Commit graph

1931 commits

Author SHA1 Message Date
Jon Siwek
1d24b8a857 Update cmake module to fix ZeekPluginDynamic's find_package(CAF)
Fixes GH-1347
2021-01-06 20:45:44 -08:00
Tim Wojtulewicz
fa61a715bc Merge remote-tracking branch 'origin/topic/jsiwek/add-lgtm-config'
* origin/topic/jsiwek/add-lgtm-config:
  Add LGTM config file
2020-12-28 15:37:37 -07:00
Jon Siwek
f5b1d9c519 Update submodule(s) [nomail] 2020-12-23 10:39:01 -08:00
Jon Siwek
604fbea00d Merge remote-tracking branch 'origin/topic/johanna/1323'
* origin/topic/johanna/1323:
  TLS 1.3 changes: Address review feedback
  Add one more TLS 1.3 testcase and update NEWS
  Fix TLS 1.3 session resumption detection.
  Introduce ssl_probable_encrypted_handshake_message event
  SSL Analyzer: ignore CCS for TLS 1.3
  TLS analyzer: change logic to track TLS 1.3 connection establishment
2020-12-22 11:00:59 -08:00
Jon Siwek
b4968de3ea Merge remote-tracking branch 'origin/topic/christian/ci-big-sur-support'
* origin/topic/christian/ci-big-sur-support:
  Add MacOS Big Sur to CI, now that Cirrus supports it
2020-12-21 10:55:37 -08:00
Jon Siwek
ed4afa95d3 Merge remote-tracking branch 'origin/topic/neverlord/cmake-cleanup'
* origin/topic/neverlord/cmake-cleanup:
  Remove explicit use of config mode for finding CAF
2020-12-17 16:11:58 -08:00
Jon Siwek
b0d8ca06af Merge branch 'create-shadow-files-atomically' of https://github.com/awelzel/zeek
* 'create-shadow-files-atomically' of https://github.com/awelzel/zeek:
  logging/ascii: Atomically create .shadow files using rename()
2020-12-16 15:10:39 -08:00
Jon Siwek
206c674cc9 Merge EDNS ECS option parsing security/bug fixes 2020-12-15 08:03:40 -08:00
Jon Siwek
dd7bda6a1c Fix local.zeek compatibility test 2020-12-14 22:28:27 -08:00
Jon Siwek
a475cc7a29 Update NEWS with 4.1.0 placeholder sections 2020-12-14 21:44:30 -08:00
Jon Siwek
3af403542f Update submodules 2020-12-14 21:23:30 -08:00
Jon Siwek
5f8b79ee3b Merge remote-tracking branch 'origin/topic/jsiwek/gh-1329-fuzzer-driver-cleanup'
* origin/topic/jsiwek/gh-1329-fuzzer-driver-cleanup:
  Rename a 'do_net_run' variable to 'do_run_loop'
  GH-1329: call Zeek's cleanup function from standalone fuzzer driver
2020-12-14 14:28:00 -08:00
Jon Siwek
144ca0f45b Update submodule(s) [nomail] 2020-12-14 10:56:08 -08:00
Jon Siwek
d1c659faa8 Merge remote-tracking branch 'origin/topic/christian/zkg-inclusion'
* origin/topic/christian/zkg-inclusion:
  Install zkg as part of the Zeek distribution.
2020-12-12 20:25:59 -08:00
Jon Siwek
9658271d19 Merge remote-tracking branch 'origin/topic/jsiwek/fix-coverity'
* origin/topic/jsiwek/fix-coverity:
  Update Coverity Scan GitHub Action

Fixes GH-1330
2020-12-12 13:40:11 -08:00
Jon Siwek
bb11ce47a0 Merge remote-tracking branch 'origin/topic/neverlord/caf-migration'
Merge adjustments:
- Fix the `--with-caf=` option from emitting messages about a variable
  having an unset value.
- Fix the `zeek-config --caf_root` option

* origin/topic/neverlord/caf-migration:
  Update submodule(s)
  Fix message ordering of Broker messages
  Fix UB in shutdown of Broker manager
  Preserve string output of Broker errors
  Migrate to CAF 0.18
2020-12-10 14:14:38 -08:00
Jon Siwek
2e6ef02750 Update submodule(s) [nomail] 2020-12-09 17:29:17 -08:00
Jon Siwek
2ae452d8aa Merge remote-tracking branch 'origin/topic/jsiwek/gh-1321-fix-connection-status-update-event'
* origin/topic/jsiwek/gh-1321-fix-connection-status-update-event:
  GH-1321: Prevent compounding of `connection_status_update` event timers
2020-12-09 10:59:14 -08:00
Jon Siwek
07c4662dc4 Fix narrowing conversion compiler error in SMB error-response logic 2020-12-07 16:56:07 -08:00
Jon Siwek
0b8535b879 Merge remote-tracking branch 'origin/topic/vlad/gh-1286'
Merge adjustments:
- Rewrote the check for error response as a switch statement to
  fix compiler warning about signed/unsigned comparison and also
  to just simplify/clarify the logic.
- Changed the btest to use `zeek -b`.

