Commit graph

3721 commits

Author SHA1 Message Date
Yacin Nadji
45ab85c09e Add tests for raw_bytes_to_v6_addr 2022-03-08 17:50:26 -05:00
Tim Wojtulewicz
e7412e257f Merge remote-tracking branch 'bbannier/topic/bbannier/more-autoformating'
* bbannier/topic/bbannier/more-autoformating:
  Format Python scripts with yapf.
  Format shell scripts with shfmt.
2021-12-01 10:33:22 -07:00
Vern Paxson
417f9ffe98 fix btest comment to more accurately describe the test 2021-11-29 13:17:57 -08:00
Vern Paxson
8f8c594220 btests for erroneous script conditionals 2021-11-24 15:19:44 -08:00
Benjamin Bannier
fd56eddcfb Format Python scripts with yapf.
We also add a very basic yapf configuration file. Most of the changes in
this patch were performed automatically, but we broke one overly long
string into multiple components on `src/make_dbg_constants.py`.
2021-11-24 23:13:24 +01:00
Benjamin Bannier
1f388e3f40 Format shell scripts with shfmt.
All changes in this patch were performed automatically with `shfmt` with
configuration flags specified in `.pre-commit-config.yaml`.

In addition to fixing whitespace the roundtrip through shfmt's AST also
transforms command substitutions

    `cmd`
    # becomes
    $(cmd)

and some redirects

    >&2 echo "msg"
    # becomes
    echo >&2 "msg"
2021-11-24 23:13:02 +01:00
Tim Wojtulewicz
8e1d770966 Merge remote-tracking branch 'origin/topic/vern/record-empty-vector-fix'
* origin/topic/vern/record-empty-vector-fix:
  fixes for constructing and assigning records with fields that are empty vectors
2021-11-24 13:32:45 -07:00
Vern Paxson
06bbd167cd fixes for constructing and assigning records with fields that are empty vectors 2021-11-24 11:16:33 -08:00
Tim Wojtulewicz
2044fbe53b Add GTPv1 packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
dc0ecf9811 Add Teredo packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
05574ecce1 Add VXLAN packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
cbb0bcd49c Add Geneve packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
7e40094f2c Add AYIYA packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
44e0760e96 Add PacketAnalyzer::register_for_port(s) functions
These allow packet analyzers to register ports as identifiers to forward from
parent analyzers, while also adding those ports to the now-global
Analyzer::ports table at the same time.
2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
612212568a Add analyzer_confirmation and analyzer_violation events 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
a7d3cb48ef Add concept of "parent" tag namespaces
This allows us to create an EnumType that groups all of the analyzer
tag values into a single type, while still having the existing types
that split them up. We can then use this for certain events that benefit
from taking all of the tag types at once.
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
331161138a Unify all of the Tag types into one type
- Remove tag types for each component type (analyzer, etc)
- Add deprecated versions of the old types
- Remove unnecessary tag element from templates for TaggedComponent and ComponentManager
- Enable TaggedComponent to pass an EnumType when initializing Tag objects
- Update some tests that are affected by the tag enum values changing order
2021-11-23 19:36:49 -07:00
Johanna Amann
3fe6ad1a82 Merge remote-tracking branch 'origin/topic/johanna/gh-1829-test'
* origin/topic/johanna/gh-1829-test:
  Add testcase for TCP segment offloading.
2021-11-23 15:35:35 +00:00
Johanna Amann
d3f16af4ab Add testcase for TCP segment offloading.
Relates to GH-1829
2021-11-23 12:37:55 +00:00
Johanna Amann
12d81b27ed Merge remote-tracking branch 'origin/master' into topic/johanna/openssl-3-compat 2021-11-23 10:23:12 +00:00
Johanna Amann
48ee7db3c1 Merge remote-tracking branch 'origin/topic/johanna/gh-1829'
* origin/topic/johanna/gh-1829:
  Add documentation for GH-1829
  Packets with TSO: address review feedback.
  Accept packets that use tcp segment offloading.

Fixes GH-1829
2021-11-23 10:20:07 +00:00
Johanna Amann
253d214126 OpenSSL 3: fix warnings and tests
This commit fixes the compile-time warnings that OpenSSL 3.0 raises for
our source-code. For the cases where this was necessary we now have two
implementations - one for OpenSSL 1.1 and earlier, and one for OpenSSL
3.0.

This also makes our testsuite pass with OpenSSL 3.0

Relates to GH-1379
2021-11-17 13:33:49 +00:00
Tim Wojtulewicz
6e8dae316b Added plugin.unprocessed_packet_hook btest 2021-11-12 09:30:26 -07:00
Tim Wojtulewicz
fe932944c4 GH-1620: Add event and plugin hook to track packets not processed 2021-11-12 09:30:26 -07:00
Johanna Amann
d451fb8184 Merge branch 'topic/AbdelSaTd/case-insensitive-find'
* topic/AbdelSaTd/case-insensitive-find:
  testing-do-find-str_case-insensitive
  case-insensitive-search-features-for-do_find_str

I did a few small style-fixes while merging this and expanded the test
a bit. I also removed unecessary commits.

