Commit graph

1577 commits

Author SHA1 Message Date
Jon Siwek
70b45d1aba Merge remote-tracking branch 'origin/topic/robin/631-deprecation-v2'
During merge I split the test for bro_init/bro_done/bro_script_loaded
event errors into individual tests since the other testing of the zeek
versions of those events seemed fine to otherwise keep.

* origin/topic/robin/631-deprecation-v2:
  Update NEWS for naming changes.
  Small cleanup and updating submodules.
  Remove test for legacy plugin.
  Remove legancy symlinks in aux/.
  Add warnings when loading scripts ending in ".bro", or using legacy environment variables.
  Fix missing rename.
  No longer symlink local.zeek to local.bro.
  Update notice user agent.
  Remove old_comm_usage_is_ok.
  Remove bro-config.h.in and bro-path-dev.in.
  Change Bro wrapper script to now abort when old executable names are still used.
  Remove APIs that were explicitly deprecated to be removed in 3.1.
2020-01-30 19:19:56 -08:00
Tim Wojtulewicz
c5b2659b6b Merge remote-tracking branch 'origin/topic/jsiwek/supervisor-coverity-fixes'
* origin/topic/jsiwek/supervisor-coverity-fixes:
  Fix leaked FDs in redirecting supervised node stdout/stderr
  Add checks for failed fcntl calls
  Set Pipe file descriptor flags correctly
2020-01-30 08:44:59 -07:00
Jon Siwek
f3e5728bcb Merge branch 'leaks' of https://github.com/MaxKellermann/zeek
* 'leaks' of https://github.com/MaxKellermann/zeek:
  Scope: fix memory leak by removing duplicate copy_string() call
  util, nb_dns: fix off-by-one bugs in strncpy() calls
  Type, util: add `constexpr` to static variables
  Net: remove unused variable
2020-01-29 11:50:09 -08:00
Johanna Amann
ad18014bed Merge remote-tracking branch 'origin/topic/jsiwek/ssl-empty-files'
* origin/topic/jsiwek/ssl-empty-files:
  Skip file analysis for zero-length SSL/TLS data
2020-01-29 11:16:35 -08:00
Robin Sommer
6bcd583836 Merge remote-tracking branch 'origin/topic/jsiwek/supervisor'
* origin/topic/jsiwek/supervisor: (44 commits)
  Add note that Supervisor script APIs are unstable until 4.0
  Move command-line arg parsing functions to Options.{h,cc}
  Add btests for supervisor stem/leaf process revival
  Move supervisor control events into SupervisorControl namespace
  Fix supervisor "destroy" call on nodes not currently alive
  Move supervisor source files into supervisor/
  Address supervisor code re-factoring feedback from Robin
  Convert supervisor internals to rapidjson
  Add Supervisor documentation
  Add supervisor btests
  Improve logging of supervised node errors
  Fix supervised node inheritence of command-line script paths
  Improve normalize_path() util function
  Use a timer to check for death of supervised node's parent
  Improve supervisor checks for parent process termination
  Improve handling of premature supervisor stem exit
  Improve supervisor signal handler safety
  Remove unused supervisor config options
  Cleanup minor Supervisor TODOs
  Improve supervisor debug logging
  ...
2020-01-29 13:11:04 +00:00
Jon Siwek
84b8ee3b06 Merge remote-tracking branch 'origin/topic/jsiwek/cirrus-catalina'
* origin/topic/jsiwek/cirrus-catalina:
  Update Cirrus CI config to use macOS Catalina
2020-01-28 17:56:22 -08:00
Jon Siwek
83874fa5fa Merge branch 'getrandom' of https://github.com/MaxKellermann/zeek
- Removed the superfluous check for C++17 in the merge since that's
  a requirement enforced at the CMake-level.

