Commit graph

14311 commits

Author SHA1 Message Date
Arne Welzel
3af6b97c63 analyzers/http: Update request_version on subsequent SetVersion() calls
The #124 PR introduced special treatment when HTTP version 0.9
was set. With #127, a reproducer that set HTTP/1.0 in the first
request was created and subsequent requests wouldn't reset to
HTTP version 0.9.

This is subtle, but doesn't seem like things fall apart.

Improves runtime from 20 seconds to 2 seconds for the given
reproducer.

Fixes #127.
2023-01-26 19:59:02 +01:00
Tim Wojtulewicz
9a96e3b52a Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump spicy to v1.6.1.
2023-01-26 10:55:08 -07:00
Tim Wojtulewicz
a27a3532d8 Merge remote-tracking branch 'origin/topic/timw/2658-avoid-teredo-violations'
* origin/topic/timw/2658-avoid-teredo-violations:
  Update external testing repo commit hashes for Teredo changes
  Update scripts.base.frameworks.analyzer.logging btest to use a different trace file
  Update btest baselines due to reduced calls to UID::Set
  Rework TeredoAnalzyer::DetectProtocol to not catch as many packets
2023-01-26 09:44:48 -07:00
Tim Wojtulewicz
f842a86e80 Update external testing repo commit hashes for Teredo changes 2023-01-26 09:23:22 -07:00
Tim Wojtulewicz
6ebfa02199 Update scripts.base.frameworks.analyzer.logging btest to use a different trace file 2023-01-26 09:14:00 -07:00
Tim Wojtulewicz
3d5918e6b3 Update btest baselines due to reduced calls to UID::Set
UID::Set is called by AnalyzerViolation, and since Teredo isn't calling nearly
as many of those anymore the UIDs used by other calls changed as well.
2023-01-26 09:14:00 -07:00
Tim Wojtulewicz
b0ac20b2f2 Rework TeredoAnalzyer::DetectProtocol to not catch as many packets 2023-01-26 09:14:00 -07:00
Tim Wojtulewicz
8a9dd7b0ae Merge remote-tracking branch 'origin/topic/timw/2669-for-loop-error'
* origin/topic/timw/2669-for-loop-error:
  GH-2669: Give script location for type clash in for-loop construction
2023-01-26 09:11:51 -07:00
Tim Wojtulewicz
5e68880470 GH-2669: Give script location for type clash in for-loop construction 2023-01-26 09:11:10 -07:00
Arne Welzel
c414136288 Merge branch 'topic/awelzel/ci-skip-some-tasks'
* topic/awelzel/ci-skip-some-tasks:
  cirrus: Introduce SKIP_TASK_ON_PR
2023-01-26 14:38:08 +01:00
Benjamin Bannier
885a2fb695 Bump spicy to v1.6.1. 2023-01-26 12:43:39 +01:00
Tim Wojtulewicz
252fb581e7 Merge remote-tracking branch 'origin/topic/vern/add-C++-removal'
* origin/topic/vern/add-C++-removal:
  removed -O add-C++ option and updated documentation
2023-01-25 14:11:10 -07:00
Tim Wojtulewicz
8d815feb34 Merge remote-tracking branch 'origin/topic/timw/2684-remove-vxlan-violations'
* origin/topic/timw/2684-remove-vxlan-violations:
  GH-2684: Stop violating VXLAN for forwarding failures
2023-01-25 11:12:25 -07:00
Tim Wojtulewicz
e61c3a95ad GH-2684: Stop violating VXLAN for forwarding failures 2023-01-25 10:50:07 -07:00
Tim Wojtulewicz
e0553d451f Revert "Update external test repo commits"
This reverts commit 8e405ef2f0.
2023-01-25 08:36:41 -07:00
Tim Wojtulewicz
8e405ef2f0 Update external test repo commits 2023-01-25 08:36:16 -07:00
Tim Wojtulewicz
31ff9a45de Merge remote-tracking branch 'origin/topic/timw/testing-c++-branch-benchmarks'
* origin/topic/timw/testing-c++-branch-benchmarks:
  Fix CI benchmark script to properly urlencode arguments
2023-01-25 08:19:08 -07:00
Arne Welzel
5d708b257f cirrus: Introduce SKIP_TASK_ON_PR
Limit the number of tasks we run on PRs to only a subset instead of
the full set to reduce the amount of resources we use for PRs. Labeling
a PR with "fullci" can be used enable running all tasks.

