Commit graph

14293 commits

Author SHA1 Message Date
Tim Wojtulewicz
31ff9a45de Merge remote-tracking branch 'origin/topic/timw/testing-c++-branch-benchmarks'
* origin/topic/timw/testing-c++-branch-benchmarks:
  Fix CI benchmark script to properly urlencode arguments
2023-01-25 08:19:08 -07:00
Tim Wojtulewicz
b522f6ea08 Fix CI benchmark script to properly urlencode arguments 2023-01-24 14:53:46 -07:00
Tim Wojtulewicz
a82f743bcc Merge remote-tracking branch 'origin/topic/timw/test-bad-rdp-keyboard'
* origin/topic/timw/test-bad-rdp-keyboard:
  Add test for new handling of unknown RDP keyboards
2023-01-24 09:01:51 -07:00
zeek-bot
e3494b9483 Update doc submodule [nomail] [skip ci] 2023-01-24 00:31:03 +00:00
Tim Wojtulewicz
ac7e7f9ed9 Merge remote-tracking branch 'origin/topic/vern/Jan23-C++-maint'
* origin/topic/vern/Jan23-C++-maint:
  Maintenance updates for -O gen-C++ / -O gen-standalone-C++   fixes for using BiFs in standalone global initializations   avoiding redundant global initializations   updates to maintenance scripts and notes   removal of an unused member variable
2023-01-23 14:35:24 -07:00
Tim Wojtulewicz
89675fc7de Add test for new handling of unknown RDP keyboards 2023-01-23 13:01:48 -07:00
Tim Wojtulewicz
6cfb45d24f Merge remote-tracking branch 'jeff-bb/patch-2'
* jeff-bb/patch-2:
  Log raw keyboard value on best guess
  Avoid excessive fmt calls, return default behavior on unknown
  "Best Guess" unknown keyboard / language variants
2023-01-23 12:50:23 -07:00
Tim Wojtulewicz
6e59793da6 Merge remote-tracking branch 'jeff-bb/patch-1'
* jeff-bb/patch-1:
  Remove Duplicate 4122 Croatian
  Revert Sort
  Update RDP Keyboard Languages
2023-01-23 09:37:59 -07:00
jeff-bb
7085104c33
Log raw keyboard value on best guess 2023-01-23 09:12:48 -06:00
Johanna Amann
6d6238ddf7 Update submodules
[nomail]
2023-01-23 09:14:15 +00:00
jeff-bb
04113b13d5
Avoid excessive fmt calls, return default behavior on unknown
Using "in" to query the language const. This also handles the case of not having a best guess and continue using the existing behavior.

Given
keyboard_layout = 1033 (0x0409), "keyboard-English - United States"
keyboard_layout = 66569 (0x00010409), "keyboard-English - United States (Best Guess)"
keyboard_layout = 12345 (0x3039), "keyboard-12345"
2023-01-20 08:29:55 -06:00
jeff-bb
3012e0417a
Remove Duplicate 4122 Croatian 2023-01-19 17:04:42 -06:00
jeff-bb
dd2cdb064b
"Best Guess" unknown keyboard / language variants
If the lookup table does not have an entry, it will just log as the raw decimal language/keyboard code. With this change, if we do not have an entry in the lookup table, we'll look at the low order / 4 least significant bits to see if we have a match. The high order / 4 most significant bits are flags/modifiers to the base language/keyboard code. We'll append that it is a "Best Guess"

