Commit graph

1952 commits

Author SHA1 Message Date
Jon Siwek
05618dc8a8 Merge remote-tracking branch 'origin/topic/jsiwek/update-minimum-cmake'
* origin/topic/jsiwek/update-minimum-cmake:
  Update minimum required CMake to 3.5
2020-12-02 11:11:45 -08:00
Tim Wojtulewicz
49293c080d Merge remote-tracking branch 'origin/topic/timw/1184-additional-weird-info'
* origin/topic/timw/1184-additional-weird-info:
  GH-1184: Add 'source' field to weird log denoting where the weird was reported
2020-12-01 10:18:00 -07:00
Robin Sommer
eccbbb4476 Merge remote-tracking branch 'origin/topic/robin/gh-1179-plugin-loading'
* origin/topic/robin/gh-1179-plugin-loading:
  Retry loading plugins on failure to resolve to dependencies.
  Fix use of deprecated functionality in test.
  When attempting to activate a plugin, load dynamic libraries first.
  Add test creating multiple plugins with load dependencies.
2020-12-01 14:51:49 +00:00
Tim Wojtulewicz
616d29c08d Merge remote-tracking branch 'origin/topic/bbannier/debug_logger_lookup'
* origin/topic/bbannier/debug_logger_lookup:
  Find correct zeek namespace in debug logger macros.
2020-11-30 14:07:56 -07:00
Johanna Amann
f55bd8ebb4 Merge remote-tracking branch 'origin/topic/jsiwek/python2-eol'
* origin/topic/jsiwek/python2-eol:
  Update CentOS CI Dockerfiles to fix git/diff dependencies
  Update CI scripts to remove `python` vs `python3` workarounds
  Remove Python 2 compatibility logic in httpd test script
  Update Python invocations to explicit `python3`
  Update CMake logic to enforce Python >= 3.5
  Update documentation for Python >= 3.5 requirement
  Update all submodules that have Python 2 EOL changes
2020-11-26 18:17:54 +00:00
Jon Siwek
499cb11dc3 Merge remote-tracking branch 'origin/topic/christian/libdir-improvements'
* origin/topic/christian/libdir-improvements:
  Update CMakeLists.txt to make portability symlink absolute
  Improve support for custom libdir locations
2020-11-24 15:24:14 -08:00
Jon Siwek
f70a7cb4d3 Merge remote-tracking branch 'origin/topic/timw/internal-type-symbols'
* origin/topic/timw/internal-type-symbols:
  Move implementation of internal_{type,var,etc} methods back into global namespace.
2020-11-23 21:50:47 -08:00
Jon Siwek
08c8b741a9 Merge remote-tracking branch 'origin/topic/neverlord/ubuntu-16-image'
* origin/topic/neverlord/ubuntu-16-image:
  Simplify CI dependencies and setup
2020-11-23 21:41:55 -08:00
Jon Siwek
8d0f2f9ab7 Merge remote-tracking branch 'origin/topic/timw/fix-email-regex'
* origin/topic/timw/fix-email-regex:
  Reverts the regex change in dead3226a5.
2020-11-19 18:09:47 -08:00
Tim Wojtulewicz
a56fbe408f Merge remote-tracking branch 'christina23/master'
* christina23/master:
  Added unit tests for regex fix
  Improved regex for SMTP parsing
2020-11-17 15:01:21 -07:00
Jon Siwek
824ff81bf6 Merge remote-tracking branch 'origin/topic/johanna/1033'
- Fixed signed/unsigned comparison compiler warning
- Did other minor changes to address efficiency nitpicks