This removes a total of 14 task execution from PRs by default at the cost of
needing to monitor master builds more closely for distro specific breakage.

This could probably be even be more advanced:

Leveraging changesIncludeOnly('scripts/*', 'testing/*'), we might be able to
limit to running a single Linux distro rather than a whole set of different
for simple script changes. For now I've left that out, however.
2023-01-25 12:54:10 +01:00
Tim Wojtulewicz
b522f6ea08 Fix CI benchmark script to properly urlencode arguments 2023-01-24 14:53:46 -07:00
Vern Paxson
65a2900bb7 removed -O add-C++ option and updated documentation 2023-01-24 10:52:58 -08:00
Tim Wojtulewicz
a82f743bcc Merge remote-tracking branch 'origin/topic/timw/test-bad-rdp-keyboard'
* origin/topic/timw/test-bad-rdp-keyboard:
  Add test for new handling of unknown RDP keyboards
2023-01-24 09:01:51 -07:00
zeek-bot
e3494b9483 Update doc submodule [nomail] [skip ci] 2023-01-24 00:31:03 +00:00
Tim Wojtulewicz
ac7e7f9ed9 Merge remote-tracking branch 'origin/topic/vern/Jan23-C++-maint'
* origin/topic/vern/Jan23-C++-maint:
  Maintenance updates for -O gen-C++ / -O gen-standalone-C++   fixes for using BiFs in standalone global initializations   avoiding redundant global initializations   updates to maintenance scripts and notes   removal of an unused member variable
2023-01-23 14:35:24 -07:00
Tim Wojtulewicz
89675fc7de Add test for new handling of unknown RDP keyboards 2023-01-23 13:01:48 -07:00
Tim Wojtulewicz
6cfb45d24f Merge remote-tracking branch 'jeff-bb/patch-2'
* jeff-bb/patch-2:
  Log raw keyboard value on best guess
  Avoid excessive fmt calls, return default behavior on unknown
  "Best Guess" unknown keyboard / language variants
2023-01-23 12:50:23 -07:00
Tim Wojtulewicz
6e59793da6 Merge remote-tracking branch 'jeff-bb/patch-1'
* jeff-bb/patch-1:
  Remove Duplicate 4122 Croatian
  Revert Sort
  Update RDP Keyboard Languages
2023-01-23 09:37:59 -07:00
jeff-bb
7085104c33
Log raw keyboard value on best guess 2023-01-23 09:12:48 -06:00
Johanna Amann
6d6238ddf7 Update submodules
[nomail]
2023-01-23 09:14:15 +00:00
jeff-bb
04113b13d5
Avoid excessive fmt calls, return default behavior on unknown
Using "in" to query the language const. This also handles the case of not having a best guess and continue using the existing behavior.

Given
keyboard_layout = 1033 (0x0409), "keyboard-English - United States"
keyboard_layout = 66569 (0x00010409), "keyboard-English - United States (Best Guess)"
keyboard_layout = 12345 (0x3039), "keyboard-12345"
2023-01-20 08:29:55 -06:00
jeff-bb
3012e0417a
Remove Duplicate 4122 Croatian 2023-01-19 17:04:42 -06:00
jeff-bb
dd2cdb064b
"Best Guess" unknown keyboard / language variants
If the lookup table does not have an entry, it will just log as the raw decimal language/keyboard code. With this change, if we do not have an entry in the lookup table, we'll look at the low order / 4 least significant bits to see if we have a match. The high order / 4 most significant bits are flags/modifiers to the base language/keyboard code. We'll append that it is a "Best Guess"

