Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
19529 commits 387 branches 195 tags 255 MiB
Commit graph

3779 commits

Author SHA1 Message Date
Arne Welzel
906b91dca8 Merge remote-tracking branch 'origin/topic/vern/http-sqli-replacement' 
* origin/topic/vern/http-sqli-replacement:
  site/local: Switch to detect-sql-injection
  Add a revised script for detecting HTTP SQL injection, deprecate original
 2025-05-20 16:26:13 +02:00
Tim Wojtulewicz
ddeecabc1e Merge remote-tracking branch 'origin/topic/awelzel/event-trace-fix-operator-equals' 
* origin/topic/awelzel/event-trace-fix-operator-equals:
  EventTrace: Fix operator==() UBSAN downcast error
 2025-05-19 12:33:08 -07:00
Christian Kreibich
fdecfba6b4 Merge branch 'smoot-improve-from_json' of github.com:/stevesmoot/zeek 
* 'smoot-improve-from_json' of github.com:/stevesmoot/zeek:
  update baseline for zam
  Update src/zeek.bif
  Change from_json to return an error rather than print it.
 2025-05-19 11:06:29 -07:00
Arne Welzel
eb15997cc3 Merge remote-tracking branch 'origin/topic/awelzel/event-trace-mgr-destructor-fclose' 
* origin/topic/awelzel/event-trace-mgr-destructor-fclose:
  btest/core: Add event-trace test
  zeek-setup: Free event_trace_mgr after generating trace
  EventTraceMgr: Rename etm to event_trace_mgr
  EventTraceMgr: Move fclose() to destructor
 2025-05-19 20:02:12 +02:00
Tim Wojtulewicz
cc79afd24f Merge remote-tracking branch 'origin/topic/timw/include-cleanup-part-2' 
* origin/topic/timw/include-cleanup-part-2:
  Remove unnecessary #includes in script_opt
  Remove unnecessary #includes in telemetry and supervisor
  Remove unnecessary #includes in cluster/broker/iosource/probabilistic/session
  Remove unnecessary #includes in zeekygen and base plugin files
  Remove unnecessary #includes in input/logging/threading
  Remove unnecessary #includes in analyzer/packet analyzer/file analyzer source files
  Remove unnecessary #includes in analyzer/packet analyzer/file analyzer headers
  Remove unnecessary #includes in base files in repo
 2025-05-19 10:26:05 -07:00
Tim Wojtulewicz
224be5a951 Merge remote-tracking branch 'origin/topic/timw/rename-ci-github-labels' 
* origin/topic/timw/rename-ci-github-labels:
  Rename CI-related github labels for PRs
 2025-05-19 09:44:10 -07:00
Tim Wojtulewicz
9683e88795 Merge remote-tracking branch 'origin/topic/timw/include-cleanup-part-1' 
* origin/topic/timw/include-cleanup-part-1:
  Remove including <cinttypes> from util.h
  Remove telemetry #includes from OpaqueVal.h
  Reduce includes in plugin/Component.h
  Remove zeek/Stats.h include from NetVar.h
  Include StmtBase/StmtEnums in Func.h instead of Stmt.h
  Use modern names for standard headers
  Remove fix for CentOS 7 from TCP_Flags.h
  Fix usage of std::string in http analyzer
  Reorder top section of net_util.h to batch includes together
  Use quotes instead of <> for zeek includes
  Fix Obj.h include in IntrusivePtr.h to have full path
 2025-05-16 10:27:46 -07:00
Arne Welzel
4691e2c51b Merge remote-tracking branch 'origin/topic/vern/event-trace-on-exit' 
* origin/topic/vern/event-trace-on-exit:
  Generate --event-trace output explicitly rather than in EventTraceMgr destructor
 2025-05-16 13:40:04 +02:00
Tim Wojtulewicz
6833088cde Merge remote-tracking branch 'origin/topic/timw/disallow-blind-searching-for-krb5-on-macos' 
* origin/topic/timw/disallow-blind-searching-for-krb5-on-macos:
  Require non-system version of libkrb5 on macOS
 2025-05-15 12:15:57 -07:00
Arne Welzel
e40aac30f4 Merge remote-tracking branch 'origin/topic/awelzel/bump-ixwebsocket-11.4.6' 
* origin/topic/awelzel/bump-ixwebsocket-11.4.6:
  IXWebSocket: Point at upstream, bump to v11.4.6
 2025-05-15 16:44:30 +02:00
Johanna Amann
