Commit graph

1825 commits

Author SHA1 Message Date
Jon Siwek
19dc0f8be9 Merge branch 'topic/timw/algorithms'
* topic/timw/algorithms:
  Remove List::append deprecation
  Mark List::append/insert deprecated in favor of push_back/push_front for consistency with Queue
  Mark List::sort as deprecated, remove List::sortedinsert
  Change container iterators to just use pointers directly into the container elements
2019-07-22 12:24:14 -07:00
Johanna Amann
354d5e8631 Merge remote-tracking branch 'origin/topic/jsiwek/max-protocol-violations'
* origin/topic/jsiwek/max-protocol-violations:
  Add DPD::max_violations option
2019-07-22 11:16:11 -07:00
Jon Siwek
270e1c0e31 Fix typo in NEWS 2019-07-19 18:02:15 -07:00
Robin Sommer
1c703f0893 Merge remote-tracking branch 'origin/topic/jsiwek/support-older-plugins'
* origin/topic/jsiwek/support-older-plugins:
  Support old plugins that use files within the source/build tree
2019-07-19 15:50:28 +00:00
Jon Siwek
12b65be771 Remove unused expression type tag: EXPR_MATCH 2019-07-18 19:45:38 -07:00
Robin Sommer
c22edc28a5 Merge remote-tracking branch 'origin/topic/zeke/README'
Includes light edit pass.

* origin/topic/zeke/README:
  Add plaintext README file.
  Fix try.zeek.org link
  Improve readability of plaintext.
  Tone down HTML and improve development section.
  Remove development paragraph.
  Update README.
2019-07-16 16:08:57 +00:00
Robin Sommer
a45cc53892 Merge remote-tracking branch 'origin/topic/jsiwek/fix-enumtype-shallow-clone'
* origin/topic/jsiwek/fix-enumtype-shallow-clone:
  Fix ref-counting bug in EnumType copy ctor
2019-07-16 15:34:45 +00:00
Jon Siwek
8c45937798 Merge branch 'topic/jsiwek/template-containers-merge'
* topic/jsiwek/template-containers-merge:
  Fix a potential usage of List::remove_nth(-1)
  Change List::remote(const T&) to return a bool
  Fix debug build due to old int_list usage within assert
  Convert uses of loop_over_list to ranged-for loops
  Remove loop_over_queue (as an example for later removing loop_over_list)
  Change int_list in CCL.h to be a vector, fix uses of int_list to match
  Remove List<> usage from strings.bif
  Replace uses of the old Queue/PQueue generation code with new template versions
  Convert BaseQueue/Queue/PQueue into templates, including iterator support
  Replace uses of the old Dict generation code with new template versions
  Convert PDict into template
  Replace uses of the old List generation code with new template versions
  Convert BaseList/List/PList into templates, including iterator support

* Generally squashed fixups from topic/timw/template-containers

* Add missing include file in List.h: <cassert>
2019-07-15 19:51:27 -07:00
Jon Siwek
50e4da74cf Fix canonification of timestamps with a decisecond multiple
Unit tests sometimes use current_time(), which occassionally lands on
a perfect tenth of a second and end up fooling the old canonification
regexp and resulting in output which differs from what's in the
test baseline.
2019-07-12 18:24:56 -07:00
Johanna Amann
d43af755b5 Merge remote-tracking branch 'origin/topic/timw/json-coverity'
* origin/topic/timw/json-coverity:
  Fix a couple of resource leaks from JSON changes
2019-07-12 15:02:38 -07:00
Johanna Amann
db79041b19 Merge remote-tracking branch 'origin/topic/timw/157-global-attributes'
* origin/topic/timw/157-global-attributes:
  GH-157: Mark some attributes as not allowed for global variables

Fixes GH-157
2019-07-12 13:45:22 -07:00
Johanna Amann
418ab0e33a Merge remote-tracking branch 'origin/topic/jsiwek/zeekenv-static-local-fix'
* origin/topic/jsiwek/zeekenv-static-local-fix:
  Fix potential thread safety issue with zeekenv util function
2019-07-11 13:30:50 -07:00
Jon Siwek
a2c7ed5ff6 Merge branch 'topic/hui/dnp3-fix' of https://github.com/hugolin615/zeek
* 'topic/hui/dnp3-fix' of https://github.com/hugolin615/zeek:
  fixed some bugs on dnp3 analyzer

Adjusted some inconsistent whitespace.

