Commit graph

3268 commits

Author SHA1 Message Date
Jon Siwek
000d902b86 Merge branch 'master' into topic/jsiwek/supervisor 2020-01-08 10:36:26 -08:00
Jon Siwek
66ca20b737 Increase timeout for a few btests
Saw these start being sensitive running an "ASan -O0" build locally
2020-01-08 10:31:16 -08:00
Jon Siwek
6046da9993 Merge branch 'master' into topic/jsiwek/supervisor 2020-01-07 16:57:58 -08:00
Jon Siwek
d581aa76aa Merge remote-tracking branch 'origin/topic/dev/patterns-in-sets'
Fixes in merge:
- Memory leak in HashKey ctor
- Minor whitespace/style changes

* origin/topic/dev/patterns-in-sets:
  Enable Patterns as Table index in non singleton cases
  Added support to create a Hashkey for PatternVals using their Pattern Texts
2020-01-06 14:15:30 -08:00
Tim Wojtulewicz
71e6893441 Merge remote-tracking branch 'origin/topic/jsiwek/fix-hexdump-warning'
* origin/topic/jsiwek/fix-hexdump-warning:
  Fix snprintf compiler warning in hexdump BIF
2020-01-06 14:16:55 -07:00
Jon Siwek
149d3b4828 Increase a timeout for a btest 2020-01-06 11:20:30 -08:00
Jon Siwek
f1be24c4c1 Update submodules 2020-01-06 10:49:09 -08:00
Tim Wojtulewicz
65a4e36a92 Merge remote-tracking branch 'origin/topic/jsiwek/asan'
* origin/topic/jsiwek/asan: (28 commits)
  Increase timeout for a btest
  Switch CI scripts to use ASAN/LSAN instead of gperftools
  Remove redundant memory leak btests
  Fix reference counting issues related to lambdas/closures
  Disable LeakSanitizer for btests that have known leaks
  Rewrite the btest for when-statement timeouts
  Fix memory leak when a logging plugin hook prevents a write
  Fix memory leaks in various input framework error-handling cases
  Fix memory leak in Reporter::get_weird_sampling_whitelist() BIF
  Fix reference counting of Log::Filter "config" field
  Fix memory leak in system_env() BIF
  Clean up triggers awaiting global state modification at shutdown
  Fix memory leak in initializing log writers with no local backend
  Fix packet filter memory leaks
  Skip sending thread heartbeat if it alread asked to be finished
  Fix memory leak of sqlite input reader prepared statement
  Prevent duplicate "finish" threading messages
  Fix memory leak when table-based input stream overwrites old entries
  Fix scripting error in a DHCP btest
  Fix memory leaks in Kerberos ticket decryption
  ...
2020-01-06 11:20:47 -07:00
Jon Siwek
a1377e1d42 Increase timeout for a btest
May be more timing-sensitive with slower ASAN/LSAN configuration in
addition to already-slower CI environment.
2020-01-02 23:04:22 -08:00
Jon Siwek
e6f4e01041 Remove redundant memory leak btests
Or otherwise convert into a regular btest if it didn't already seem to
be covered.

There's no need for a separate memory leak test group since compiling
with LeakSanitizer now covers leak checking for the full btest suite.
2020-01-02 23:04:22 -08:00
Jon Siwek
0fe2a14d98 Disable LeakSanitizer for btests that have known leaks
E.g. ones that throw interpreter exceptions,  as those are currently
known to potentially cause leaks.  Fixing the underlying leaks involves
the larger task of more IntrusivePtr usage.

Reference cycles may also cause leaks.
2020-01-02 12:05:49 -08:00
Jon Siwek
d917737766 Rewrite the btest for when-statement timeouts
To avoid a memory leak in DNS lookups that's hard to work around and
does not otherwise effect typical operation when Zeek is allowed to
continue to run after zeek_init().
2020-01-02 12:05:49 -08:00
Jon Siwek
d936607cc9 Fix scripting error in a DHCP btest 2020-01-02 12:05:49 -08:00
Jon Siwek
10473d58a9 Fix scripting error in an ftp btest 2020-01-01 12:47:39 -08:00
Jon Siwek
cd9fec7bdb Add Cirrus CI config 2019-12-17 15:28:25 -08:00
Tim Wojtulewicz
679da0b15b Merge remote-tracking branch 'origin/topic/jsiwek/gh-700-zeek-args-bif'
* origin/topic/jsiwek/gh-700-zeek-args-bif:
  GH-700: add zeek_args() BIF
2019-12-05 12:36:35 -07:00
Tim Wojtulewicz
5c85b083b6 Merge remote-tracking branch 'origin/topic/jsiwek/gh-700-packet-sources-bif'
* origin/topic/jsiwek/gh-700-packet-sources-bif:
  GH-700: add packet_sources() BIF
2019-12-05 11:58:06 -07:00
Jon Siwek
30d0b21ecc Merge remote-tracking branch 'origin/topic/dev/print-to-log'
Adjustments during merge:

- kept the UNKNOWN Log::ID as placeholder value
- changed the coverage.find-bro-logs test to check for arbitrary $path
  field values instead of just string literals
- don't force EnumVal to unsigned integer since the relevant union member
  is the signed integer and added the relevant enum values/types to
  .bif files for easier access
- compare FILE* versus file name to check for stdout equality (don't
  think it matters much, just a bit more efficient)
- minor whitespace/style tweaks

* origin/topic/dev/print-to-log:
  Added a non boolean configuration and other changes as suggested by Jon
  Allow Print Statements to be redirected to a Log# This is a combination of 3 commits.
2019-12-02 13:47:09 -08:00
Jon Siwek
57c7cbdb92 GH-700: add zeek_args() BIF
Provides access to all zeek command-line arguments ("argv").
2019-11-28 10:24:48 -08:00
Jon Siwek
6e7b101df2 GH-700: add packet_sources() BIF
Provides access to properties of packet sources, like interface or pcap
file name.
2019-11-28 09:44:38 -08:00
Dev Bali
4be6871df2 Added a non boolean configuration and other changes as suggested by Jon 2019-11-26 21:53:21 -08:00
Johanna Amann
e5db1f085c Merge remote-tracking branch 'origin/topic/jsiwek/gh-684-fix-rpc-parsing'
* origin/topic/jsiwek/gh-684-fix-rpc-parsing:
  GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors

Addresses GH-684
2019-11-21 08:50:28 -08:00
Johanna Amann
5dafa7218d Merge remote-tracking branch 'origin/topic/jsiwek/fix-zeek-profiler-file'
* origin/topic/jsiwek/fix-zeek-profiler-file:
  Fix ZEEK_PROFILER_FILE file format/parsing
2019-11-21 08:37:04 -08:00
Robin Sommer
a00f139f1c Merge remote-tracking branch 'origin/topic/jsiwek/gh-646-conn-removal'
Clarified doc strings a bit.

* origin/topic/jsiwek/gh-646-conn-removal:
  GH-646: add new "successful_connection_remove" event
2019-11-18 12:08:12 +00:00
Jon Siwek
eb4bf2d6a2 Merge remote-tracking branch 'origin/topic/jsiwek/ci-doctest'
* origin/topic/jsiwek/ci-doctest:
  Run doctest unit tests in Travis CI
  Fix indents/whitespace in Travis CI script
2019-11-15 18:27:21 -08:00
Jon Siwek
25ae6d90b7 Merge remote-tracking branch 'origin/topic/jsiwek/openbsd'
* origin/topic/jsiwek/openbsd:
  Adjust btests for OpenBSD portability
  Convert pcapng test suite files to pcap format
  Fix undefined symbols loading libbroker on OpenBSD
  Fix compile warnings on OpenBSD
2019-11-15 18:26:50 -08:00
Jon Siwek
9941537481 Run doctest unit tests in Travis CI 2019-11-15 16:14:43 -08:00
Jon Siwek
9e83abc5d9 Fix indents/whitespace in Travis CI script 2019-11-15 16:14:43 -08:00
Dev Bali
c9016f1397 Allow Print Statements to be redirected to a Log# This is a combination of 3 commits. 2019-11-13 19:59:42 -08:00
Jon Siwek
37a478ae99 GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors
The parsing logic that should be specific to the AUTH_UNIX credential
flavor was previously applied unconditionally to other flavors.
2019-11-13 13:14:14 -08:00
Henri DF
a645e38b78 Recursively handle into container types in record_fields() 2019-11-13 15:28:06 +01:00
Henri DF
26633eb727 Print full container types in record_fields() 2019-11-12 13:19:12 +01:00
Jon Siwek
31f60853c9 GH-646: add new "successful_connection_remove" event
And switch Zeek's base scripts over to using it in place of
"connection_state_remove".  The difference between the two is
that "connection_state_remove" is raised for all events while
"successful_connection_remove" excludes TCP connections that were never
established (just SYN packets).  There can be performance benefits
to this change for some use-cases.