* origin/topic/vlad/gh-1286:
  Add tests for new SMB3 multichannel support
  Fix SMB2 response status parsing. Fixes #1286
2020-12-07 16:08:04 -08:00
Johanna Amann
8955e6c060 Merge branch 'master' of github.com:zeek/zeek 2020-12-07 18:23:18 +00:00
Johanna Amann
c85d6d6112 Merge remote-tracking branch 'origin/topic/christian/gh-1307-baseline-refresh'
* origin/topic/christian/gh-1307-baseline-refresh:
  Additional use of btest-diff --binary
  Update btest-diff calls on binary files to using "--binary"
  Switch to btest-diff with --binary support
  Update external baseline commit hashes
  Fix binary baseline & line-end problem
  Fix diff-remove-abspath on OSX
  Bump submodules for btest 0.64 update
  Canonifier improvements for the scripts.base.frameworks.logging.ascii-double test
  Baseline refresh to reflect btest 0.64
  Make diff-remove-abspath canonifier match on non-whitespace paths only
  Harden diff-remove-timestamps canonifier
2020-12-07 18:12:29 +00:00
Jon Siwek
94366fdfd9 Merge remote-tracking branch 'origin/topic/jsiwek/fix-zeekygen-misassociations'
* origin/topic/jsiwek/fix-zeekygen-misassociations:
  Fix misassociation of Zeekygen-style comments within function scopes
2020-12-07 09:43:07 -08:00
Jon Siwek
6323b0a8c2 Remove an extraneous Zeekygen-style comment 2020-12-04 19:20:57 -08:00
Jon Siwek
27ea03db2e Update submodule(s) [nomail] 2020-12-04 11:18:44 -08:00
Johanna Amann
47ceac2491 Merge remote-tracking branch 'origin/topic/johanna/GH-348'
* origin/topic/johanna/GH-348:
  Sumstats: allow users to manage epoch manually
  Sumstats: epoch_finished was not called under certain circumstances
2020-12-04 18:49:53 +00:00
Jon Siwek
4228fbca0b Merge remote-tracking branch 'origin/topic/johanna/static-ci'
* origin/topic/johanna/static-ci:
  Fix cirrus config for static broker test.
  Add a test for compiling with static broker/binpac
2020-12-03 18:02:55 -08:00
Tim Wojtulewicz
c643ed2fe4 Merge remote-tracking branch 'origin/topic/robin/gh-1179-plugin-loading-fixes'
* origin/topic/robin/gh-1179-plugin-loading-fixes:
  Fix a couple of life-time issues when plugin loading fails.
2020-12-03 09:36:02 -07:00
Jon Siwek
71f9340e75 Merge branch 'add-X-to-double' of https://github.com/ynadji/zeek
- Minor whitespace/grammar/doc tweaks during merge

* 'add-X-to-double' of https://github.com/ynadji/zeek:
  Add `count_to_double` and `int_to_double` bif functions
2020-12-02 12:54:08 -08:00
Jon Siwek
05618dc8a8 Merge remote-tracking branch 'origin/topic/jsiwek/update-minimum-cmake'
* origin/topic/jsiwek/update-minimum-cmake:
  Update minimum required CMake to 3.5
2020-12-02 11:11:45 -08:00
Tim Wojtulewicz
49293c080d Merge remote-tracking branch 'origin/topic/timw/1184-additional-weird-info'
* origin/topic/timw/1184-additional-weird-info:
  GH-1184: Add 'source' field to weird log denoting where the weird was reported
2020-12-01 10:18:00 -07:00
Robin Sommer
eccbbb4476 Merge remote-tracking branch 'origin/topic/robin/gh-1179-plugin-loading'
* origin/topic/robin/gh-1179-plugin-loading:
  Retry loading plugins on failure to resolve to dependencies.
  Fix use of deprecated functionality in test.
  When attempting to activate a plugin, load dynamic libraries first.
  Add test creating multiple plugins with load dependencies.
2020-12-01 14:51:49 +00:00
Tim Wojtulewicz
616d29c08d Merge remote-tracking branch 'origin/topic/bbannier/debug_logger_lookup'
* origin/topic/bbannier/debug_logger_lookup:
  Find correct zeek namespace in debug logger macros.
2020-11-30 14:07:56 -07:00
Johanna Amann
f55bd8ebb4 Merge remote-tracking branch 'origin/topic/jsiwek/python2-eol'
* origin/topic/jsiwek/python2-eol:
  Update CentOS CI Dockerfiles to fix git/diff dependencies
  Update CI scripts to remove `python` vs `python3` workarounds
  Remove Python 2 compatibility logic in httpd test script
  Update Python invocations to explicit `python3`
  Update CMake logic to enforce Python >= 3.5
  Update documentation for Python >= 3.5 requirement
  Update all submodules that have Python 2 EOL changes
2020-11-26 18:17:54 +00:00
Jon Siwek
499cb11dc3 Merge remote-tracking branch 'origin/topic/christian/libdir-improvements'
* origin/topic/christian/libdir-improvements:
  Update CMakeLists.txt to make portability symlink absolute
  Improve support for custom libdir locations
2020-11-24 15:24:14 -08:00
Jon Siwek
f70a7cb4d3 Merge remote-tracking branch 'origin/topic/timw/internal-type-symbols'
* origin/topic/timw/internal-type-symbols:
  Move implementation of internal_{type,var,etc} methods back into global namespace.
2020-11-23 21:50:47 -08:00
Jon Siwek
08c8b741a9 Merge remote-tracking branch 'origin/topic/neverlord/ubuntu-16-image'
* origin/topic/neverlord/ubuntu-16-image:
  Simplify CI dependencies and setup
2020-11-23 21:41:55 -08:00
Jon Siwek
8d0f2f9ab7 Merge remote-tracking branch 'origin/topic/timw/fix-email-regex'
* origin/topic/timw/fix-email-regex:
  Reverts the regex change in dead3226a5.
2020-11-19 18:09:47 -08:00
Tim Wojtulewicz
a56fbe408f Merge remote-tracking branch 'christina23/master'
* christina23/master:
  Added unit tests for regex fix
  Improved regex for SMTP parsing
2020-11-17 15:01:21 -07:00
Jon Siwek
824ff81bf6 Merge remote-tracking branch 'origin/topic/johanna/1033'
- Fixed signed/unsigned comparison compiler warning
- Did other minor changes to address efficiency nitpicks

