to Zeek's transport_proto.
We now hardcode this specific enum mapping to make Zeek-side usage
more convenient.

Closes #3606.
2024-04-29 08:38:53 +02:00
Vern Paxson
033cf2d8dd factored BTest constants into globals to prevent premature ZAM optimization when testing 2024-04-27 19:40:39 -07:00
Vern Paxson
cf456f943f addressed minor issues flagged by Coverity 2024-04-27 19:40:03 -07:00
zeek-bot
bbcb90741d Update doc submodule [nomail] [skip ci] 2024-04-27 00:11:19 +00:00
Tim Wojtulewicz
6900f3301e Move packet_analysis::Dispatcher to detail namespace 2024-04-26 13:11:45 -07:00
Tim Wojtulewicz
ad6d70d4e6 Merge remote-tracking branch 'pbcullen/topic/pbcullen/shadow-file-handling'
* pbcullen/topic/pbcullen/shadow-file-handling:
  reformat changes
  Gracefully handle empty/missing shadow file
2024-04-26 12:29:28 -07:00
Christian Kreibich
7fdbb73511 Merge branch 'topic/christian/3671-fix-icmp-caplen-violations'
* topic/christian/3671-fix-icmp-caplen-violations:
  Factor in caplens in ICMPAnalyzer::DeliverPacket length calculations
2024-04-26 11:18:34 -07:00
Tim Wojtulewicz
12b1030c1b Update binpac submodule [nomail] 2024-04-26 09:12:38 -07:00
Tim Wojtulewicz
b77f504287 Update gen-zam submodule [nomail] 2024-04-26 09:09:19 -07:00
zeek-bot
9a158b3c9c Update doc submodule [nomail] [skip ci] 2024-04-26 00:31:08 +00:00
Christian Kreibich
581971e160 Factor in caplens in ICMPAnalyzer::DeliverPacket length calculations
Relying only on the IP-header-provided length could violate buffer boundaries in
the endpoints' rule matching. This change mirrors what we do in UDP and TCP.