There's also a new event called ``connection_successful`` and a new
``connection`` record field named "successful" to help indicate this new
property of connections.
2019-11-11 19:52:59 -08:00
Jon Siwek
0c71715cf4 Adjust btests for OpenBSD portability 2019-11-08 17:32:44 -08:00
Jon Siwek
7965dcd041 Convert pcapng test suite files to pcap format
The former isn't supported by default on OpenBSD.
2019-11-08 13:08:06 -08:00
Jon Siwek
afb8bc6df8 Fix ZEEK_PROFILER_FILE file format/parsing
Some Zeek script statement descriptions were exceeding the hardcoded
maximum length and also could contain tab characters which were
supposed to be reserved for use as a delimiter in the file format.
2019-11-07 16:47:09 -08:00
Jon Siwek
cc37e505e4 Merge remote-tracking branch 'origin/master' into topic/jsiwek/supervisor 2019-11-05 10:11:47 -08:00
Jon Siwek
63fe835acf Allow record_fields() string arguments that name a record type 2019-11-01 12:46:17 -07:00
Jon Siwek
8d31baf3b7 Fix Travis CI script to run Coverity build in container
It was previously running on the host and didn't have adequate compiler
to do C++17.
2019-10-31 12:09:18 -07:00
Jon Siwek
9c4e44924f GH-664: fix signature matching for payload-carrying SYN packets
Or more generally, signatures would not work correctly for any case
where the first TCP packet seen contained payload data, regardless of
its TCP flags.
2019-10-29 17:20:08 -07:00
Jon Siwek
36d7628bcb Install cmake3 from EPEL on CentOS CI system 2019-10-28 20:18:45 -07:00
Johanna Amann
44086c1f03 Merge remote-tracking branch 'origin/topic/jsiwek/gh-654-coerce-unspecified-table-defaults'
* origin/topic/jsiwek/gh-654-coerce-unspecified-table-defaults:
  GH-654: allow table() in function &default expressions
  GH-654: allow table() in record &default expressions

Fixes GH-654
2019-10-28 20:59:39 +01:00
Robin Sommer
29164c5992 Merge remote-tracking branch 'origin/topic/jsiwek/gh-585-c++17'
* origin/topic/jsiwek/gh-585-c++17:
  Update Travis CI config for C++17
  GH-585: Require C++17
2019-10-28 10:06:16 +00:00
Robin Sommer
9d7c9f37d4 Merge branch 'Fix_http_build_url' of ssh://github.com/Olerdrive/zeek
I changed the format string of the port to %d and added a test.
2019-10-28 09:32:32 +00:00
Jon Siwek
b698c5507a GH-654: allow table() in function &default expressions
Table parameters of functions previously did not coerce unspecified
tables used in their &default attribute to the correct type.
2019-10-25 13:00:46 -07:00
Jon Siwek
34bf78984b GH-654: allow table() in record &default expressions
Table fields of records previously did not coerce unspecified tables
used in their &default attribute to the correct type.
2019-10-25 12:48:52 -07:00
Jon Siwek
81ab0b0d05 Use explicit path name for NTP log stream
For consistency (we do this for all other logs) and just to avoid
the extra path function calls.
2019-10-25 10:38:58 -07:00
Jon Siwek
08e2f97393 Update Travis CI config for C++17
Several platforms didn't have a C++17 compiler in their default repos.

Also moved from Fedora 28 to Fedora 30 since that will soon be the
oldest, still-supported version.
2019-10-24 22:27:54 -07:00
Jon Siwek
4bf3c6ff22 Improve &default validation for global vars: exclude sets 2019-10-15 18:24:35 -07:00
Johanna Amann
5265613a9e Merge remote-tracking branch 'origin/topic/jsiwek/gh-618-tcp-option-values'
* origin/topic/jsiwek/gh-618-tcp-option-values:
  Add weirds for invalid TCP option lengths
  GH-618: add "tcp_options" event containing TCP option values
  Fix tcp_option event
2019-10-15 16:50:43 -07:00