* origin/topic/johanna/1033:
  BrokerStore <-> Zeek Tables: support complex indices
2020-11-17 13:34:26 -08:00
Johanna Amann
995d889789 Merge remote-tracking branch 'origin/topic/jsiwek/fix-ConnectionEvent-leak'
* origin/topic/jsiwek/fix-ConnectionEvent-leak:
  Fix memory leak in deprecated Analyzer::ConnectionEvent()
2020-11-17 11:51:27 +00:00
Jon Siwek
6ed4850a26 Merge remote-tracking branch 'origin/topic/jsiwek/gh-352-improve-sql-injection-regex' into master
* origin/topic/jsiwek/gh-352-improve-sql-injection-regex:
  GH-352: Improve HTTP::match_sql_injection_uri regex
2020-11-16 11:51:04 -08:00
Jon Siwek
02c0b33b54 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1264-ssh-host-key-fingerprints' into master
* origin/topic/jsiwek/gh-1264-ssh-host-key-fingerprints:
  Simply ssh/main.zeek by using "ssh_server_host_key" for fingerprinting
  Deprecate "ssh1_server_host_key" parameters *e* and *p*
  GH-1264: Implement "ssh_server_host_key" event
2020-11-16 11:22:37 -08:00
Johanna Amann
50a49eabb5 Merge branch 'topic/vbrevet/ssh_version' of https://github.com/vbrevet/zeek
* 'topic/vbrevet/ssh_version' of https://github.com/vbrevet/zeek:
  [SSH] Handle SSH version 1.99 SSH can set in its identification a version 1.99 (SSH-1.99-xxx). That means the client/server is compatible with SSHv1 and SSHv2. So the version choice depends of the both side.
2020-11-16 11:05:30 +00:00
Jon Siwek
fc114069b0 Merge remote-tracking branch 'origin/topic/jsiwek/unknown-protocol-options'
* origin/topic/jsiwek/unknown-protocol-options:
  Move UnknownProtocol options to init-bare.zeek
  Coverity 1436183: Initialize packet_analysis::Manager fields
2020-11-12 14:35:01 -08:00
Tim Wojtulewicz
c10bcc7116 Merge remote-tracking branch 'origin/topic/timw/1079-zeek-includes'
* origin/topic/timw/1079-zeek-includes:
  Move 'using namespace' declaration after other includes
  Use binpac.h as if it was an external dependency
  Fix includes of bif.h and _pac.h files to use full paths inside build directory
  Remove unnecessary include of NetVar.h from packet analysis plugins
  GH-1079: Use full paths starting with zeek/ when including files
2020-11-12 12:16:34 -07:00
Tim Wojtulewicz
a6a4b976ec Support for additional DNS RR Type: LOC[29], SSHFP[44], NSEC3PARAM[51], custom BIND9 signaling[65534] 2020-11-11 13:35:51 -07:00
Tim Wojtulewicz
8722118935 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1269'
* origin/topic/jsiwek/gh-1269:
  GH-1269: Fix LogAscii::enable_leftover_log_rotation crash in bad dirs
2020-11-10 14:06:10 -07:00
Tim Wojtulewicz
2e57f8487b Merge remote-tracking branch 'origin/topic/jsiwek/ci-debian-10-gcc'
* origin/topic/jsiwek/ci-debian-10-gcc:
  Change Debian 10 CI config to use GCC
2020-11-10 13:55:53 -07:00
Tim Wojtulewicz
ad46a8b717 Merge remote-tracking branch 'origin/topic/timw/1221-unknown-protocols'
* origin/topic/timw/1221-unknown-protocols:
  GH-1221: Add unknown_protocols.log for logging packet analyzer lookup failures
  Remove default_analyzer for Ethernet packet analzyer
2020-11-10 08:42:26 -07:00
Jon Siwek
721b232d94 Merge remote-tracking branch 'origin/topic/christian/ci-refresh'
* origin/topic/christian/ci-refresh:
  Add CI support for Debian 10, Fedora 31 & 33, FreeBSD 11, Ubuntu 20.04
2020-11-09 16:28:05 -08:00
Tim Wojtulewicz
9fc4f6c2fa Merge remote-tracking branch 'origin/topic/timw/1186-pkt-hdr-size'
* origin/topic/timw/1186-pkt-hdr-size:
  Remove now-unused Packet::l2_valid field
  GH-1186: Remove Packet::hdr_size and uses of it.
2020-11-09 10:56:22 -07:00
Jon Siwek
8337b4cf2d Merge remote-tracking branch 'origin/topic/jsiwek/rename-files-with-colons' into master
* origin/topic/jsiwek/rename-files-with-colons:
  GH-1252: rename files with colons for Windows compatibility
2020-11-04 10:42:22 -08:00
Tim Wojtulewicz
43f7b3beab Merge remote-tracking branch 'origin/topic/timw/1215-analyzer-registration'
* origin/topic/timw/1215-analyzer-registration:
  GH-1215: Remove dispatch_map from packet analysis, replace with BIF methods for registering dispatches
2020-11-02 12:04:05 -07:00
Jon Siwek
95fd2382bc Merge remote-tracking branch 'origin/topic/timw/1256-strerror'
* origin/topic/timw/1256-strerror:
  GH-1256: Write out strerror when writing errno during safe_write
2020-11-02 09:51:27 -08:00
Duffy O'Craven
b32eba579d updated to mention notice_alarm.log by name. That has taken the place of the file formerly named alarm.log 2020-10-27 13:56:30 -07:00
Tim Wojtulewicz
008cdef712 Merge remote-tracking branch 'origin/topic/jsiwek/better-zeekygen-redef-info'
* origin/topic/jsiwek/better-zeekygen-redef-info:
  Improve how Zeekygen generated record/enum redefinition docs
2020-10-26 11:04:17 -07:00
Tim Wojtulewicz
75caf60990 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1245-tld-validity'
* origin/topic/jsiwek/gh-1245-tld-validity:
  GH-1245: require TLD of hostname literals to start with a letter
2020-10-26 10:42:15 -07:00
Tim Wojtulewicz
5ee06d8535 Merge remote-tracking branch 'origin/topic/timw/1116-coveralls'
* origin/topic/timw/1116-coveralls:
  Add coveralls badge to README.md
  Remove the entire auxil directory from the results
  Prevent non-master builds, add cirrus information to upload
  Add support for sending data to coveralls with lcov_html.sh via Cirrus
2020-10-23 14:48:15 -07:00
Jon Siwek
06191390c3 Merge remote-tracking branch 'origin/topic/jsiwek/gh-251-revert-absolute-value-coercion'
* origin/topic/jsiwek/gh-251-revert-absolute-value-coercion:
  GH-251 (revert): remove coercion-to-signed-integer for |x| expressions
2020-10-23 12:26:07 -07:00
Seth Hall
22ef67888c Merge branch 'topic/seth/more-ignore-checksum-options'
* topic/seth/more-ignore-checksum-options:
  Fixing how I define const on the Contains method.
  Screwed up a change.
  Changes in response to Johanna's code review.
  Fixed a bug with ICMP checksum validation
  Fixing a test
  Accidentally missed a change.
  Add an option to ignore packets sourced from particular subnets.
2020-10-22 16:01:34 -04:00
Tim Wojtulewicz
e70f578621 Merge remote-tracking branch 'origin/topic/timw/coverity'
* origin/topic/timw/coverity:
  Fix a couple of Coverity findings (1433618, 1433619)
2020-10-21 11:06:39 -07:00
Robin Sommer
fc427035a4 Bump BTest to 0.64.
Previous version had a problem with canonification.
2020-10-20 14:03:00 +00:00
Robin Sommer
df48b7ea57 Update BTest to 0.63.
New baselines will now be store canonified.

