Commit graph

3756 commits

Author SHA1 Message Date
Tim Wojtulewicz
8632d79775 Merge remote-tracking branch 'origin/topic/timw/ci-centos9-newer-python'
* origin/topic/timw/ci-centos9-newer-python:
  CI: Update CentOS 9 to Python 3.13
2025-08-19 15:08:45 -07:00
Arne Welzel
cf8a54b3df Merge remote-tracking branch 'origin/topic/awelzel/no-null-strings-in-threading-vals'
* origin/topic/awelzel/no-null-strings-in-threading-vals:
  logging/Manager: Also pass non-null vector and set
  logging/Manager: Non-null strings for empty strings
2025-08-19 20:27:46 +02:00
Tim Wojtulewicz
7514f7c038 Merge remote-tracking branch 'origin/topic/timw/add-missing-cluster-serializer-header'
* origin/topic/timw/add-missing-cluster-serializer-header:
  Add a missing header for the broker cluster serializer
2025-08-18 14:59:50 -07:00
Tim Wojtulewicz
177a45f71c Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2025-08-18 14:47:14 -07:00
Evan Typanski
59e84e06f6 Merge remote-tracking branch 'origin/topic/etyp/fix-optional-attr-errors'
* origin/topic/etyp/fix-optional-attr-errors:
  Fix parameter attributes pretending to be records
  Only allow `&optional` in records
2025-08-18 14:49:56 -04:00
Tim Wojtulewicz
a4da8d3f7b Merge remote-tracking branch 'origin/topic/etyp/update-news-record-vec-deprecation'
* origin/topic/etyp/update-news-record-vec-deprecation:
  Add `record_type_to_vector` deprecation to NEWS
2025-08-18 09:40:50 -07:00
Arne Welzel
9b94e25e67 Merge remote-tracking branch 'origin/topic/awelzel/4754-follow-up'
* origin/topic/awelzel/4754-follow-up:
  cluster/serializer/broker: Drop unused include
  cluster/serializer/broker: fixup inconsistent param comment
2025-08-18 16:44:43 +02:00
Arne Welzel
2c9015d247 Merge branch 'master' of https://github.com/blightzero/zeek
* 'master' of https://github.com/blightzero/zeek:
  Changed behavior of var-extraction-uri.zeek from policy/protocol/http to extract only the URI parameter names. Do not include the path in the first parameter name. Only extract uri vars if parameters actually exist.
2025-08-18 13:14:34 +02:00
Arne Welzel
e04f725523 Merge remote-tracking branch 'amazing-pp/t/psql-login-no-role'
* amazing-pp/t/psql-login-no-role:
  Report PostgreSQL login success only after ReadyForQuery
2025-08-18 09:40:22 +02:00
Arne Welzel
c0a863cba0 Merge remote-tracking branch 'origin/topic/vern/stmt-line-numbers'
* origin/topic/vern/stmt-line-numbers:
  maintenance updates for ZAM BiF-tracking
  fix line numbers associated with "if" and initialization statements
2025-08-17 17:29:09 +02:00
Arne Welzel
3d6a064ecc Merge remote-tracking branch 'origin/topic/awelzel/4754-double-wrapped-broker-data-records'
* origin/topic/awelzel/4754-double-wrapped-broker-data-records:
  cluster/serializer/broker: Do not special case Broker::Data anymore
  broker/Data: Support unwrapping Broker::Data records
2025-08-17 16:57:28 +02:00
Tim Wojtulewicz
a3983cc939 Merge remote-tracking branch 'origin/revert-4746-topic/timw/move-submodules-to-main-repo'
* origin/revert-4746-topic/timw/move-submodules-to-main-repo:
  Revert "Move BinPAC, bifcl, af_packet, and gen_zam submodules into main zeek repo"
2025-08-15 15:21:12 -07:00
Tim Wojtulewicz
e64ec54172
Revert "Move BinPAC, bifcl, af_packet, and gen_zam submodules into main zeek repo" 2025-08-15 15:11:22 -07:00
Tim Wojtulewicz
a10a70994e Merge remote-tracking branch 'origin/topic/timw/move-submodules-to-main-repo'
* origin/topic/timw/move-submodules-to-main-repo:
  Fix some clang-tidy findings in generated BIF code
  Fix clang-tidy and pre-commit warnings for gen-zam code files
  Move gen-zam code into the main Zeek repository
