Commit graph

10798 commits

Author SHA1 Message Date
Jon Siwek
c42ebfa1cf Merge remote-tracking branch 'origin/topic/timw/the-missing-bools'
* origin/topic/timw/the-missing-bools:
  Fix uses of GetBool in bifs to use GetTrue/GetFalse
  Change Sessions::dump_this_packet to a bool
2020-04-02 15:03:34 -07:00
Jon Siwek
8c0e8ecd28 Allow alternate event/hook prototype declarations
The alternates must be some subset of the canonical prototype (the one
that's first declared) and allows users to define handlers for any
such prototype.  Example:

    # Prototype declarations
    global my_event: event(s: string, c: count);
    global my_event: event(c: count);
    global my_event: event();

    # Handler definitions
    event my_event(s: string, c: count) { print s, c; }
    event my_event(c: count) { print c; }
    event my_event() { }

This allows handlers to consume a subset of the arguments or even
re-order them.  This makes it easier to either extend an existing
event/hook's arguments and/or deprecate usages of certain prototypes.
2020-04-01 17:25:28 -07:00
Jon Siwek
eefafdc1e1 Updating submodule(s).
[nomail]
2020-04-01 13:51:31 -07:00
Tim Wojtulewicz
f4765a49a1 Fix uses of GetBool in bifs to use GetTrue/GetFalse 2020-04-01 11:08:20 -07:00
Tim Wojtulewicz
0d695ac453 Change Sessions::dump_this_packet to a bool 2020-04-01 11:08:16 -07:00
Johanna Amann
3ce1c9ffd6 Merge remote-tracking branch 'origin/topic/jsiwek/misc-lambda-fixes'
* origin/topic/jsiwek/misc-lambda-fixes:
  GH-725: fix logic for finding a lambda's usage of outer IDs
  Change record field anonymous functions to use lambda expressions
2020-03-31 15:46:54 -07:00
Johanna Amann
d18f2f8f76 Merge remote-tracking branch 'origin/topic/timw/override'
* origin/topic/timw/override:
  Mark input/output message classes as final, since nothing should be inheriting from them
  Add missing override specifier to a number of methods, remove virtual from some as well
  Add override specifier to Configure() method in almost all of the internal plugins
2020-03-31 08:48:44 -07:00
Robin Sommer
f62d7dd091 Merge branch 'topic/antonio.nappa/fix_lowercase_intel_bug' of ssh://github.com/jeppojeps/zeek 2020-03-31 07:08:14 +00:00
Robin Sommer
033fdcca74 Merge branch 'topic/timw/the-great-embooleanating'
(Squashed this one before merge).

* topic/timw/the-great-embooleanating:
  The Great Embooleanating
2020-03-31 06:57:39 +00:00
Tim Wojtulewicz
fd5e15b116 The Great Embooleanating
A large number of functions had return values and/or arguments changed
to use ``bool`` types instead of ``int``.
2020-03-31 06:41:54 +00:00
Tim Wojtulewicz
d614756a7f Mark input/output message classes as final, since nothing should be inheriting from them 2020-03-30 14:54:24 -07:00
Tim Wojtulewicz
186005133b Add missing override specifier to a number of methods, remove virtual from some as well 2020-03-30 14:54:24 -07:00
Tim Wojtulewicz
6aaabceed2 Add override specifier to Configure() method in almost all of the internal plugins 2020-03-30 14:54:24 -07:00
Johanna Amann
3c470ffe13 Merge remote-tracking branch 'origin/topic/jsiwek/gh-887-fix-gre-erspan-dot1q'
* origin/topic/jsiwek/gh-887-fix-gre-erspan-dot1q:
  GH-887: improve GRE/ERSPAN parsing of non-IPv4/IPv6 inner payload
  Fix ERSPAN III optional sub-header parsing
2020-03-30 14:30:00 -07:00
Johanna Amann
bad8283c3c Merge remote-tracking branch 'origin/topic/timw/expr-cleanup'
* origin/topic/timw/expr-cleanup:
  Don't use xor operator for boolean operations
  Fix whitespace issues
  Fix a variable-name-shadowing issue
  Don't allocate a value during a loop if avoidable
  Fix type narrowing on a couple of subtractions
  Fold multiple if cases with the same return value into a single return
  Fold a number of allocations into the if statement where they're used
  Remove unused ListExpr::AllConst method
  Constify a couple of method arguments
  Mark RuntimeError methods in Reporter as noreturn since they throw exceptions
2020-03-30 13:59:27 -07:00
Johanna Amann
0865ef3c45 Merge remote-tracking branch 'origin/topic/timw/remove-cq'
* origin/topic/timw/remove-cq:
  Remove unused cq queue code.
2020-03-30 13:30:32 -07:00
Johanna Amann
2e6eb7795c Merge remote-tracking branch 'origin/topic/jsiwek/tcp-hdr-reserved-bits'
* origin/topic/jsiwek/tcp-hdr-reserved-bits:
  Add a "reserved" field to tcp_hdr record
2020-03-30 13:23:51 -07:00
Johanna Amann
5453c6004e Merge remote-tracking branch 'origin/topic/jsiwek/rocksdb-opt-in'
* origin/topic/jsiwek/rocksdb-opt-in:
  GH-878: Make RocksDB usage opt-in and add --enable-rocksdb configure flag