(This is my first attempt at Zeek scripting, apologies upfront if I'm missing obvious language features. I feel like the const language lookup should return a success/fail return code that we would key off of, but unsure how to accomplish that so instead went for string matching on value in == value out).
2023-01-19 16:55:23 -06:00
jeff-bb
ee21b30a18
Revert Sort 2023-01-19 16:05:43 -06:00
jeff-bb
498aaef428
Update RDP Keyboard Languages
Using additional sources to add more languages / locales. Changed sort order to match other sections.
2023-01-19 15:44:57 -06:00
Tim Wojtulewicz
80a3f5814b Merge remote-tracking branch 'origin/topic/timw/zeek-path-dev'
* origin/topic/timw/zeek-path-dev:
  Reduce startup time on Windows by using std::filesystem::canonical
  Fix diff-remove-abspath to ignore Windows drive letters
  Re-enable the float/double versions of hton{d,f} on Windows
  Make sure the DEBUG flag is defined when building in debug mode
  Don't close the kqueue manually on shutdown on Windows
  Fix MSVC compiler warning due to a type mismatch
  GH-2565: Update libunistd submodule to fix builds on VS2022
  GH-2641: Lazy-load syslog to avoid creating bro.log on Windows
  Use newer diff on Alpine for --strip-trailing-ci
  Update btest submodule to version that supports Windows
  Use pathsep btest value in btest.cfg
  Use build_dir btest value in btest.cfg
  Fix zeek-path-dev.sh creation to better support Windows
2023-01-19 09:14:27 -07:00
Tim Wojtulewicz
db161bd6df Reduce startup time on Windows by using std::filesystem::canonical
realpath() apparently doesn't handle Windows symlinks very well. This
causes plugin::Manager and ScannedFile to rescan a bunch of extra
paths that they should be skipping. This commit reduces the startup
time on Windows by 3-4 seconds (~8.5s to ~5s).
2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
d6ce5894a7 Fix diff-remove-abspath to ignore Windows drive letters 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
3750396aed Re-enable the float/double versions of hton{d,f} on Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
1f0860b5e2 Make sure the DEBUG flag is defined when building in debug mode
MSVC uses _DEBUG, unlike all of the other compilers, so we aren't
properly enabling/disabling varying bits of code that are dependent
on DEBUG being defined.
2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
4cb77c1743 Don't close the kqueue manually on shutdown on Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
a757ba12f3 Fix MSVC compiler warning due to a type mismatch 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
bc02962d4c GH-2565: Update libunistd submodule to fix builds on VS2022 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
a1e8af7745 GH-2641: Lazy-load syslog to avoid creating bro.log on Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
991652f479 Use newer diff on Alpine for --strip-trailing-ci 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
94d3b19e23 Update btest submodule to version that supports Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
7623e9f290 Use pathsep btest value in btest.cfg 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
b3498da983 Use build_dir btest value in btest.cfg 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
e44eb3522e Fix zeek-path-dev.sh creation to better support Windows 2023-01-19 09:13:33 -07:00
Johanna Amann
593ad25521 Merge remote-tracking branch 'origin/topic/johanna/more-ci-removals'
* origin/topic/johanna/more-ci-removals:
  Remove outdated distributions from CI.
2023-01-19 13:48:51 +00:00
Arne Welzel
b4cb5e753a Merge branch 'topic/awelzel/fix-zam-memory-leak'
* topic/awelzel/fix-zam-memory-leak:
  testing/btest: Add ZAM basic test
  Fix ZAM memory leak as reported in #2634
2023-01-18 17:14:56 +01:00
Arne Welzel
69c7d91af0 Merge branch 'topic/awelzel/parse-eftp-squelch-errors-warnings'
* topic/awelzel/parse-eftp-squelch-errors-warnings:
  bifs/parse_eftp: Prevent reporter warnings/errors on invalid input
2023-01-18 17:12:20 +01:00
Johanna Amann
12dd21cbe5 Remove outdated distributions from CI.
Fedora 35: CI folder was forgotten during removal

