Commit graph

17954 commits

Author SHA1 Message Date
Benjamin Bannier
7c456538b4 Fix formatting of zeek_add_plugin 2025-03-03 11:23:09 +01:00
Tim Wojtulewicz
6de81160b6 Fix language/assert btest baselines for to_count/to_int changes 2025-02-28 20:21:57 -07:00
Tim Wojtulewicz
eb015801bd Update the bifs.to_count baseline for ZAM 2025-02-28 20:21:57 -07:00
zeek-bot
d3d7c54686 Update doc submodule [nomail] [skip ci] 2025-03-01 00:13:44 +00:00
Arne Welzel
d079a2b9a8 scan.l: Extract switch_to() from load_files() 2025-02-28 17:56:17 +01:00
Arne Welzel
2a8040039a ScannedFile: Allow skipping canonicalization 2025-02-28 17:55:36 +01:00
zeek-bot
31b5f763cf Update doc submodule [nomail] [skip ci] 2025-02-27 00:13:27 +00:00
zeek-bot
2e4da3223a Update doc submodule [nomail] [skip ci] 2025-02-26 00:13:08 +00:00
Mark Overholser
3acbb55513 Update zeek.bif documentation for to_count and to_int 2025-02-25 15:18:12 -06:00
Tim Wojtulewicz
3c16b0720a Merge remote-tracking branch 'origin/topic/timw/few-btest-jobs-for-zam-ci-tasks'
* origin/topic/timw/few-btest-jobs-for-zam-ci-tasks:
  CI: Use the right variable for the number of test jobs for zeekctl_debian11_task tasks
  CI: Use fewer btest jobs for ZAM tasks
2025-02-25 07:30:00 -07:00
zeek-bot
6f2e91aec3 Update doc submodule [nomail] [skip ci] 2025-02-25 00:13:44 +00:00
Tim Wojtulewicz
66e3232dcc Merge remote-tracking branch 'markoverholser/master'
* markoverholser/master:
  Fix incorrect syntax for static_cast in to_count that I introduced in a previous merge
  Update baselines after changes to to_count and to_int
  fix to_count in zeek.bif to resolve conflict from bbanier's adjustment to static casting of the return from strtoull
  Fix tests in to_count to reflect appropriate function; add tests for 0x-formatted hex values for to_count and to_int
  update BIFs to_int() and to_count() to accept optional 'base' argument; allows more more exotic conversions from hex, octal, binary
  Fixes #4076; update BIFs to_int() and to_count() to accept optional 'base' argument for more easy conversions of strings representing (for example) hexadecimal, octal, or binary numbers
2025-02-24 11:38:11 -07:00
Tim Wojtulewicz
3dd1d37f9d CI: Use the right variable for the number of test jobs for zeekctl_debian11_task tasks 2025-02-24 11:18:13 -07:00
Tim Wojtulewicz
b5b0c5c996 CI: Use fewer btest jobs for ZAM tasks
The ZAM tasks are being killed due to OOM issues on Cirrus while
running btests. Use fewer jobs try to avoid that.
2025-02-24 11:17:10 -07:00
Mark Overholser
165e753439 Fix incorrect syntax for static_cast in to_count that I introduced in a previous merge 2025-02-24 11:02:13 -06:00
Arne Welzel
58babca824 geneve/functions.bif: Fix :zeek:see directive, take two 2025-02-24 15:06:58 +01:00
Arne Welzel
8da219c61a geneve/functions.bif: Fix :zeek:see directive 2025-02-24 15:05:06 +01:00
Mark Overholser
362f083351 Update baselines after changes to to_count and to_int 2025-02-23 16:34:20 -06:00
Mark Overholser
eeaeaaeb16 fix to_count in zeek.bif to resolve conflict from bbanier's adjustment to static casting of the return from strtoull 2025-02-23 16:23:31 -06:00
Mark Overholser
8fce9c34f8 Fix tests in to_count to reflect appropriate function; add tests for 0x-formatted hex values for to_count and to_int 2025-02-23 16:19:12 -06:00
zeek-bot
6671e95c6b Update doc submodule [nomail] [skip ci] 2025-02-23 00:16:34 +00:00
Arne Welzel
3682a42376 Merge remote-tracking branch 'origin/topic/awelzel/get-geneve-options'
* origin/topic/awelzel/get-geneve-options:
  PacketAnalyzer::Geneve: Add get_options()
  packet_analysis: Track data spans of packet analyzers
2025-02-22 12:33:46 -08:00
Arne Welzel
776c003033 PacketAnalyzer::Geneve: Add get_options()
Allow to extract Geneve options on-demand, for example during a
new_connection() event.
2025-02-22 12:19:42 -08:00
Arne Welzel
2dc98acd1f packet_analysis: Track data spans of packet analyzers
Do not just track the analyzer instance in the stack, but also the
data span it is given. This allows to extract more information on-demand
during event processing.

