Commit graph

226 commits

Author SHA1 Message Date
Benjamin Bannier
f5a76c1aed Reformat Zeek in Spicy style
This largely copies over Spicy's `.clang-format` configuration file. The
one place where we deviate is header include order since Zeek depends on
headers being included in a certain order.
2023-10-30 09:40:55 +01:00
Benjamin Bannier
0896f09081 Exclude dot directories when searching ZEEK_PLUGIN_PATH
Dot directories rarely contain anything we would want to load as a
dynamic plugin. Even worse, they likely contain files with externally
controlled lifetimes which might be removed while we are using them
(see e.g., zeek/btest#98).

With this patch we do not search _discovered_ dot directories anymore.
We continue to load from a user-specified `ZEEK_PLUGIN_PATH`, even if
its name starts with a dot.

Since this patch changes previous behavior it is a **BREAKING CHANGE**.
2023-09-26 11:56:47 +02:00
Robin Sommer
7544aedb6a
Fix lack of namespace qualification inside an include file. 2023-09-21 10:54:02 +02:00
Tim Wojtulewicz
1f415a7775 Rename magic __bro_plugin__ file to __zeek_plugin__ 2023-08-02 10:10:44 -07:00
Tim Wojtulewicz
64b78f6fb9 Use emplace_back over push_back where appropriate 2023-07-07 09:17:05 -07:00
Tim Wojtulewicz
90d0bc64fa Replace empty destructor bodies with =default definitions 2023-07-07 09:17:05 -07:00
Arne Welzel
5a9c6d4633 Merge remote-tracking branch 'origin/topic/awelzel/duplicate-plugin-no-debug'
* origin/topic/awelzel/duplicate-plugin-no-debug:
  plugin/Manager: Warn when plugin with the same name is found
2023-06-15 18:39:49 +02:00
Tim Wojtulewicz
4229af6820 Remove deprecations tagged for v6.1 2023-06-14 10:07:22 -07:00
Arne Welzel
fdd6dfd096 plugin/Manager: Warn when plugin with the same name is found
This was brought up on Slack as a potential source of confusion during
development as it's not visible when plugin directories are ignored outside
of looking into the plugin debug stream. I'd actually prefer to just
FatalError() this, but a warning seems reasonably visible for interactive
usage.
2023-06-14 17:36:18 +02:00
Arne Welzel
8f45313672 Fixup ifdef check in Plugin.h 2023-05-10 15:53:13 +02:00
Dominik Charousset
986834dce7 Clean up ZEEK_CONFIG_SKIP_VERSION_H issues 2023-05-08 18:05:56 +02:00
Tim Wojtulewicz
ada22fbf42 dlclose() handle if the library loaded wasn't a plugin 2023-03-13 08:08:40 -07:00
Arne Welzel
d23b1331e5 zeek-config: Move ZEEK_VERSION* out of zeek-config.h
When bumping the VERSION file, everything that includes the auto-generated
zeek/zeek-config.h needs to rebuild and ccache usage is voided due the file
changing. Split the mutable version information into a new zeek-version.h
file to avoid this.

Further, do not include zeek-version.h within Plugin.h and avoid the reference
to ZEEK_VERSION_FUNCTION unless we're building an external plugin.

Closes #2776.
2023-02-22 16:48:39 +01:00
Tim Wojtulewicz
35ee96c4cb A bunch of other minor issues reported by PVS-Studio 2023-01-27 13:03:52 -07:00
Tim Wojtulewicz
db161bd6df Reduce startup time on Windows by using std::filesystem::canonical
realpath() apparently doesn't handle Windows symlinks very well. This
causes plugin::Manager and ScannedFile to rescan a bunch of extra
paths that they should be skipping. This commit reduces the startup
time on Windows by 3-4 seconds (~8.5s to ~5s).
2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
a757ba12f3 Fix MSVC compiler warning due to a type mismatch 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
a8fc63e182 Merge remote-tracking branch 'microsoft/master'
* microsoft/master: (71 commits)
  Clang formatting
  Mask ports before inserting them into the map
  Fix compiler warning from applied patch
  Remove statistics plugin in favor of stats bif
  Add EventHandler version of stats plugin
  Mark a few EventHandler methods const
  Changed implementation from std::map to std::unordered_map of Val.cc
  Removed const, Windows build is now working
  Added fixes suggested in PR
  Update src/packet_analysis/protocol/ip/IP.cc
  Apply suggestions from code review
  Clang format again but now with v13.0.1
  Rewrote usages of define(_MSC_VER) to ifdef _MSC_VER
  Clang format it all
  Fixed initial CR comments
  Add NEWS entry about Windows port
  Add a couple of extra unistd.h includes to fix a build failure
  Use std::chrono instead of gettimeofday
  Update libkqueue submodule [nomail]
  Don't call tokenize_string if the input string is empty
  ...
2022-11-11 15:23:21 -07:00
Josh Soref
cd201aa24e Spelling src
These are non-functional changes.

