Commit graph

2189 commits

Author SHA1 Message Date
Tim Wojtulewicz
9a6959d633 Merge remote-tracking branch 'origin/topic/jsiwek/improve-netbios-toupper'
* origin/topic/jsiwek/improve-netbios-toupper:
  Replace toupper() usages in netbios decoding BIFs
2021-06-01 19:12:09 -07:00
Tim Wojtulewicz
ff79a58f59 Merge remote-tracking branch 'origin/topic/neverlord/telemetry-scraper'
* origin/topic/neverlord/telemetry-scraper:
  Integrate review feedback
  Sync new broker options, fix name inconsistencies
  Integrate new Broker metric exporter parameters
2021-06-01 10:19:46 -07:00
Tim Wojtulewicz
ca4d0321f1 Merge remote-tracking branch 'sigkillchris/sigkillchris-patch-1'
* sigkillchris/sigkillchris-patch-1:
  Update detect-MHR.zeek
2021-06-01 09:52:17 -07:00
Tim Wojtulewicz
7393e13d67 Merge remote-tracking branch 'origin/topic/jsiwek/gh-839-fix-optional-subrecord-table-indices'
* origin/topic/jsiwek/gh-839-fix-optional-subrecord-table-indices:
  GH-839: Fix use of &optional sub-records within table/set indices
2021-06-01 09:39:54 -07:00
Tim Wojtulewicz
5f57daf9d1 Ensure SessionAdapter members are initialized
Fixes Coverity #1453273
2021-05-26 10:53:08 -07:00
Robin Sommer
815b8cbcc9 Merge remote-tracking branch 'origin/topic/robin/file-api-extension'
* origin/topic/robin/file-api-extension:
  Extend the file analyzer API to set source manually.
2021-05-26 08:08:09 +02:00
Jon Siwek
7185a71960 Update Broker submodule for bump of embedded CAF to 0.18.3 2021-05-24 15:05:19 -07:00
Tim Wojtulewicz
aa09e02117 Merge remote-tracking branch 'origin/topic/timw/1114-analyzers'
* origin/topic/timw/1114-analyzers:
  Add type field to session::Key to help avoid collisions in map
  Move bad UDP checksum handling into adapter object
  Rename IPBasedTransportAnalyzer to SessionAdapter
  Move building session analyzer tree out of analyzer::Manager
  Rework the packet flow through the IP-based analyzers
  Add new UDP packet analyzer, remove old one
  Add new ICMP packet analyzer, remove old one
  Add base class for IP-based packet analyzers
  Move SessionManager::ParseIPPacket to IP analyzer's namespace
  Added skeletons for TCP/UDP/ICMP packet analysis plugins.
2021-05-24 12:40:00 -07:00
Jon Siwek
82fb5722a1 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1244-print-small-floating-point'
* origin/topic/jsiwek/gh-1244-print-small-floating-point:
  Omit unneeded decimal points in modp_dtoa2() scientific notation output
  GH-1244: Change modp_dtoa2() to use scientific notation for small values
2021-05-18 11:47:56 -07:00
Tim Wojtulewicz
f66b4f5340 Merge remote-tracking branch 'origin/topic/timw/dict-iterator-construction'
* origin/topic/timw/dict-iterator-construction:
  GH-1546: Make DictIterator() public, add copy/move operators
2021-05-17 11:58:17 -07:00
Jon Siwek
31f73f6e92 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1555-gh-1558-config-enum-fixes'
* origin/topic/jsiwek/gh-1555-gh-1558-config-enum-fixes:
  GH-1558: Fix reading `vector of enum` types from config files
  GH-1555: Fix reading empty set[enum] values from config files
2021-05-17 11:35:20 -07:00
Johanna Amann
1d25def759 Merge branch 'master' of https://github.com/kramse/zeek
* 'master' of https://github.com/kramse/zeek:
  Added note about default configuration
  More precise description of the example
  Removed tcpdump file, as it may not even work.
