Commit graph

3196 commits

Author SHA1 Message Date
Arne Welzel
5ef5733fcc Merge remote-tracking branch 'matti/topic/matti/docker-jq'
* matti/topic/matti/docker-jq:
  Add jq to final.Dockerfile
2023-11-21 14:32:40 +01:00
Arne Welzel
f95ec84d77 Merge remote-tracking branch 'origin/topic/awelzel/pattern-tables-reuse-compile-set'
* origin/topic/awelzel/pattern-tables-reuse-compile-set:
  TableVal: Replace raw subnets/pattern_matcher with unique_ptr
  TablePatternMatcher: Drop Insert()/Remove(), use Clear()
  TableType: Simplify and inline Is...Index tests
  NEWS: Add small table[pattern] section
  Expr/Val: Add support for in set[pattern]
  zeek.bif: Implement table_pattern_matcher_stats() bif for introspection
  DFA: Extract inner Stats struct from DFA_State_Cache
  Expr: Implement string in table[pattern] of X
  RE: Remove RE_DisjunctiveMatcher and re-use MatchAll()
  TablePatternMatcher: Use const StringValPtr& instead of const StringVal*
  Val: Move TablePatternMatcher into detail namespace
  TablePatternMatcher: Use unique_ptr
  IndexType: Add IsPatternIndex(), like IsSubNetIndex()
  btest: Add test for pattern tables and when
  Reuse CompileSet() instead of || string formatting
  script optimization support for using strings to index table[pattern] values
  BTests for indexing "table[pattern] of T" with strings
  support for indexing "table[pattern] of T" with strings to get multi-matches
2023-11-21 12:00:51 +01:00
Arne Welzel
a5a79d3f3a Merge remote-tracking branch 'origin/topic/awelzel/3453-dnssec-ed448-ed25519'
* origin/topic/awelzel/3453-dnssec-ed448-ed25519:
  DNS: Add Ed25519 and Ed448 enum values to parser
2023-11-21 10:08:34 +01:00
Arne Welzel
b0a200a5dc Merge remote-tracking branch 'origin/topic/vern/zam-EH-coalesce'
* origin/topic/vern/zam-EH-coalesce:
  BTest updates to accommodate event handler coalescence differences
  BTests for testing that event handler coalescence operates as expected
  coalescing of event handlers (ZAM optimization)

Minor fixups during merge as commented on the PR.
2023-11-17 18:05:32 +01:00
Tim Wojtulewicz
de77b034c2 Merge remote-tracking branch 'origin/topic/timw/opensuse-ci-fixes'
* origin/topic/timw/opensuse-ci-fixes:
  CI: Install missing packages on opensuse
2023-11-17 09:24:44 -07:00
Arne Welzel
d9b8154c4e Merge remote-tracking branch 'origin/topic/awelzel/3455-do-split-string-2'
* origin/topic/awelzel/3455-do-split-string-2:
  strings.bif/do_split_string: Pass bol and eol to MatchPrefix()
  RE_Matcher: Add MatchPrefix with bol/eol control
2023-11-17 13:01:47 +01:00
Arne Welzel
abc32b3b46 Merge remote-tracking branch 'origin/topic/neverlord/coverity-1523915'
* origin/topic/neverlord/coverity-1523915:
  Bind scan_path to the scope; avoid heap allocation
2023-11-11 17:46:04 +01:00
Arne Welzel
a488dcffb6 Merge remote-tracking branch 'origin/topic/vern/script-opt.Nov23'
* origin/topic/vern/script-opt.Nov23:
  retention of superseded AST elements to prevent pointer mis-aliasing
  BTest updates for latest ZAM maintenance
  greater ZAM optimization of inlined function calls
  some minor ZAM optimization improvements
  added "-O noinline" option to turn off ZAM inlining, to help with diagnosing optimization problems
  fixes for a number of ZAM optimization bugs
  allow explicitly marking an identifier as equivalent to special '_' identifier
  fixed some warnings about mixing signed & unsigned integers
  descriptions of "for" statements now include their "value variable" if present
2023-11-10 12:43:08 +01:00
Robin Sommer
2498f7dbe9
Merge remote-tracking branch 'origin/topic/robin/gh-3443-skip'
* origin/topic/robin/gh-3443-skip:
  Spicy: Provide `zeek::skip_input()` to disable deliver to current analyzer.