Opensuse Leap 15.3: EOL was 2022

Openssl-3: No longer necessary, since part of distributions (e.g. Ubuntu
22.10)
2023-01-18 14:42:54 +00:00
Arne Welzel
eb09662d48 bifs/parse_eftp: Prevent reporter warnings/errors on invalid input
When passing invalid IPs or an out-of range port to parse_eftp()
a warning or error was generated on stderr (in addition to setting
the $valid field to F). Prevent the output by adding safe-guarding
and using IPAddr::ConvertString() instead.
2023-01-16 15:20:02 +01:00
Vern Paxson
18f4fcb5a4 Maintenance updates for -O gen-C++ / -O gen-standalone-C++
fixes for using BiFs in standalone global initializations
  avoiding redundant global initializations
  updates to maintenance scripts and notes
  removal of an unused member variable
2023-01-12 14:08:45 -08:00
Arne Welzel
d4a84e7442 Merge remote-tracking branch 'origin/topic/vern/dup-rec-fields2'
* origin/topic/vern/dup-rec-fields2:
  fix for crashes when record definitions repeat a field name

Removed dead if !init code during merge.
2023-01-12 09:42:50 +01:00
Christian Kreibich
144cadf6cd Merge branch 'topic/christian/ci-updates'
* topic/christian/ci-updates:
  CI: remove Fedora 35, now EOL
  CI: avoid deprecated ::set-output use
  CI: move action/checkout use to v3
2023-01-11 17:02:55 -08:00
Christian Kreibich
67cea914c9 Bump submodules [nomail] [skip ci]
This includes CI updates for zeek-af_packet-plugin, zeek-archiver, and doc, plus
the Python 3.7 minimum version requirement in the install docs.
2023-01-11 16:57:14 -08:00
Tim Wojtulewicz
5827e2ce5d Merge remote-tracking branch 'origin/topic/timw/2575-npcap-support'
* origin/topic/timw/2575-npcap-support:
  Fixes to support the Npcap library on Windows
2023-01-11 11:44:18 -07:00
Tim Wojtulewicz
58f4ff91d8 Fixes to support the Npcap library on Windows
- Ignore conan libpcap if PCAP_ROOT_DIR is passed
- Update the cmake submodule to pick up changes for finding the right
  paths to npcap
- Add lazy-loading of npcap so the library path gets set correctly
  at startup
2023-01-11 11:42:58 -07:00
Johanna Amann
7c54d1aa1c Merge remote-tracking branch 'origin/topic/vern/gh-2645'
* origin/topic/vern/gh-2645:
  fix for crash when specifying an unwriteable file to --profile-scripts (GH-2645)
2023-01-11 09:00:47 +00:00
Christian Kreibich
7bf2d1f6e2 Update doc submodule [nomail] [skip ci] 2023-01-10 19:01:21 -08:00
Christian Kreibich
12885c7475 Fix a docstring typo 2023-01-10 18:49:19 -08:00
Christian Kreibich
1697bf13b1 CI: remove Fedora 35, now EOL 2023-01-10 17:27:23 -08:00
Christian Kreibich
e5e09cffe9 CI: avoid deprecated ::set-output use
This pattern is deprecated in favor of environment files and throwing warnings
in the CI runs. Details below.

https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
2023-01-10 17:18:52 -08:00
Christian Kreibich
b5777aa54e CI: move action/checkout use to v3
Being less specific here automatically pulls in their point releases.
2023-01-10 17:04:29 -08:00
zeek-bot
f5305ade7f Update doc submodule [nomail] [skip ci] 2023-01-11 00:35:58 +00:00
Vern Paxson
a172617250 fix for crashes when record definitions repeat a field name 2023-01-10 13:56:47 -08:00
Arne Welzel
4396124d89 Merge remote-tracking branch 'origin/topic/christian/file-event-docstrings'
* origin/topic/christian/file-event-docstrings:
  Expand docstrings of file_new and file_over_new_connection events
2023-01-10 10:31:17 +01:00
Arne Welzel
2d852209b0 Merge remote-tracking branch 'origin/topic/awelzel/analyzer-log'
* origin/topic/awelzel/analyzer-log:
  btest/net-control: Use different expiration times for rules
  analyzer: Add analyzer.log for logging violations/confirmations
2023-01-10 10:22:58 +01:00