Commit graph

1952 commits

Author SHA1 Message Date
Tim Wojtulewicz
e6cf7413f9 Merge remote-tracking branch 'origin/topic/timw/hardware-checksum'
* origin/topic/timw/hardware-checksum:
  Cleanup in iosource/Packet
  Add ability for packet sources to flag a packet's l2 or l3 checksum as valid.
2020-03-17 16:55:19 -07:00
Jon Siwek
acb3b27a2c Merge branch 'master' of https://github.com/shirkdog/zeek
* 'master' of https://github.com/shirkdog/zeek:
  Duplicate smb2_negotiate_response events defined.
2020-03-16 12:38:27 -07:00
Jon Siwek
e5e4fd6af6 Add branch whitelist for CI notifications 2020-03-13 13:41:46 -07:00
Johanna Amann
da5fca7163 Merge branch 'topic/johanna/gh-744-cache-the-heck-out-of-these-certs'
* topic/johanna/gh-744-cache-the-heck-out-of-these-certs:
  X509 caching API change: callback gets entry directly
  Address feedback
  Small default updates & external baselines.
  X509 caching: small API changes, tests & test updates
  Certificate caching - now working in principle.
  First (sadly not completely working) approach at caching X509 certificates
2020-03-12 13:44:07 -07:00
Jon Siwek
860f851a66 Update pointer to external test repo 2020-03-12 12:04:24 -07:00
Jon Siwek
b811f7cee3 Fix whitespace in connection record comments 2020-03-11 16:40:20 -07:00
Jon Siwek
26af1f55af Merge remote-tracking branch 'origin/topic/vladg/gh-843'
Added a comment to clarify comparison of EOF packet length to 13.

* origin/topic/vladg/gh-843:
  Update baselines
  Made additional MySQL fixes.
  Add support to MySQL for deprecation of EOF packets.
  Whitespace cleanup & fixes
  Fix EOF detection in the MySQL protocol analyzer.
2020-03-11 11:25:00 -07:00
Tim Wojtulewicz
b2a707a7bf Merge remote-tracking branch 'origin/topic/jsiwek/coverity-gh-action'
* origin/topic/jsiwek/coverity-gh-action:
  Stop running GitHub Actions in forked repos
  Remove Travis CI configuration
  Add GitHub Action for Coverity Scan
2020-03-09 13:36:08 -07:00
Jon Siwek
c5feccb8f6 Merge remote-tracking branch 'origin/topic/timw/urgent-flag'
* origin/topic/timw/urgent-flag:
  Add urgent flag to tcp_flags documentation
2020-03-06 16:33:24 -08:00
Johanna Amann
0c44c3135c Merge remote-tracking branch 'origin/topic/jsiwek/gh-836-move-3rdparties-up'
* origin/topic/jsiwek/gh-836-move-3rdparties-up:
  Move libkqueue submodule to the aux directory
  Move rapidjson submodule to aux directory
2020-03-06 07:59:59 -08:00
Jon Siwek
363fc49518 Fix a btest to order zeek_init() events via &priority 2020-03-05 14:19:34 -08:00
Jon Siwek
30a794cf5f Merge branch 'queue_lock' of https://github.com/MaxKellermann/zeek
* 'queue_lock' of https://github.com/MaxKellermann/zeek:
  threading/Queue: lock mutex before notifying the condition_variable
2020-02-28 11:39:10 -08:00
Jon Siwek
cf196bb148 Merge branch 'leaks' of https://github.com/MaxKellermann/zeek
Only one instance of base_type() getting a NewRef instead of AdoptRef
fixed in merge.  All other changes are superficial formatting and
factoring.