2023-11-09 17:22:48 +01:00
Arne Welzel
a7e1841be1 Merge remote-tracking branch 'origin/topic/awelzel/btest-test-dirs-add-opt-and-misc'
* origin/topic/awelzel/btest-test-dirs-add-opt-and-misc:
  btest/opt: Update pure-inlining baseline
  btest/opt: Update basic baseline
  Expr: Fix alloc-dealloc-mismatch
  btest: Move zam/basic.test into opt/basic.test, update TestDirs
2023-11-09 10:42:49 +01:00
Arne Welzel
cef0210799 Merge remote-tracking branch 'origin/topic/awelzel/deprecate-things-for-7.1'
* origin/topic/awelzel/deprecate-things-for-7.1:
  Bump zeekctl
  EventHandler: Deprecate SetUsed() and Used() as well.
  EventRegistry: Deprecate UsedHandlers() and UnusedHandlers()
  time machine: Mark leftovers for removal in v7.1
  policy/misc/load-balancing: Deprecate script
  cluster: Deprecate the Cluster::Node$interface field
2023-11-07 19:42:56 +01:00
Arne Welzel
46b7e9d7be Merge remote-tracking branch 'origin/topic/timw/update-bifcl-binpac'
* origin/topic/timw/update-bifcl-binpac:
  Update binpac and bifcl submodules [nomail]
2023-11-07 10:03:43 +01:00
Arne Welzel
8a13155a41 Merge branch 'topic/xb-anssi/http_signature_body_end_match' of https://github.com/xb-anssi/zeek
* 'topic/xb-anssi/http_signature_body_end_match' of https://github.com/xb-anssi/zeek:
  Let signature framework match HTTP body end
  Test how the signature framework matches HTTP body
2023-11-07 09:58:59 +01:00
Arne Welzel
768153452a Merge remote-tracking branch 'origin/topic/neverlord/copy-string'
* origin/topic/neverlord/copy-string:
  Fix unsafe and inefficient uses of copy_string
2023-11-07 09:57:12 +01:00
Tim Wojtulewicz
f2608680ce Merge remote-tracking branch 'origin/topic/timw/update-c-ares'
* origin/topic/timw/update-c-ares:
  Update c-ares in Windows conanfile
  Upgrade c-ares submodule to 1.21.0
2023-11-06 09:30:01 -07:00
Arne Welzel
4eb1b71d1b Merge remote-tracking branch 'origin/topic/awelzel/3379-shared-ptr-and-micro-optimizations'
* origin/topic/awelzel/3379-shared-ptr-and-micro-optimizations:
  build_inner_connection: Use the outer packet's timestamp
  build_inner_connection: Avoid one extra Init()
  packet_analysis: Do not run DetectProtocol() on disabled analyzers
  packet_analysis/Dispatcher: Do not index table twice
  packet_analysis: Avoid shared_ptr copying for analyzer lookups
2023-11-01 12:04:47 +01:00
Johanna Amann
3257c0e216 Merge remote-tracking branch 'origin/topic/johanna/its-time-to-add-more-tls-extension-types'
* origin/topic/johanna/its-time-to-add-more-tls-extension-types:
  SSL: Add new extension types and ECH test
2023-10-31 16:19:57 +00:00
Tim Wojtulewicz
d7cb384545 Merge remote-tracking branch 'origin/topic/bbannier/use-spicy-formatting-style'
* origin/topic/bbannier/use-spicy-formatting-style:
  Update `.git-blame-ignore-revs`
  Format JSON with clang-format
  Bump pre-commit hooks
  Reformat Zeek in Spicy style
2023-10-30 12:48:37 -07:00
Benjamin Bannier
552c65a881 Merge remote-tracking branch 'origin/topic/bbannier/issue-3421' 2023-10-30 11:47:43 +01:00
Tim Wojtulewicz
7852463b2f Merge remote-tracking branch 'security/topic/awelzel/195-ieee802-heap-buffer-overflow'
* security/topic/awelzel/195-ieee802-heap-buffer-overflow:
  IEEE802_11: Fix buffer-overflow due to not accounting for the amsdu header
2023-10-27 11:04:33 -07:00
Arne Welzel
ab4576369f Merge remote-tracking branch 'origin/topic/awelzel/3398-protocol-analyzer-packet-fuzzing'
* origin/topic/awelzel/3398-protocol-analyzer-packet-fuzzing:
  fuzzers: Add DTLS fuzzer
  generic-analyzer-fuzzer: Support NextPacket() fuzzing
2023-10-27 19:20:32 +02:00
Benjamin Bannier
08d9a1934f Merge branch 'origin/topic/bbannier/fix-core.mmdb-tests' 2023-10-26 15:34:40 +02:00
Arne Welzel
d999b74b99 Merge remote-tracking branch 'origin/topic/awelzel/generic-fuzzer-ux'