* origin/topic/johanna/1033:
  BrokerStore <-> Zeek Tables: support complex indices
2020-11-17 13:34:26 -08:00
Johanna Amann
995d889789 Merge remote-tracking branch 'origin/topic/jsiwek/fix-ConnectionEvent-leak'
* origin/topic/jsiwek/fix-ConnectionEvent-leak:
  Fix memory leak in deprecated Analyzer::ConnectionEvent()
2020-11-17 11:51:27 +00:00
Jon Siwek
6ed4850a26 Merge remote-tracking branch 'origin/topic/jsiwek/gh-352-improve-sql-injection-regex' into master
* origin/topic/jsiwek/gh-352-improve-sql-injection-regex:
  GH-352: Improve HTTP::match_sql_injection_uri regex
2020-11-16 11:51:04 -08:00
Jon Siwek
02c0b33b54 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1264-ssh-host-key-fingerprints' into master
* origin/topic/jsiwek/gh-1264-ssh-host-key-fingerprints:
  Simply ssh/main.zeek by using "ssh_server_host_key" for fingerprinting
  Deprecate "ssh1_server_host_key" parameters *e* and *p*
  GH-1264: Implement "ssh_server_host_key" event
2020-11-16 11:22:37 -08:00
Johanna Amann
50a49eabb5 Merge branch 'topic/vbrevet/ssh_version' of https://github.com/vbrevet/zeek
* 'topic/vbrevet/ssh_version' of https://github.com/vbrevet/zeek:
  [SSH] Handle SSH version 1.99 SSH can set in its identification a version 1.99 (SSH-1.99-xxx). That means the client/server is compatible with SSHv1 and SSHv2. So the version choice depends of the both side.
2020-11-16 11:05:30 +00:00
Jon Siwek
fc114069b0 Merge remote-tracking branch 'origin/topic/jsiwek/unknown-protocol-options'
* origin/topic/jsiwek/unknown-protocol-options:
  Move UnknownProtocol options to init-bare.zeek
  Coverity 1436183: Initialize packet_analysis::Manager fields
2020-11-12 14:35:01 -08:00
Tim Wojtulewicz
c10bcc7116 Merge remote-tracking branch 'origin/topic/timw/1079-zeek-includes'
* origin/topic/timw/1079-zeek-includes:
  Move 'using namespace' declaration after other includes
  Use binpac.h as if it was an external dependency
  Fix includes of bif.h and _pac.h files to use full paths inside build directory
  Remove unnecessary include of NetVar.h from packet analysis plugins
  GH-1079: Use full paths starting with zeek/ when including files
2020-11-12 12:16:34 -07:00
Tim Wojtulewicz
a6a4b976ec Support for additional DNS RR Type: LOC[29], SSHFP[44], NSEC3PARAM[51], custom BIND9 signaling[65534] 2020-11-11 13:35:51 -07:00
Tim Wojtulewicz
8722118935 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1269'
* origin/topic/jsiwek/gh-1269:
  GH-1269: Fix LogAscii::enable_leftover_log_rotation crash in bad dirs
2020-11-10 14:06:10 -07:00
Tim Wojtulewicz
2e57f8487b Merge remote-tracking branch 'origin/topic/jsiwek/ci-debian-10-gcc'
* origin/topic/jsiwek/ci-debian-10-gcc:
  Change Debian 10 CI config to use GCC
2020-11-10 13:55:53 -07:00
Tim Wojtulewicz
ad46a8b717 Merge remote-tracking branch 'origin/topic/timw/1221-unknown-protocols'
* origin/topic/timw/1221-unknown-protocols:
  GH-1221: Add unknown_protocols.log for logging packet analyzer lookup failures
  Remove default_analyzer for Ethernet packet analzyer
2020-11-10 08:42:26 -07:00