Commit graph

3436 commits

Author SHA1 Message Date
Jon Siwek
efba91cd26 Merge branch 'topic/oakljon/gh-1352-smtp-header-parsing' of https://github.com/theavgjojo/zeek
* 'topic/oakljon/gh-1352-smtp-header-parsing' of https://github.com/theavgjojo/zeek:
  GH-1352: Added flag to stop processing SMTP headers in attached messages
2021-01-21 17:01:13 -08:00
Jon Siwek
7f3f5a868f Merge remote-tracking branch 'origin/topic/jsiwek/gh-1296-fix-list-type-checks'
* origin/topic/jsiwek/gh-1296-fix-list-type-checks:
  GH-1296: fix type-checks related to list-type equality
2021-01-21 14:00:07 -08:00
Jon Oakley
25de6f28e5 GH-1352: Added flag to stop processing SMTP headers in attached
messages
2021-01-21 14:55:10 -05:00
Johanna Amann
079d4164c0 Merge remote-tracking branch 'origin/topic/christian/fix-config-segfault'
* origin/topic/christian/fix-config-segfault:
  Btest tweak for improved type rendering in config framework errors and set types
  More precise type information in a config framework error message
  Explicitly don't support sets with multiple index types in input/config frameworks
2021-01-21 11:30:36 +00:00
Jon Siwek
ee4c259cd4 Merge branch 'master' into topic/vern/script-xform 2021-01-13 12:18:44 -08:00
Christian Kreibich
fcab8df8fb Btest tweak for improved type rendering in config framework errors and set types 2021-01-11 13:54:13 -08:00
Jon Siwek
614fade0a4 Merge branch 'master' into topic/vern/lambda-copy-semantics 2021-01-11 11:48:45 -08:00
Jon Siwek
8c64ba6907 GH-1296: fix type-checks related to list-type equality
List-types as used in composite table/set indices, for example,
previously had incorrect same_type() comparisons due to flattening
of the list-type into a single type without checking whether the
number and kind of types all match.

This patch simply removes the flatten_type() call from same_type() since
it was already contradicting/preventing a subsequent full-comparison
between elements of two TYPE_LISTs.

There was also a superfluous special-case of the `in` operator's
type-checking for testing whether a record is in a table/set.  It's
superfluous because the general case will already do the type-checking
from MatchesIndex() after first wrapping the record operand in a
ListExpr.  The previous logic was incorrectly relying on the
flatten_type() for testing equality of a record-type against a
list-type, whereas the general case correctly normalizes to testing
equality of two list-types.

