Commit graph

1952 commits

Author SHA1 Message Date
Jon Siwek
b73cc816e9 Merge remote-tracking branch 'origin/topic/jsiwek/gh-779-udp-state-sig'
* origin/topic/jsiwek/gh-779-udp-state-sig:
  GH-779: Add "udp-state" signature condition
  Rename RuleConditionTCPState::TCPState enum values
  Rename signature parser tokens to not be TCP-specific
2020-10-12 11:16:54 -07:00
Jon Siwek
b3c5e9adbb Merge remote-tracking branch 'origin/topic/jsiwek/gh-1200'
* origin/topic/jsiwek/gh-1200:
  GH-1200: ignore a maybe-uninitialized warning
2020-10-08 12:07:58 -07:00
Jon Siwek
6902b645ba Merge: Fix multipart MIME leak of sub-part found after closing-boundary 2020-10-07 10:46:51 -07:00
Jon Siwek
f9f6140c15 Merge remote-tracking branch 'origin/topic/robin/gh-425-record-perf'
- Removed a now-unused-local-variable
- Added std::move() in AssignExpr::SetOp2()

* origin/topic/robin/gh-425-record-perf:
  Avoid unnecessary temporary value when coercing a record that's already the right type.
  Optimize record constructor expression.
  Unify type comparisions for records.
2020-10-06 12:25:39 -07:00
Jon Siwek
506d961b27 Merge branch 'logging-ascii-enable-shadow-logs' of https://github.com/awelzel/zeek into master
- Improved documentation/comment for the new option

* 'logging-ascii-enable-shadow-logs' of https://github.com/awelzel/zeek:
  logging/ascii: Support leftover log rotation in non-supervisor setups
2020-10-06 10:15:34 -07:00
Jon Siwek
a2577891e0 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1180-include-external-headers'
* origin/topic/jsiwek/gh-1180-include-external-headers:
  Add external dependency include paths to `zeek-config --include_dir`
2020-10-02 10:50:14 -07:00
Jon Siwek
a87281a1d9 Merge remote-tracking branch 'origin/topic/jsiwek/improve-checksum'
* origin/topic/jsiwek/improve-checksum:
  Switch one's complement checksum implementation
2020-10-02 10:26:43 -07:00
Jon Siwek
c8545c85d8 Improve broker/ssl_auth_failure.zeek test
There was a race that previously may cause it to not truly test
whether the connecting-process exited due to SSL authentication
failure or just because the listening-process wasn't available yet
(e.g. due to process scheduling variability).
2020-09-29 17:12:03 -07:00
Jon Siwek
b065b6ed61 Merge remote-tracking branch 'origin/topic/robin/filtered-trace'
* origin/topic/robin/filtered-trace:
  Tweak find-filtered-trace to not flag traces if they have non-TCP traffic.
2020-09-25 15:12:04 -07:00
Jon Siwek
c1492942bb Merge branch 'add-dce-rpc-payloads' of https://github.com/ynadji/zeek
- Changed the new stub events to correctly check for existence of
  their associated handler before generating an event