Fixes GH-878
2020-03-30 13:23:09 -07:00
Jon Siwek
b7dee712d5 GH-887: improve GRE/ERSPAN parsing of non-IPv4/IPv6 inner payload
This changes the decapsulation logic for GRE/ERSPAN payloads to re-use
existing Layer 2 parsing logic that already handles things like 802.1Q
tags correctly before going on to process the inner IPv4/IPv6 payload.
2020-03-27 15:22:00 -07:00
Jon Siwek
42dc2906af Fix ERSPAN III optional sub-header parsing 2020-03-27 15:07:18 -07:00
Tim Wojtulewicz
85c6c2b9ee Merge remote-tracking branch 'origin/topic/jsiwek/runtime-exception-leak-cleanup'
* origin/topic/jsiwek/runtime-exception-leak-cleanup:
  Func::DescribeDebug: move a NumFields() call out of loop
  Use const-ref parameter for zeek::val_list_to_args()
  Fix missing IntrusivePtr.h include and ambiguous ODesc::Add call
  Remove TimerMgr arg from event queuing/scheduling methods
  Deprecate Analyzer::ConnectionEvent()
  Deprecate file_analysis::File::FileEvent methods using val_list args
  Deprecate Connection::ConnectionEvent methods
  Deprecate EventMgr::QueueEventFast() and update usages to Enqueue()
  Deprecate EventMgr::QueueEvent() and update usages to Enqueue()
  Deprecate Func::Call(val_list*, ...)
  Use vector<IntrusivePtr<Val>> for Func::Call and Event queuing args
  Fix memory leak in Zeek when-statement bodies with runtime errors
  Change TableVal::RecoverIndex() to return IntrusivePtr
  Use IntrusivePtr in TableVal::CallExpireFunc
  Fix memory leak when runtime error occurs in a Zeek for-loop
  Enable leak checks for btests that produce runtime exceptions
2020-03-27 11:49:45 -07:00
Jon Siwek
75d7396f2d Updating submodule(s).
[nomail]
2020-03-27 11:16:46 -07:00
Antonio Nappa
cc309a5c99 fixed a newline issue with baselines 2020-03-27 11:27:28 -04:00
Jon Siwek
1ca11f11c7 GH-725: fix logic for finding a lambda's usage of outer IDs 2020-03-26 17:05:59 -07:00
Jon Siwek
f032885085 Change record field anonymous functions to use lambda expressions
There was an alternate syntax to assign anonymous functions to record
fields that was never migrated to use the new lambda expression
machinery (and so didn't allow referencing variables in outer scope):

    type myrec: record {
        foo: function(a: string);
    };