Fixes GH-421
2019-07-11 13:18:58 -07:00
Jon Siwek
cb292af84d Fix a sign-compare compiler warning 2019-07-11 12:14:27 -07:00
Johanna Amann
1f329ad541 Merge remote-tracking branch 'origin/topic/timw/150-to-json'
* origin/topic/timw/150-to-json:
  Update submodules for JSON work
  Update unit tests for JSON logger to match new output
  Modify JSON log writer to use the external JSON library
  Update unit test output to match json.zeek being deprecated and slight format changes to JSON output
  Add proper JSON serialization via C++, deprecate json.zeek
  Add new method for escaping UTF8 strings for JSON output
  Move do_sub method from zeek.bif to StringVal class method
  Move record_fields method from zeek.bif to Val class method
  Add ToStdString method for StringVal
2019-07-11 11:17:32 -07:00
Jon Siwek
31772b1b96 Remove unused option: chunked_io_buffer_soft_cap
Used to be a part of old serialization/communication system.
2019-07-10 18:41:16 -07:00
Jon Siwek
0d34a1c646 Merge remote-tracking branch 'origin/topic/timw/coverity-fixes'
* origin/topic/timw/coverity-fixes:
  Avoid a null dereference (Coverity-1402816)
  Avoid resource leaks (Coverity-1402818, Coverity-1402812)
  Avoid null dereference in broker (Coverity-1402824, Coverity-1402814)
  Remove unused variable from RecordVal (Coverity-1402820)
2019-07-09 18:28:35 -07:00
Jon Siwek
002109973d Improve stability of a unit test 2019-07-03 13:04:57 -07:00
Jon Siwek
723793aa9e Merge remote-tracking branch 'origin/topic/timw/clang-tidy'
* origin/topic/timw/clang-tidy:
  Add clang-tidy rule to CMake including a base configuration
2019-07-03 11:51:10 -07:00
Jon Siwek
c03ef308c9 Improve Zeekygen output for long attribute expressions
Long inline-literals often don't wrap pleasantly in HTML renders and
we had a few &default or &deprecated attributes whose expressions
evaluate to a value long enough to warrant different formatting or
even truncation.
2019-07-03 11:09:10 -07:00
Jon Siwek
c5c688054c Merge remote-tracking branch 'origin/topic/johanna/gh-446-rfb'
* origin/topic/johanna/gh-446-rfb:
  Deprecate rfb_event.
2019-07-03 09:36:12 -07:00
Johanna Amann
e382369091 Merge branch 'master' of https://github.com/sfinlon/zeek
* 'master' of https://github.com/sfinlon/zeek:
  Fix CIF integration and add logging options to intel.log and added comments to code
2019-07-03 01:58:04 -07:00
Johanna Amann
3cdda7647f Merge remote-tracking branch 'origin/topic/jsiwek/gh-443-fix-timestamp-0-logs'
* origin/topic/jsiwek/gh-443-fix-timestamp-0-logs:
  GH-443: fix uses of timestamp 0 in cluster diagnostic logs
2019-07-01 01:29:41 -07:00
Johanna Amann
1ebd3adf20 Merge remote-tracking branch 'origin/topic/jsiwek/gh-243-wrap-up-deprecation-removal'
* origin/topic/jsiwek/gh-243-wrap-up-deprecation-removal:
  Improve deprecation warning messages
  Remove deprecated DNS events
  Remove BackDoor analyzer
  Remove InterConn analyzer
  Remove deprecated/unused irc_servers option
  Remove deprecated print_hook event
  Remove dead code: dump_used_event_handlers
  Remove unused software_version_found events
  Remove deprecated open_log_file and log_file_name functions
  Remove deprecated/unused "packet" type
  Un-deprecate anonymizer BIFs
  Un-deprecate file rotation functions
2019-07-01 01:14:29 -07:00
Jon Siwek
b6c4aa7d2e Merge branch 'master' of https://github.com/spacepatcher/zeek
* 'master' of https://github.com/spacepatcher/zeek:
  Add Windows Minidump file signature
2019-06-28 12:11:17 -07:00
Jon Siwek
bc77b65b0a Merge remote-tracking branch 'origin/topic/johanna/gh-214-notice-on-workers'
* origin/topic/johanna/gh-214-notice-on-workers:
  Change notices to be processed on worker.

