Commit graph

12548 commits

Author SHA1 Message Date
Christian Kreibich
5c44dfbb9e Flip unit tests to being enabled by default
This flips --enable-cpp-tests to --disable-cpp-tests, enabling unit testing by
default. The help output has a minor corresponding tweak as well.
2021-12-06 12:17:22 -08:00
Christian Kreibich
f20f8ad4a8 Support for unit tests in plugins
This pushes the unit test kickoff down in the Zeek startup sequence, to give
plugins a chance to register. It also enforces deterministic mode for unit
testing, since without it some unit tests start to have nondeterministic results
at that stage.
2021-12-06 12:17:22 -08:00
Christian Kreibich
f8b8401d84 Alphabetically sort configure's enable/disable/with options 2021-12-06 12:17:20 -08:00
Tim Wojtulewicz
e7412e257f Merge remote-tracking branch 'bbannier/topic/bbannier/more-autoformating'
* bbannier/topic/bbannier/more-autoformating:
  Format Python scripts with yapf.
  Format shell scripts with shfmt.
2021-12-01 10:33:22 -07:00
Tim Wojtulewicz
6a7bbd5268 Merge remote-tracking branch 'origin/topic/vern/CPP-cond'
* origin/topic/vern/CPP-cond:
  fix btest comment to more accurately describe the test
  clang-format issue
  btests for erroneous script conditionals
  avoid compiling-to-C++ for functions potentially influenced by conditionals
  track the use of conditionals in functions and files
  AST profiles track the associated function/body/expression
2021-12-01 10:25:58 -07:00
Tim Wojtulewicz
6392ca0fec Merge remote-tracking branch 'origin/topic/timw/1873-tag-deprecations'
* origin/topic/timw/1873-tag-deprecations:
  GH-1873: Deprecate the tag types differently to avoid type clashes
2021-12-01 09:44:22 -07:00
Tim Wojtulewicz
328411e807 GH-1873: Deprecate the tag types differently to avoid type clashes 2021-12-01 09:43:28 -07:00
Johanna Amann
94ee837398 Fix for the recent patch that allows segment offloaded packets.
We recently added support for segment offloaded packets. It turns out
that this can lead to problems in UDP/ICMP based parsers since I missed
correctly also updating the payloadlength there, and using the capture
length instead when segment offloading is enabled.

Credit to OSS-Fuzz for discovery
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41391
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41394
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41395
(Link to details becomes public 30 days after patch release)
2021-11-30 11:55:30 -07:00
Vern Paxson
417f9ffe98 fix btest comment to more accurately describe the test 2021-11-29 13:17:57 -08:00
Vern Paxson
46f46e7803 clang-format issue 2021-11-29 13:17:46 -08:00
Tim Wojtulewicz
6a5b51eba8 Merge remote-tracking branch 'origin/topic/timw/coverity-fixes'
* origin/topic/timw/coverity-fixes:
  Fix a number of Coverity findings
2021-11-29 13:47:08 -07:00
Tim Wojtulewicz
fbcebb85a1 Merge remote-tracking branch 'origin/topic/vern/CPP-trim'
* origin/topic/vern/CPP-trim:
  suppress unneeded initializations
  address clang 10 warnings
2021-11-29 13:46:14 -07:00
Tim Wojtulewicz
72604f866b Fix a number of Coverity findings
1466460: Uninitialized field in gtp-analyzer.pac
1462465: Null pointer dereference in CompositeHash::SingleValHash
1462463: Copy/paste error in TCPSessionAdapter::build_syn_packet_val
1462067: Uninitialized fields in Zinst
2021-11-29 10:43:34 -07:00
zeek-bot
d2a9fcda0c Update doc submodule [nomail] [skip ci] 2021-11-25 04:26:38 +00:00
Vern Paxson
8f8c594220 btests for erroneous script conditionals 2021-11-24 15:19:44 -08:00
Vern Paxson
a4b9218771 avoid compiling-to-C++ for functions potentially influenced by conditionals 2021-11-24 15:19:21 -08:00
Vern Paxson
e73351a6e1 track the use of conditionals in functions and files 2021-11-24 15:19:01 -08:00
Vern Paxson
f865897cac AST profiles track the associated function/body/expression 2021-11-24 15:18:40 -08:00
Benjamin Bannier
fd56eddcfb Format Python scripts with yapf.
We also add a very basic yapf configuration file. Most of the changes in
this patch were performed automatically, but we broke one overly long
string into multiple components on `src/make_dbg_constants.py`.
2021-11-24 23:13:24 +01:00
Benjamin Bannier
1f388e3f40 Format shell scripts with shfmt.
All changes in this patch were performed automatically with `shfmt` with
configuration flags specified in `.pre-commit-config.yaml`.

In addition to fixing whitespace the roundtrip through shfmt's AST also
transforms command substitutions