Also setting new MinVersion option in btest.cfg.
2020-10-20 09:01:11 +00:00
Jon Siwek
924a24ad2b Merge remote-tracking branch 'origin/topic/timw/packet-length-checks' into master
* origin/topic/timw/packet-length-checks:
  Add length checks for IP header values before parsing TCP/UDP
2020-10-19 18:58:19 -07:00
Jon Siwek
66eaf9c7cc Merge remote-tracking branch 'origin/topic/jsiwek/pop3-fuzzer-deprecation-warning' into master
* origin/topic/jsiwek/pop3-fuzzer-deprecation-warning:
  Fix deprecation warning in POP3 fuzzer
2020-10-19 11:54:40 -07:00
Jon Siwek
0cc1fc3d88 Merge remote-tracking branch 'origin/topic/jsiwek/avoid-memcmp-null-args'
* origin/topic/jsiwek/avoid-memcmp-null-args:
  Avoid passing null pointers to memcmp in ZeekString comparison methods
2020-10-16 12:42:07 -07:00
Jon Siwek
5e164469f3 Merge remote-tracking branch 'origin/topic/vlad/gh-1225'
* origin/topic/vlad/gh-1225:
  Extract length as a uint8
  Change ICMP ND length to a uint16
2020-10-16 10:37:08 -07:00
Johanna Amann
65125121d8 Merge branch 'topic/johanna/GH-169'
* topic/johanna/GH-169:
  Make event ordering deterministic
  dump-events: try to make baseline work on all systems
  Introduce generate_all_events bif and add option to misc/dump-events