* 'leaks' of https://github.com/MaxKellermann/zeek: (22 commits)
  Stmt: use class IntrusivePtr
  Stmt: remove unused default constructors and `friend` declarations
  Val: remove unimplemented prototype recover_val()
  Val: cast_value_to_type() returns IntrusivePtr
  Val: use IntrusivePtr in check_and_promote()
  Val: use nullptr instead of 0
  zeekygen: use class IntrusivePtr
  ID: use class IntrusivePtr
  Expr: use class IntrusivePtr
  Var: copy Location to stack, to fix use-after-free crash bug
  Scope: lookup_ID() and install_ID() return IntrusivePtr<ID>
  Scope: delete duplicate locals
  EventRegistry: automatically delete EventHandlers
  main: destroy event_registry after iosource_mgr
  zeekygen/IdentifierInfo: delete duplicate fields
  main: free the global scope in terminate_bro()
  Scope: pop_scope() returns IntrusivePtr<>
  Scope: unref all inits in destructor
  Var: pass IntrusivePtr to add_global(), add_local() etc.
  plugin/ComponentManager: hold a reference to the EnumType
  ...
2020-02-28 00:48:20 -08:00
Jon Siwek
646a2313ae Merge remote-tracking branch 'origin/topic/timw/cleanup'
* origin/topic/timw/cleanup:
  Expr: use fmt instead of sprintf
  Expr: other minor initialization cleanup
  Expr: use List::empty()
  Expr: Convert a bunch of methods returning ints to return bools
  IPAddr: minor cleanup
  PriorityQueue: initialization cleanup
  IP: Cleanup initialization, make a few functions consistent with others
2020-02-27 14:25:37 -08:00
Jon Siwek
36557f3086 Merge remote-tracking branch 'origin/topic/johanna/global_frame_stack'
Additionally changed to pop call_stack which tracks related data.

* origin/topic/johanna/global_frame_stack:
  Pop global frame stack on exception.
2020-02-26 19:56:52 -08:00
Jon Siwek
597407a708 Merge branch 'refactor' of https://github.com/MaxKellermann/zeek
- Minor code style/format tweaks in merge

* 'refactor' of https://github.com/MaxKellermann/zeek:
  IntrusivePtr: overload std::swap()
  IntrusivePtr: eliminate setPtr()
  IntrusivePtr: optimize release() using std::exchange()
  Expr: remove unused default constructors and `friend` declarations
  Expr: remove useless override
  Type: don't pass reference to pointer to MatchesIndex()
  Expr: don't pass reference to pointer to check_and_promote*()
  ID: remove unused default constructor
  Scope: simplify PList access, use pop_back() and back()
  List: add method empty()
2020-02-26 10:07:31 -08:00
Jon Siwek
502a0db96b Merge branch 'double_free' of https://github.com/MaxKellermann/zeek
* 'double_free' of https://github.com/MaxKellermann/zeek:
  Type: fix double free bug in SetType::ShallowClone()
2020-02-26 09:40:37 -08:00
Jon Siwek
84e3e6c619 Merge remote-tracking branch 'origin/topic/timw/faster-hashing'
- Minor cleanups in siphash24.h (code style, header include)
- Updated COPYING.3rdparty with new license info

* origin/topic/timw/faster-hashing:
  Add a faster siphash24 implementation than the reference one
2020-02-25 19:56:17 -08:00
Jon Siwek
5a6799dd34 Update submodules 2020-02-25 19:29:06 -08:00
Jon Siwek
4c7b1fa619 Merge branch 'leaks' of https://github.com/MaxKellermann/zeek
- Various minor code formatting/styling during the merge

