Commit graph

3799 commits

Author SHA1 Message Date
Johanna Amann
4399f171ae Merge remote-tracking branch 'origin/topic/johanna/pppoe-session-id-logging'
* origin/topic/johanna/pppoe-session-id-logging:
  Update external tests for pppoe-session-id conn.log changes
  PPPoE: add session id logging
2025-07-24 07:57:18 +01:00
Tim Wojtulewicz
acdf8f4d4d Merge remote-tracking branch 'origin/topic/timw/coverity-fixes'
* origin/topic/timw/coverity-fixes:
  Fix a few other minor issues reported by Coverity
  Add a few extra null checks, plus a missing initialization that led to a bad null check
  Fix some integer overflow issues reported by Coverity
  Ignore a couple of known-unused results reported by Coverity
  Fix some bit-shifting overflow/UB issues reported by Coverity
  Reset the value of a status variable in SQLite backend before using it in a loop
  Fix a potential memory leak reported by Coverity
  Avoid some string copies in IRC analyzer
  Add some additional std::moves reported by Coverity
  Fix an unsigned integer comparison reported by Coverity
  Fix uninitialized class member Coverity findings
  Handle uncaught exception during setup
  Update gen-zam submodule for Coverity findings
2025-07-23 15:26:29 -07:00
Tim Wojtulewicz
ca3b670d0f Merge remote-tracking branch 'origin/topic/timw/storage-forced-sync'
* origin/topic/timw/storage-forced-sync:
  Fix swapped storage metrics names
  Add flag to force synchronous mode when calling storage script-land functions
2025-07-23 14:03:56 -07:00
Arne Welzel
ee5ffdf42c Merge remote-tracking branch 'origin/topic/awelzel/control-switch-to-cluster'
* origin/topic/awelzel/control-switch-to-cluster:
  NEWS: ZeekControl, ZeroMQ and WebSocket
  Update zeekctl module for ClusterBackend and UseWebSocket
  control: Use Cluster::publish() for replying
2025-07-23 19:31:45 +02:00
Tim Wojtulewicz
83c914ce2d Merge remote-tracking branch 'origin/topic/timw/ci-weekly-compiler-task'
* origin/topic/timw/ci-weekly-compiler-task:
  CI: Add weekly task for running builds with newest compilers
2025-07-23 08:21:31 -07:00
Tim Wojtulewicz
2e612fc493 Merge remote-tracking branch 'origin/topic/timw/commit-info-for-plugin-ci-build'
* origin/topic/timw/commit-info-for-plugin-ci-build:
  Output more information when cloning repos for include_plugins CI task
2025-07-23 08:20:43 -07:00
Arne Welzel
84cbd3784f Merge remote-tracking branch 'origin/topic/awelzel/make-record-fields-ordered'
* origin/topic/awelzel/make-record-fields-ordered:
  Type/RecordType: Make table returned by GetRecordFieldsVal() ordered
2025-07-23 13:38:05 +02:00
Tim Wojtulewicz
07a1c6b699 Merge remote-tracking branch 'origin/topic/timw/update-af-packet'
* origin/topic/timw/update-af-packet:
  Update zeek-af_packet-plugin submodule to fix initialization [nomail]
2025-07-22 11:40:27 -07:00
Tim Wojtulewicz
ed81e251dc Merge remote-tracking branch 'origin/topic/timw/update-broker'
* origin/topic/timw/update-broker:
  Update broker submodule [nomail]
2025-07-22 08:05:22 -07:00
Tim Wojtulewicz
cb2e193452 Merge remote-tracking branch 'origin/topic/timw/storage-metrics'
* origin/topic/timw/storage-metrics:
  Add SQLite page_count and file_size metrics
  Add btests to cover storage metrics
  Add storage metrics for operations, expirations, data transferred
  Fix ordering of telemtry metrics when running under test
  Make RunPragma take an optional value parser to return data
  Make SQLite::Step take a callback function for parsing result data
2025-07-18 14:28:46 -07:00
Tim Wojtulewicz
1dc7d88efd Merge remote-tracking branch 'origin/topic/timw/update-libkqueue'
* origin/topic/timw/update-libkqueue:
  Update libkqueue submodule [nomail]
2025-07-17 12:59:10 -07:00
Tim Wojtulewicz
beb70e27b5 Merge remote-tracking branch 'origin/topic/timw/cpp20-starts-and-ends-with'
* origin/topic/timw/cpp20-starts-and-ends-with:
  Use std::string/string_view versions of starts_with/ends_with where appropriate
2025-07-17 09:09:40 -07:00
Tim Wojtulewicz
6218643347 Merge remote-tracking branch 'origin/topic/timw/hilti-nolint-enum'
* origin/topic/timw/hilti-nolint-enum:
  Add nolint for enum size for HILTI_RT_ENUM use
2025-07-17 08:40:58 -07:00
Robin Sommer
c94ce6b946
Merge remote-tracking branch 'origin/topic/robin/gh-4481-test-analyzer'
* origin/topic/robin/gh-4481-test-analyzer:
  Spicy: Fix missing include.