- Added a test case for the new stub event

* 'add-dce-rpc-payloads' of https://github.com/ynadji/zeek:
  Add stub payload to dce_rpc_request and dce_rpc_response
2020-09-25 14:39:30 -07:00
Tim Wojtulewicz
8d856df305 Merge remote-tracking branch 'origin/topic/jsiwek/packet-analyzer-docs'
* origin/topic/jsiwek/packet-analyzer-docs:
  Fix a Sphinx warning about misformatted packet analyzer comment
  Add Zeekygen documentation support for packet analyzers
2020-09-24 16:03:58 -07:00
Jon Siwek
8feca7291b Merge remote-tracking branch 'origin/topic/jsiwek/gh-822-ubsan-ci'
* origin/topic/jsiwek/gh-822-ubsan-ci:
  Fix negative-value-left-shift undefined behavior in patricia trie
  Improve negation of ConstExpr
  Avoid signed integer overflow when combining SMB header PID bits
  Avoid unary negation of INT64_MIN in modp_litoa10
  Avoid double-to-int conversion overflows in modp_dtoa functions
  Fix divide-by-zero in Entropy analyzer
  Fix divide-by-zero in stats/profiling memory usage calculation
  Fix uninitialized field in POP3 fuzzer
  Add framework for running UndefinedBehaviorSanitizer in CI
2020-09-24 08:17:58 -07:00
Tim Wojtulewicz
68e20def1e Merge remote-tracking branch 'j-gras/llpoc'
* j-gras/llpoc: (43 commits)
  Update NEWS
  Fix build on FreeBSD, which was missing full definition of sockaddr for ARP
  Update hashes for external testing repos
  Fix handling of session analysis.
  Fix Sessions::DoNextPacket to ignore ARP packets and not report weirds for them
  Packet analysis cleanup.
  Minor cleanup
  Simplify packet analyzer config.
  Make default packet analyzer definition explicit.
  Add explicit root analyzer for packet analysis.
  Extend packet analysis test.
  Simplify MPLS analysis.
  Improve packet analysis data flow.
  Improve packet analyzer API.
  Rename DefaultAnalyzer to IP.
  Move ARP analysis into packet analyzer.
  Small cleanup of packet analysis.
  Fix some build issues from the rebase
  Remove encap_hdr_size (replaced by skip analyzer).
  Add skip analyzer test and update baselines.
  ...
2020-09-23 11:32:57 -07:00
Jon Siwek
f744d4c070 Improve fa_file/fa_metadata documentation
Related to https://github.com/zeek/zeek-docs/pull/38
2020-09-22 16:04:00 -07:00
Jon Siwek
01d83c3204 Avoid race condition in control/id_value btest 2020-09-22 14:11:17 -07:00
Jon Siwek
75b3ff7da4 Merge remote-tracking branch 'origin/topic/jsiwek/gh-927-when-condition-eval-order' into master
* origin/topic/jsiwek/gh-927-when-condition-eval-order:
  GH-927: Fix circumvention of evaluation order in 'when' conditions
2020-09-22 11:09:51 -07:00
Jon Siwek
ba5655fdfa Merge remote-tracking branch 'origin/topic/christian/ci-fedora-32' into master
* origin/topic/christian/ci-fedora-32:
  CI: Move to Fedora 32
2020-09-21 15:23:36 -07:00
Tim Wojtulewicz
6b93020c6f Merge remote-tracking branch 'origin/topic/jsiwek/gh-1164-fix-rst-conn-state'
* origin/topic/jsiwek/gh-1164-fix-rst-conn-state:
  GH-1164: Fix incorrect RSTOS0 conn_state determinations
2020-09-17 13:40:06 -07:00
Tim Wojtulewicz
3b641870dc Merge remote-tracking branch 'origin/topic/jsiwek/gh-1119-conn-removal-callbacks'
* origin/topic/jsiwek/gh-1119-conn-removal-callbacks:
  GH-1119: add base/protcols/conn/removal-hooks.zeek
  Avoid run-time cost of find-filtered-trace.zeek for live traffic
  Remove connection_successful and successful_connection_remove events
2020-09-17 13:16:19 -07:00
Tim Wojtulewicz
26808ea7d4 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1155-recursive-table-index-type-check'
* origin/topic/jsiwek/gh-1155-recursive-table-index-type-check:
  GH-1155: Recursively check table index for unsupported types
2020-09-17 11:42:57 -07:00
Tim Wojtulewicz
0cb39a5c31 Merge remote-tracking branch 'origin/topic/christian/1074-avoid-packed-member-warning'
* origin/topic/christian/1074-avoid-packed-member-warning:
  Avoid passing address of member in packed struct #1074
2020-09-17 11:25:15 -07:00
Jon Siwek
1046e45dba Improve notice/suppression-cluster btest to avoid race potential 2020-09-14 12:28:25 -07:00
Jon Siwek
5945aec7e8 Fix generate-docs Action to stage autogenerated script-reference files 2020-09-10 11:54:51 -07:00
Jon Siwek
b620ace06b Merge remote-tracking branch 'origin/topic/jsiwek/reporter-weird-sampling-api-tweaks'
* origin/topic/jsiwek/reporter-weird-sampling-api-tweaks:
  Improve Reporter weird-sampling-whitelist getters/setters
2020-09-09 10:47:16 -07:00
Jon Siwek
260895fcb1 Merge remote-tracking branch 'origin/topic/robin/gh-343-http-sigs'
* origin/topic/robin/gh-343-http-sigs:
  Change HTTP's DPD signatures so that each side can trigger the analyzer on its own.
2020-09-08 17:24:29 -07:00
Jon Siwek
991bbc961d Merge remote-tracking branch 'origin/topic/robin/gh-623-sampling'
- Merge adjustments:
  - Minor whitespace/style tweaks
  - Fixed portability of the btest due to differences in `uniq -c`
    output format

* origin/topic/robin/gh-623-sampling:
  Extend weird sampling with option to track selected weirds globally.
2020-09-08 17:06:40 -07:00
Jon Siwek
90f04c3d0a Merge remote-tracking branch 'origin/topic/jsiwek/exclude-installing-zeek-symlink'
* origin/topic/jsiwek/exclude-installing-zeek-symlink:
  Exclude installing "zeek -> ." include dir symlink
2020-09-04 18:30:38 -07:00
Jon Siwek
2a8de33c63 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1122'
* origin/topic/jsiwek/gh-1122:
  GH-165: Fix global initializations that indirectly use builtin types
  Improve how primary/top-level BIFs get initialized
  GH-1122: Allow initializing globals with calls to subdir BIFs
  GH-1122: Improve error for global record initialization exceptions
2020-09-04 17:24:50 -07:00
Jon Siwek
c7408482b4 Change a script comment to use "code-block" directive 2020-09-03 15:03:12 -07:00
Jon Siwek
48e2445600 Merge remote-tracking branch 'origin/topic/jsiwek/skip-ci-benchmark'
* origin/topic/jsiwek/skip-ci-benchmark:
  Improve CI benchmark script's error handling/messaging
2020-09-02 20:51:35 -07:00
Johanna Amann
425b6104c5 Merge remote-tracking branch 'origin/topic/jsiwek/gh-955-prohibit-typecasting-switch-fallthrough'
* origin/topic/jsiwek/gh-955-prohibit-typecasting-switch-fallthrough:
  GH-955: Prohibit `fallthrough` in typecasting `switch` cases