    local o = "o";
    local mr = myrec($foo(a: string) = { print a + o; });
2020-03-26 15:48:18 -07:00
Jon Siwek
29a7222563 Func::DescribeDebug: move a NumFields() call out of loop 2020-03-26 15:21:51 -07:00
Jon Siwek
ccee29d4d3 Updating submodule(s).
[nomail]
2020-03-26 13:34:36 -07:00
Antonio Nappa
dd6d379b40 fix-lowercase-intel-bug 2020-03-26 15:55:01 -04:00
Jon Siwek
3c1ad8b962 GH-878: Make RocksDB usage opt-in and add --enable-rocksdb configure flag 2020-03-26 12:18:42 -07:00
Jon Siwek
66156b4eee Updating submodule(s).
[nomail]
2020-03-26 12:00:59 -07:00
Jon Siwek
13391806ba Add a "reserved" field to tcp_hdr record
This record is available by handling either raw_packet or new_packet
events.
2020-03-26 11:48:53 -07:00
Jon Siwek
e7e5cf0f89 Use const-ref parameter for zeek::val_list_to_args()
It ended up being used a bit more than initially expected and this
is closer to the style we're generally aiming for.
2020-03-26 11:32:01 -07:00
Jon Siwek
599dda9ae9 Fix missing IntrusivePtr.h include and ambiguous ODesc::Add call 2020-03-25 19:37:06 -07:00
Jon Siwek
54bc3bd5c6 Remove TimerMgr arg from event queuing/scheduling methods
It's not useful for anything since there's only ever a single TimerMgr.
2020-03-25 19:05:17 -07:00
Jon Siwek
5e496e43b7 Deprecate Analyzer::ConnectionEvent()
And update usages to Analyzer::EnqueueConnEvent()
2020-03-25 18:40:49 -07:00
Jon Siwek
e394ea38bc Deprecate file_analysis::File::FileEvent methods using val_list args
And update usages to the overload that takes a zeek::Args instead.
2020-03-25 18:40:49 -07:00
Jon Siwek
de47a50dde Deprecate Connection::ConnectionEvent methods
And update usages to Connection::EnqueueEvent
2020-03-25 18:39:56 -07:00
Jon Siwek
6980f63a91 Deprecate EventMgr::QueueEventFast() and update usages to Enqueue() 2020-03-25 16:09:33 -07:00
Jon Siwek
0db484cc7a Deprecate EventMgr::QueueEvent() and update usages to Enqueue() 2020-03-25 16:09:33 -07:00
Tim Wojtulewicz
67e4179454 Remove unused cq queue code.
This code isn't used anymore now that the Timer code uses PQ all the time.
2020-03-25 15:45:48 -07:00
Jon Siwek
b667c637df Deprecate Func::Call(val_list*, ...)
The version taking a vector of intrusive pointers should be used
instead.  A variadic version is also added that forwards all arguments.
2020-03-24 20:48:32 -07:00
Jon Siwek
4e1ac4e124 Use vector<IntrusivePtr<Val>> for Func::Call and Event queuing args
This change may break BIFs that use @ARGS@, @ARG@, or @ARGC@ since their
types have changed.
2020-03-24 16:50:18 -07:00
Johanna Amann
8a4ccabc3e Merge remote-tracking branch 'origin/topic/jsiwek/fix-greedy-flowbuffer-bounds-check'
* origin/topic/jsiwek/fix-greedy-flowbuffer-bounds-check:
  Add test case for binpac flowbuffer frame length parsing bug
2020-03-24 13:49:58 -07:00
Tim Wojtulewicz
7ec96f25ac Don't use xor operator for boolean operations 2020-03-24 13:39:56 -07:00
Tim Wojtulewicz
10f0fffe29 Fix whitespace issues 2020-03-24 13:39:56 -07:00
Tim Wojtulewicz
12f2153f67 Fix a variable-name-shadowing issue 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
91f05f19ef Don't allocate a value during a loop if avoidable 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
f2a6ad63ed Fix type narrowing on a couple of subtractions 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
499729bd8e Fold multiple if cases with the same return value into a single return 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
e4a36678ba Fold a number of allocations into the if statement where they're used 2020-03-24 13:39:55 -07:00