Commit graph

3803 commits

Author SHA1 Message Date
Tim Wojtulewicz
3282bbc429 Merge remote-tracking branch 'origin/topic/vern/ZAM-maint.May25'
* origin/topic/vern/ZAM-maint.May25:
  fix for crash when interpreting transformed ASTs that include multi-field record assignments/additions
  Remove unused ZAM compiler method
2025-05-30 13:07:01 -07:00
Tim Wojtulewicz
70bc0d9deb Merge remote-tracking branch 'origin/topic/timw/cleanup-cmake-summary-output'
* origin/topic/timw/cleanup-cmake-summary-output:
  Add utility methods to make CMake summary output nicer
2025-05-30 12:16:35 -07:00
Tim Wojtulewicz
dc5dd8be45 Merge remote-tracking branch 'origin/topic/timw/new-ci-pr-labels'
* origin/topic/timw/new-ci-pr-labels:
  CI: Add PR label for skipping all CI jobs
  CI: Add PR label for running cluster tests
2025-05-30 10:29:37 -07:00
Tim Wojtulewicz
9c290df47f Merge remote-tracking branch 'origin/topic/timw/ci-clang-tidy'
* origin/topic/timw/ci-clang-tidy:
  CI: Add new task to run clang-tidy as part of nightly builds
  CI: Update to clang 19 on ubuntu 24.04, add clang-tidy package
2025-05-30 08:39:36 -07:00
Arne Welzel
f4cd92e24a Merge remote-tracking branch 'origin/topic/awelzel/4494-ts-millis-signed'
* origin/topic/awelzel/4494-ts-millis-signed:
  logging/ascii/json: Make TS_MILLIS signed, add TS_MILLIS_UNSIGNED
2025-05-30 17:24:17 +02:00
Tim Wojtulewicz
c387ec87be Merge remote-tracking branch 'origin/topic/timw/clang-tidy-performance-fixes'
* origin/topic/timw/clang-tidy-performance-fixes:
  Add move operations for LogWriteHeader
  Add missing setting of type in session::Key move operations
  Update .clang-tidy to have performance-* enabled with some exclusions
  Fix clang-tidy performance-inefficient-string-concatenation warnings
  Fix clang-tidy performance-unnecessary-copy-initialization warnings
  Fix clang-tidy performance-move-const-argument warnings (not move assignable/copyable)
  Fix clang-tidy performance-move-const-argument warnings (passing move to const argument)
  Fix clang-tidy performance-move-const-argument warnings (moving trivially copyable)
  Fix clang-tidy performance-move-const-argument warnings (moving const variables)
  Fix clang-tidy performance-inefficient-vector-operation warnings
  Fix clang-tidy performance-for-range-copy warnings
  Fix clang-tidy performance-faster-string-find warnings
  Fix clang-tidy performance-enum-size warnings
  Fix clang-tidy performance-avoid-endl warnings
2025-05-30 08:13:19 -07:00
Arne Welzel
10bfb34a8a Update doc submodule [nomail] [skip ci]
Fix botched last-minute cleanup.
2025-05-30 16:49:10 +02:00
Arne Welzel
1d241fabf4 Merge remote-tracking branch 'origin/topic/awelzel/zeekygen-field-directive'
* origin/topic/awelzel/zeekygen-field-directive:
  Bump doc submodule for ext/zeek.py modifications
  RecordType:DescribeReST: Render RecordType using zeek:field directive
2025-05-30 16:44:42 +02:00
Arne Welzel
f16ebd34b3 Merge remote-tracking branch 'origin/topic/awelzel/4474-cluster-websocket-ipv6'
* origin/topic/awelzel/4474-cluster-websocket-ipv6:
  IXWebsocket: Bump to version with memset() sock addr fix
  cluster/websocket: Deprecate $listen_host, introduce $listen_addr
  cluster/websocket-ixwebsocket: Determine proper address_family
2025-05-30 11:47:55 +02:00
Tim Wojtulewicz
2d7aad2c81 Merge remote-tracking branch 'origin/topic/timw/remove-with-bind'