Fixes GH-214
2019-06-28 11:51:04 -07:00
Jon Siwek
dafc44e8b9 Merge remote-tracking branch 'origin/topic/johanna/gh-375-remove-brofile-cache'
* origin/topic/johanna/gh-375-remove-brofile-cache:
  Remove the BroFile cache

Fixes GH-375
2019-06-27 12:09:31 -07:00
Jon Siwek
4a6977ba5b Merge remote-tracking branch 'origin/topic/johanna/stringval-from-stdstring'
* origin/topic/johanna/stringval-from-stdstring:
  Fix creating a StringVal from std::string.
2019-06-27 10:13:31 -07:00
Jon Siwek
f810de11fa Make a paraglob unit test parallelizable 2019-06-25 12:50:30 -07:00
Johanna Amann
750fa2e226 Merge remote-tracking branch 'origin/topic/jsiwek/gh-427-fix-zeekygen-default-vals'
* origin/topic/jsiwek/gh-427-fix-zeekygen-default-vals:
  GH-427: improve default ID values shown by Zeekygen
2019-06-25 10:39:15 -07:00
Johanna Amann
54613ad2b8 Merge remote-tracking branch 'origin/topic/jsiwek/gh-435-rpc-crash'
* origin/topic/jsiwek/gh-435-rpc-crash:
  GH-435: fix null pointer deref in RPC analyzer
2019-06-24 15:26:27 -07:00
Johanna Amann
5f9a9bbcbe Merge branch 'paraglob' of https://github.com/ZekeMedley/zeek
* 'paraglob' of https://github.com/ZekeMedley/zeek:
  Add leak test to paraglob.
  Catch paraglob serialization errors in DoClone.
  Update paraglob serialization.
  Stop execution on paraglob error.
  Update paraglob submodule
  Change C++11 detection in paraglob.
  Make paraglob serializable and copyable.
  Initial paraglob integration.

I made a bunch of small changes:
 * paraglob now deals better with \0 characters
 * I rolled back the changes to Binary Serialization format,
 * there were some small formatting issue
 * the error output was slightly unsafe
 * build_unique is now in util.h.

and perhaps a few more small things.
2019-06-24 15:21:46 -07:00
Jon Siwek
7cf623b2ff Merge remote-tracking branch 'origin/topic/johanna/gh-417-consider-removing-p0f'
* origin/topic/johanna/gh-417-consider-removing-p0f:
  Remove old, unmaintained p0f support.
2019-06-21 11:18:20 -07:00
Jon Siwek
f95390aabe Merge branch 'master' of https://github.com/zeek/zeek 2019-06-20 20:55:24 -07:00
Jon Siwek
d72f5458f1 Merge branch 'rdp_client_cluster_data' of https://github.com/neslog/zeek
* 'rdp_client_cluster_data' of https://github.com/neslog/zeek:
  Fixing types.
  Correcting types.
  Removing misc data from Client Cluster data trying to assign values.
  Adding options field to RDP::ClientChannelDef Adding Client Cluster Data

Adjustments:

- Reformatting
- Added comments
- Changed the REDIRECTED_SESSIONID_FIELD_VALID field to a bool
2019-06-20 20:41:16 -07:00
Johanna Amann
9564651655 Merge remote-tracking branch 'origin/master' 2019-06-20 20:25:05 -07:00
Jon Siwek
6ccf1f928b Merge remote-tracking branch 'origin/topic/johanna/warn-if-no-cmake-files'
* origin/topic/johanna/warn-if-no-cmake-files:
  Make configure complain if submodules are not checked out.
2019-06-20 19:57:52 -07:00
Jon Siwek
aefd9322fd Fix TableVal::DoClone to use CloneState cache 2019-06-20 18:34:36 -07:00
Jon Siwek
61d19d25e1 Remove old Broccoli SSL options
- ssl_ca_certificate
- ssl_private_key
- ssl_passphrase
2019-06-20 14:19:55 -07:00
Jon Siwek
b9d3d4d63b Remove unused SerialInfo.h and SerialTypes.h headers 2019-06-20 14:01:16 -07:00
Jon Siwek
399496efa8 Merge remote-tracking branch 'origin/topic/johanna/remove-serializer'
* origin/topic/johanna/remove-serializer:
  Fix memory leak introduced by removing opaque of ocsp_resp.
  Change return value of OpaqueVal::DoSerialize.
  Add missing ShallowClone implementation for SetType
  Remove opaque of ocsp_resp.
  Remove remnants of event serializer.
  Fix cardinalitycounter deserialization.
  Smaller compile fixes for the new opaque serialization.
  Reimplement serialization infrastructure for OpaqueVals.
  Couple of compile fixes.
  Remove const from ShallowClone.
  Remove test-case for removed functionality
  Implement a Shallow Clone operation for types.
  Remove value serialization.

