For low-level packet analysis use-cases, these fields are currently
not script-land accessible via raw_packet() or so. They are accessible
on the icmp_context record, but not on the actual ip4_hdr record, so
add them.
Moving the defaults for build variables from the `configure` script to
`CMakeLists.txt` gives the same default behavior on platforms where the
`configure` script is not available (Windows) and also allows a pure
CMake-based work flow (e.g., the standard `cmake -S . -B build`) without
having to manually adjust the defaults.
The `configure` script also becomes much simpler as a result.
The PktSrc::Stats object works with 64bit unsigned integers. Unfortunately,
libpcap's struct pcap_stat is using 32bit values and users have reported
the wrapping of these values being visible in their stats.log roughly every
7.5 hours (~160kpps).
This change moves tracking of link and drop counters into the PktSrc::Stats
object (like is done for received and bytes_received) and updates them
on a call to PcapSource::Statistics() with the difference to the
previous stats values to prevent the wrap from becoming visible to
script land.
This doesn't cover the case of the stats counters wrapping around multiple
times between two invocations of PktSrc::Statistics(). With the default
interval of 5 minutes for the stats script, this seems acceptable.
Closes#2791.
* jgras/topic/jgras/cluster-init-tests:
Simplify btests using cluster_started event.
Remove old cluster start tests.
Reverted removal of old cluster start tests during merge.
* origin/topic/timw/windows-ci-unit-testing:
Modify Windows test cmd file to actually run tests
Add template file and cmake call for zeek-path setup on Windows
* origin/topic/neverlord/gh-2806:
test/builtin-plugins: Add plugin using ZEEK_VERSION_NUMBER
Revert putting plugins into a fresh scope for now
Propagate zeek-version.h skip via CMake properties
* origin/topic/awelzel/zeekctl-multiple-loggers:
NEWS: Add entry for ZeekControl and multi-loggers
Bump zeekctl to multi-logger version
logging: Support rotation_postprocessor_command_env
* origin/topic/timw/2324-llc-snap-and-novell-oh-my:
Update docs and NEWS to include LLC, SNAP, and Novell packet analyzers
Fix length checks in VLAN/Ethernet analyzers for non-ethertype protocols
Add forwarding from VLAN analyzer into LLC, SNAP, and Novell 802.3 analyzers
Remove non-standard way of forwarding out of the Ethernet analyzer
Add basic LLC, SNAP, and Novell 802.3 packet analyzers
ARP: add support for IEEE802 hardware type
* topic/timw/2167-aruba-expansion:
Add NEWS entry about 802.11 and ARUBA changes
Remove workaround for tunnels from IEEE 802.11 analyzer
PPP in the GRE analyzer is actually PP*T*P
Add support for 802.11 A-MSDU aggregates
Fix IEEE 802.11 analyzer to properly forward tunneled packets
Fix IEEE 802.11 analyzer to skip packets with the Protected bit enabled
Expand support for Aruba protocol types in GRE analyzer
Default tunnel_type in iosource::Packet to NONE
This also fixes the GRE analyzer to forward into the IEEE 802.11 analyzer
if it encounters Aruba packets with the proper protocol types. This way
the QoS header can be handled correctly.
* origin/topic/christian/sync-ignore_checksums-from-cli:
Given the -C flag, set script-layer ignore_checksums to true.
Add btest for "-C" flag vs the script-layer ignore_checksums global.
* Mask VLAN ID from tp_vlan_tci field to fix vlan > 4095 reported by Zeek
when PCP and/or DEI bits are set.
* Descriptive error message when interface is down. Instead of
"Invalid argument", Zeek now reports "interface is down".
* Performance improvements for the Redis Log::log_stream_policy example
around PortVal wrapping and caching field offsets for property lookups.
* Debug output is now channeled through PLUGIN_DBG_LOG() and available via
zeek -B plugin-Zeek-JavaScript instead of unconditionally on stderr.
* Reduced CMake output when Node.js isn't found