* 'leaks' of https://github.com/MaxKellermann/zeek:
  parse.y: fix memory leak in FieldAssignExpr call
  parse.y: fix use-after-free bug in open-ended index_slice
  Type: fix use-after-free bug in init_type()
  Expr: fix memory leak in RecordCoerceExpr::Fold()
  Expr: fix memory leak in RecordCoerceExpr::InitVal()
  zeekygen/IdentifierInfo: fix memory leak in operator=()
  Func: fix memory leaks in get_func_priority()
  parse.y: fix several memory leaks after lookup_ID()
  Func: fix memory leaks in check_built_in_call()
  Var: fix memory leaks in add_global() and add_local()
  Var: add missing references to `init` in add{,_and_assign}_local()
  parse.y: hold reference on init_expr for zeekygen::Manager::Redef()
  Expr: fix two memory leaks in AssignExpr::InitVal()
  parse.y: fix memory leak after "&derepcated" without string
  RuleMatcher: delete PatternSet instances in destructor (memleak)
  option.bif: fix crash bug by referencing `Func`, not `Val`
2020-02-24 20:51:31 -08:00
Jon Siwek
a15f471a87 Update zeek-testing commit 2020-02-24 18:13:17 -08:00
Jon Siwek
1f4dca04d4 Merge branch 'ExpandAndInit_IntrusivePtr' of https://github.com/MaxKellermann/zeek
- Minor whitespace tweak in merge

* 'ExpandAndInit_IntrusivePtr' of https://github.com/MaxKellermann/zeek:
  Val: pass IntrusivePtr<> to TableVal::ExpandAndInit()
2020-02-24 18:12:58 -08:00
Tim Wojtulewicz
01df20c782 Merge remote-tracking branch 'origin/topic/jsiwek/deprecated-attribute'
* origin/topic/jsiwek/deprecated-attribute:
  Switch to using [[deprecated]] attribute
2020-02-24 18:53:37 -07:00
Tim Wojtulewicz
822567b3f9 Merge remote-tracking branch 'origin/topic/jsiwek/32bit-compat'
* origin/topic/jsiwek/32bit-compat:
  Improve formatting of doubles that are close to integers
  Improve HTTP version number comparisons
  Add a 32-bit task to Cirrus CI config
  Replace va_list fmt() overload with vfmt()
  Format tables indexed by patterns consistently across 32-bit/64-bit
  Format interval values consistently across 32-bit/64-bit platforms
2020-02-24 18:49:33 -07:00
Jon Siwek
15b4eeb085 Merge branch 'opaqueval_intrusiveptr' of https://github.com/MaxKellermann/zeek
- Minor whitespace changes during merge.

* 'opaqueval_intrusiveptr' of https://github.com/MaxKellermann/zeek:
  OpaqueVal: use class IntrusivePtr
2020-02-24 17:25:03 -08:00
Jon Siwek
e0da9fbe82 Merge branch 'scanned-file-device-and-inode' of https://github.com/awelzel/zeek
- Minor whitespace adjustments
- Converted std::pair usage to anonymous struct to improve readability

* 'scanned-file-device-and-inode' of https://github.com/awelzel/zeek:
  scan.l: Actually add <utility> include, too.
  ScannedFile: Identify already scanned files by device and inode
2020-02-24 17:09:30 -08:00
Jon Siwek
43ade7ea4a Update a URL in CI README 2020-02-21 21:24:31 -08:00
Jon Siwek
f0c713046c Merge branch 'refactor_obj' of https://github.com/MaxKellermann/zeek
Minor formatting/style changes in merge.

* 'refactor_obj' of https://github.com/MaxKellermann/zeek:
  Val: use C++ initializers
  Val: add BroValUnion constructors
  Val: reduce duplicate code by using delegating constructors
  Val: remove unused default constructors and `friend` declarations
  Val: remove the unnecessary BroValUnion typedef
  Type: remove unnecessary enum typedefs
  Type: use C++ initializers
  Type: move code from BroType::BroType() to constexpr functions
  Type: remove useless BroType destructor
  Obj: disallow copying BroObj
  Obj: use C++ initializers
  Obj: make `no_location` constexpr
2020-02-21 20:06:09 -08:00
Jon Siwek
3996a54302 Merge branch 'noreturn' of https://github.com/MaxKellermann/zeek
Minor formatting change in merge so [[noreturn]] is consistently
on same line as function declarations.