The special-cased type-checking logic for assigning a record value to a
table index during its initialization similarly needed minor
re-organization in order to maintain the same error messages as before.
2021-01-10 17:32:50 -08:00
Vern Paxson
dc38880cee canonicalization for an error message in one of the alternative test baselines 2021-01-10 14:44:46 -08:00
Vern Paxson
06f0a1b3df baseline differences for "xform" alternative: changes generally reflect exposure of transformed code, or error propagation stopping earlier due to error now occurring in an assignment (to a temporary) 2021-01-10 14:25:46 -08:00
Vern Paxson
0e4c996718 new testing alternative for script transformation (= xform) 2021-01-10 14:24:18 -08:00
Vern Paxson
117ff4eb08 bug in correctly inspecting test output file 2021-01-10 14:23:42 -08:00
Vern Paxson
bd2c94521a split bifs.string_utils into a non-error test and an only-errors test, to help control for differing error propagation 2021-01-10 14:21:51 -08:00
Vern Paxson
eb1848c547 cleaner approach for localizing errors associated with duplicated ASTs: virtualize GetLocationInfo 2021-01-07 15:14:22 -08:00
Jon Siwek
64631a2d9f Merge branch 'master' into topic/vern/script-inlining 2021-01-06 22:08:29 -08:00
Vern Paxson
35421b07f1 tests added for new capture-by-reference closure semantics & errors 2021-01-04 14:38:12 -08:00
Vern Paxson
fd309676bd test suite updates and additions for new capture semantics & suppression of error cascades 2021-01-04 14:34:18 -08:00
Jon Siwek
604fbea00d Merge remote-tracking branch 'origin/topic/johanna/1323'
* origin/topic/johanna/1323:
  TLS 1.3 changes: Address review feedback
  Add one more TLS 1.3 testcase and update NEWS
  Fix TLS 1.3 session resumption detection.
  Introduce ssl_probable_encrypted_handshake_message event
  SSL Analyzer: ignore CCS for TLS 1.3
  TLS analyzer: change logic to track TLS 1.3 connection establishment
2020-12-22 11:00:59 -08:00
Johanna Amann
22ed75c3ce Add one more TLS 1.3 testcase and update NEWS 2020-12-15 16:57:26 +00:00
Johanna Amann
3c95c9a956 Fix TLS 1.3 session resumption detection.
Now we detect TLS 1.3 session resumption by looking if both sides have
the PSK extension set, which is much more exact than the previous
approach.
2020-12-15 16:34:47 +00:00
Jon Siwek
206c674cc9 Merge EDNS ECS option parsing security/bug fixes 2020-12-15 08:03:40 -08:00
Jon Siwek
dd7bda6a1c Fix local.zeek compatibility test 2020-12-14 22:28:27 -08:00
Jon Siwek
b0505277ae
Fix typo in table iterator invalidation test comment
Co-authored-by: Tim Wojtulewicz <tim@corelight.com>
2020-12-14 10:42:37 -08:00
Jon Siwek
7393fc6d24 Update alternative plugins.hooks baselines 2020-12-13 13:24:47 -08:00
Jon Siwek
30df2c58c0 Merge branch 'master' into topic/vern/script-inlining 2020-12-13 10:42:26 -08:00
Jon Siwek
8f98b068c8 GH-1328: Improve behavior of Dictionary iterator invalidation
Previously, an assertion was triggered in debug builds upon any attempt
to insert or remove a Dictionary entry while any iteration of that
Dictionary is underway and also even in cases where Dictionary membership
was not actually modified (and thus invalidates a loop).

Now, it emits run-time warnings regardless of build-type and only when
insert/remove operations truly change the Dictionary membership.  In the
context of a Zeek script causing an invalidation, the warning message
also now helps pinpoint the exact expression that causes it.
2020-12-11 18:52:31 -08:00
Jon Siwek
7c27d4c1e7 Add test case to cover weird EDNS ECS parsing situations 2020-12-08 13:14:20 -08:00
Jon Siwek
a35cd2a726 GH-1321: Prevent compounding of connection_status_update event timers
Particularly for ICMP connections, a new timer got added every time a
`connection` record was updated even if there was still a pending timer
for that connection.
2020-12-08 11:20:02 -08:00
Jon Siwek
0b8535b879 Merge remote-tracking branch 'origin/topic/vlad/gh-1286'
Merge adjustments:
- Rewrote the check for error response as a switch statement to
  fix compiler warning about signed/unsigned comparison and also
  to just simplify/clarify the logic.
- Changed the btest to use `zeek -b`.

* origin/topic/vlad/gh-1286:
  Add tests for new SMB3 multichannel support
  Fix SMB2 response status parsing. Fixes #1286
2020-12-07 16:08:04 -08:00
Vlad Grigorescu
f30ca69402 Add tests for new SMB3 multichannel support 2020-12-07 15:35:04 -06:00
Johanna Amann
8955e6c060 Merge branch 'master' of github.com:zeek/zeek 2020-12-07 18:23:18 +00:00
Christian Kreibich
b04082c140 Additional use of btest-diff --binary 2020-12-06 20:19:52 -08:00
Christian Kreibich
17cd740519 Update btest-diff calls on binary files to using "--binary"
This converts Johanna's TEST_DIFF_CANONIFIER removals via "env -u" to
using the new "btest-diff --binary", and updates the affected baselines.
2020-12-06 20:19:52 -08:00
Johanna Amann
5f6b95c027 Update external baseline commit hashes 2020-12-06 20:19:52 -08:00
Johanna Amann
442cb40db8 Fix binary baseline & line-end problem
By default all baslines are run through diff-remove-timestamp. On a BSD
sed implementation, this means that a newline is added to the end of the
file, if no newline was there originally. This behavior differs from GNU
sed, which does not add a newline.