* accounting
* activation
* actual
* added
* addresult
* aggregable
* aligned
* alternatively
* ambiguous
* analysis
* analyzer
* anticlimactic
* apparently
* application
* appropriate
* arithmetic
* assignment
* assigns
* associated
* authentication
* authoritative
* barrier
* boundary
* broccoli
* buffering
* caching
* called
* canonicalized
* capturing
* certificates
* ciphersuite
* columns
* communication
* comparison
* comparisons
* compilation
* component
* concatenating
* concatenation
* connection
* convenience
* correctly
* corresponding
* could
* counting
* data
* declared
* decryption
* defining
* dependent
* deprecated
* detached
* dictionary
* directional
* directly
* directory
* discarding
* disconnecting
* distinguishes
* documentation
* elsewhere
* emitted
* empty
* endianness
* endpoint
* enumerator
* essentially
* evaluated
* everything
* exactly
* execute
* explicit
* expressions
* facilitates
* fiddling
* filesystem
* flag
* flagged
* for
* fragments
* guarantee
* guaranteed
* happen
* happening
* hemisphere
* identifier
* identifies
* identify
* implementation
* implemented
* implementing
* including
* inconsistency
* indeterminate
* indices
* individual
* information
* initial
* initialization
* initialize
* initialized
* initializes
* instantiate
* instantiated
* instantiates
* interface
* internal
* interpreted
* interpreter
* into
* it
* iterators
* length
* likely
* log
* longer
* mainly
* mark
* maximum
* message
* minimum
* module
* must
* name
* namespace
* necessary
* nonexistent
* not
* notifications
* notifier
* number
* objects
* occurred
* operations
* original
* otherwise
* output
* overridden
* override
* overriding
* overwriting
* ownership
* parameters
* particular
* payload
* persistent
* potential
* precision
* preexisting
* preservation
* preserved
* primarily
* probably
* procedure
* proceed
* process
* processed
* processes
* processing
* propagate
* propagated
* prototype
* provides
* publishing
* purposes
* queue
* reached
* reason
* reassem
* reassemble
* reassembler
* recommend
* record
* reduction
* reference
* regularly
* representation
* request
* reserved
* retrieve
* returning
* separate
* should
* shouldn't
* significant
* signing
* simplified
* simultaneously
* single
* somebody
* sources
* specific
* specification
* specified
* specifies
* specify
* statement
* subdirectories
* succeeded
* successful
* successfully
* supplied
* synchronization
* tag
* temporarily
* terminating
* that
* the
* transmitted
* true
* truncated
* try
* understand
* unescaped
* unforwarding
* unknown
* unknowndata
* unspecified
* update
* usually
* which
* wildcard

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
2022-11-09 12:08:15 -05:00
Tomer Lev
73e749a162 Clang format again but now with v13.0.1 2022-11-09 18:56:00 +02:00
Tomer Lev
a105ea9d80 Rewrote usages of define(_MSC_VER) to ifdef _MSC_VER 2022-11-09 18:56:00 +02:00
Tomer Lev
5cdc6e150e Clang format it all 2022-11-09 18:55:51 +02:00
Tomer Lev
12494aac45 Fixed initial CR comments 2022-11-09 18:54:42 +02:00
Tim Wojtulewicz
359b5547cd Don't call tokenize_string if the input string is empty 2022-11-09 18:17:10 +02:00
Tim Wojtulewicz
77c555a3a8 Fixing some issues from rebasing 2022-11-09 18:16:13 +02:00
Tim Wojtulewicz
45fa4c0dc4 Disable Manager::ActivateDynamicPluginInternal if building on Windows 2022-11-09 18:16:13 +02:00
Elad Solomon
dfd6cbe6b4 Fixed usages of path_list_separator 2022-11-09 18:15:34 +02:00
Elad Solomon
3a80b79497 Compile Zeek with MSVC
Allow Zeek to be embedded in another project
2022-11-09 18:15:30 +02:00
Arne Welzel
048f2201fb plugins: Reject dynamic plugins matching names of built-in ones
This goes the hard-exit on conflicts route as IMO it provides better
messaging that something is wrong, rather than defaulting to something
the user may not expect.