* 'noreturn' of https://github.com/MaxKellermann/zeek:
  threading/MsgThread: add [[noreturn]] to InternalError()
  Flare: add [[noreturn]] to bad_pipe_op()
  Obj: add [[noreturn]] attributes to Internal(),  bad_ref()
  Reporter: add [[noreturn]] attribute to several methods
2020-02-21 15:37:33 -08:00
Jon Siwek
38b25cf38d Merge branch 'smart_ptr' of https://github.com/MaxKellermann/zeek
Minor whitespace fixes during merge.

* 'smart_ptr' of https://github.com/MaxKellermann/zeek:
  OpaqueVal: remove misplaced `virtual` keywords
  CompHash: use class IntrusivePtr for the `type` field
  IntrusivePtr: replace the "add_ref" parameter with tag structs
  IntrusivePtr: remove reset(), nobody uses it
  IntrusivePtr: remove ordering operators
  IntrusivePtr: rename detach() to release()
  IntrusivePtr: move nullptr initializer to field declaration
2020-02-21 10:15:24 -08:00
Jon Siwek
678115803b Merge branch 'expr_missing_ref' of https://github.com/MaxKellermann/zeek
Updated the Ref() to happen inline with Assign() call for clarity.

* 'expr_missing_ref' of https://github.com/MaxKellermann/zeek:
  Expr: add missing reference in AssignExpr::InitVal()
2020-02-20 14:59:04 -08:00
Jon Siwek
a20dd12117 Merge branch 'memleaks' of https://github.com/MaxKellermann/zeek
The merge commit fixes reference counting issues introduced with the
changes to ListExpr::Assign() and IndexExpr::Assign(), but then also
several other pre-existing reference counting confusions in other
Assign() implementations/calls, some which were now directly observable
via new crashing behavior, others just from a cursory code audit.