  Bump Spicy.
  Spicy: Add functions to check if Zeek provides an analyzer of a given name.
2025-07-16 17:47:08 +02:00
Arne Welzel
8f4470926f Merge remote-tracking branch 'origin/topic/awelzel/eml-extraction-v3'
* origin/topic/awelzel/eml-extraction-v3:
  NEWS: Add entry about SMTP::enable_rfc822_msg_file_analysis
  btest: Add tests for full email extraction
  SMTP: Adapt scripts for enable_rfc822_msg_file_analysis
  SMTP: Add missing Undelivered() call
  SMTP: Add enable_rfc822_msg_file_analysis
2025-07-16 12:38:29 +02:00
Christian Kreibich
fba319857b Merge branch 'topic/bbannier/named-ctr'
* topic/bbannier/named-ctr:
  Prefer explicit construction to coercion in record initialization
2025-07-15 17:38:04 -07:00
Christian Kreibich
907ddce581 Merge branch 'topic/christian/fix-debuglogger-stdsort'
* topic/christian/fix-debuglogger-stdsort:
  Add missing header to allow std::sort() on GCC 15.1
2025-07-15 17:37:02 -07:00
Tim Wojtulewicz
dc5d7c3fc9 Merge remote-tracking branch 'origin/topic/timw/std-filesystem'
* origin/topic/timw/std-filesystem:
  Fix some missing #includes resulting from removal of ghc::filesystem
  Remove ghc::filesystem submodule, switch to std::filesystem
2025-07-14 13:09:24 -07:00
Tim Wojtulewicz
55b427142d Merge remote-tracking branch 'origin/topic/johanna/connection-syn-packet-doc'
* origin/topic/johanna/connection-syn-packet-doc:
  Documentation: connection_SYN_packet
2025-07-14 11:26:13 -07:00
Tim Wojtulewicz
a843521e78 Merge remote-tracking branch 'origin/topic/timw/cpp20-clang-tidy-updates'
* origin/topic/timw/cpp20-clang-tidy-updates:
  Use ranges::reverse_view to fix a few reverse ranged-for loops
  Disable a few new modernize clang-tidy checkers, enabled by C++20
2025-07-14 09:31:31 -07:00
Tim Wojtulewicz
448590270b Merge remote-tracking branch 'origin/topic/timw/move-util-deferred'
* origin/topic/timw/move-util-deferred:
  Move util::Deferred into util-types.h
2025-07-13 19:23:08 -07:00
Evan Typanski
54f9e45597 Merge remote-tracking branch 'origin/topic/etyp/baseline-cleanup'
* origin/topic/etyp/baseline-cleanup:
  Cleanup unused baselines
2025-07-11 15:35:59 -04:00
Tim Wojtulewicz
0e869a5941 Merge remote-tracking branch 'origin/topic/timw/cpp20-NEWS'
* origin/topic/timw/cpp20-NEWS:
  Add NEWS entry about C++ 20 [nomail] [skip ci]
2025-07-11 12:13:54 -07:00
Evan Typanski
a739d47835 Merge remote-tracking branch 'origin/topic/vern/add-del-void-exprs'
* origin/topic/vern/add-del-void-exprs:
  crash fixes for constructs that expect add/delete expressions to return values
2025-07-11 12:58:56 -04:00
Tim Wojtulewicz
1e55543e86 Merge branch 'topic/timw/c++20'
* topic/timw/c++20:
  Reduce some false-positive warnings from GCC to warnings with -Werror
  Add zeek-namespaced alias for jthread
  Include RequireCXXStd.cmake from main CMakeLists.txt
  Update submodules to C++20-enabled versions
2025-07-10 15:43:09 -07:00
Tim Wojtulewicz
c6011e2160 Merge remote-tracking branch 'origin/topic/timw/known-services-with-storage-framework'
* origin/topic/timw/known-services-with-storage-framework:
  Modify known-services policy script to add storage framework support
2025-07-10 08:55:49 -07:00
Robin Sommer
6446bdf0dc
Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  [Spicy] Add linker scope to debugging output.