* 'getrandom' of https://github.com/MaxKellermann/zeek:
  util: use getrandom() on Linux if available
2020-01-28 12:45:15 -08:00
Jon Siwek
0412cb3996 Merge branch 'topic/frerich/gh-750-uri-with-empty-portnum' of https://github.com/frerich/zeek
* 'topic/frerich/gh-750-uri-with-empty-portnum' of https://github.com/frerich/zeek:
  Document recent fix for decompose_uri in release notes
  Fixed decompose_uri choking on URIs with empty port component
  Adding test for decompose_uri parsing URI with empty port
2020-01-24 15:16:14 -08:00
Jon Siwek
f45c2cf06b Skip check for outdated docs in Cirrus CI for PRs 2020-01-23 18:10:17 -08:00
Johanna Amann
97bea7c4f1 Merge remote-tracking branch 'origin/topic/jsiwek/fix-create-stream-priorities'
* origin/topic/jsiwek/fix-create-stream-priorities:
  Use consistent zeek_init priority for Log::create_stream calls
2020-01-23 15:31:06 -08:00
Robin Sommer
fc1c95725b Update Broker submodule.
Includes a test baseline update for change in Broker error message.
2020-01-23 13:51:29 +00:00
Robin Sommer
01b7db5b46 Merge remote-tracking branch 'origin/topic/jsiwek/smb-transaction-strings'
* origin/topic/jsiwek/smb-transaction-strings:
  Improve creation of SMB transaction data strings
2020-01-23 13:19:11 +00:00
Robin Sommer
11850088ee Merge remote-tracking branch 'origin/topic/jsiwek/ftp-word'
* origin/topic/jsiwek/ftp-word:
  Improve FTP word/whitespace handling
2020-01-23 13:14:46 +00:00
Robin Sommer
270702cacb Updating CHANGES and VERSION. 2020-01-18 14:32:30 +00:00
Robin Sommer
c8c6621a0e Merge remote-tracking branch 'origin/topic/timw/bit-fields'
* origin/topic/timw/bit-fields:
  Use bools instead of single-bit bitfields in Ident and TCP protocol analyzers
  Bit of code-modernization cleanup in BroString
  Use fixed types in NetbiosSSN.h and Timer.h instead of bit fields
2020-01-17 11:55:00 +00:00
Robin Sommer
0d29a80519 Merge remote-tracking branch 'origin/topic/jsiwek/ftp-adat-fix'
* origin/topic/jsiwek/ftp-adat-fix:
  Handle invalid Base64 encodings in FTP ADAT analyzer
2020-01-16 13:27:03 +00:00
Jon Siwek
f59e3da4f7 Merge remote-tracking branch 'origin/sethhall-fix-ssl-files-warning'
* origin/sethhall-fix-ssl-files-warning:
  Fix warning when reading files from non-network sources
2020-01-14 09:46:19 -08:00
Robin Sommer
bcf9dbac94 Update submodules. 2020-01-13 12:11:08 +00:00
Jon Siwek
6218f99b96 Update timeouts for a btest 2020-01-09 19:05:23 -08:00
Tim Wojtulewicz
03eb1d43d2 Merge remote-tracking branch 'origin/topic/jsiwek/btest-asan-options'
* origin/topic/jsiwek/btest-asan-options:
  Extend ASAN_OPTIONS in btests instead of overwrite
2020-01-09 13:39:49 -08:00
Jon Siwek
da0185a60f Update external test repo commit hash 2020-01-09 12:29:02 -08:00
Tim Wojtulewicz
1e41d7f583 Merge remote-tracking branch 'origin/topic/jsiwek/doctest-leakcheck'
* origin/topic/jsiwek/doctest-leakcheck:
  Enable LeakSanitizer for unit tests run via doctest
2020-01-09 11:38:28 -08:00
Tim Wojtulewicz
d845627daa Merge remote-tracking branch 'origin/topic/jazoff/ntlm-field-error'
* origin/topic/jazoff/ntlm-field-error:
  fix NTLM field value access
2020-01-09 10:26:00 -08:00
Jon Siwek
66ca20b737 Increase timeout for a few btests
Saw these start being sensitive running an "ASan -O0" build locally
2020-01-08 10:31:16 -08:00
Jon Siwek
3273169385 Preserve optimization setting for sanitizer build 2020-01-07 20:58:35 -08:00
Jon Siwek
0c55b01ec9 Merge remote-tracking branch 'origin/topic/timw/fix-x509-build-warning'
* origin/topic/timw/fix-x509-build-warning:
  Fix build warning in X509 plugin
2020-01-06 16:46:17 -08:00
Jon Siwek
d581aa76aa Merge remote-tracking branch 'origin/topic/dev/patterns-in-sets'
Fixes in merge:
- Memory leak in HashKey ctor
- Minor whitespace/style changes