* 'memleaks' of https://github.com/MaxKellermann/zeek:
  input/Manager: fix memory leak in UnrollRecordType()
  OpaqueVal: fix two memory leaks in BloomFilterVal::Merge()
  DbgBreakpoint: fix memory leak
  DebugCmds: fix memory leak
  scan.l: fix crash bug in do_atif()
  Expr: fix memory leak in RecordConstructorExpr::InitVal()
  Expr: fix memory leaks in AssignExpr::EvalIntoAggregate()
  Expr: fix memory leaks in CondExpr::Eval()
  Expr: fix several memory leaks in BoolExpr::Eval()
  Expr: fix various memory leaks in Assign()
  Expr: fix memory leaks in BinaryExpr::Eval()
  analyzer/protocol/http: fix potential memory leak
2020-02-19 18:59:04 -08:00
Jon Siwek
b8497c8245 Merge branch 'dns_memleak' of https://github.com/MaxKellermann/zeek
* 'dns_memleak' of https://github.com/MaxKellermann/zeek:
  analyzer/protocol/dns: fix NSEC3 memory leak
  analyzer/protocol/dns: change runtime check to assert()
  analyzer/protocol/dns: fix memory leak
2020-02-18 12:21:17 -08:00
Jon Siwek
11d8b8c040 Fix code format of various reporter btests 2020-02-14 22:03:11 -08:00
Jon Siwek
e896846752 Update libkqueue for a linux bugfix 2020-02-14 21:15:21 -08:00
Tim Wojtulewicz
47d813badc Merge remote-tracking branch 'MaxKellermann/eliminate_code
* MaxKellermann/eliminate_code:
  RE: make the RE_Matcher destructor non-virtual
  analyzer/protocol/smtp: remove unnecessary nullptr check
  analyzer/Manager: remove unnecessary clear() calls from destructor
  analyzer/protocol/http: remove unnecessary empty destructor
  iosource/pcap/Source: remove unused fields `last_hdr`, `last_data`
  iosource/Manager: eliminate two std::string copies
2020-02-14 16:17:31 -07:00
Jon Siwek
b1e96ab952 Fix various format specifiers 2020-02-14 11:10:41 -08:00
Tim Wojtulewicz
cf8496dc0a Merge remote-tracking branch 'MaxKellermann/includes'
* MaxKellermann/includes:
  broker: include cleanup
  file_analysis: include cleanup
  file_analysis/Analyzer: eliminate duplicate constructor
  probabilistic/Topk: include cleanup
  digest: eliminate the "Reporter.h" include
  Val: eliminate the "RE.h" include
  Val: eliminate the "BroString.h" include
  Val: eliminate the "CompHash.h" include
  Val: forward-declare class PDict, reduce includes
  Val: eliminate the "Scope.h" include
2020-02-14 10:30:13 -07:00
Jon Siwek
a5166086db Merge remote-tracking branch 'origin/topic/timw/dict-unit-tests'
* origin/topic/timw/dict-unit-tests:
  Reset the number of entries in a dict when calling Clear()
  Code cleanup in Dict.h
  Add unit testing for the public Dictionary API
2020-02-13 19:34:29 -08:00
Jon Siwek
33c13c3689 Merge remote-tracking branch 'origin/topic/timw/event-mgr-coverity'
* origin/topic/timw/event-mgr-coverity:
  Check for failure when registering event manager with iosource manager (Coverity 1419398)
2020-02-13 17:15:00 -08:00
Jon Siwek
20eb0e15c7 Updating CHANGES and VERSION. 2020-02-12 00:20:08 -08:00
Jon Siwek
2fb9753cc5 Merge remote-tracking branch 'origin/topic/timw/clang-tidy'
* origin/topic/timw/clang-tidy:
  fixup! Use string_view for a couple of Dbg methods
  Add a couple of missing #includes that clang-tidy complains about (clang-diagnostic-error)
  Fix missing namespace that was causing a build error
  Remove unnecessary const from return value (readability-const-return-type)
  Give real variable names to SegmentProfiler objects when defining them (bugprone-unused-raii)
  Mark a few clang-tidy findings as false-positive
  Use std::move in a few places instead of copying a pass-by-value argument (performance-unnecessary-value-param)
  Use const-references in lots of places (preformance-unnecessary-value-param)
  Use string_view for a couple of Dbg methods
  Use const references over copying variables (performance-unnecessary-copy-initialization, performance-for-range-copy)
  Use single-character version of string find() (performance-faster-string-find)
  Move constructors/operators should be marked noexcept to avoid the compiler picking the copy constructor instead (performance-noexcept-move-constructor)
2020-02-11 23:51:40 -08:00
Jon Siwek
da34c94ae3 Update Broker submodule 2020-02-08 16:20:44 -08:00
Jon Siwek
996b3d523a Update to start of 3.2.0 development 2020-02-08 16:08:01 -08:00
Jon Siwek
0c771ea123 Fix broken links in documentation 2020-02-08 15:48:11 -08:00
Jon Siwek
bb876623af Update submodules to release versions 2020-02-08 12:44:57 -08:00
Jon Siwek
b268b57194 Update embedded CAF to 0.17.4 2020-02-08 09:40:48 -08:00
Jon Siwek
6c72b09bf5 Note new CMake 3.0+ and C++17 requirements in NEWS 2020-02-07 21:11:35 -08:00
Jon Siwek
e50a8848ae Improve an input framework test
A race condition could cause unstable output: if the thread reading the
file is fast, often you see both "pred" functions execute and then both
"line" events execute with both entries already in the table, but if the
thread reading the file is slow, you see pred, event, pred, event, with
only one entry available in the first event.
2020-02-07 20:03:10 -08:00
Jon Siwek
a3b1d202a5 Improve stability of a &expire_func btest
The order in which &expire_func's get called isn't well-defined, so
separate the output from either to ensure diffs against the Baseline are
always consistent.
2020-02-07 15:11:06 -08:00