Closes GH-955
2020-09-02 11:49:28 -07:00
Jon Siwek
efcdacda98 Switch generate-docs action to daily schedule 2020-09-01 22:34:11 -07:00
Jon Siwek
7865e38134 Fix generate-docs action to not fail when there's no changes 2020-09-01 20:34:47 -07:00
Jon Siwek
d51e0f73b7 Update generate-docs action to use access token for submodule update 2020-09-01 19:50:44 -07:00
Jon Siwek
49de7199d7 Update generate-docs action to install Sphinx dependency 2020-09-01 18:38:24 -07:00
Jon Siwek
b064f097ee Add missing configure step for doc-generation action 2020-09-01 17:59:10 -07:00
Jon Siwek
d99c5aaf7d Improve documentation for rfind_str() 2020-09-01 17:54:44 -07:00
Jon Siwek
f6e48c3a18 Reformat strings.bif Zeekygen comments to fix Sphinx warnings 2020-09-01 11:58:52 -07:00
Jon Siwek
5e6bb843ab Merge remote-tracking branch 'origin/topic/timw/174-duplicate-attributes'
- Replaced "tag" with "attribute" in the error message since the former
  is not exactly the same concept/meaning and also not user-facing
  terminology

* origin/topic/timw/174-duplicate-attributes:
  Allow duplicate attributes in full redefs
  Short-circuit checking of whether attr exists
  Expanded check for other tag types, fixed btest to cover more tags
  GH-174: Add warning for duplicate attributes
2020-08-31 17:39:47 -07:00
Jon Siwek
5ab20dfcb9 Simplify a broker btest
The explicit sorting function definition was a temporary stability
workaround with a better fix now being available via
https://github.com/zeek/btest/pull/25
2020-08-31 15:01:23 -07:00
Johanna Amann
b8a47de26c Merge remote-tracking branch 'origin/topic/jsiwek/gh-926-ternary-type-checking'
* origin/topic/jsiwek/gh-926-ternary-type-checking:
  GH-926: Improve type-checking for ternary conditional operator

Fixes GH-926
2020-08-28 16:52:29 -07:00
Jon Siwek
dc9e175a61 Potentially improve intel/remove-item-cluster btest 2020-08-27 18:01:33 -07:00
Jon Siwek
5b25870c83 Merge remote-tracking branch 'origin/topic/timw/158-packet-filter-option'
* origin/topic/timw/158-packet-filter-option:
  GH-158: Ensure packet-filter framework is loaded if -f option is passed
2020-08-27 15:34:31 -07:00
Jon Siwek
cf63da7975 Merge remote-tracking branch 'origin/topic/vlad/gh-1145'
* origin/topic/vlad/gh-1145:
  Fix another umask issue. #1145

Fixes GH-1145
2020-08-27 11:15:00 -07:00
Jon Siwek
ff0aa6b050 Merge remote-tracking branch 'origin/topic/timw/rename-binpac_bro'
* origin/topic/timw/rename-binpac_bro:
  Rename bro-bif.h to zeek-bif.h
  Fix uses of bro.pac to use zeek.pac
  Rename the bro-related binpac files to zeek
2020-08-26 11:21:17 -07:00
Jon Siwek
b232474fce Merge remote-tracking branch 'origin/topic/vlad/gh-1145'
* origin/topic/vlad/gh-1145:
  Have mkdir in ensure_dir respect umask.
2020-08-26 11:00:38 -07:00
Jon Siwek
427a7de411 Merge remote-tracking branch 'origin/topic/timw/266-namespaces-part5'
- Did a few whitespace re-adjustments during merge

* origin/topic/timw/266-namespaces-part5:
  Update plugin btests for namespace changes
  Plugins: Clean up explicit uses of namespaces in places where they're not necessary.
  Base: Clean up explicit uses of namespaces in places where they're not necessary.
2020-08-25 19:51:42 -07:00
Jon Siwek
99d9a3a48c Fix closing timestamp of rotated log files in supervised-cluster mode 2020-08-25 17:06:10 -07:00
Jon Siwek
8d3c07b62a Improve an Intel framework btest
Relying on non-atomic `cp` operation may not cooperate well with the
Input framework file re-reading logic.
2020-08-25 14:36:52 -07:00
Jon Siwek
80a573d2b2 Merge remote-tracking branch 'origin/topic/timw/smith-waterman-iterators'
* origin/topic/timw/smith-waterman-iterators:
  Mark Continuation.h and PacketDumper.h as deprecated
  Remove vector iterator type aliases from SmithWaterman code, fix uses of them
2020-08-24 19:21:21 -07:00