    `cmd`
    # becomes
    $(cmd)

and some redirects

    >&2 echo "msg"
    # becomes
    echo >&2 "msg"
2021-11-24 23:13:02 +01:00
Tim Wojtulewicz
8e1d770966 Merge remote-tracking branch 'origin/topic/vern/record-empty-vector-fix'
* origin/topic/vern/record-empty-vector-fix:
  fixes for constructing and assigning records with fields that are empty vectors
2021-11-24 13:32:45 -07:00
Vern Paxson
a2cec7463f suppress unneeded initializations 2021-11-24 12:17:16 -08:00
Vern Paxson
a830c269ab address clang 10 warnings 2021-11-24 11:56:01 -08:00
Vern Paxson
06bbd167cd fixes for constructing and assigning records with fields that are empty vectors 2021-11-24 11:16:33 -08:00
Tim Wojtulewicz
e0b4659488 Merge remote-tracking branch 'origin/topic/vern/CPP-speedup'
* origin/topic/vern/CPP-speedup:
  use iterator-based idiom for check-if-present-then-access
  const-ify member function
  switch looping over vectors to use iterators
  remove unused local variables
  efficiency fix - return a reference rather than a copy of a map
  fix for case-sensitive file systems
  geez sometimes it's signed sometimes it's not
  documentation updates
  remove -O add-C++ and -O update-C++ options
  extensive rewrite of generation & execution of run-time initialization
  factoring out CPPEscape to be a standalone function
  removing unused SubNetType class
2021-11-23 19:44:57 -07:00
Tim Wojtulewicz
e86a606d18 Merge remote-tracking branch 'origin/topic/timw/1571-move-tunnel-analyzers-2'
* origin/topic/timw/1571-move-tunnel-analyzers-2:
  Update NEWS and some minor fixes for docs/zeekygen
  Remove the old session-based tunnel analyzers
  Add GTPv1 packet analyzer, disable old analyzer
  Add Teredo packet analyzer, disable old analyzer
  Add VXLAN packet analyzer, disable old analyzer
  Add Geneve packet analyzer, disable old analyzer
  Add AYIYA packet analyzer, disable old analyzer
  Add PacketAnalyzer::register_for_port(s) functions
  Add analyzer_confirmation and analyzer_violation events
  Add utility function for tunnel analyzers to setup encapsulation
  Store some additional information in the packet during processing
  Minor fix in UDP to avoid duplicating tunnels
  Fix error text in IPTunnel analyzer
  Change Packet::ip_hdr to be a shared_ptr so it can be copied into EncapsulatingConn
  Add method for packet analyzers to register for protocol detection
  Add concept of "parent" tag namespaces
  Unify plugin::Component and plugin::TaggedComponent into a single class
  Remove uses of deprecated Tag types
  Unify all of the Tag types into one type
2021-11-23 19:42:15 -07:00
Tim Wojtulewicz
e82a78616b Update NEWS and some minor fixes for docs/zeekygen 2021-11-23 19:39:36 -07:00
Tim Wojtulewicz
9135345fa8 Remove the old session-based tunnel analyzers 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
2044fbe53b Add GTPv1 packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
dc0ecf9811 Add Teredo packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
05574ecce1 Add VXLAN packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
cbb0bcd49c Add Geneve packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
7e40094f2c Add AYIYA packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
44e0760e96 Add PacketAnalyzer::register_for_port(s) functions
These allow packet analyzers to register ports as identifiers to forward from
parent analyzers, while also adding those ports to the now-global
Analyzer::ports table at the same time.
2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
612212568a Add analyzer_confirmation and analyzer_violation events 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
7bffd2eccd Add utility function for tunnel analyzers to setup encapsulation 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
f93c5a6942 Store some additional information in the packet during processing
- Session related to the packet
- is_orig information if a UDP header was found
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
5f58ce8a5d Minor fix in UDP to avoid duplicating tunnels 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
1dede6dd70 Fix error text in IPTunnel analyzer 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
ed798c6aba Change Packet::ip_hdr to be a shared_ptr so it can be copied into EncapsulatingConn 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
d4f57a6100 Add method for packet analyzers to register for protocol detection 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
a7d3cb48ef Add concept of "parent" tag namespaces
This allows us to create an EnumType that groups all of the analyzer
tag values into a single type, while still having the existing types
that split them up. We can then use this for certain events that benefit
from taking all of the tag types at once.
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
7d66f4252f Unify plugin::Component and plugin::TaggedComponent into a single class
These two are almost always used in conjunction with each other, and
TaggedComponent is never used by itself. Combining them together into
a single class will help simplify some of the code around managing
the mapping between Tags and Components.
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
8b544d648d Remove uses of deprecated Tag types 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
331161138a Unify all of the Tag types into one type
- Remove tag types for each component type (analyzer, etc)
- Add deprecated versions of the old types
- Remove unnecessary tag element from templates for TaggedComponent and ComponentManager
- Enable TaggedComponent to pass an EnumType when initializing Tag objects
- Update some tests that are affected by the tag enum values changing order
2021-11-23 19:36:49 -07:00
zeek-bot
4f9f46a0c4 Update doc submodule [nomail] [skip ci] 2021-11-24 00:42:06 +00:00
Johanna Amann
3fe6ad1a82 Merge remote-tracking branch 'origin/topic/johanna/gh-1829-test'
* origin/topic/johanna/gh-1829-test:
  Add testcase for TCP segment offloading.
2021-11-23 15:35:35 +00:00
Johanna Amann
3846f69f38 Merge remote-tracking branch 'origin/topic/johanna/openssl-3-compat'
* origin/topic/johanna/openssl-3-compat:
  Update cmake submodule for OpenSSL 3.0 changes
  OpenSSL 3: normalize self-signed-cert error message
  Make cmake & ci like OpenSSL 3.0
  Add OpenSSL 3.0 CI test
  OpenSSL 3: fix warnings and tests
  Switch OpaqueVal hashing back to legacy OpenSSL implementation

Fixes GH-1379
2021-11-23 13:48:26 +00:00
Johanna Amann
d3f16af4ab Add testcase for TCP segment offloading.
Relates to GH-1829
2021-11-23 12:37:55 +00:00
Johanna Amann
12d81b27ed Merge remote-tracking branch 'origin/master' into topic/johanna/openssl-3-compat 2021-11-23 10:23:12 +00:00