* origin/topic/dev/patterns-in-sets:
  Enable Patterns as Table index in non singleton cases
  Added support to create a Hashkey for PatternVals using their Pattern Texts
2020-01-06 14:15:30 -08:00
Tim Wojtulewicz
71e6893441 Merge remote-tracking branch 'origin/topic/jsiwek/fix-hexdump-warning'
* origin/topic/jsiwek/fix-hexdump-warning:
  Fix snprintf compiler warning in hexdump BIF
2020-01-06 14:16:55 -07:00
Jon Siwek
149d3b4828 Increase a timeout for a btest 2020-01-06 11:20:30 -08:00
Jon Siwek
0cde6d2af5 Fix Cirrus CI FreeBSD python dependencies installation 2020-01-06 10:51:17 -08:00
Tim Wojtulewicz
65a4e36a92 Merge remote-tracking branch 'origin/topic/jsiwek/asan'
* origin/topic/jsiwek/asan: (28 commits)
  Increase timeout for a btest
  Switch CI scripts to use ASAN/LSAN instead of gperftools
  Remove redundant memory leak btests
  Fix reference counting issues related to lambdas/closures
  Disable LeakSanitizer for btests that have known leaks
  Rewrite the btest for when-statement timeouts
  Fix memory leak when a logging plugin hook prevents a write
  Fix memory leaks in various input framework error-handling cases
  Fix memory leak in Reporter::get_weird_sampling_whitelist() BIF
  Fix reference counting of Log::Filter "config" field
  Fix memory leak in system_env() BIF
  Clean up triggers awaiting global state modification at shutdown
  Fix memory leak in initializing log writers with no local backend
  Fix packet filter memory leaks
  Skip sending thread heartbeat if it alread asked to be finished
  Fix memory leak of sqlite input reader prepared statement
  Prevent duplicate "finish" threading messages
  Fix memory leak when table-based input stream overwrites old entries
  Fix scripting error in a DHCP btest
  Fix memory leaks in Kerberos ticket decryption
  ...
2020-01-06 11:20:47 -07:00
Jon Siwek
a4fab5327a Merge remote-tracking branch 'origin/topic/timw/util-unit-tests'
* origin/topic/timw/util-unit-tests:
  fixup! Add unit tests to util.cc and module_util.cc
  Mark safe_snprintf and safe_vsnprintf as deprecated, remove uses of them
  Add unit tests to util.cc and module_util.cc
2020-01-06 09:44:43 -08:00
Jon Siwek
84e3bc7aca Add GitHub Action for CI notification emails 2019-12-18 13:36:40 -08:00
Jon Siwek
52f97c7e45 Update encrypted key used for CI access 2019-12-18 13:24:47 -08:00
Jon Siwek
92c2074193 Merge remote-tracking branch 'origin/topic/timw/599-json-leak'
* origin/topic/timw/599-json-leak:
  GHI-599: avoid memory leak with default pattern matching and json formatting
2019-12-16 09:40:43 -08:00
Jon Siwek
5658a529f0 Update URL for Malware Hash Registry website 2019-12-16 08:22:46 -08:00
Tim Wojtulewicz
679da0b15b Merge remote-tracking branch 'origin/topic/jsiwek/gh-700-zeek-args-bif'
* origin/topic/jsiwek/gh-700-zeek-args-bif:
  GH-700: add zeek_args() BIF
2019-12-05 12:36:35 -07:00
Tim Wojtulewicz
5c85b083b6 Merge remote-tracking branch 'origin/topic/jsiwek/gh-700-packet-sources-bif'
* origin/topic/jsiwek/gh-700-packet-sources-bif:
  GH-700: add packet_sources() BIF
2019-12-05 11:58:06 -07:00
Tim Wojtulewicz
33571e7d19 Merge remote-tracking branch 'origin/topic/devbali/use-new-zeek-logo'
* origin/topic/devbali/use-new-zeek-logo:
  Use new Zeek Logo instead of Bro Eyes on README.md
2019-12-04 14:44:00 -07:00
Jon Siwek
30d0b21ecc Merge remote-tracking branch 'origin/topic/dev/print-to-log'
Adjustments during merge:

- kept the UNKNOWN Log::ID as placeholder value
- changed the coverage.find-bro-logs test to check for arbitrary $path
  field values instead of just string literals
- don't force EnumVal to unsigned integer since the relevant union member
  is the signed integer and added the relevant enum values/types to
  .bif files for easier access
- compare FILE* versus file name to check for stdout equality (don't
  think it matters much, just a bit more efficient)
- minor whitespace/style tweaks

* origin/topic/dev/print-to-log:
  Added a non boolean configuration and other changes as suggested by Jon
  Allow Print Statements to be redirected to a Log# This is a combination of 3 commits.
2019-12-02 13:47:09 -08:00
Johanna Amann
e5db1f085c Merge remote-tracking branch 'origin/topic/jsiwek/gh-684-fix-rpc-parsing'
* origin/topic/jsiwek/gh-684-fix-rpc-parsing:
  GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors

Addresses GH-684
2019-11-21 08:50:28 -08:00
Johanna Amann
5dafa7218d Merge remote-tracking branch 'origin/topic/jsiwek/fix-zeek-profiler-file'
* origin/topic/jsiwek/fix-zeek-profiler-file:
  Fix ZEEK_PROFILER_FILE file format/parsing
2019-11-21 08:37:04 -08:00
Robin Sommer
a00f139f1c Merge remote-tracking branch 'origin/topic/jsiwek/gh-646-conn-removal'
Clarified doc strings a bit.

* origin/topic/jsiwek/gh-646-conn-removal:
  GH-646: add new "successful_connection_remove" event
2019-11-18 12:08:12 +00:00
Jon Siwek
620b789126 Updating submodule(s).
[nomail]
2019-11-15 18:28:44 -08:00
Jon Siwek
17fd371eae Merge remote-tracking branch 'origin/topic/neverlord/doctest'
- Minor whitespace tweaks
- Add line to build summary output for whether unit tests are enabled

* origin/topic/neverlord/doctest:
  Add doctest license and copyright
  Integrate review feedback
  Fix submodule reference for doctest
  Add initial scaffold for unit testing via doctest
2019-11-14 19:17:37 -08:00
Jon Siwek
0e0063335a Merge branch 'topic/simon/configure-fail-hint' of https://github.com/simonhf/zeek
- Adjusted the hint text a bit during merge

* 'topic/simon/configure-fail-hint' of https://github.com/simonhf/zeek:
  Add hint to run make distclean if configure fails
2019-11-14 17:30:06 -08:00
Jon Siwek
2395a73f26 Install test-all-policy.zeek script
The zeekygen script, which is already installed, refers to it, and
could also generally be useful for "test everything" type scenarios.
2019-11-14 17:00:29 -08:00
Jon Siwek
ca48a1865d Merge branch 'improve-container-record-fields-bif' of https://github.com/henridf/zeek
- Minor whitespace adjustment in merge

* 'improve-container-record-fields-bif' of https://github.com/henridf/zeek:
  Recursively handle into container types in record_fields()
  tabify
  Apply suggestions from code review
  Print full container types in record_fields()
2019-11-13 13:46:27 -08:00
Jon Siwek
eaa1350656 Update embedded CAF to 0.17.3 2019-11-11 13:40:31 -08:00
Johanna Amann
b86a8acc2b Merge remote-tracking branch 'origin/topic/jsiwek/improve-record-fields-bif'
* origin/topic/jsiwek/improve-record-fields-bif:
  Allow record_fields() string arguments that name a record type
2019-11-07 13:49:14 -08:00