In this commit we unify this behavior by always adding a newline, even
when using GNU sed. This commit also disables the canonifier for a bunch
of binary baselines, so we do not have to change them.
2020-12-06 20:19:52 -08:00
Johanna Amann
7040e30431 Fix diff-remove-abspath on OSX
\t does not work on OS-X and just matches the letter t. This commit
replaces it with a literal tab instead.
2020-12-06 20:19:52 -08:00
Christian Kreibich
c0bd02e18f Canonifier improvements for the scripts.base.frameworks.logging.ascii-double test
This now more surgically applies canonifiers so that the double-format
numerical output isn't itself canonified.
2020-12-06 20:19:52 -08:00
Christian Kreibich
0b674eb851 Baseline refresh to reflect btest 0.64 2020-12-06 20:19:49 -08:00
Christian Kreibich
3984d99a86 Make diff-remove-abspath canonifier match on non-whitespace paths only
This avoids swallowing multiple separate paths separated by unrelated
content into one substitution, like here:

orig_p=59856<...>/tcp] -> orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]
2020-12-06 18:19:06 -08:00
Christian Kreibich
3ca804421e Harden diff-remove-timestamps canonifier
This pattern got mislead by matching suffixes of other numbers, and
noramlizing exact 0-timestamps isn't really required.

- Remove eplicit "0.000000" number pattern from timestamp normalization

- Require beginning of line or non-numeric character before the
  beginning of the number replacement
2020-12-06 18:19:06 -08:00
Jon Siwek
ff7d9e3d72 Merge branch 'master' into topic/vern/script-inlining 2020-12-04 16:18:14 -08:00
Johanna Amann
47ceac2491 Merge remote-tracking branch 'origin/topic/johanna/GH-348'
* origin/topic/johanna/GH-348:
  Sumstats: allow users to manage epoch manually
  Sumstats: epoch_finished was not called under certain circumstances
2020-12-04 18:49:53 +00:00
Jon Siwek
71f9340e75 Merge branch 'add-X-to-double' of https://github.com/ynadji/zeek
- Minor whitespace/grammar/doc tweaks during merge

* 'add-X-to-double' of https://github.com/ynadji/zeek:
  Add `count_to_double` and `int_to_double` bif functions
2020-12-02 12:54:08 -08:00
Jon Siwek
3605e04d83 Update minimum required CMake to 3.5
Also now uses CMake's ENABLE_EXPORTS target property for the zeek
executable to ensure symbols are visible to plugins.  Prior to CMake
3.4, the policy was to export symbols by default for certain platforms,
but later versions need either the explicit target property or policy.
2020-12-01 22:13:52 -08:00
Yacin Nadji
607af85ac1 Add count_to_double and int_to_double bif functions 2020-12-01 16:35:49 -05:00
Tim Wojtulewicz
49293c080d Merge remote-tracking branch 'origin/topic/timw/1184-additional-weird-info'
* origin/topic/timw/1184-additional-weird-info:
  GH-1184: Add 'source' field to weird log denoting where the weird was reported
2020-12-01 10:18:00 -07:00
Tim Wojtulewicz
e27008ef26 GH-1184: Add 'source' field to weird log denoting where the weird was reported 2020-12-01 09:34:37 -07:00
Robin Sommer
eccbbb4476 Merge remote-tracking branch 'origin/topic/robin/gh-1179-plugin-loading'
* origin/topic/robin/gh-1179-plugin-loading:
  Retry loading plugins on failure to resolve to dependencies.
  Fix use of deprecated functionality in test.
  When attempting to activate a plugin, load dynamic libraries first.
  Add test creating multiple plugins with load dependencies.
2020-12-01 14:51:49 +00:00
Jon Siwek
7d68f2ce9d Remove Python 2 compatibility logic in httpd test script 2020-11-25 14:57:09 -08:00
Jon Siwek
9717c623c2 Update Python invocations to explicit python3 2020-11-25 14:57:09 -08:00