Commit graph

11757 commits

Author SHA1 Message Date
Henrik Kramselund Jereminsen
8e8f2d0b12 Just a few ideas for improving the manual page 2021-05-13 16:03:46 +02:00
Jon Siwek
672504e265 Update submodule(s) [nomail] 2021-04-21 14:03:07 -07:00
Jon Siwek
d166250961 Merge remote-tracking branch 'origin/topic/timw/zeek-cut-lgtm'
* origin/topic/timw/zeek-cut-lgtm:
  Fix LGTM finding in zeek-cut with uses of localtime and gmtime
2021-04-20 15:21:12 -07:00
Jon Siwek
e8247c2472 Merge remote-tracking branch 'origin/topic/vern/vector-holes'
* origin/topic/vern/vector-holes:
  Remove NEWS entry regarding changed vector-holes functionality
  Fix potential segfaults in VectorVal Insert/Remove methods
  Fix copy() to work with a vector that has trailing holes
  update test suite for vector holes now being supported for numeric types
  add vector tests for creating holes, "in" operator, "?" operator, copying vectors with holes
  restore support for vectors with holes remove vestigial comment
  fix using ++/-- to vectors that contain holes
2021-04-20 14:43:01 -07:00
Jon Siwek
8cb824b889 Remove NEWS entry regarding changed vector-holes functionality
There's no longer breaking behavior changes to how vector-holes work.
2021-04-19 19:32:48 -07:00
Jon Siwek
fd5cdbbe50 Fix potential segfaults in VectorVal Insert/Remove methods
The existence/hole check for managed types was needed to prevent
accessing a nil-optional value.
2021-04-19 19:29:37 -07:00
Jon Siwek
819fc1aac0 Fix copy() to work with a vector that has trailing holes
Previously, the trailing holes would not be preserved in the copy.
2021-04-19 19:23:04 -07:00
Jon Siwek
59186d739b Update submodule(s) [nomail] 2021-04-19 16:28:04 -07:00
Jon Siwek
60ccba4680 Update submodule(s) [nomail] [skip ci] 2021-04-19 16:05:57 -07:00
Jon Siwek
db534b79fb Update submodule(s) [nomail] 2021-04-16 16:25:42 -07:00
Jon Siwek
f176da200e Merge remote-tracking branch 'origin/topic/jsiwek/gh-1506-fix-broker-func-indices'
- Extended a btest to cover tables/sets with index types
  (this was originally broken until fixed by GH-1514)

* origin/topic/jsiwek/gh-1506-fix-broker-func-indices:
  GH-1506: Fix Broker unserialization of set/table function indices
2021-04-16 16:03:29 -07:00
Tim Wojtulewicz
df22bdd52e Merge remote-tracking branch 'origin/topic/timw/1487-not-valid-enum'
* origin/topic/timw/1487-not-valid-enum:
  Move an assert() in input/Manager.cc to account for ValueToVal errors
  Add test for config framework
  Fix similar issues with ValueTo* methods in the input framework
  GH-1487: Handle error from ValueToVal instead of ignoring it
2021-04-16 08:08:59 -07:00
Jon Siwek
846cc53780 Merge remote-tracking branch 'origin/topic/jsiwek/fix-table-vector-index'
* origin/topic/jsiwek/fix-table-vector-index:
  Fix indexing of set/table types with a vector
2021-04-15 17:59:31 -07:00
Jon Siwek
7d0d57d33b Merge remote-tracking branch 'origin/topic/jsiwek/gh-1507-sip-junk'
* origin/topic/jsiwek/gh-1507-sip-junk:
  GH-1507: Tolerate junk data before SIP requests
2021-04-15 17:43:51 -07:00
Jon Siwek
df9b57118d Merge remote-tracking branch 'origin/topic/jsiwek/gh-1503-improve-expire-func-type-check'
* origin/topic/jsiwek/gh-1503-improve-expire-func-type-check:
  Extend language.expire-func-type-check btest
  GH-1503: Improve &expire_func compatibility type-checking
2021-04-15 17:42:33 -07:00
Jon Siwek
05b992b865 Extend language.expire-func-type-check btest
Now covers more forms of both valid and invalid &expire_funcs
2021-04-15 16:13:35 -07:00
Tim Wojtulewicz
97288134c2 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1496-fix-armv7-build'
* origin/topic/jsiwek/gh-1496-fix-armv7-build:
  GH-1496: Fix build on armv7 architecture
2021-04-15 11:55:04 -07:00
Jon Siwek
d3ace9b7ac GH-1506: Fix Broker unserialization of set/table function indices
Zeek function types are serialized as a broker::vector, but the
unserialization logic for Zeek set/table types that use a function for
as an index incorrectly identified it as a composite-index, which also
use broker::vector, rather than a singleton-index, and makes such
unserialization fail.