  Move zeek-af_packet-plugin code into the main Zeek repository
  Move the bifcl code into the main Zeek repository
  Fix clang-tidy findings in the binpac lib code
  Add copyright headers to all of the binpac source files
  Move binpac code into the main Zeek repository
2025-08-15 14:02:23 -07:00
Arne Welzel
63574b9fd4 Merge remote-tracking branch 'origin/topic/awelzel/docker-trixie'
* origin/topic/awelzel/docker-trixie:
  ci: Run zeekctl and builtin tasks with Debian 13, too
  ci: Prepend timestamps to output
  ci: Enable Spicy for arm_debian13
  ci: Add Debian 13.0 (trixie)
  docker: Bump to debian:trixie-slim
2025-08-13 21:21:16 +02:00
Tim Wojtulewicz
75ba63eb3f Merge remote-tracking branch 'origin/topic/timw/limit-string-and-container-lengths-in-logs'
* origin/topic/timw/limit-string-and-container-lengths-in-logs:
  Add NEWS entry for field length limiting
  Tag truncated values with a flag, plus pack threading::Value better
  Remove length limiting on string fields for HTTP
  Make total_size counter a member in logging::Manager
  Remove using numeric_limits and just check for zero instead
  Expand the size of the log-size filters for x509
  Add options to filter at the stream level as well as globally
  Add a weird that gets emitted when strings/containers are over the limits
  Add metrics to track string and container fields limited by length
  Replace unused stream argument from RecordToLogRecord with WriterInfo
  Implement string- and container-length filtering at the log record level
2025-08-12 17:43:02 -07:00
Tim Wojtulewicz
cc59bfa5d8 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump pre-commit hooks
  Bump auxil/spicy to latest development snapshot
2025-08-12 12:38:51 -07:00
Tim Wojtulewicz
d9357b4204 Merge remote-tracking branch 'origin/topic/timw/remove-8.1-deprecations'
* origin/topic/timw/remove-8.1-deprecations:
  Pass DNS complete_flag along as a uint8_t instead of a String
  Update docs submodule with 8.1 deprecation removals
  Update zeekjs submodule with 8.1 deprecation fixes
  Remove deprecations tagged for v8.1
2025-08-12 11:01:29 -07:00
Tim Wojtulewicz
76289a8022 Merge remote-tracking branch 'origin/topic/awelzel/4730-smb-read-response-data-offset'
* origin/topic/awelzel/4730-smb-read-response-data-offset:
  smb2/read: Parse only 1 byte for data_offset, ignore reserved1
2025-08-11 11:37:38 -07:00
Tim Wojtulewicz
dff534962e Merge remote-tracking branch 'origin/topic/timw/docs-generation-virtualenv'
* origin/topic/timw/docs-generation-virtualenv:
  Update docs submodule with new python packages
  Use virtualenv in docs generation/builds
2025-08-10 21:28:48 -07:00
Arne Welzel
13f613eb1d Merge remote-tracking branch 'origin/topic/awelzel/4176-cluster-on-sub-unsub-hooks'
* origin/topic/awelzel/4176-cluster-on-sub-unsub-hooks:
  cluster: Add on_subscribe() and on_unsubscribe() hooks
2025-08-08 14:24:18 +02:00
Tim Wojtulewicz
54d67c3322 Merge remote-tracking branch 'origin/topic/timw/cleanup-warnings-from-plugin-btest-builds'
* origin/topic/timw/cleanup-warnings-from-plugin-btest-builds:
  Update zeek-aux to remove BRO_DIST from plugin skeleton
  cmake_minimum_required() should come before project()
2025-08-07 08:39:40 -07:00
Arne Welzel
bd9130a69a Merge remote-tracking branch 'origin/topic/awelzel/tap-analyzer-take-four-thanks-clang-tidy'
* origin/topic/awelzel/tap-analyzer-take-four-thanks-clang-tidy:
  btest/tap-analyzer: Update existing test and add new one for UpdateConnVal()
  SessionAdapter: Keep tap_analyzers until destruction
  tcp,udp,icmp adapters: Move TapPacket() to earlier
  tcp,udp,icmp adapters: Fix UpdateConnVal() superclass call
2025-08-07 10:49:12 +02:00
Johanna Amann