TrackAnalyzer() is technically a public API, but no one should use it
outside of the Analyzer's Forward methods itself.
2025-02-22 12:19:42 -08:00
Benjamin Bannier
0bc0104eb2 Merge remote-tracking branch 'origin/topic/timw/to-int-zam' 2025-02-21 12:24:43 +01:00
Tim Wojtulewicz
caeae0b777 Fix bifs.to_count and bifs.to_int btests under ZAM 2025-02-20 17:24:50 -07:00
Tim Wojtulewicz
bcecc6ea51 Merge remote-tracking branch 'mnhsrj/innerPktResults'
* mnhsrj/innerPktResults:
  Set original/outer packet flags to reflect inner packet results
2025-02-20 16:41:05 -07:00
Tim Wojtulewicz
07a03bbfe9 Merge remote-tracking branch 'origin/topic/bbannier/integer-conversion-error-handling'
* origin/topic/bbannier/integer-conversion-error-handling:
  Also trim trailing spaces in `to_count`/`to_int` inputs
  Align error handling in `to_int` with existing behavior of `to_count`
  Baseline handling of leading/trailing spaces in `to_count`/`to_int`.
  Add error messages to `to_count`/`to_int` baselines
2025-02-20 15:35:34 -07:00
Tim Wojtulewicz
27bfd5b4a8 Merge remote-tracking branch 'origin/topic/timw/update-broker'
* origin/topic/timw/update-broker:
  Update broker submodule [nomail]
2025-02-18 09:46:43 -07:00
Tim Wojtulewicz
6609269f3c Merge remote-tracking branch 'origin/topic/awelzel/freebsd-14-1-to-14-2'
* origin/topic/awelzel/freebsd-14-1-to-14-2:
  cirrus: Bump FreeBSD 14 task to 14.2
2025-02-18 08:51:40 -07:00
Benjamin Bannier
d421a19691 Also trim trailing spaces in to_count/to_int inputs
Previously we would already trim leading spaces in inputs to `to_count`
and `to_int`, effectively by just passing the behavior of the low-level
functions used in their implementations to the user. While this was
useful it was also inconsistent in that we did not allow trailing
spaces which we enable with this patch.
2025-02-18 14:15:32 +01:00
Benjamin Bannier
55533e12d4 Align error handling in to_int with existing behavior of to_count
Previously `to_int` would silently ignore invalid inputs and simply
return `0` while `to_count` would return an error; this patch changes
`to_int` to behave like `to_count`.