A general example where this failure can happen in practice is when
trying to unserialize a connection record for which there's a
Conn::RemovalHook, since that's a set[function], and a specific case of
that is use of the Intel Framework in a Zeek cluster.
2021-04-15 01:13:51 -07:00
Jon Siwek
735ac0b4fa Fix indexing of set/table types with a vector
Previous behavor:

  internal error: bad index type in CompositeHash::ComputeSingletonHash
  Aborted (core dumped)
2021-04-14 21:58:14 -07:00
Vern Paxson
d00748a2e7 update test suite for vector holes now being supported for numeric types 2021-04-14 18:19:26 -07:00
Vern Paxson
e96b29d4d8 add vector tests for creating holes, "in" operator, "?" operator, copying vectors with holes 2021-04-14 18:19:13 -07:00
Vern Paxson
c1903afb3b restore support for vectors with holes
remove vestigial comment
2021-04-14 18:16:46 -07:00
Vern Paxson
ff393dbd8a fix using ++/-- to vectors that contain holes 2021-04-14 18:16:19 -07:00
Tim Wojtulewicz
fc3438bda5 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1450-large-double-format'
* origin/topic/jsiwek/gh-1450-large-double-format:
  GH-1450: Improve printing/logging of large double/interval/time values
2021-04-14 16:06:11 -07:00
Tim Wojtulewicz
d579dd4318 Merge remote-tracking branch 'origin/topic/jsiwek/crlf-parsing'
* origin/topic/jsiwek/crlf-parsing:
  Add btest for unterminated pattern parsing error behavior
  GH-1497: Support CRLF line-endings in Zeek scripts and signature files
  Escape non-printables in "unrecognized character" parser error messages
2021-04-14 15:54:42 -07:00
Tim Wojtulewicz
0ab4cc8237 Merge remote-tracking branch 'origin/topic/jsiwek/pcap-null-data-check'
* origin/topic/jsiwek/pcap-null-data-check:
  Add a check for null packet data in pcap IOSource
2021-04-14 15:52:05 -07:00
Jon Siwek
183789294f GH-1507: Tolerate junk data before SIP requests
This allows for data that won't match a SIP request method to precede an
actual request and generates a new 'sip_junk_before_request' weird when
encountering such a situation.
2021-04-14 15:34:07 -07:00
Tim Wojtulewicz
20828319c6 Fix LGTM finding in zeek-cut with uses of localtime and gmtime 2021-04-14 15:28:44 -07:00
Jon Siwek
1bbb7fc4bd Fix typo in NEWS [skip ci] 2021-04-12 18:15:38 -07:00
Jon Siwek
361c99cc26 Add explanation of vector holes/in-operator changes to NEWS [skip ci] 2021-04-12 18:07:30 -07:00
Jon Siwek
01f6264c87 GH-1503: Improve &expire_func compatibility type-checking
Previously, incompatible &expire_funcs could mistakenly be used, such as
when using that attribute on the unspecified table()/set()
initializations/assignments, resulting in invalid function calls that
eventually crash Zeek.
2021-04-12 16:27:50 -07:00
Jon Siwek
2793984607 Move an assert() in input/Manager.cc to account for ValueToVal errors 2021-04-12 14:21:41 -07:00
Jon Siwek
0c93e2fcb8 Merge remote-tracking branch 'origin/topic/christian/orig-resp-explanation'
* origin/topic/christian/orig-resp-explanation:
  Reference the manual's explanation of originator and responder from conn_id
2021-04-09 12:18:19 -07:00
Jon Siwek
952d8de8fd Add btest for unterminated pattern parsing error behavior
And clarified the error message that it's more about finding an
unterminated pattern than knowing for sure there's remaining pattern
text spanning multiple lines.