(This is my first attempt at Zeek scripting, apologies upfront if I'm missing obvious language features. I feel like the const language lookup should return a success/fail return code that we would key off of, but unsure how to accomplish that so instead went for string matching on value in == value out).
2023-01-19 16:55:23 -06:00
jeff-bb
ee21b30a18
Revert Sort 2023-01-19 16:05:43 -06:00
jeff-bb
498aaef428
Update RDP Keyboard Languages
Using additional sources to add more languages / locales. Changed sort order to match other sections.
2023-01-19 15:44:57 -06:00
Tim Wojtulewicz
80a3f5814b Merge remote-tracking branch 'origin/topic/timw/zeek-path-dev'
* origin/topic/timw/zeek-path-dev:
  Reduce startup time on Windows by using std::filesystem::canonical
  Fix diff-remove-abspath to ignore Windows drive letters
  Re-enable the float/double versions of hton{d,f} on Windows
  Make sure the DEBUG flag is defined when building in debug mode
  Don't close the kqueue manually on shutdown on Windows
  Fix MSVC compiler warning due to a type mismatch
  GH-2565: Update libunistd submodule to fix builds on VS2022
  GH-2641: Lazy-load syslog to avoid creating bro.log on Windows
  Use newer diff on Alpine for --strip-trailing-ci
  Update btest submodule to version that supports Windows
  Use pathsep btest value in btest.cfg
  Use build_dir btest value in btest.cfg
  Fix zeek-path-dev.sh creation to better support Windows
2023-01-19 09:14:27 -07:00
Tim Wojtulewicz
db161bd6df Reduce startup time on Windows by using std::filesystem::canonical
realpath() apparently doesn't handle Windows symlinks very well. This
causes plugin::Manager and ScannedFile to rescan a bunch of extra
paths that they should be skipping. This commit reduces the startup
time on Windows by 3-4 seconds (~8.5s to ~5s).
2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
d6ce5894a7 Fix diff-remove-abspath to ignore Windows drive letters 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
3750396aed Re-enable the float/double versions of hton{d,f} on Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
1f0860b5e2 Make sure the DEBUG flag is defined when building in debug mode
MSVC uses _DEBUG, unlike all of the other compilers, so we aren't
properly enabling/disabling varying bits of code that are dependent
on DEBUG being defined.
2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
4cb77c1743 Don't close the kqueue manually on shutdown on Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
a757ba12f3 Fix MSVC compiler warning due to a type mismatch 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
bc02962d4c GH-2565: Update libunistd submodule to fix builds on VS2022 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
a1e8af7745 GH-2641: Lazy-load syslog to avoid creating bro.log on Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
991652f479 Use newer diff on Alpine for --strip-trailing-ci 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
94d3b19e23 Update btest submodule to version that supports Windows 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
7623e9f290 Use pathsep btest value in btest.cfg 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
b3498da983 Use build_dir btest value in btest.cfg 2023-01-19 09:13:33 -07:00
Tim Wojtulewicz
e44eb3522e Fix zeek-path-dev.sh creation to better support Windows 2023-01-19 09:13:33 -07:00
Johanna Amann
593ad25521 Merge remote-tracking branch 'origin/topic/johanna/more-ci-removals'
* origin/topic/johanna/more-ci-removals:
  Remove outdated distributions from CI.
2023-01-19 13:48:51 +00:00
Arne Welzel
b4cb5e753a Merge branch 'topic/awelzel/fix-zam-memory-leak'
* topic/awelzel/fix-zam-memory-leak:
  testing/btest: Add ZAM basic test
  Fix ZAM memory leak as reported in #2634
2023-01-18 17:14:56 +01:00
Arne Welzel
69c7d91af0 Merge branch 'topic/awelzel/parse-eftp-squelch-errors-warnings'
* topic/awelzel/parse-eftp-squelch-errors-warnings:
  bifs/parse_eftp: Prevent reporter warnings/errors on invalid input
2023-01-18 17:12:20 +01:00