* origin/topic/awelzel/generic-fuzzer-ux:
  fuzzer-setup: Allow customization without recompiling
2023-10-25 17:02:44 +02:00
Arne Welzel
8b89f1cf8d Merge remote-tracking branch 'origin/topic/awelzel/3043-supervisor-safe-write-error'
* origin/topic/awelzel/3043-supervisor-safe-write-error:
  Supervisor: Handle EAGAIN error on stem pipe
2023-10-25 12:56:04 +02:00
Arne Welzel
ddcf75e934 Merge remote-tracking branch 'origin/topic/timw/verbose-cluster-testing-btests'
* origin/topic/timw/verbose-cluster-testing-btests:
  CI: Pass -A flag to btest for cluster-testing builds
2023-10-25 09:15:31 +02:00
Tim Wojtulewicz
e0182e17bf Merge remote-tracking branch 'origin/topic/neverlord/cmake-submodule-update'
* origin/topic/neverlord/cmake-submodule-update:
  Update CMake submodule for caching fix
2023-10-24 13:06:04 -07:00
Arne Welzel
22fb445a7f Merge remote-tracking branch 'origin/topic/awelzel/3190-supervisor-eventmgr-shared-pipe-fix'
* origin/topic/awelzel/3190-supervisor-eventmgr-shared-pipe-fix:
  event: Reinitialize EventMgr's flare after fork() from stem
2023-10-24 19:35:35 +02:00
Arne Welzel
44b67894ac Merge remote-tracking branch 'origin/topic/awelzel/mmdb-fix-and-tests'
* origin/topic/awelzel/mmdb-fix-and-tests:
  base/frameworks/spicy: Do not load base/misc/version
  btest/core/mmdb: Basic lookup_autonomous_system / lookup_location tests
  btest/files: Add mmdb testing databases and generator code
  zeek.bif: Switch mmdb stale check to network_time
  Fix mmdb pointer destruction
2023-10-24 14:13:37 +02:00
Benjamin Bannier
d3eaf587e7 Merge remote-tracking branch 'origin/topic/robin/gh-3370' 2023-10-23 11:30:12 +02:00
Tim Wojtulewicz
bf75f56ef7 Merge remote-tracking branch 'origin/topic/awelzel/quic-longer-but-configurable-history-max-length'
* origin/topic/awelzel/quic-longer-but-configurable-history-max-length:
  quic: Bump maximum history length, make configurable
2023-10-20 11:45:04 -07:00
Arne Welzel
e632131e9e Merge remote-tracking branch 'origin/topic/awelzel/add-ssl-fuzzer'
* origin/topic/awelzel/add-ssl-fuzzer:
  fuzzers: Add SSL fuzzer
2023-10-19 20:00:04 +02:00
Arne Welzel
ee827a0a63 Merge remote-tracking branch 'origin/topic/robin/gh-3383'
* origin/topic/robin/gh-3383:
  Fix missing version number in `spicyz`.
2023-10-19 16:26:05 +02:00
Arne Welzel
a503c2a672 Merge remote-tracking branch 'origin/topic/awelzel/quic-ldap-event-prototypes'
* origin/topic/awelzel/quic-ldap-event-prototypes:
  ldap: Use longer event names
  ldap: Add spicy-events.zeek
  quic: Add spicy-events.zeek
2023-10-19 11:08:36 +02:00
Tim Wojtulewicz
fc62bb477c Merge remote-tracking branch 'origin/topic/timw/3382-update-ssh-key-exchanges'
* origin/topic/timw/3382-update-ssh-key-exchanges:
  Add new SSH key exchange algorithms reported by OpenSSH 9.0
2023-10-18 12:05:37 -07:00
Arne Welzel
a5b94f04fd Merge remote-tracking branch 'origin/topic/awelzel/better-gre-over-udp-pcap'
* origin/topic/awelzel/better-gre-over-udp-pcap:
  gre-over-udp: Update testing pcap with both endpoints
2023-10-17 19:34:01 +02:00
Arne Welzel
a17923da50 Merge branch 'ldap-asn1-fixes' of https://github.com/pauldokas/zeek
* 'ldap-asn1-fixes' of https://github.com/pauldokas/zeek:
  performance improvements for the LDAP ASN.1 analyzer
2023-10-17 17:20:53 +02:00
Tim Wojtulewicz
d4993ebf7f Merge remote-tracking branch 'origin/topic/timw/3344-gre-over-udp'
* origin/topic/timw/3344-gre-over-udp:
  Add registration for GRE-over-UDP
2023-10-16 11:52:18 -07:00
Tim Wojtulewicz
6990d50e08 Merge remote-tracking branch 'origin/topic/neverlord/broker-refactoring'
* origin/topic/neverlord/broker-refactoring:
  Broker: Adapt to upstream API adjustments
2023-10-13 14:40:34 -07:00
Tim Wojtulewicz
738c39379f Start of 6.2.0 development 2023-10-13 10:58:29 -07:00
Arne Welzel