* origin/topic/timw/remove-with-bind:
  Remove obsolete --with-bind configure flag
2025-05-28 08:29:50 -07:00
Tim Wojtulewicz
88ae3ba412 Merge remote-tracking branch 'origin/topic/timw/coverity'
* origin/topic/timw/coverity:
  Add a few std::moves to fix Coverity warnings
  Fix possible memory leak in broker::Manager
  fixup! Use SCN* constants when reading into sized integer types
  from_json: Statically lookup err index in result type
  Use SCN* constants when reading into sized integer types
  Remove setting unused variable value in FTP::parse_eftp
2025-05-27 12:49:13 -07:00
Tim Wojtulewicz
aaca36dc22 Merge remote-tracking branch 'origin/topic/timw/clang-tidy-bugprone-fixes'
* origin/topic/timw/clang-tidy-bugprone-fixes: (22 commits)
  Update .clang-tidy to have bugprone-* enabled with some exclusions
  Fix clang-tidy bugprone-unused-return-value warnings
  Fix clang-tidy bugprone-unsafe-functions warnings
  Fix clang-tidy bugprone-unused-local-non-trivial-variable warnings
  Fix clang-tidy bugprone-throw-keyword-missing warnings
  Fix clang-tidy bugprone-switch-missing-default-case warnings
  Fix clang-tidy bugprone-suspicious-realloc-usage warnings
  Fix clang-tidy bugprone-suspicious-include warnings
  Fix clang-tidy bugprone-suspicious-string-compare warnings
  Fix clang-tidy bugprone-suspicious-stringview-data-usage warnings
  Fix clang-tidy bugprone-string-literal-with-embedded-nul warnings
  Fix clang-tidy bugprone-parent-virtual-call warnings
  Fix clang-tidy bugprone-misplaced-widening-cast warnings
  Fix clang-tidy bugprone-inc-dec-in-conditions warnings
  Fix clang-tidy bugprone-multi-level-implicit-pointer-conversion warnings
  Fix clang-tidy bugprone-macro-parentheses warnings
  Fix clang-tidy bugprone-incorrect-roundings warnings
  Fix clang-tidy bugprone-incorrect-division warnings
  Fix clang-tidy bugprone-implicit-widening-of-multiplication-result warnings
  Remove noexcept from util::tokenize_string
  ...
2025-05-27 11:59:46 -07:00
Johanna Amann
8ce741a7a8 Merge remote-tracking branch 'origin/topic/johanna/gh-4463'
* origin/topic/johanna/gh-4463:
  Add explicit TLS support for FTP
2025-05-27 17:47:52 +01:00
Evan Typanski
9f2fb47f48 Merge remote-tracking branch 'origin/topic/etyp/redis-analyzer'
* origin/topic/etyp/redis-analyzer:
  spicy-redis: Add NEWS entry
  spicy-redis: Separate error replies from success
  spicy-redis: Cleanup scripts and tests
  spciy-redis: Bring Redis analyzer into Zeek proper
  spicy-redis: Abort parsing if server data comes first
  spicy-redis: Add recursion depth to server data
  spicy-redis: Make client data only accept bulk strings
  spicy-redis: Add dpd signature and clean pcaps
  spicy-redis: Add some commands and touch up parsing
  spicy-redis: Add some script logic for logging
  spicy-redis: Separate client/server
  spicy-redis: Touchup logging and Spicy issues
  spicy-redis: Add synchronization and pipeline support
  spicy-redis: Begin Spicy Redis analyzer
2025-05-27 10:20:00 -04:00
Arne Welzel
cef63e871e Merge remote-tracking branch 'origin/topic/awelzel/fix-no-zero-timestamp-metadata'
* origin/topic/awelzel/fix-no-zero-timestamp-metadata:
  btest: Add test for Cluster::hello zero-timestamp
  EventMgr/Enqueue: Add automatic timestamp metadata to local events, only
  cluster and broker: Propagate zero-timestamp as metadata, too.