  Just a few ideas for improving the manual page
2021-05-17 13:14:50 +01:00
Tim Wojtulewicz
67e8a05fc1 Merge remote-tracking branch 'origin/topic/timw/zeek-string-tests'
* origin/topic/timw/zeek-string-tests:
  Add unit tests to ZeekString.cc
2021-05-11 09:26:57 -07:00
Jon Siwek
37b7c65310 Merge remote-tracking branch 'origin/topic/vern/cpp'
* origin/topic/vern/cpp: (34 commits)
  fixed cut-and-paste botch (redundant line of code)
  Fix LGTM warnings in script_opt/CPP code
  bug fixes for stand-alone compiles with empty records
  remove -O force-C++, and also some inadvertently replicated code
  better initial workflow, thanks to Jon Siwek
  remove optimization no longer needed
  removed redundant Traverse invocation
  style nit: removed std:: where not needed due to "using" clause
  Fix various compiler/linter warnings in script_opt/CPP code
  first cut at embedding filenames in C++ function names - for Justin to test
  fixes for personal build scripts - will go away once workflow is streamlined
  whoops removed a std:: from generated code
  decluttered code by removing "std::" - no semantic changes (also some whitespace fixes)
  porting fixes from Justin
  documenting poor run-time error messages
  README documentation
  minor tweaks tidyness tweaks
  notes for tests that are problematic when using compile-to-C++
  new "-a cpp" btest alternative
  hooks for activating the compiler & associated BiF
  ...
2021-05-10 12:57:56 -07:00
Johanna Amann
f76a95a2c2 Merge remote-tracking branch 'origin/topic/christian/install-btest-tooling'
* origin/topic/christian/install-btest-tooling:
  Explain zeek-config options in help output
  Sort variables at top of zeek-config alphabetically
  Install Zeek's btest tooling with the distribution
2021-05-10 10:26:59 +01:00
Tim Wojtulewicz
6454f59369 Merge remote-tracking branch 'origin/topic/timw/session-coverity'
* origin/topic/timw/session-coverity:
  Minor cleanup in IPAddr.h
  Fix a few Coverity warnings from the session manager work
2021-05-05 14:06:25 +00:00
Jon Siwek
932a83bb60 Merge remote-tracking branch 'origin/topic/vern/record-holes'
* origin/topic/vern/record-holes:
  switched RecordVal's to use std::optional for tracking missing fields
  added constructors for directly building ZVal's
2021-05-03 18:21:42 -07:00
Jon Siwek
9e8eb30620 Add missing zeek/ prefix to a telemetry header's includes 2021-04-30 18:29:34 -07:00
Tim Wojtulewicz
72ba93d9a3 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1534-better-duplicate-enum-error'
* origin/topic/jsiwek/gh-1534-better-duplicate-enum-error:
  GH-1534: Fix excessive coredump for duplicate enum definitions
2021-04-30 09:42:40 -07:00
Tim Wojtulewicz
ad67d810be Merge remote-tracking branch 'origin/topic/jsiwek/fix-netbios-decode-bifs'
* origin/topic/jsiwek/fix-netbios-decode-bifs:
  Fixes to `decode_netbios_name` and `decode_netbios_name_type` BIFs
2021-04-30 09:40:46 -07:00
Tim Wojtulewicz
af3814792a Merge remote-tracking branch 'origin/topic/timw/1114-sessions-manager'
* origin/topic/timw/1114-sessions-manager:
  Rename ConnID and ConnIDKey
  Remove Session prefix from some session-related classes and files
  Move session code into new directory and into zeek::session namespace
  Move SessionKey into a separate file, added comments
  Review cleanup
  Rework stats to store handles to the counters
  Rename some connection-specific methods in Session and SessionManager
  Add deprecated version of Sessions.h
  Rename NetSessions to SessionManager
  Store a single map of Sessions instead of split maps of Connections.