Various changes I made:

- Fix memory leak in type-checker for opaque vals wrapped in broker::data

- Noticed the two "copy-all" leak tests weren't actually checking for
  memory leaks because the heap checker isn't active until after zeek_init()
  is evaluated.

- Change OpaqueVal::DoClone to use the clone caching mechanism

- Improve copy elision for broker::expected return types in the various
  OpaqueVal serialize methods

  - Not all compilers end up properly treating the return of
    local/automatic variable as an rvalue that can be moved, and ends up
    copying it instead.

  - Particularly, until GCC 8, this pattern ends up copying instead of
    moving, and we still support platforms whose default compiler
    pre-dates that version.

  - Generally seems it's something that wasn't addressed until C++14.
    See http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_defects.html#1579

- Change OpaqueVal::SerializeType to return broker::expected

- Change probabilistic DoSerialize methods to return broker::expected
2019-06-20 13:38:54 -07:00
Johanna Amann
979f64f16e Merge remote-tracking branch 'origin/topic/timw/393-vector-slicing'
* origin/topic/timw/393-vector-slicing:
  Fix memory leak in vector slice assignment
  Misc. tweaks to vector slicing implementation
  Add ability to grow/shrink a vector using slicing, also adds Insert/Remove methods for VectorVal
  Allow assignment for vectors using slices
  Check for integral slice indexes, add extra test for [:]
  Return an empty vector if the indices for slicing don't make sense
  GH-393: Add slice notation for vectors
2019-06-19 17:33:51 -07:00
Jon Siwek
8f668ce82c Merge remote-tracking branch 'origin/topic/dnthayer/rename-to-zeek'
* origin/topic/dnthayer/rename-to-zeek:
  Rename bro to zeek in error messages
2019-06-17 20:27:42 -07:00
Jon Siwek
e2dc0092f3 Merge branch 'ntp-rewrite' of https://github.com/mauropalumbo75/zeek
* 'ntp-rewrite' of https://github.com/mauropalumbo75/zeek: (25 commits)
  update tests baseline
  Apply requested changes: - file dpd.sig and TODO comments for signature protocol detection removed - missing doc field filled in events.bif - rename OpCode and ReqCode fields into op_code and req_code respectively - removed unnecessary child method in NTP.h/.cc - main.zeek and ntp-protocol.pac reformatted
  minor changes in the documentation
  fix some initializations
  fix wrong assignment of control key_id/crypto_checksum
  code clean up
  add extension fields parsing
  add extended mac field with 20 byte digest (+4 byte key id)
  update tests and add a new one for key_id and mac
  fix auth field (key_id and mac) in standard and control msg
  remove old NTP record in init-bare.zeek
  fix key_id and digest (WIP)
  fix wrong Assign with reference_id
  add tests for ntp protocol (finished)
  add tests for ntp protocol (WIP)
  fix problem with time vals
  add ntp records to init-bare.zeek
  update ntp analyzer to val_mgr
  extend and refact script-side of NTP analyzer
  extend and refactor several fields
  ...
2019-06-15 19:11:34 -07:00
Jon Siwek
852506e26a Merge remote-tracking branch 'origin/topic/vlad/dns_spf'
* origin/topic/vlad/dns_spf:
  DNS: Add support for SPF response records
2019-06-14 20:58:54 -07:00
Jon Siwek
853a796b9e GH-406: rename bro.bif to zeek.bif
Fixes GH-406
2019-06-14 19:53:38 -07:00
Jon Siwek
56bb28a636 Merge remote-tracking branch 'origin/topic/jsiwek/gh-387-broker-topic-names'
* origin/topic/jsiwek/gh-387-broker-topic-names:
  GH-387: update Broker topic names to use "zeek/" prefix
2019-06-14 19:30:51 -07:00
Jon Siwek
fcceba5ece Merge remote-tracking branch 'origin/topic/timw/asan'
* origin/topic/timw/asan:
  Fix potential null-dereference in current_time()
  Add --sanitizers flag to configure script to enable Clang sanitizers
2019-06-13 11:20:49 -07:00
Jon Siwek
b33926a8e1 Merge remote-tracking branch 'origin/topic/dnthayer/gh-313'
* origin/topic/dnthayer/gh-313:
  Create local.zeek as symlink for upgrade installs
  Rename directories from bro to zeek
2019-06-12 15:11:04 -07:00
Jon Siwek
e0f9b0829e Adapt bro_plugin CMake macros to use zeek_plugin 2019-06-07 20:07:39 -07:00