Commit graph

142 commits

Author SHA1 Message Date
Arne Welzel
df581c59b4 scripts: Use tpe instead of type_, again
The .rst generation doesn't escape the trailing `_` and the docs build
gets upset due to using `type` as a reference target then.

For the better or worse, revert to using tpe. Though I acknowledge this
means we need to be careful with trailing underscores because our docs
build is so fragile.

Partly reverts b9eabbabba.
2025-07-03 20:25:34 +02:00
Benjamin Bannier
b9eabbabba Bump pre-commit hooks 2025-07-01 10:39:47 +02:00
Tim Wojtulewicz
c1a8f8b763 Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
JW-Corelight
05e3de9b81 Add recommended non-routable subnets
224.0.0.0/24 (and 6to4 conversion 2002:e000::/40) from RFC5771	"Multicast Local Network Control Block" defined as non-routable.

239.0.0.0/8 (and 6to4 conversion 2002:ef00::/24) from RFC2365 "Administratively Scoped IP Multicast"

fec0::/10 from RFC3879 "Deprecated Site Local Addresses"
(cherry picked from commit 821ab2dbed)
2025-01-09 22:15:45 -07:00
Jan Grashoefer
c2b17f9d30 Introduce get_packet_lag() 2024-12-09 19:19:29 +01:00
Christian Kreibich
0554951cb6 Clarify membership in the Site::private_address_space prefix list. [skip ci]
IANA's IPv6 special-purpose address registry now has members that technically
meet the definition of not being globally reachable, but don't imply operating
locally. An example: https://datatracker.ietf.org/doc/draft-ietf-6man-sids/06/

This change just explains that distinction.
2024-05-04 11:21:26 -07:00
Vern Paxson
263093af78 flag base script as being known to ZAM optimization 2024-04-25 09:15:13 -07:00
Arne Welzel
947294efab utils: Introduce packages.zeek with can_load() helper 2024-02-22 11:41:50 +01:00
Arne Welzel
7a043e5e8f all: Fix typos identified by typos pre-commit hook 2023-06-13 17:57:32 +02:00
Christian Kreibich
693d8e9251 Treat private address space as site-local by default
This makes Site::private_address_space work like a subset of Site::local_nets,
to match many user's intuition of how we should treat site locality out of the
box. As config options, changes/redefs to Site::private_address_space propagate
to Site::local_nets, while changes to the latter don't affect the former.

A new global bit `Site::private_address_space_is_local` controls the behavior.
It defaults to true, and redefing to false brings back the original behavior.
2023-03-15 17:01:00 -07:00
Josh Soref
21e0d777b3 Spelling fixes: scripts
* accessing
* across
* adding
* additional
* addresses
* afterwards
* analyzer
* ancillary
* answer
* associated
* attempts
* because
* belonging
* buffer
* cleanup
* committed
* connects
* database
* destination
* destroy
* distinguished
* encoded
* entries
* entry
* hopefully
* image
* include
* incorrect
* information
* initial
* initiate
* interval
* into
* java
* negotiation
* nodes
* nonexistent
* ntlm
* occasional
* omitted
* otherwise
* ourselves
* paragraphs
* particular
* perform
* received
* receiver
* referring
* release
* repetitions
* request
* responded
* retrieval
* running
* search
* separate
* separator
* should
* synchronization
* target
* that
* the
* threshold
* timeout
* transaction
* transferred
* transmission
* triggered
* vetoes
* virtual

Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
2022-11-02 17:36:39 -04:00
Arne Welzel
0e28a7faf5 strings: Implement join_string_set() as bif
Haven't measured speed, but this is probably faster than
the cat() and string invocations.
2022-09-20 23:07:26 +02:00
Tim Wojtulewicz
e618be094a Merge remote-tracking branch 'theavgjojo/master'
* theavgjojo/master:
  UPDATED: improving email address splitting for common comma case
2022-08-11 10:41:18 -07:00
Yacin Nadji
825fb1c24a lower priority for change handlers 2022-08-08 11:47:52 +02:00
Yacin Nadji
dc1102e9dd split update_zones_regex into two functions 2022-08-08 11:40:18 +02:00
TheAvgJojo
1e37e91eda UPDATED: improving email address splitting for common comma case 2022-08-05 17:38:54 -04:00
Yacin Nadji
4a04b563f5 GH-2319: Add change handlers to Site 2022-08-05 16:17:50 +02:00
Christian Kreibich
9d59a48ae2 Expand build_path() function to handle empty dir arguments gracefully
When passing an empty string as a directory, the function would produce
filenames starting with a slash even when the given file_name is not an absolute
path. Defaulting to the root directory is likely never intended and might
conveivably be dangerous. The middle "/" is now skipped also if dir is an empty
string.
2022-05-19 09:45:52 -07:00
Vern Paxson
fab4905fc2 new global_options() BiF to speed up startup, plus a micro-preen 2022-05-03 11:13:15 -07:00
Vern Paxson
98cd3f2213 update uses of "when" in base scripts to include captures 2022-01-07 14:53:33 -08:00
Tim Wojtulewicz
a6378531db Remove trailing whitespace from script files 2021-10-20 09:57:09 -07:00
Tim Wojtulewicz
0f348ea042 GHI-1766: Remove address from Site::private_address_space that converts into 0.0.0.0/0 2021-09-27 14:24:14 -07:00
Robin Sommer
47c35190a4 Sanity-check the method passed into ActiveHTTP.
Reported by Pierre Gaulon.
2021-09-23 12:21:23 +02:00
Tim Wojtulewicz
0dca1a70a7 Reformat docs in addrs.zeek to fix doc generation 2021-09-14 19:26:28 -07:00
Tim Wojtulewicz
569552b320 GH-1589: Avoid extracting IP-like strings from SMTP headers 2021-09-03 17:35:10 +00:00
Vlad Grigorescu
5f5ea7c031 Zeekygen doesn't support comments on set members 2021-07-08 06:15:21 -05:00
Vlad Grigorescu
d930f6aa7d Add 6to4 addresses, if the matching IPv4 address is private 2021-07-08 06:13:51 -05:00
Vlad Grigorescu
632182d1a9 Update Site::private_address_space to latest IANA networks 2021-07-07 14:41:31 -05:00
Vern Paxson
5a8ba8c3e5 lint fixes: ensuring functions return values, robustness to nil Val's 2021-03-18 08:21:19 -07:00
Tim Wojtulewicz
01ec5ebdcd Reverts the regex change in dead3226a5.
The regex change broke some of the external tests. I added some more cases
to the regular email btest to hopefully cover all of the cases better.
2020-11-18 15:35:17 -07:00
christina23
dead3226a5 Improved regex for SMTP parsing 2020-11-16 11:43:35 -05:00
Jon Siwek
c7408482b4 Change a script comment to use "code-block" directive 2020-09-03 15:03:12 -07:00
Jon Siwek
170752fa99 Fix extract_first_email_addr() to really return the first email
The use of find_all() in extract_email_addrs_vec() extracted occurrences
to an intermediate set and thus lost any sense of ordering.