  Convert session stats to use the new telemetry API
  Add test for get_conn_stats BIF before reworking session stats
  Add new Session base class
  Move packet filter out of NetSessions
  Move some code out of NetSessions
2021-04-29 11:29:59 -07:00
Tim Wojtulewicz
14ffd9646f Merge remote-tracking branch 'origin/topic/bbannier/issue-1517'
* origin/topic/bbannier/issue-1517:
  Add basic testing for Geneve protocol analyzer
  GH-1517: Add Geneve decap support
2021-04-29 09:01:11 -07:00
Jon Siwek
aaabb75f66 Merge remote-tracking branch 'origin/topic/jsiwek/misc-table-stuff'
* origin/topic/jsiwek/misc-table-stuff:
  Add a fatal error condition for invalid Dictionary insertion distances
  Fix using clear_table() within an &expire_func
  Remove saving/restoring of value pointer after calling expire_func
  Avoid allocating a HashKey for no-op table expiry iterations
2021-04-28 13:49:31 -07:00
Jon Siwek
333957df22 Fix -Wsign-compare warnings in Debug{Cmds}.cc 2021-04-28 13:10:38 -07:00
Tim Wojtulewicz
6b8699fbda Merge remote-tracking branch 'origin/topic/timw/1528-remove-queue'
* origin/topic/timw/1528-remove-queue:
  GH-1528: Remove broken Queue/PQueue class, replace with std::deque
2021-04-28 09:27:35 -07:00
Jon Siwek
b44ae62ce4 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1483-mismatch-ctor-init-errors'
* origin/topic/jsiwek/gh-1483-mismatch-ctor-init-errors:
  GH-1483: Improve error for mismatched container initialization types
2021-04-26 11:15:34 -07:00
Tim Wojtulewicz
d9f40abf6d Merge remote-tracking branch 'origin/topic/timw/mobile-ipv6-test'
* origin/topic/timw/mobile-ipv6-test:
  Update btest baselines for --enable-mobile-ipv6 builds
  Build ubuntu18 on CI with --enable-mobile-ipv6
2021-04-26 09:54:19 -07:00
Jon Siwek
d166250961 Merge remote-tracking branch 'origin/topic/timw/zeek-cut-lgtm'
* origin/topic/timw/zeek-cut-lgtm:
  Fix LGTM finding in zeek-cut with uses of localtime and gmtime
2021-04-20 15:21:12 -07:00
Jon Siwek
e8247c2472 Merge remote-tracking branch 'origin/topic/vern/vector-holes'
* origin/topic/vern/vector-holes:
  Remove NEWS entry regarding changed vector-holes functionality
  Fix potential segfaults in VectorVal Insert/Remove methods
  Fix copy() to work with a vector that has trailing holes
  update test suite for vector holes now being supported for numeric types
  add vector tests for creating holes, "in" operator, "?" operator, copying vectors with holes
  restore support for vectors with holes remove vestigial comment
  fix using ++/-- to vectors that contain holes
2021-04-20 14:43:01 -07:00
Jon Siwek
f176da200e Merge remote-tracking branch 'origin/topic/jsiwek/gh-1506-fix-broker-func-indices'
- Extended a btest to cover tables/sets with index types
  (this was originally broken until fixed by GH-1514)

* origin/topic/jsiwek/gh-1506-fix-broker-func-indices:
  GH-1506: Fix Broker unserialization of set/table function indices
2021-04-16 16:03:29 -07:00
Tim Wojtulewicz
df22bdd52e Merge remote-tracking branch 'origin/topic/timw/1487-not-valid-enum'
* origin/topic/timw/1487-not-valid-enum:
  Move an assert() in input/Manager.cc to account for ValueToVal errors
  Add test for config framework
  Fix similar issues with ValueTo* methods in the input framework
  GH-1487: Handle error from ValueToVal instead of ignoring it
2021-04-16 08:08:59 -07:00
Jon Siwek
846cc53780 Merge remote-tracking branch 'origin/topic/jsiwek/fix-table-vector-index'
* origin/topic/jsiwek/fix-table-vector-index:
  Fix indexing of set/table types with a vector
2021-04-15 17:59:31 -07:00
Tim Wojtulewicz
97288134c2 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1496-fix-armv7-build'
* origin/topic/jsiwek/gh-1496-fix-armv7-build:
  GH-1496: Fix build on armv7 architecture
2021-04-15 11:55:04 -07:00
Tim Wojtulewicz
fc3438bda5 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1450-large-double-format'
* origin/topic/jsiwek/gh-1450-large-double-format:
  GH-1450: Improve printing/logging of large double/interval/time values
2021-04-14 16:06:11 -07:00
Tim Wojtulewicz
d579dd4318 Merge remote-tracking branch 'origin/topic/jsiwek/crlf-parsing'
* origin/topic/jsiwek/crlf-parsing:
  Add btest for unterminated pattern parsing error behavior
  GH-1497: Support CRLF line-endings in Zeek scripts and signature files
  Escape non-printables in "unrecognized character" parser error messages
2021-04-14 15:54:42 -07:00
Tim Wojtulewicz
0ab4cc8237 Merge remote-tracking branch 'origin/topic/jsiwek/pcap-null-data-check'
* origin/topic/jsiwek/pcap-null-data-check:
  Add a check for null packet data in pcap IOSource
2021-04-14 15:52:05 -07:00
Jon Siwek
361c99cc26 Add explanation of vector holes/in-operator changes to NEWS [skip ci] 2021-04-12 18:07:30 -07:00
Jon Siwek
0c93e2fcb8 Merge remote-tracking branch 'origin/topic/christian/orig-resp-explanation'
* origin/topic/christian/orig-resp-explanation:
  Reference the manual's explanation of originator and responder from conn_id
2021-04-09 12:18:19 -07:00
Jon Siwek
25dcf210b1 Disable Broker tests in Coverity Scan cronjob build
Coverity has trouble analyzing them and they're contributing to
bringing the overall successfully-analyzed-compilation-unit ratio
below the required 85%.