2025-05-26 16:08:58 +02:00
Tim Wojtulewicz
f996f661b6 Merge remote-tracking branch 'origin/topic/timw/redis-connection-failure'
* origin/topic/timw/redis-connection-failure:
  Redis: bump version of hiredis required
  Redis: return proper error if connection fails
2025-05-23 12:13:51 -07:00
Arne Welzel
d929392a76 Merge remote-tracking branch 'origin/topic/awelzel/4177-4178-custom-event-metadata-part-1'
* origin/topic/awelzel/4177-4178-custom-event-metadata-part-1:
  Event: Move meta after args
  Event: Use IntrusivePtr to manage obj refcount
  btest/zam: Update for new EventMetadata bifs
  broker and cluster: Switch to new Enqueue() API
  Event/zeek.bif: Add EventMetadata current() and current_values() accessors
  Event: Deprecate default network timestamp metadata
  Event: Store timestamp in metadata vector
  EventRegistry/zeek.bif/init-bare: Add event metadata infrastructure
  EventMgr: Add CurrentEvent() accessor
2025-05-23 21:02:28 +02:00
Tim Wojtulewicz
57b618ee4a Merge remote-tracking branch 'origin/topic/timw/remove-findclangtidy'
* origin/topic/timw/remove-findclangtidy:
  Remove FindClangTidy.cmake, update cmake submodule
2025-05-23 08:32:13 -07:00
Tim Wojtulewicz
bb17d9e4d6 Merge remote-tracking branch 'origin/topic/timw/sqlite-cluster-test-followup'
* origin/topic/timw/sqlite-cluster-test-followup:
  SQLite: Add TODO note about possibly using sqlite3_busy_timeout
  SQLite: Fix typo in variable name causing pragmas not to retry on busy
  SQLite: Use tableval iteration instead of ToMap for pragmas
  SQLite: Fix logging/error messages around executing pragmas
2025-05-22 16:55:20 -07:00
Tim Wojtulewicz
6b104f3e22 Merge remote-tracking branch 'origin/topic/timw/fix-sqlite-btest-output'
* origin/topic/timw/fix-sqlite-btest-output:
  Update baseline of sqlite-basic btest after recent changes
2025-05-21 12:47:16 -07:00
Tim Wojtulewicz
1862e66097 Merge remote-tracking branch 'origin/topic/timw/sqlite-cluster-test'
* origin/topic/timw/sqlite-cluster-test:
  SQLite: Move integrity_check to pragma table
  SQLite: Add backend option for pragma timeout
  SQLite: Rename tuning_params to pragma_commands, move running pragmas to utility method
  SQLite: Retry pragma statements at startup to avoid contention
  SQLite: Check for locked database as well as busy databases
  SQLite: Fix some string-sizing issues
  SQLite: Run pragmas on connection before creating table
  SQLite: Add busy_timeout pragma to default options
  Prefix sqlite-based btests with sqlite- to match redis tests
  Add sqlite cluster storage btest
2025-05-21 09:41:15 -07:00
Arne Welzel
891338194f Merge remote-tracking branch 'origin/topic/awelzel/fixup-detect-sql-injection-zeekygen-comment'
* origin/topic/awelzel/fixup-detect-sql-injection-zeekygen-comment:
  http/detect-sql-injection: Fix zeekygen comment
  btest/coverage/test-all-policy-zeekygen: Load test-all-policy with zeekygen enabled
2025-05-21 13:39:07 +02:00
Tim Wojtulewicz
c596556036 Merge remote-tracking branch 'origin/topic/timw/3913-parse-port-invalid-read'
* origin/topic/timw/3913-parse-port-invalid-read:
  Add extra input files to ftp fuzzer corpus
  Use bool instead of int flag in FTP analyzer's parse_eftp method
  Fix undefined behavior in FTP analyzer's parse_port method
  Fix invalid-read in FTP analyzer's parse_port method
2025-05-20 12:02:18 -07:00
Arne Welzel
ec744024d3 Merge remote-tracking branch 'origin/topic/awelzel/btest-cluster-layout-replacement'
* origin/topic/awelzel/btest-cluster-layout-replacement:
  btest remaining: Use generic cluster-layout.zeek
  btest/frameworks/logging: Use generic cluster-layout.zeek
  btest/files/x509: Use generic cluster-layout.zeek
  btest/frameworks/notice: Use generic cluster-layout.zeek
  btest/policy: Use generic cluster-layout.zeek
  btest/frameworks/intel: Use generic cluster-layout.zeek
  btest/frameworks/sumstats: Use generic cluster-layout.zeek
  btest/frameworks/cluster: Use generic cluster-layout.zeek
  btest/frameworks/config: Use generic cluster-layout.zeek
  btest/broker: Use generic cluster-layout.zeek
  btest/cluster: Use generic cluster-layout.zeek
  testing/btest/Files: Add generic broker/cluster-layout.zeek
2025-05-20 20:30:47 +02:00
Arne Welzel
906b91dca8 Merge remote-tracking branch 'origin/topic/vern/http-sqli-replacement'
* origin/topic/vern/http-sqli-replacement:
  site/local: Switch to detect-sql-injection
  Add a revised script for detecting HTTP SQL injection, deprecate original
2025-05-20 16:26:13 +02:00
Tim Wojtulewicz
ddeecabc1e Merge remote-tracking branch 'origin/topic/awelzel/event-trace-fix-operator-equals'
* origin/topic/awelzel/event-trace-fix-operator-equals:
  EventTrace: Fix operator==() UBSAN downcast error
2025-05-19 12:33:08 -07:00
Christian Kreibich
fdecfba6b4 Merge branch 'smoot-improve-from_json' of github.com:/stevesmoot/zeek
* 'smoot-improve-from_json' of github.com:/stevesmoot/zeek:
  update baseline for zam
  Update src/zeek.bif
  Change from_json to return an error rather than print it.