9d3e39581e Merge branch 'topic/jgras/pop3-stls-dpd' of https://github.com/J-Gras/zeek 
* 'topic/jgras/pop3-stls-dpd' of https://github.com/J-Gras/zeek:
  Add STLS command to POP3 DPD signature
 2025-05-15 10:23:43 +01:00
Arne Welzel
2255fa23b8 Merge remote-tracking branch 'origin/topic/vern/zam-aggr-change-in-loop' 
* origin/topic/vern/zam-aggr-change-in-loop:
  fix for ZAM optimization when an aggregate is modified inside of a loop
 2025-05-13 19:50:56 +02:00
Tim Wojtulewicz
5aa6734042 Merge remote-tracking branch 'origin/topic/timw/allow-macos-libkrb5' 
* origin/topic/timw/allow-macos-libkrb5:
  Allow macOS to search for libkrb5, but disallow system version of library
 2025-05-13 10:03:55 -07:00
Arne Welzel
8f60d37ad0 Merge remote-tracking branch 'origin/topic/awelzel/4440-websocket-pong-timeout' 
* origin/topic/awelzel/4440-websocket-pong-timeout:
  btest/cluster/websocket: Update tests for new event signature
  cluster/websocket: Propagate code and reason to websocket_client_lost()
  cluster/websocket: Support configurable ping interval
  IXWebSocket: Bump to improve O^2 rxbuf erase()
 2025-05-13 18:58:54 +02:00
Tim Wojtulewicz
912356deac Merge remote-tracking branch 'origin/topic/bbannier/fix-spicy-main' 
* origin/topic/bbannier/fix-spicy-main:
  Fix clang-tidy `bugprone-inc-dec-in-conditions` report in Spicy plugins glue compiler
  Fix clang-tidy `performance-enum-size` reports in Spicy plugin's glue compiler
  Remove unneeded copies in Spicy plugin glue compiler
  Adjust for renamed function flavor in Spicy development version
 2025-05-12 11:33:54 -07:00
Arne Welzel
6b6c3dbbb7 Merge remote-tracking branch 'origin/topic/justin/file_analysis_speedup' 
* origin/topic/justin/file_analysis_speedup:
  speed up file analysis, remove IncrementByteCount
 2025-05-09 17:25:55 +02:00
Arne Welzel
20ada619c5 Updating submodules binpac, broker and zeek-aux [nomail] 2025-05-09 09:52:20 +02:00
Tim Wojtulewicz
957098af1c Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy' 
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
 2025-05-08 15:14:37 -07:00
Christian Kreibich
8d79429555 Merge branch 'topic/christian/fix-broker-peering-overflows-metric' 
* topic/christian/fix-broker-peering-overflows-metric:
  Bugfix: accurately track Broker buffer overflows w/ multiple peerings
 2025-05-08 15:07:39 -07:00
Tim Wojtulewicz
2c17c85f55 Merge branch 'topic/timw/switch-broker-error-to-error' 
* topic/timw/switch-broker-error-to-error:
  Downgrade broker clone FatalError to an Error
 2025-05-08 13:47:06 -07:00
Arne Welzel
7583651bec Merge remote-tracking branch 'origin/topic/awelzel/ci-fedora-42' 
* origin/topic/awelzel/ci-fedora-42:
  probabilistic/BitVector: Add include <cstdint>
  Bump spicy to fix build with GCC 15.1
  CI: Drop fedora-40
  CI: Add fedora-42
 2025-05-08 13:19:30 +02:00
Arne Welzel
60efc7741d Merge branch 'gcc15' of https://github.com/i2z1/zeek 
* 'gcc15' of https://github.com/i2z1/zeek:
  Include cstdint header to support uint8_t/uint64_t in GCC 15+
 2025-05-08 09:25:28 +02:00
Tim Wojtulewicz
1dfbd33929 Merge remote-tracking branch 'origin/topic/timw/storage-timeout-option' 
* origin/topic/timw/storage-timeout-option:
  Move options to redis backend options instead of module-level options
  Add operation_timeout and command_timeout storage backend options
 2025-05-07 15:39:35 -07:00
Tim Wojtulewicz
507974a1d8 Merge remote-tracking branch 'origin/topic/christian/news-fix' 
* origin/topic/christian/news-fix:
  Fix Broker metrics naming bugs that snuck in w/ last-minute renaming [skip ci]
 2025-05-07 14:09:52 -07:00
Tim Wojtulewicz
6f8924596f Merge remote-tracking branch 'origin/topic/johanna/fix-failed-service-logging' 
* origin/topic/johanna/fix-failed-service-logging:
  Fix policy/protocols/conn/failed-service-logging.zeek
 2025-05-07 10:29:54 -07:00
Arne Welzel
8089f5bed4 Merge remote-tracking branch 'origin/topic/awelzel/more-terminate-while-queueing-hardening' 
* origin/topic/awelzel/more-terminate-while-queueing-hardening:
  btest/cluster/generic/publish-any: Apply Christian's fix from broker/publish-any
  wstest/terminate-while-queueing: Patch close_socket()
 2025-05-07 17:24:04 +02:00
Tim Wojtulewicz
d7b31f5b44 Merge remote-tracking branch 'origin/topic/timw/storage-is-connected-bif' 
* origin/topic/timw/storage-is-connected-bif:
  Add Storage::is_connected BIF
  Move cast_handle from storage-async.bif to BackendHandleVal static method
 2025-05-07 08:16:59 -07:00
Arne Welzel
135acc7c6d Merge remote-tracking branch 'origin/topic/awelzel/fix-flaky-terminate-while-queueing' 
* origin/topic/awelzel/fix-flaky-terminate-while-queueing:
  cluster/websocket: Stop and wait for reply thread during Terminate()
 2025-05-07 13:22:13 +02:00
Arne Welzel
3be7a9ce91 Merge remote-tracking branch 'origin/topic/awelzel/double-commented-btest-lines' 
* origin/topic/awelzel/double-commented-btest-lines:
  testing/btest: Fix double commented @TEST- lines
 2025-05-06 14:21:03 +02:00
Arne Welzel
4afb0ffeeb Merge remote-tracking branch 'origin/topic/awelzel/4420-simeon-breaking-websockets' 
* origin/topic/awelzel/4420-simeon-breaking-websockets:
  Websocket: Close onloop during Terminate()
  OnLoop: notify_all() instead of notify_one()
 2025-05-06 14:20:38 +02:00
Tim Wojtulewicz
0393e4b84a Merge remote-tracking branch 'XueSongTap/master' 
* XueSongTap/master:
  Add baseline for find_first test, update comments, and reorder function imports
  Add find_first string function
 2025-05-05 13:40:40 -07:00
Tim Wojtulewicz
f9aa9a430d Merge remote-tracking branch 'origin/topic/timw/storage-check-redis-server-version' 
* origin/topic/timw/storage-check-redis-server-version:
  Add commands to the static methods for the Redis implementation
  Redis: Check server version when connecting
 2025-05-05 11:12:09 -07:00
Tim Wojtulewicz
58d71d2fa3 Merge remote-tracking branch 'origin/topic/timw/storage-redis-expire-string-view' 
* origin/topic/timw/storage-redis-expire-string-view:
  Use std::string_view in Redis::DoExpire to avoid copies
 2025-05-05 10:44:51 -07:00
Arne Welzel
50ac8d1468 Merge remote-tracking branch 'origin/topic/awelzel/4405-quic-fragmented-crypto' 
* origin/topic/awelzel/4405-quic-fragmented-crypto:
  Bump external/zeek-testing
  QUIC: Extract reset_crypto() function
  QUIC: Rename ConnectionIDInfo to Context
  QUIC: Switch initial_destination_conn_id to optional
  QUIC: Use initial destination conn_id for decryption
  QUIC: Handle CRYPTO frames across multiple INITIAL packets
  QUIC: Do not consume EncryptedLongPacketPayload
  QUIC: Fix ACK frame parsing
 2025-05-05 14:40:59 +02:00
Arne Welzel
d655c64e0b Merge remote-tracking branch 'origin/topic/awelzel/event-publish-hook' 
* origin/topic/awelzel/event-publish-hook:
  NEWS: Add HookPublishEvent() note
  btest/plugin: Test for PublishEventHook()
  broker and cluster: Wire up HookPublishEvent
  plugin: Add HookPublishEvent hook
 2025-04-30 17:57:46 +02:00
Arne Welzel
f8b75426ee Merge remote-tracking branch 'origin/topic/awelzel/bif-tracking-no-zeromq' 
* origin/topic/awelzel/bif-tracking-no-zeromq:
  ZAM-bif-tracking: Remove ZeroMQ dependency
 2025-04-30 17:23:22 +02:00
Tim Wojtulewicz
e56de061f9 Merge remote-tracking branch 'origin/topic/vern/zam-inlining-temps' 
* origin/topic/vern/zam-inlining-temps:
  fixed incorrect ZAM optimization of expressions seen in single-statement inlined functions
 2025-04-29 17:50:39 -07:00
Tim Wojtulewicz
2cf8497bf7 Merge remote-tracking branch 'origin/topic/timw/update-ct-ca-lists' 