2f2f328a72 Merge remote-tracking branch 'origin/topic/johanna/analyzer-log-proto'
* origin/topic/johanna/analyzer-log-proto:
  Add proto to analyzer.log
2025-08-06 14:38:47 +01:00
Evan Typanski
22f77248f5 Merge remote-tracking branch 'origin/topic/etyp/fix-record-vec-type-conflict'
* origin/topic/etyp/fix-record-vec-type-conflict:
  Fix record coercion with compatible types
2025-08-06 09:10:19 -04:00
Arne Welzel
33b6869425 Merge remote-tracking branch 'origin/topic/awelzel/tap-analyzer-take-three'
* origin/topic/awelzel/tap-analyzer-take-three:
  TapAnalyzer: Fix docstring
  btest/plugins/tap-analyzer: Update baseline
2025-08-06 14:27:56 +02:00
Arne Welzel
7dea987432 Merge remote-tracking branch 'origin/topic/awelzel/4337-tap-analyzer-follow-up'
* origin/topic/awelzel/4337-tap-analyzer-follow-up:
  TapAnalyzer: More verdict to action rename
2025-08-05 20:00:44 +02:00
Arne Welzel
1e05588e8e Merge remote-tracking branch 'origin/topic/awelzel/4337-tap-analyzer-sketch'
* origin/topic/awelzel/4337-tap-analyzer-sketch:
  IPBasedAnalyzer: Call TapPacket() when skipping
  SessionAdapter: Introduce TapAnalyzer for session adapter
2025-08-05 19:49:01 +02:00
Christian Kreibich
56325d1412 Merge branch 'topic/christian/zeek-8.0-news'
* topic/christian/zeek-8.0-news:
  Compile contributors for Zeek 8.0 in the NEWS file
2025-08-04 09:35:53 -07:00
Arne Welzel
4ecc62322e Merge remote-tracking branch 'origin/topic/awelzel/depend-on-libzmq'
* origin/topic/awelzel/depend-on-libzmq:
  ci/windows: No ZeroMQ cluster backend
  cluster/zeromq: Bail on missing ZeroMQ by default
2025-08-01 17:10:32 +02:00
Arne Welzel
3c2d01e19e Merge remote-tracking branch 'origin/topic/neverlord/std-span'
* origin/topic/neverlord/std-span:
  Remove zeek::Span and use std::span instead
2025-08-01 14:50:02 +02:00
Tim Wojtulewicz
f2e155d7fa Merge remote-tracking branch 'origin/topic/timw/update-ct-ca-lists'
* origin/topic/timw/update-ct-ca-lists:
  Update CT/CA lists to versions from NSS 3.114
2025-07-31 14:32:21 -07:00
Tim Wojtulewicz
b9a5a635bd Merge remote-tracking branch 'origin/topic/timw/clang-tidy-fix'
* origin/topic/timw/clang-tidy-fix:
  Fix use-after-move reported by clang-tidy
2025-07-31 10:34:58 -07:00
Johanna Amann
136bdb43fd Merge remote-tracking branch 'origin/topic/johanna/gh-4694'
* origin/topic/johanna/gh-4694:
  Add tests for the deprecated-dpd-log.zeek policy script
  Move c$service_violation to deprecated-dpd-log.zeek
2025-07-31 16:11:00 +01:00
Tim Wojtulewicz
3e0012ea30 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump `auxil/spicy` to latest development snapshot
2025-07-31 07:58:05 -07:00
Arne Welzel
10e7f14f78 Merge remote-tracking branch 'origin/topic/awelzel/defer-more-stuff'
* origin/topic/awelzel/defer-more-stuff:
  RecordType: Ensure &default fields are always re-initialized
  Attr: Deprecate using &default and &optional together on record fields
  RecordType: Allow deferring &default=vector(), set(), table() fields
2025-07-30 10:35:56 +02:00
Arne Welzel
d7fbd49d9e Merge remote-tracking branch 'origin/topic/vern/zam-record-fields-fixes'
* origin/topic/vern/zam-record-fields-fixes:
  fixes for specialized ZAM operations needing to check whether record fields exist
2025-07-30 10:08:21 +02:00
Johanna Amann
a22b45c69e Merge remote-tracking branch 'origin/topic/johanna/gh-4202'
* origin/topic/johanna/gh-4202:
  Update NEWS for Conn::set_conn changes
  DNS-fuzzer: raise new_connection event
  Optimize Conn::set_conn to minimize operations
  Move Conn::set_conn() from connection_state_remove to new_connection
2025-07-29 21:01:51 +01:00
Arne Welzel
ab282e3637 Merge remote-tracking branch 'origin/topic/awelzel/cluster-event-out-of-detail'