Fixes #2403
2022-10-12 18:45:17 +02:00
Tim Wojtulewicz
0d3d9f67b0 Fix some warnings from bro_version deprecation 2022-07-18 08:55:18 -07:00
Tim Wojtulewicz
a9328b5c44 Rename bro_version and BRO_PLUGIN_BRO_VERSION to zeek names 2022-07-12 13:58:42 -07:00
Tim Wojtulewicz
99bc16073a Deprecate BRO_PLUGIN_API_VERSION, create zeek::PLUGIN_API_VERSION 2022-07-12 12:01:23 -07:00
Tim Wojtulewicz
1496b99a34 Deprecate HOOK_BRO_OBJ_DTOR and related methods 2022-07-12 12:01:23 -07:00
Tim Wojtulewicz
4d4c6280e9 Miscellaneous deprecations and renaming 2022-07-12 12:01:23 -07:00
Tim Wojtulewicz
7c4fd382d9 Code modernization: Convert from deprecated C standard library headers 2022-06-27 09:47:31 -07:00
Tim Wojtulewicz
5ca0bb79c8 Fixes from review, post-rebase 2022-05-26 18:39:01 -07:00
Tim Wojtulewicz
a680c2faf0 Add Component::GetCanonicalNameVal to avoid extra StringVal allocations 2022-05-10 14:17:23 -07:00
Tim Wojtulewicz
22ab3bb0b3 Avoid type unnecessary type conversion in ComponentManager::GetComponentName 2022-05-10 12:50:53 -07:00
Christian Kreibich
397e4c9718 Add "Reporter" entry to fix plugin hook_name() vs HookType imbalance
The hook_name() list was missing an entry corresponding to HOOK_REPORTER.

Co-authored-by: Peter Cullen <peter.cullen@corelight.com>
2022-04-14 15:20:44 -07:00
Tim Wojtulewicz
a117c81d85 Fixing a big pile of Coverity issues
1469562/1469558: Uninitialized fields in Func constructor
1469571/1469566: Null pointer dereference in Trigger::Init()
1469568: Uninitialized fields in CounterVector constructor
1469570: Uncaught exception in plugin manager
1469569: Resource leak in script_opt::Stmt
1469561/1469561: Uninitialized fields in ZBody constructor
1469559: Uninitialized fields in logging::Manager
1469563: Resource leak in ZAMCompiler::CompileDel
1469549/1469553/1469556: Context not fully initialized in HashVals
1469548: Remove dead code from IPAddr
1469551/1469554: Handle iosource_mgr registration failure in broker::Manager
1469552/1469572: Resource leaks in input::Manager
2022-02-09 14:07:11 -07:00
Vern Paxson
d758585e42 updated Bro->Zeek in comments in the source tree 2022-01-24 14:26:20 -08:00
Tim Wojtulewicz
a7d3cb48ef Add concept of "parent" tag namespaces
This allows us to create an EnumType that groups all of the analyzer
tag values into a single type, while still having the existing types
that split them up. We can then use this for certain events that benefit
from taking all of the tag types at once.
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
7d66f4252f Unify plugin::Component and plugin::TaggedComponent into a single class
These two are almost always used in conjunction with each other, and
TaggedComponent is never used by itself. Combining them together into
a single class will help simplify some of the code around managing
the mapping between Tags and Components.
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
331161138a Unify all of the Tag types into one type
- Remove tag types for each component type (analyzer, etc)
- Add deprecated versions of the old types
- Remove unnecessary tag element from templates for TaggedComponent and ComponentManager
- Enable TaggedComponent to pass an EnumType when initializing Tag objects
- Update some tests that are affected by the tag enum values changing order
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
fe932944c4 GH-1620: Add event and plugin hook to track packets not processed 2021-11-12 09:30:26 -07:00
Robin Sommer
34eaf42b92 Add new hook HookLoadFileExtended that allows plugins to supply Zeek script code to parse.
The new hooks works similar to the existing `HookLoadFile` but,
additionally, allows the plugin to return a string that contains the
code to be used for the file being loaded. If the plugin does so, the
content of any actual file on disk will be ignored (in fact, there
doesn't even need to be a file on disk in that case). This works for
both Zeek scripts and signatures.

There's a new test that covers the new functionality, testing loading
both scripts and signatures from memory. I also manually tested that the
debugger integration works, but I don't see much of a way to add a
regression test for that part.

We keep the existing hook as well for backwards compatibility. We could
decide to deprecate it, but not sure that buys us much, so left that
out.

Closes #1757.
2021-11-05 13:01:19 +01:00
Tim Wojtulewicz
64748edab1 Replace most uses of typedef with using for type aliasing 2021-10-11 14:51:10 -07:00
Tim Wojtulewicz
9af6b2f48d clang-format: Set penalty for breaking after assignment operator 2021-09-27 10:49:48 -07:00
Tim Wojtulewicz
4423574d26 clang-format: Set IndentCaseBlocks to false 2021-09-27 10:49:48 -07:00
Tim Wojtulewicz
9cb54f5d44 clang-format: Force zeek-config.h to be earlier in the config ordering 2021-09-25 11:52:55 -07:00
Tim Wojtulewicz
b2f171ec69 Reformat the world 2021-09-16 15:35:39 -07:00