* origin/topic/timw/update-ct-ca-lists:
  External tests: add removed logs to CT list to prevent baseline changes
  Update Mozilla CA list and CT list to NSS 3.110
 2025-04-29 08:53:04 -07:00
Arne Welzel
d5e1dc27c6 Merge branch 'topic/mohan/intel-event-groups' of https://github.com/Mohan-Dhawan/zeek 
* 'topic/mohan/intel-event-groups' of https://github.com/Mohan-Dhawan/zeek:
  coalesce smtp handlers for ADDR
  Add fine-grained groups for Intel events
 2025-04-29 15:00:58 +02:00
Arne Welzel
5bf660a9ce Merge remote-tracking branch 'origin/topic/awelzel/cluster-coverity-fixes' 
* origin/topic/awelzel/cluster-coverity-fixes:
  broker/WebSocketShim: Check RegisterFd() return
  cluster/OnLoop: Fix coverity report about proc accessed without lock
 2025-04-28 19:41:10 +02:00
Arne Welzel
540baa89af Merge remote-tracking branch 'origin/topic/awelzel/3045-no-holes-in-vectors' 
* origin/topic/awelzel/3045-no-holes-in-vectors:
  broker/Data/data_to_val: Fail on vectors/lists with holes
 2025-04-28 18:24:25 +02:00
Tim Wojtulewicz
b9b268bd86 Merge remote-tracking branch 'origin/topic/timw/use-after-move' 
* origin/topic/timw/use-after-move:
  Fix use-after-move in recent broker changes
 2025-04-25 16:11:56 -07:00
Tim Wojtulewicz
82bf555f7d Merge branch 'topic/timw/4218-lowercase-http' 
* topic/timw/4218-lowercase-http:
  Ignore case when matching prefix in http analyzer
 2025-04-25 10:33:39 -07:00
Tim Wojtulewicz
4f65b89edf Merge remote-tracking branch 'origin/topic/timw/seven-two-news' 
* origin/topic/timw/seven-two-news:
  Updates for the various Broker changes
  Add versions of bundled dependencies
  Fix a few typos.
  Additional user contributions for NEWS
  NEWS addition for cluster backends
  NEWS additions for 7.2
  Reformat 7.2 NEWS entries for consistent line lengths
 2025-04-25 10:25:12 -07:00
Christian Kreibich
ebd0207352 Merge branch 'topic/christian/broker-tuning' 
* topic/christian/broker-tuning:
  Lower listen/connect retry intervals in Broker and the cluster framework to 1sec
  Bump cluster testsuite
  Switch Broker's default backpressure policy to drop_oldest, bump buffer sizes
  Deprecate Broker::congestion_queue_size and stop using it internally
 2025-04-25 10:23:55 -07:00
Christian Kreibich
c1a5f70df8 Merge branch 'topic/christian/broker-backpressure-metrics' 
* topic/christian/broker-backpressure-metrics:
  Add basic btest to verify that Broker peering telemetry is available.
  Add cluster framework telemetry for Broker's send-buffer use
  Add peer buffer update tracking to the Broker manager's event_observer
  Rename the Broker manager's LoggerAdapter
  Avoid race in the cluster/broker/publish-any btest
 2025-04-25 10:04:09 -07:00
Tim Wojtulewicz
6f52bdd29a Merge remote-tracking branch 'origin/topic/timw/clang-tidy-highway-hash' 
* origin/topic/timw/clang-tidy-highway-hash:
  Skip linting on highwayhash and src/3rdparty files
 2025-04-25 06:41:16 -07:00
Tim Wojtulewicz
c4613cf573 Merge remote-tracking branch 'origin/topic/timw/storage-framework-script-docs-updates' 
* origin/topic/timw/storage-framework-script-docs-updates:
  Minor changes to storage framework script docs
 2025-04-25 06:40:54 -07:00
Evan Typanski
154ee7720e Merge remote-tracking branch 'origin/topic/etyp/spicy-bump' 
* origin/topic/etyp/spicy-bump:
  Bump Spicy
 2025-04-25 08:41:02 -04:00
Arne Welzel
a852ecf913 Merge remote-tracking branch 'origin/topic/awelzel/backend-ready-callback-logic' 
* origin/topic/awelzel/backend-ready-callback-logic:
  btest/cluster/websocket: Move no-subscriptions test
  cluster/websocket: Leverage ReadyToPublishCallback()
  cluster/zeromq: Implement DoReadyToPublishCallback()
  cluster/Backend: Add ReadyToPublishCallback() API
 2025-04-25 10:06:36 +00:00