Closes GH-1828
2021-11-10 11:33:47 +00:00
Abdel
effa8c403f testing-do-find-str_case-insensitive 2021-11-10 11:25:20 +00:00
Robin Sommer
1bb21bfcb4 Merge remote-tracking branch 'origin/topic/robin/gh-1757-loadfile2'
* origin/topic/robin/gh-1757-loadfile2:
  Tweaking a couple of debug message.
  Add new hook `HookLoadFileExtended` that allows plugins to supply Zeek script code to parse.
  Move logic to execute `HookLoadFile` for signatures into rule matcher code.
2021-11-10 11:28:53 +01:00
Tim Wojtulewicz
0604df01e3 Merge remote-tracking branch 'origin/topic/bbannier/issue-1780'
* origin/topic/bbannier/issue-1780:
  Add Github action exercising pre-commit
  Add pre-commit config.
  Format code with `clang-format`
  Remove stale files `src/DebugCmdInfoConstants.*`
  Disable formatting for files in `testing/btest/plugins`
  Move 3rdparty source files to `3rdparty/`
2021-11-09 10:30:14 -07:00
Tim Wojtulewicz
8429ef746d Merge remote-tracking branch 'origin/topic/timw/1819-hashing-segfault'
* origin/topic/timw/1819-hashing-segfault:
  GH-1819: Handle recursive types when describing type in binary mode
2021-11-09 09:46:08 -07:00
Tim Wojtulewicz
9fdc70634f Merge remote-tracking branch 'origin/topic/timw/remove-false-teredo-test'
* origin/topic/timw/remove-false-teredo-test:
  Remove no-op false-teredo test
2021-11-09 09:28:43 -07:00
Benjamin Bannier
b23eb76043 Disable formatting for files in testing/btest/plugins
Files in that folder were previously not formatted. With this patch we
now disable formatting in that folder explicitly by adding a dedicated
`clang-format` config which deactivates any formatting changes.
2021-11-09 07:20:18 +01:00
Tim Wojtulewicz
e0b116154a GH-1819: Handle recursive types when describing type in binary mode 2021-11-08 15:19:57 -07:00
Tim Wojtulewicz
f2ea56379b Remove no-op false-teredo test 2021-11-05 15:51:22 -07:00
Robin Sommer
34eaf42b92 Add new hook HookLoadFileExtended that allows plugins to supply Zeek script code to parse.
The new hooks works similar to the existing `HookLoadFile` but,
additionally, allows the plugin to return a string that contains the
code to be used for the file being loaded. If the plugin does so, the
content of any actual file on disk will be ignored (in fact, there
doesn't even need to be a file on disk in that case). This works for
both Zeek scripts and signatures.

There's a new test that covers the new functionality, testing loading
both scripts and signatures from memory. I also manually tested that the
debugger integration works, but I don't see much of a way to add a
regression test for that part.

We keep the existing hook as well for backwards compatibility. We could
decide to deprecate it, but not sure that buys us much, so left that
out.

Closes #1757.
2021-11-05 13:01:19 +01:00
Robin Sommer
1efaf8d7a4 Move logic to execute HookLoadFile for signatures into rule matcher code.
This (1) fixes an issue where signature files supplied on the command
line wouldn't pass through the hooks, and (2) prepares for allowing
hooks to supply the content of a signature file directly.
2021-11-05 12:58:38 +01:00
Yacin Nadji
cdb52e6460 Curse you tabs! 2021-11-03 15:46:17 -04:00
Yacin Nadji
d426e285eb Add reverse order intersection check 2021-11-03 14:52:45 -04:00
Yacin Nadji
75e584cb73 Change set intersection test to be correct 2021-11-03 14:21:02 -04:00
Tim Wojtulewicz
ceaec09024 GH-693: use pcap_dump_open_append where supported 2021-11-02 17:09:39 -07:00
Johanna Amann
e14b695497 Accept packets that use tcp segment offloading.
When checksum offloading is enabled, we now forward packets that
have 0 header lengths set - and assume that they have TSO enabled.

If checksum offloading is not enabled, we drop the packets.

Addresses GH-1829
2021-10-28 17:12:54 +02:00
FlyingWithJerome
605d4024e4 remove excussive fields in dns_svcb_rr 2021-10-12 21:40:56 -04:00
FlyingWithJerome
ac1ea204fe newlines at the end of test outputs 2021-10-12 17:43:32 -04:00
FlyingWithJerome
d5a6896171 add svcb test case 2021-10-12 17:43:32 -04:00
FlyingWithJerome
ca4b181d35 add a dns https test case 2021-10-12 17:43:32 -04:00
FlyingWithJerome
0849332eb9 fix a few syntax errors 2021-10-12 17:43:32 -04:00
Christian Kreibich
a8ab977b0e Expand table/set tests to cover new index types 2021-10-01 14:03:08 -07:00
Christian Kreibich
b7603faf3d Whitespace tweak in a btest, no other change 2021-10-01 14:03:08 -07:00
Tim Wojtulewicz
e5b163290d Merge remote-tracking branch 'origin/topic/vern/remove-uu'
* origin/topic/vern/remove-uu:
  fix up for linking w/ doc update
  documentation update
  script simplification that removes an unnecessary &is_assigned
  removing -uu functionality and associated script analysis now no longer needed
2021-09-24 10:31:56 -07:00
Robin Sommer
dd5d6e1756 Merge branch 'topic/foxds/dcerpc_auth' of ssh://github.com/fox-ds/zeek
* 'topic/foxds/dcerpc_auth' of ssh://github.com/fox-ds/zeek:
  Fix protocol forwarding in dce_rpc-auth
  Fix protocol forwarding in dce_rpc-auth
2021-09-23 17:50:00 +02:00
FOX-DS
fef4531f78 Fix protocol forwarding in dce_rpc-auth 2021-09-23 08:50:11 -04:00