2021-04-07 18:34:12 -07:00
Jon Siwek
c9874be22a Merge remote-tracking branch 'origin/topic/timw/1493-mobile-ipv6'
* origin/topic/timw/1493-mobile-ipv6:
  GH-1493: Fix build with -DENABLE_MOBILE_IPV6
2021-04-07 15:54:40 -07:00
Tim Wojtulewicz
2f69e32233 Merge remote-tracking branch 'origin/topic/jsiwek/intrusiveptr-hash'
* origin/topic/jsiwek/intrusiveptr-hash:
  Change TableVal::ToMap() to return ValPtr-indexed maps
  Add std::hash specialization for IntrusivePtr
  Move IntrusivePtr relational operators to zeek namespace
2021-04-07 11:13:05 -07:00
Jon Siwek
cd8f19328a Merge remote-tracking branch 'origin/topic/neverlord/gh-1408'
- Minor adjustments to header includes, whitespace, and a
  compiler warning fix during merge

* origin/topic/neverlord/gh-1408:
  Add new Timer class to the telemetry API
  Fix build with latest VectorVal API
  Update baselines
  Prefix telemetry BIFs with __
  Expose telemetry API to scripting land
  Add handle types for histogram metrics
  Move duplicated code to detail header
  Adhere to Zeek coding style
  Apply suggestions from code review
  Add telemetry Manager to Zeek setup / teardown
  Add missing whitespaces for Zeek coding style
  Add gauge metric types
  Add scaffold for new metrics API with counters
2021-04-05 14:21:44 -07:00
Jon Siwek
e6955d55dd Increase timeout of plugins.reader btest 2021-04-03 09:40:45 -07:00
Jon Siwek
fe6fd61468 Merge remote-tracking branch 'origin/topic/vern/cpp-prep-profiling'
* origin/topic/vern/cpp-prep-profiling:
  Add missing errno include to ProfileFunc.cc
  Adjust GetAttrs() usage in ProfileFunc::PreExpr() to const-reference
  Fix whitespace in ProfileFunc::PreExpr()
  Avoid redundant map/set searches in various ProfileFunc methods
  Improve detail::script_specific_filename()
  Use std::string_view in p_hash() to avoid string copies
  function profiling rewritten - more detailed info, supports global profiling
  track whether a given function/body should be included/skipped for optimization
2021-04-01 14:14:59 -07:00
Jon Siwek
2beaee9318 Add ssh to Alpine Dockerfile for retrieving external test repos 2021-03-31 11:59:04 -07:00
Jon Siwek
631f19377e Change ci/init-external-repos.sh to use base64 -d
The BusyBox version of `base64` does not have `--decode`.
2021-03-31 10:48:07 -07:00
Jon Siwek
ade37c1dfc Teach ci/init-external-repos.sh to consider user permissions
Any errors while setting up external/private test repo should fail the
task for PRs submitted by a user with write/admin permission.
2021-03-31 10:31:39 -07:00
Jon Siwek
f75da8bb08 Merge remote-tracking branch 'origin/topic/johanna/opensuse-leap'
* origin/topic/johanna/opensuse-leap:
  CI: Add OpenSUSE Leap 15.2
2021-03-31 09:56:30 -07:00
Jon Siwek
75ebc5bca1 Merge branch 'fix_timeval' of https://github.com/abenson/zeek
* 'fix_timeval' of https://github.com/abenson/zeek:
  Fix incomplete-type for struct timeval
2021-03-30 14:58:00 -07:00
Jon Siwek
c033bd20aa Merge remote-tracking branch 'origin/topic/vern/global-stmts'
* origin/topic/vern/global-stmts:
  whitespace adjustment
  "balance" tests with multiple Zeek scripts to load the same elements
  put global statements into a quasi-function to support script optimization
2021-03-29 15:42:43 -07:00