  [Spicy] Remove declarations for unimplemented functions.
  [Spicy] Bump `auxil/spicy/` to latest development snapshot.
2025-07-10 09:41:07 +02:00
Tim Wojtulewicz
0848ddfb9f Merge remote-tracking branch 'origin/topic/vern/ZAM-incr-op-opt-fix'
* origin/topic/vern/ZAM-incr-op-opt-fix:
  ZAM optimizer fix for += / -= set operations
2025-07-09 15:10:17 -07:00
Christian Kreibich
9322687823 Merge branch 'topic/christian/rdp-cookie-clarification'
* topic/christian/rdp-cookie-clarification:
  Clarify the cookie field's origin in the RDP log.
2025-07-08 17:45:27 -07:00
Arne Welzel
0c60f2a70a Merge branch 'topic/jgras/connection-packet-threshold' of https://github.com/J-Gras/zeek
* 'topic/jgras/connection-packet-threshold' of https://github.com/J-Gras/zeek:
  Add NEWS entry for generic packet thresholds
  Allow for multiple generic packet thresholds
  Add btest for conn_generic_packet_threshold_crossed event
  Update dump-events btest baseline
  Add conn_generic_packet_threshold_crossed event
2025-07-08 17:54:27 +02:00
Johanna Amann
8ba77da152 Merge remote-tracking branch 'origin/topic/johanna/gh-4602'
* origin/topic/johanna/gh-4602:
  PPPoE: don't forward more bytes than header indicates
2025-07-08 11:44:53 +01:00
Arne Welzel
d42d467965 Merge remote-tracking branch 'origin/topic/vern/line-number-ordering'
* origin/topic/vern/line-number-ordering:
  Bump ZeekJS to work with new Location constructor
  remove non-functional column information from Location objects
  isolate Location specifics to private class variables to enforce correct line number ordering
2025-07-08 10:40:58 +02:00
Arne Welzel
3c941a6d3e Merge remote-tracking branch 'origin/topic/awelzel/id-opt-info-branch-clone-no-lint'
* origin/topic/awelzel/id-opt-info-branch-clone-no-lint:
  script_opt/IDOptInfo: Add NOLINT(bugprone-branch-clone)
2025-07-07 20:07:35 +02:00
Arne Welzel
b034fd3f55 Merge remote-tracking branch 'origin/topic/awelzel/bump-zeekjs-0-18-0'
* origin/topic/awelzel/bump-zeekjs-0-18-0:
  Bump zeekjs to v0.18.0
2025-07-07 18:17:25 +02:00
Arne Welzel
869bd181b2 Merge remote-tracking branch 'origin/topic/vern/ZAM-const-prop-fix'
* origin/topic/vern/ZAM-const-prop-fix:
  fix for error in ZAM's constant propagation logic
2025-07-07 18:15:57 +02:00
Arne Welzel
eb6b4a0c46 Merge remote-tracking branch 'origin/topic/awelzel/revert-to-tpe'
* origin/topic/awelzel/revert-to-tpe:
  scripts: Use tpe instead of type_, again
2025-07-03 20:44:04 +02:00
Arne Welzel
388cbcee48 Merge remote-tracking branch 'origin/topic/awelzel/4605-conn-id-context'
* origin/topic/awelzel/4605-conn-id-context:
  NEWS: Adapt for conn_id$ctx introduction
  conn_key/fivetuple: Drop support for non conn_id records
  Conn: Move conn_id init and flip to IPBasedConnKey
  IPBasedConnKey: Add GetTransportProto() helper
  input/Manager: Ignore empty record types
  external: Bump commit hashes for external suites
  ip/vlan_fivetuple: Populate nested conn_id_context, not conn_id
  ConnKey: Extend DoPopulateConnIdVal() with ctx
  btest: Update tests and baselines after adding ctx to conn_id
  init-bare: Add conn_id_ctx to conn_id
2025-07-03 18:42:48 +02:00
Johanna Amann
2a34cf3f46 Merge remote-tracking branch 'origin/topic/johanna/ssl-small-tweaks'
* origin/topic/johanna/ssl-small-tweaks:
  Spicy SSL analyzer: move unknown version out of possible range
  Spicy SSL analyzer: move exceptions to &requires & throw
2025-07-02 07:50:33 +01:00
Evan Typanski
310a82e7fd Merge remote-tracking branch 'origin/topic/etyp/redis-resp3'