Fixes GH-169
2020-10-16 07:11:57 +00:00
Tim Wojtulewicz
a9d86cec8b Merge remote-tracking branch 'origin/topic/timw/1131-ip-handling'
* origin/topic/timw/1131-ip-handling:
  Rework Sessions::Weird
  Prevent String::Set from crashing if passed a nullptr
  Store packet's ip header as unique_ptr
  Remove some unused includes from Packet.h
  Use shared_ptr for encapsulation data instead of raw pointer
  Review cleanup
  Update external testing repo hashes
  Reorder Packet member variables slightly for better packing
  Store the ip header in the packet after processing, reuse other places
  Change to store data in packet directly instead of keystore
  Don't always insert data into keystore for tunnels
  Add comment about packet header size and session analysis
  Set data to ip header's payload instead of advancing the pointer
  Move packet dumping to packet_mgr
  Make Sessions::NextPacket call packet_mgr, fix fuzzer code to do the same
  Move IP and IP tunnel code from Sessions into packet analyzers
  Prep work for IP changes
2020-10-15 13:25:51 -07:00
Jon Siwek
5f1ee35d31 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1211-improve-already-defined-error' into master
* origin/topic/jsiwek/gh-1211-improve-already-defined-error:
  GH-1211: Improve error message for already-defined functions
2020-10-14 10:48:05 -07:00
Jon Siwek
92cc798dd5 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1208-dict-asserts'
* origin/topic/jsiwek/gh-1208-dict-asserts:
  GH-1208: Use Dictionary validity assertions only during CI
2020-10-13 16:26:38 -07:00
Jon Siwek
6cb0cb9746 Merge remote-tracking branch 'origin/topic/seth/make-cluster-port-optional'
* origin/topic/seth/make-cluster-port-optional:
  Apply suggestions from code review
  Update scripts/base/frameworks/cluster/main.zeek
  Make defining a port number for hosts in a cluster that only connect outbound optional
2020-10-13 15:35:43 -07:00
Tim Wojtulewicz
3f25214914 Merge remote-tracking branch 'origin/topic/timw/1063-kqueue-update'
* origin/topic/timw/1063-kqueue-update:
  Update cmake submodule to pull in fix for building libkqueue
  GH-1063: Update libkqueue to fix pf_ring-zc failures
2020-10-13 13:49:38 -07:00
Jon Siwek
a90d978cd4 Merge remote-tracking branch 'origin/topic/timw/remove-loginconn'
* origin/topic/timw/remove-loginconn:
  Remove unused LoginConn type and variable in Conn.h
2020-10-13 13:42:01 -07:00
Jon Siwek
d62fb3ab9a Merge remote-tracking branch 'origin/topic/jsiwek/zeek-script-args'
* origin/topic/jsiwek/zeek-script-args:
  Improve zeek_script_args test case and documentation
  Apply suggestions from code review
  Add a test for script args.
  Fixed an option processing bug
  Make it possible to pass command line options through to scripts.
2020-10-13 13:34:18 -07:00
Jon Siwek
961532a8f7 Merge remote-tracking branch 'origin/topic/seth/pcap_findalldevs'
- Minor adjustments to whitespace/formatting

* origin/topic/seth/pcap_findalldevs:
  Finishing changes from code review.
  Update src/iosource/pcap/pcap.bif
  Update src/iosource/pcap/pcap.bif
  Update scripts/base/init-bare.zeek
  Update src/iosource/pcap/pcap.bif
  I accidentally missed a paren
  New bif to wrap pcap_findalldevs
2020-10-13 10:52:14 -07:00
Jon Siwek
d827e8b2d2 Improve documentation for zeek_init event scheduling pitfalls 2020-10-12 17:45:24 -07:00
Jon Siwek
86e10bfb7e Merge remote-tracking branch 'origin/topic/vlad/caploss_no_traffic'
- Tweaked the Too_Little_Traffic notice message to avoid
  cluster-specific terminology.

* origin/topic/vlad/caploss_no_traffic:
  Fix scheduling due to network_time being 0 in zeek_init
  Add test for CaptureLoss::Too_Little_Traffic
  Add CaptureLoss::Too_Little_Traffic
  Add CaptureLoss::initial_watch_interval for a quick read on cluster health after startup.
  Documentation update, reference the threshold variable. [nomail] [skip ci]
  Whitespace fixes only [nomail] [skip ci]
2020-10-12 17:05:05 -07:00