2025-05-19 11:06:29 -07:00
Arne Welzel
eb15997cc3 Merge remote-tracking branch 'origin/topic/awelzel/event-trace-mgr-destructor-fclose'
* origin/topic/awelzel/event-trace-mgr-destructor-fclose:
  btest/core: Add event-trace test
  zeek-setup: Free event_trace_mgr after generating trace
  EventTraceMgr: Rename etm to event_trace_mgr
  EventTraceMgr: Move fclose() to destructor
2025-05-19 20:02:12 +02:00
Tim Wojtulewicz
cc79afd24f Merge remote-tracking branch 'origin/topic/timw/include-cleanup-part-2'
* origin/topic/timw/include-cleanup-part-2:
  Remove unnecessary #includes in script_opt
  Remove unnecessary #includes in telemetry and supervisor
  Remove unnecessary #includes in cluster/broker/iosource/probabilistic/session
  Remove unnecessary #includes in zeekygen and base plugin files
  Remove unnecessary #includes in input/logging/threading
  Remove unnecessary #includes in analyzer/packet analyzer/file analyzer source files
  Remove unnecessary #includes in analyzer/packet analyzer/file analyzer headers
  Remove unnecessary #includes in base files in repo
2025-05-19 10:26:05 -07:00
Tim Wojtulewicz
224be5a951 Merge remote-tracking branch 'origin/topic/timw/rename-ci-github-labels'
* origin/topic/timw/rename-ci-github-labels:
  Rename CI-related github labels for PRs
2025-05-19 09:44:10 -07:00
Tim Wojtulewicz
9683e88795 Merge remote-tracking branch 'origin/topic/timw/include-cleanup-part-1'
* origin/topic/timw/include-cleanup-part-1:
  Remove including <cinttypes> from util.h
  Remove telemetry #includes from OpaqueVal.h
  Reduce includes in plugin/Component.h
  Remove zeek/Stats.h include from NetVar.h
  Include StmtBase/StmtEnums in Func.h instead of Stmt.h
  Use modern names for standard headers
  Remove fix for CentOS 7 from TCP_Flags.h
  Fix usage of std::string in http analyzer
  Reorder top section of net_util.h to batch includes together
  Use quotes instead of <> for zeek includes
  Fix Obj.h include in IntrusivePtr.h to have full path
2025-05-16 10:27:46 -07:00
Arne Welzel
4691e2c51b Merge remote-tracking branch 'origin/topic/vern/event-trace-on-exit'
* origin/topic/vern/event-trace-on-exit:
  Generate --event-trace output explicitly rather than in EventTraceMgr destructor
2025-05-16 13:40:04 +02:00
Tim Wojtulewicz
6833088cde Merge remote-tracking branch 'origin/topic/timw/disallow-blind-searching-for-krb5-on-macos'
* origin/topic/timw/disallow-blind-searching-for-krb5-on-macos:
  Require non-system version of libkrb5 on macOS
2025-05-15 12:15:57 -07:00
Arne Welzel
e40aac30f4 Merge remote-tracking branch 'origin/topic/awelzel/bump-ixwebsocket-11.4.6'
* origin/topic/awelzel/bump-ixwebsocket-11.4.6:
  IXWebSocket: Point at upstream, bump to v11.4.6
2025-05-15 16:44:30 +02:00
Johanna Amann
9d3e39581e Merge branch 'topic/jgras/pop3-stls-dpd' of https://github.com/J-Gras/zeek
* 'topic/jgras/pop3-stls-dpd' of https://github.com/J-Gras/zeek:
  Add STLS command to POP3 DPD signature
2025-05-15 10:23:43 +01:00
Arne Welzel
2255fa23b8 Merge remote-tracking branch 'origin/topic/vern/zam-aggr-change-in-loop'
* origin/topic/vern/zam-aggr-change-in-loop:
  fix for ZAM optimization when an aggregate is modified inside of a loop
2025-05-13 19:50:56 +02:00
Tim Wojtulewicz
5aa6734042 Merge remote-tracking branch 'origin/topic/timw/allow-macos-libkrb5'
* origin/topic/timw/allow-macos-libkrb5:
  Allow macOS to search for libkrb5, but disallow system version of library