* origin/topic/etyp/redis-resp3:
  Touchup TODOs in the Redis analyzer
  Handle more Redis RESP3 protocol pieces
  Stringify all Redis-RESP serialized data
  Handle Redis protocol `message` separately
  Add Redis analyzer array stringification
2025-07-01 14:20:19 -04:00
Benjamin Bannier
e3b0d1d2be Merge branch 'topic/bbannier/bump-pre-commit-hooks' 2025-07-01 11:09:23 +02:00
Arne Welzel
6d272038fe Merge remote-tracking branch 'origin/topic/timw/4617-reset-expire-time-on-overwrite'
* origin/topic/timw/4617-reset-expire-time-on-overwrite:
  SQLite: Reset expiration time on overwrite
2025-07-01 09:20:58 +02:00
Tim Wojtulewicz
5daa83bfa4 Merge remote-tracking branch 'origin/topic/bbannier/readability-isolate-declaration'
* origin/topic/bbannier/readability-isolate-declaration:
  Make clang-tidy warnings report as errors to cause CI build to fail
  Fix a clang-tidy finding in cluster telemetry code
  Fix clang-tidy readability-isolate-declaration warnings
2025-06-30 14:19:37 -07:00
Arne Welzel
c725311d07 Merge remote-tracking branch 'origin/topic/awelzel/cluster-log-websocket-application-name'
* origin/topic/awelzel/cluster-log-websocket-application-name:
  cluster/WebSocket: Include X-Application-Name in cluster.log
2025-06-30 17:56:19 +02:00
Arne Welzel
5847a2d32e Merge remote-tracking branch 'origin/topic/awelzel/cluster-telemetry-follow-up'
* origin/topic/awelzel/cluster-telemetry-follow-up:
  Bump cluster test suite
  cluster/Telemetry: Cache CallExpr locations
  cluster/Telemetry: Avoid unneeded StringVal() construction
  Val: Switch TablePatternMatcher to std::string_view
  RE: Add MatchAll() and MatchSet() for std::string_view
  cluster/websocket: Fix and test for invalid X-Application-Name
  cluster/telemetry: Move topic_normalization redef to zeromq
2025-06-30 13:30:04 +02:00
Johanna Amann
dbeadc65ba Merge remote-tracking branch 'origin/topic/johanna/gh-4547'
* origin/topic/johanna/gh-4547:
  Spicy SSL analyzer: make record layer version parsing more strict
2025-06-26 20:21:54 +01:00
Arne Welzel
3cd6e1ca06 Merge remote-tracking branch 'origin/topic/vern/if-coverage'
* origin/topic/vern/if-coverage:
  extend script coverage profiling to track whether conditionals evaluate to true/false
2025-06-26 18:49:42 +02:00
Arne Welzel
22958f7cdf Merge remote-tracking branch 'origin/topic/awelzel/1474-cluster-telemetry'
* origin/topic/awelzel/1474-cluster-telemetry:
  btest/cluster/telemetry: Add smoke testing for telemetry
  cluster/WebSocket: Fetch X-Application-Name header as app label
  cluster/WebSocket: Pass X-Application-Name to dispatcher
  broker/WebSocketShim: Add calls to Telemetry hooks
  cluster/WebSocket: Configure telemetry for WebSocket backends
  broker: Hook up generic cluster telemetry
  cluster: Introduce telemetry component

One bug fix removing static from a variable that shouldn't be static.
2025-06-26 14:54:01 +02:00
Johanna Amann
14e801a709 Merge remote-tracking branch 'origin/topic/johanna/gh-4598'
* origin/topic/johanna/gh-4598:
  Only pass session ticket data in ssl_session_ticket_handshake event
2025-06-26 09:59:16 +01:00
Arne Welzel
771c37b6b2 Merge branch 'rename' of https://github.com/bhaskarbhar/zeek
* 'rename' of https://github.com/bhaskarbhar/zeek:
  Update zeek.bif
  Update init-bare.zeek
  Added Baseline
  Renamed
2025-06-25 19:27:13 +02:00
Evan Typanski
d3593e0489 Merge remote-tracking branch 'origin/topic/etyp/remove-list'
* origin/topic/etyp/remove-list:
  Remove `list` from Zeek grammar
2025-06-25 10:36:08 -04:00