bd9b82f1fb Merge remote-tracking branch 'origin/topic/awelzel/quic-reuse-openssl-ctxs'
* origin/topic/awelzel/quic-reuse-openssl-ctxs:
  protocol/quic/decrypt_crypto: Reuse OpenSSL context objects
2023-10-13 13:16:15 +02:00
Arne Welzel
701eb6161a Merge remote-tracking branch 'origin/topic/timw/docker-builder-timeouts'
* origin/topic/timw/docker-builder-timeouts:
  CI: Add more logging during docker builds
  CI: Add timeouts for apt commands in docker builder Dockerfiles
2023-10-13 08:16:54 +02:00
Benjamin Bannier
e121654ee7 Merge remote-tracking branch 'origin/topic/bbannier/fix-signed-unsigned-comparison' 2023-10-12 17:11:38 +02:00
Arne Welzel
aa665435a6 Merge remote-tracking branch 'origin/topic/awelzel/no-bytes-in-variable-length-integer'
* origin/topic/awelzel/no-bytes-in-variable-length-integer:
  quic: Avoid bytes for VariableLengthInteger
2023-10-12 15:54:04 +02:00
Arne Welzel
007bcefd09 Merge remote-tracking branch 'origin/topic/awelzel/2326-import-quic'
* origin/topic/awelzel/2326-import-quic:
  ci/btest: Remove spicy-quic helper, disable Spicy on CentOS 7
  btest/core/ppp: Run test in bare mode
  btest/quic: Update other tests
  testing/quic: Fixups and simplification after Zeek integration
  quic: Integrate as default analyzer
  quic: Include Copyright lines to the analyzer's source code contributed by Fox-IT
  quic: Squashed follow-ups: quic.log, tests, various fixes, performance
  quic: Initial implementation
2023-10-11 18:05:14 +02:00
Arne Welzel
01bf1d4764 Merge remote-tracking branch 'origin/topic/awelzel/update-zeekygen-docs-show-stderr'
* origin/topic/awelzel/update-zeekygen-docs-show-stderr:
  ci/update-zeekygen-docs.sh: Do output stderr by default
  zeekygen: Disable zeek_init() handlers causing error output
  zeekygen/example: Squelch unused function warning
2023-10-11 15:21:31 +02:00
Arne Welzel
ffc35d90ba Merge remote-tracking branch 'origin/topic/awelzel/ldap-follow-up'
* origin/topic/awelzel/ldap-follow-up:
  protocol/ldap: Add doc-id/doc-description to .evt file
  spicy/manager: Ensure Zeekygen knows identifier for registered types
2023-10-11 14:09:32 +02:00
Arne Welzel
72df1a0216 Merge remote-tracking branch 'origin/topic/bbannier/issue-3234'
* origin/topic/bbannier/issue-3234:
  Introduce dedicated `LDAP::Info`
  Remove redundant storing of protocol in LDAP logs
  Use LDAP `RemovalHook` instead of implementing `connection_state_remove`
  Tidy up LDAP code by using local references
  Pluralize container names in LDAP types
  Move LDAP script constants to their own file
  Name `LDAP::Message` and `LDAP::Search` `*Info`
  Make ports for LDAP analyzers fully configurable
  Require have-spicy for tests which log spicy-ldap information
  Fix LDAP analyzer setup for when Spicy analyzers are disabled
  Bump zeek-testing-private
  Integrate spicy-ldap test suite
  Move spicy-ldap into Zeek protocol analyzer tree
  Explicitly use all of spicy-ldap's modules
  Explicitly list `asn1.spicy` as spicy-ldap source
  Remove uses of `zeek` module in spicy-ldap
  Fix typos in spicy-ldap
  Remove project configuration files in spicy-ldap
  Integrate spicy-ldap into build
  Import zeek/spicy-ldap@57b5eff988
2023-10-10 20:07:03 +02:00
Arne Welzel
48b27f30c9 Merge remote-tracking branch 'origin/topic/awelzel/plugin-hooks-bare-mode'
* origin/topic/awelzel/plugin-hooks-bare-mode:
  btest/plugins/hooks: Run in bare mode
2023-10-09 16:27:10 +02:00
Arne Welzel
4a8f868471 Merge remote-tracking branch 'origin/topic/awelzel/dump-events-in-bare-mode'
* origin/topic/awelzel/dump-events-in-bare-mode:
  btest/coverage: Add record-fields test
  btest/dump-events: Run in bare mode, load conn and smtp scripts only
2023-10-09 14:15:49 +02:00
Benjamin Bannier
8793cde485 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy' 2023-10-06 16:09:05 +02:00