2025-05-13 10:03:55 -07:00
Arne Welzel
8f60d37ad0 Merge remote-tracking branch 'origin/topic/awelzel/4440-websocket-pong-timeout'
* origin/topic/awelzel/4440-websocket-pong-timeout:
  btest/cluster/websocket: Update tests for new event signature
  cluster/websocket: Propagate code and reason to websocket_client_lost()
  cluster/websocket: Support configurable ping interval
  IXWebSocket: Bump to improve O^2 rxbuf erase()
2025-05-13 18:58:54 +02:00
Tim Wojtulewicz
912356deac Merge remote-tracking branch 'origin/topic/bbannier/fix-spicy-main'
* origin/topic/bbannier/fix-spicy-main:
  Fix clang-tidy `bugprone-inc-dec-in-conditions` report in Spicy plugins glue compiler
  Fix clang-tidy `performance-enum-size` reports in Spicy plugin's glue compiler
  Remove unneeded copies in Spicy plugin glue compiler
  Adjust for renamed function flavor in Spicy development version
2025-05-12 11:33:54 -07:00
Arne Welzel
6b6c3dbbb7 Merge remote-tracking branch 'origin/topic/justin/file_analysis_speedup'
* origin/topic/justin/file_analysis_speedup:
  speed up file analysis, remove IncrementByteCount
2025-05-09 17:25:55 +02:00
Arne Welzel
20ada619c5 Updating submodules binpac, broker and zeek-aux [nomail] 2025-05-09 09:52:20 +02:00
Tim Wojtulewicz
957098af1c Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2025-05-08 15:14:37 -07:00
Christian Kreibich
8d79429555 Merge branch 'topic/christian/fix-broker-peering-overflows-metric'
* topic/christian/fix-broker-peering-overflows-metric:
  Bugfix: accurately track Broker buffer overflows w/ multiple peerings
2025-05-08 15:07:39 -07:00
Tim Wojtulewicz
2c17c85f55 Merge branch 'topic/timw/switch-broker-error-to-error'
* topic/timw/switch-broker-error-to-error:
  Downgrade broker clone FatalError to an Error
2025-05-08 13:47:06 -07:00
Arne Welzel
7583651bec Merge remote-tracking branch 'origin/topic/awelzel/ci-fedora-42'
* origin/topic/awelzel/ci-fedora-42:
  probabilistic/BitVector: Add include <cstdint>
  Bump spicy to fix build with GCC 15.1
  CI: Drop fedora-40
  CI: Add fedora-42
2025-05-08 13:19:30 +02:00
Arne Welzel
60efc7741d Merge branch 'gcc15' of https://github.com/i2z1/zeek
* 'gcc15' of https://github.com/i2z1/zeek:
  Include cstdint header to support uint8_t/uint64_t in GCC 15+
2025-05-08 09:25:28 +02:00
Tim Wojtulewicz
1dfbd33929 Merge remote-tracking branch 'origin/topic/timw/storage-timeout-option'
* origin/topic/timw/storage-timeout-option:
  Move options to redis backend options instead of module-level options
  Add operation_timeout and command_timeout storage backend options
2025-05-07 15:39:35 -07:00
Tim Wojtulewicz
507974a1d8 Merge remote-tracking branch 'origin/topic/christian/news-fix'
* origin/topic/christian/news-fix:
  Fix Broker metrics naming bugs that snuck in w/ last-minute renaming [skip ci]
2025-05-07 14:09:52 -07:00
Tim Wojtulewicz
6f8924596f Merge remote-tracking branch 'origin/topic/johanna/fix-failed-service-logging'
* origin/topic/johanna/fix-failed-service-logging:
  Fix policy/protocols/conn/failed-service-logging.zeek
2025-05-07 10:29:54 -07:00
Arne Welzel
8089f5bed4 Merge remote-tracking branch 'origin/topic/awelzel/more-terminate-while-queueing-hardening'
* origin/topic/awelzel/more-terminate-while-queueing-hardening:
  btest/cluster/generic/publish-any: Apply Christian's fix from broker/publish-any
  wstest/terminate-while-queueing: Patch close_socket()
2025-05-07 17:24:04 +02:00