This changes extract_email_addrs_vec() to use find_all_ordered() and
return all occurrences of email addresses found in the argument,
included duplicates, with their order of occurrence preserved.
2020-08-11 11:26:21 -07:00
Jon Siwek
7b15b82009 Merge remote-tracking branch 'origin/topic/timw/1040-str-split'
* origin/topic/timw/1040-str-split:
  GH-1040: Add zero-indexed version of str_split
2020-07-06 21:06:51 -07:00
Tim Wojtulewicz
e6871ed3e9 GH-1040: Add zero-indexed version of str_split 2020-07-06 17:05:40 -07:00
Tim Wojtulewicz
560ee0c05e GH-1041: Move compress_path to a bif that uses normalize_path 2020-07-06 11:43:44 -07:00
Jon Siwek
a1c19840ce Add backtrace() and print_backtrace() 2020-07-03 14:09:31 -07:00
Johanna Amann
2aeb3d8e39 Merge remote-tracking branch 'origin/topic/timw/906-find-all-urls-regex'
* origin/topic/timw/906-find-all-urls-regex:
  Restore previous url scheme capture group
  GH-906: Fix the regex in url.zeek to better match for find_all_urls
2020-05-13 15:05:54 -07:00
Jon Siwek
b5531ecbd3 Merge branch 'set_to_regex-docs' of https://github.com/jlagermann/zeek
- Adjusted the formatting during merge

* 'set_to_regex-docs' of https://github.com/jlagermann/zeek:
  added examples to set_to_regex comments Signed-ff-by: James Lagermann <james.lagermann@corelight.com>
2020-05-08 11:48:44 -07:00
James Lagermann
2c04a56236
added examples to set_to_regex comments
Signed-ff-by: James Lagermann <james.lagermann@corelight.com>
2020-05-08 12:31:56 -05:00
Johanna Amann
7d28a6ee9a Remove outdated comment on set_to_regex.
We can add patterns at runtime since 2.6.
2020-05-05 14:23:33 -07:00
Vern Paxson
fe46ef06a0 unused variables found via use-def analysis (plus an indentation micro-nit) 2020-04-25 18:06:47 -07:00
Tim Wojtulewicz
612c59e099 Restore previous url scheme capture group 2020-04-14 16:33:19 -07:00
Tim Wojtulewicz
0d31d39de9 GH-906: Fix the regex in url.zeek to better match for find_all_urls 2020-04-13 13:17:57 -07:00
Robin Sommer
d0b206fa36 Remove APIs that were explicitly deprecated to be removed in 3.1.
Special handling for bro_{init,done,script_loaded} events: if still
used, they cause Zeek to abort at startup.
2020-01-29 12:08:09 +00:00
Frerich Raabe
bb879fc2aa Fixed decompose_uri choking on URIs with empty port component
A call such as

  decompose_uri("git://git.kernel.org:/pub/scm/linux/");

would raise an error along the lines of

  error in /usr/local/zeek-3.0.0/share/zeek/base/utils/urls.zeek, line 122: bad conversion to count (to_count(parts[1]) and )

This was because an empty string got passsed to the to_count()
function.

Let's improve the behaviour and rather consider the portnum component
of the URI to be uninitialized.
2020-01-24 22:24:00 +01:00
Tim Wojtulewicz
33a7927704 Add proper JSON serialization via C++, deprecate json.zeek 2019-07-02 12:52:26 -07:00
Daniel Thayer
be182aac83 More bro-to-zeek renaming in scripts and other files 2019-05-16 02:36:41 -05:00
Jon Siwek
1a77c1b287 Merge remote-tracking branch 'origin/topic/johanna/remove-deprecated-functions-events'
* origin/topic/johanna/remove-deprecated-functions-events:
  Remove deprecated functions/events
2019-05-02 19:18:45 -07:00
Johanna Amann
6d47077222 Merge remote-tracking branch 'origin/topic/jsiwek/gh-340'
* origin/topic/jsiwek/gh-340:
  GH-340: Improve IPv4/IPv6 regexes, extraction, and validity functions
2019-05-02 12:28:31 -07:00