This introduces a breaking change in that `to_int` now raises an error
for trailing spaces (but still accepts leading spaces) where it
previously would have silently accepted it. This is consistent with
the behavior of `to_count`, but one could also argue that both of
these should only accept properly trimmed input; I did not go that route
since that would introduce breaking changes for both these functions
instead of for just one of them.
2025-02-18 14:03:09 +01:00
Benjamin Bannier
742f17fb15 Baseline handling of leading/trailing spaces in to_count/to_int.
Currently `to_count` reports an error for trailing spaces (but not for
leading ones) while `to_int` silently accepts them. This patch adds
baselines capture the current behavior.
2025-02-18 14:01:53 +01:00
Benjamin Bannier
4c4cd5984c Add error messages to to_count/to_int baselines
This captures error messages produced by `to_count`, but will also
baseline future error messages from `to_int` once we introduce them.
2025-02-18 14:01:32 +01:00
markoverholser
7b0e259655
Merge branch 'zeek:master' into master 2025-02-18 06:51:25 -06:00
Mark Overholser
df348ff2f2 update BIFs to_int() and to_count() to accept optional 'base' argument; allows more more exotic conversions from hex, octal, binary 2025-02-18 06:49:55 -06:00
Tim Wojtulewicz
e9330b563a Update broker submodule [nomail] 2025-02-17 13:49:20 -07:00
Johanna Amann
d3a6b93fdb Merge branch 'patch-2' of github.com:BrendanKapp/zeek 2025-02-17 17:10:04 +00:00
Brendan Kapp
76f4cd8b82
Fix dead links in README 2025-02-17 08:32:04 -07:00
Mark Overholser
0b81bf5ad3 Fixes #4076; update BIFs to_int() and to_count() to accept optional 'base' argument for more easy conversions of strings representing (for example) hexadecimal, octal, or binary numbers 2025-02-15 07:53:38 -06:00
Arne Welzel
ea56976e3c cirrus: Bump FreeBSD 14 task to 14.2
CI is currently failing with:

    { "error": { "code": 404, "message": "The resource 'projects/freebsd-org-cloud-dev/global/images/family/freebsd-14-1' was not found" ...
2025-02-14 18:31:47 -08:00
Tim Wojtulewicz
9c41b6d227 Merge remote-tracking branch 'origin/topic/etyp/locals-to-global'
* origin/topic/etyp/locals-to-global:
  Do not export locals
2025-02-14 11:29:29 -08:00
Evan Typanski
7160e074f6 Do not export locals
Fixes #4227
2025-02-12 13:49:12 -08:00
mnhsrj
0257b6cd32
Set original/outer packet flags to reflect inner packet results
Propagate inner packet flags such as 'processed', 'dump_packet', 'dump_size'
to outer packet for packets involving tunneled data.
2025-02-12 09:43:44 -05:00
zeek-bot
b7b31ebce5 Update doc submodule [nomail] [skip ci] 2025-02-08 00:13:09 +00:00
Johanna Amann
363d3a8ac9 Merge remote-tracking branch 'origin/topic/johanna/dpd-zam-baseline-changes'
* origin/topic/johanna/dpd-zam-baseline-changes:
  DPD changes - ZAM baseline updates
2025-02-07 18:09:11 +00:00
Johanna Amann
eda2c30452 DPD changes - ZAM baseline updates
See GH-4200 for related PR
2025-02-07 09:04:02 +00:00
Johanna Amann
fc233fd8d0 Merge remote-tracking branch 'origin/topic/johanna/dpd-changes'
* origin/topic/johanna/dpd-changes:
  DPD: failed services logging alignment
  DPD: update test baselines; change options for external tests.
  DPD: change policy script for service violation logging; add NEWS
  DPD changes - small script fixes and renames.
  Update public and private test suite for DPD changes.
  Allow to track service violations in conn.log.
  Make conn.log service field ordered
  DPD: change handling of pre-confirmation violations, remove max_violations
  DPD: log analyzers that have confirmed
  IRC analyzer - make protocol confirmation more robust.
2025-02-07 07:35:30 +00:00
Johanna Amann
66d07c31fa DPD: failed services logging alignment
There were some special cases in which the failed-service-logging policy
script might log a service being removed that was not removed due to an
analyzer violation. This change should fix these cases.
2025-02-06 18:56:30 +00:00
Johanna Amann
0e9cf7b019 DPD: update test baselines; change options for external tests.
As services are sorted by default now, this disables the canonifier that
sorts the service field for the external baseline.

This also adds the tracking of disabled services in the service field
via DPD::track_removed_services_in_connection - to make such changes
more visible, and check that the feature works as desired.
2025-02-06 18:56:30 +00:00