* origin/topic/awelzel/cluster-event-out-of-detail:
  cluster::Event: Move implementation into cluster/Event.{h,cc}
  cluster: Move cluster::detail::Event to cluster::Event
2025-07-29 18:24:20 +02:00
Tim Wojtulewicz
9f3a1a135f Merge remote-tracking branch 'origin/topic/timw/fix-fuzzer-conn-key-deprecation'
* origin/topic/timw/fix-fuzzer-conn-key-deprecation:
  Fix ConnKey deprecation warnings from generic fuzzer
2025-07-29 07:41:23 -07:00
Tim Wojtulewicz
743b9e27cc Merge remote-tracking branch 'origin/topic/timw/fix-irc-analyzer-event-types'
* origin/topic/timw/fix-irc-analyzer-event-types:
  Fix types passed to some of the IRC analyzer events
2025-07-29 07:19:36 -07:00
Tim Wojtulewicz
06ec03046d Merge remote-tracking branch 'origin/topic/timw/fix-ranges-debian-11-build-failure'
* origin/topic/timw/fix-ranges-debian-11-build-failure:
  Fix build failure with std::ranges on Debian 11
2025-07-29 07:19:11 -07:00
Arne Welzel
cd7836dda2 Merge remote-tracking branch 'origin/topic/awelzel/4431-zeromq-drop-policy-v2'
* origin/topic/awelzel/4431-zeromq-drop-policy-v2:
  cluster.bif: Improve Cluster::publish() docstring
  btest/cluster/zeromq: Add tests for overload behavior
  cluster/zeromq: Metric for msg errors
  cluster/zeromq: Drop events when overloaded
  cluster/zeromq: Comments and move lookups to InitPostScript()
  cluster/zeromq: Rework lambdas to member functions
  cluster/zeromq: Support local XPUB/XSUB hwm and buf configurability
  cluster/OnLoop: Support DontBlock and Force flags for queueing
  cluster/ThreadedBackend: Injectable OnLoopProcess instance
2025-07-29 11:38:49 +02:00
Arne Welzel
12518e8256 Merge remote-tracking branch 'origin/topic/awelzel/expose-num-packets-unprocessed'
* origin/topic/awelzel/expose-num-packets-unprocessed:
  ConnStats: Expose num_packets_unprocessed
  packet_analysis/Manager: Rename GetUnprocessedCount() to PacketsUnprocessed()
2025-07-29 10:12:46 +02:00
Arne Welzel
96f9cc73c3 Merge remote-tracking branch 'origin/topic/awelzel/spicy-format-for-8.0'
* origin/topic/awelzel/spicy-format-for-8.0:
  Update .git-blame-ignore-revs
  analyzer/protocol: Reformat with spicy-format
  pre-commit-config: Bump spicy-format to 0.26.0
2025-07-29 10:05:33 +02:00
Tim Wojtulewicz
73d56407b1 Merge remote-tracking branch 'origin/topic/awelzel/3935-dce-rpc-named-pipe-docs'
* origin/topic/awelzel/3935-dce-rpc-named-pipe-docs:
  dce-rpc: Make named_pipe filed docs extensive
2025-07-28 14:18:23 -07:00
Tim Wojtulewicz
22fc57a90a Merge remote-tracking branch 'origin/topic/johanna/gh-4656'
* origin/topic/johanna/gh-4656:
  Fix parsing of EDNS rcode
2025-07-28 14:16:24 -07:00
Tim Wojtulewicz
8063be111a Merge remote-tracking branch 'origin/topic/timw/more-irc-coverage'
* origin/topic/timw/more-irc-coverage:
  Expand coverage of IRC analyzer with more commands
  Add support for ircv3 tags
2025-07-28 14:15:47 -07:00
Tim Wojtulewicz
8aeaed69c5 Merge remote-tracking branch 'origin/topic/timw/lazy-allocate-id-option-handlers'
* origin/topic/timw/lazy-allocate-id-option-handlers:
  Move ID::type in structure to fill memory padding
  Use sorted forward_list instead of multimap for ID option change handlers
2025-07-28 13:57:26 -07:00
Tim Wojtulewicz
020dd1a848 Merge remote-tracking branch 'origin/topic/timw/cpp20-modernization'
* origin/topic/timw/cpp20-modernization:
  Remove intermediate cipher vectors in ssl-analyzer.pac
  Reduce the size of Func::Body quite a bit with some extra packing
  Switch to using std::ranges algorithms
  Enable modernize-std-numbers clang-tidy checker, fix findings
  Switch to using c++20 constraints instead of std::enable_if
2025-07-28 13:13:02 -07:00