Resolves #3671
2024-04-25 16:22:52 -07:00
Tim Wojtulewicz
d745fbbca2 Avoid calling typecasts in Val when we have direct access to the underlying value object 2024-04-25 10:33:41 -07:00
Tim Wojtulewicz
c7a21c18c8 Merge remote-tracking branch 'origin/topic/vern/ZAM-perf.Apr24'
* origin/topic/vern/ZAM-perf.Apr24: (27 commits)
  BTest updates for changes due to use of ZAM BiF replacements
  rewrite of ZAM optimization of BiFs and script functions/idioms
  flag base script as being known to ZAM optimization
  ZAM optimization for constructing records w/ fields initialized to network_time
  factor some functionality used by BiFs to make accessible to ZAM instructions
  factor script optimization Expr AST nodes out of main AST header
  new internal AST node for expression idioms with corresponding ZAM built-ins
  streamlining of expressions only used for script optimization
  reordering of expressions to match main usage vs. script-optimization extras
  support for conditional expressions transforming into interal has-elements expr
  make same_expr() functionality accessible as a utility
  unify functionality across EqExpr and RelExpr classes
  introduce notions of script functions/BiFs that are (1) foldable, (2) replaceable
  optimization of scripting idioms - min/max, has-elements
  hooks for ZAM optimization of calls to particular functions
  shift ZAM maintenance monitoring of new BiFs to a BTest so it automatically runs
  make externally available the expression used for initializating a record field
  record field initialization optimization: do coercions at compile-time if applicable
  $ZAM_PROFILE_ALL set tells ZAM to profile function bodies even if not executed
  performance speed-up for SMB base scripts
  ...
2024-04-25 09:16:13 -07:00
Vern Paxson
8e25181e1e BTest updates for changes due to use of ZAM BiF replacements 2024-04-25 09:15:13 -07:00
Vern Paxson
9cddf16800 rewrite of ZAM optimization of BiFs and script functions/idioms 2024-04-25 09:15:13 -07:00
Vern Paxson
263093af78 flag base script as being known to ZAM optimization 2024-04-25 09:15:13 -07:00
Vern Paxson
ef4386ea13 ZAM optimization for constructing records w/ fields initialized to network_time 2024-04-25 09:15:13 -07:00
Vern Paxson
68aa8221e1 factor some functionality used by BiFs to make accessible to ZAM instructions 2024-04-25 09:15:13 -07:00
Vern Paxson
7c8c83efc4 factor script optimization Expr AST nodes out of main AST header 2024-04-25 09:15:13 -07:00
Vern Paxson
01fd30dda9 new internal AST node for expression idioms with corresponding ZAM built-ins 2024-04-25 09:15:13 -07:00
Vern Paxson
16b2946fef streamlining of expressions only used for script optimization 2024-04-25 09:15:13 -07:00
Vern Paxson
f557b40d14 reordering of expressions to match main usage vs. script-optimization extras 2024-04-25 09:15:13 -07:00
Vern Paxson
52f506b7ae support for conditional expressions transforming into interal has-elements expr 2024-04-25 09:15:12 -07:00
Vern Paxson
86d3c932b7 make same_expr() functionality accessible as a utility 2024-04-25 09:15:12 -07:00
Vern Paxson
d15d4a6e08 unify functionality across EqExpr and RelExpr classes 2024-04-25 09:15:12 -07:00
Vern Paxson
1b838ca91d introduce notions of script functions/BiFs that are (1) foldable, (2) replaceable 2024-04-25 09:15:12 -07:00
Vern Paxson
5445e8c7ff optimization of scripting idioms - min/max, has-elements 2024-04-25 09:15:12 -07:00
Vern Paxson
e38053ee3c hooks for ZAM optimization of calls to particular functions 2024-04-25 09:15:12 -07:00
Vern Paxson
4b39e1f5f5 shift ZAM maintenance monitoring of new BiFs to a BTest so it automatically runs 2024-04-25 09:15:12 -07:00
Vern Paxson
9fe7d8581f make externally available the expression used for initializating a record field 2024-04-25 09:15:12 -07:00
Vern Paxson
88ef6cb5b6 record field initialization optimization: do coercions at compile-time if applicable 2024-04-25 09:15:12 -07:00
Vern Paxson
b3dacce3e1 $ZAM_PROFILE_ALL set tells ZAM to profile function bodies even if not executed 2024-04-25 09:15:12 -07:00
Vern Paxson
c11c2830b1 performance speed-up for SMB base scripts 2024-04-25 09:15:12 -07:00
Vern Paxson
39c3a0ec0b fix for ZAM optimization pruning of unnecessary instructions 2024-04-25 09:15:12 -07:00
Vern Paxson
6c696f7c55 bug fix for ZAM code generation 2024-04-25 09:15:12 -07:00
Vern Paxson
4e253aae0a optimize generation of "-O gen-C++" code for table/vector size operations 2024-04-25 09:15:12 -07:00
Vern Paxson
5311904bb1 removing vestigial same_val() function 2024-04-25 09:15:12 -07:00
Vern Paxson
9c4da40e39 fix for ZAM optimization of '!' expressions 2024-04-25 09:15:12 -07:00
Vern Paxson
a72b1af2ea fix for ZAM tracking of return values when in-lining 2024-04-25 09:15:12 -07:00
Vern Paxson
8c4c224c93 fix for ZAM profiling potentially accessing freed memory 2024-04-25 09:15:12 -07:00
Benjamin Bannier
d611452116 Merge branch 'topic/bbannier/spicy-hook-priority' 2024-04-25 13:52:03 +02:00
Benjamin Bannier
3c89a5492c Fix typo in hook name
While in Spicy code a hook priority is spelled `priority=4711` the
attribute is still called `&priority` (like in HILTI) and we rely on
exactly that name when e.g., extracting hook priorities for scheduling.

This change was introduced as part of
db98dc4193 and caused the default hook
priority for hooks defined in EVT files (intended to be -1000 to likely
schedule after e.g., hooks in the Spicy grammars) to be ignored. This
could then e.g., introduce issue when a `%done` hook would mutate state
exposed in an EVT hook (which now might not have seen the updated state
due to different scheduling).
2024-04-25 13:43:09 +02:00
Benjamin Bannier
ef60de0059 Bump Spicy to latest dev snapshot 2024-04-25 13:43:09 +02:00
Johanna Amann
9132cdacd5 Updating broker submodule [nomail]
Only updates 3rdparty submodule in broker
2024-04-23 11:50:53 +01:00
Tim Wojtulewicz
cbf9ff47e8 Merge remote-tracking branch 'origin/topic/timw/3662-ignore-disabled-writer-frontends'
* origin/topic/timw/3662-ignore-disabled-writer-frontends:
  Don't attempt to stop or flush disabled writer frontends
2024-04-22 17:08:33 -07:00