2021-04-09 11:15:06 -07:00
Jon Siwek
28a150246a GH-1496: Fix build on armv7 architecture 2021-04-09 10:54:53 -07:00
Christian Kreibich
768b885791 Reference the manual's explanation of originator and responder from conn_id 2021-04-09 10:31:56 -07:00
Jon Siwek
312547ab0a GH-1497: Support CRLF line-endings in Zeek scripts and signature files 2021-04-08 20:32:30 -07:00
Jon Siwek
4ae056b1a3 Escape non-printables in "unrecognized character" parser error messages 2021-04-08 20:14:49 -07:00
Jon Siwek
77cf68fda7 Add a check for null packet data in pcap IOSource
Some libpcaps (observed in Myricom's) may claim to have read a packet,
but either did not really read a packet or at least provide no way
to access its contents, so this adds a check for null-data to
handle those cases.
2021-04-08 15:09:41 -07:00
Tim Wojtulewicz
e5d3d009fc Add test for config framework 2021-04-08 14:07:40 -07:00
Tim Wojtulewicz
04c201393f Fix similar issues with ValueTo* methods in the input framework 2021-04-08 14:07:16 -07:00
Jon Siwek
25dcf210b1 Disable Broker tests in Coverity Scan cronjob build
Coverity has trouble analyzing them and they're contributing to
bringing the overall successfully-analyzed-compilation-unit ratio
below the required 85%.
2021-04-07 18:34:12 -07:00
Jon Siwek
c9874be22a Merge remote-tracking branch 'origin/topic/timw/1493-mobile-ipv6'
* origin/topic/timw/1493-mobile-ipv6:
  GH-1493: Fix build with -DENABLE_MOBILE_IPV6
2021-04-07 15:54:40 -07:00
Tim Wojtulewicz
6c52fd502f GH-1493: Fix build with -DENABLE_MOBILE_IPV6 2021-04-07 13:44:18 -07:00
Tim Wojtulewicz
2f69e32233 Merge remote-tracking branch 'origin/topic/jsiwek/intrusiveptr-hash'
* origin/topic/jsiwek/intrusiveptr-hash:
  Change TableVal::ToMap() to return ValPtr-indexed maps
  Add std::hash specialization for IntrusivePtr
  Move IntrusivePtr relational operators to zeek namespace
2021-04-07 11:13:05 -07:00
Jon Siwek
cc15c985ca GH-1450: Improve printing/logging of large double/interval/time values
The modp_dtoa/modp_dtoa2 functions aren't capable of handling double
values larger than INT_MAX and fallback on using sprintf() in that
situation.  Previously, the format string to that sprintf() was "%e",
defaulting to a precision of 6, which is already too few digits to
represent a number known to be larger than INT_MAX.  Now, an sprintf()
is still performed for values larger than INT_MAX and still uses a
scientific notation format, but in a way that uses as many decimal
digits as needed to preserve information.
2021-04-06 19:54:02 -07:00
zeek-bot
ea8367713b Update doc submodule [nomail] [skip ci] 2021-04-06 00:35:10 +00:00
Jon Siwek
cd8f19328a Merge remote-tracking branch 'origin/topic/neverlord/gh-1408'
- Minor adjustments to header includes, whitespace, and a
  compiler warning fix during merge

* origin/topic/neverlord/gh-1408:
  Add new Timer class to the telemetry API
  Fix build with latest VectorVal API
  Update baselines
  Prefix telemetry BIFs with __
  Expose telemetry API to scripting land
  Add handle types for histogram metrics
  Move duplicated code to detail header
  Adhere to Zeek coding style
  Apply suggestions from code review
  Add telemetry Manager to Zeek setup / teardown
  Add missing whitespaces for Zeek coding style
  Add gauge metric types
  Add scaffold for new metrics API with counters
2021-04-05 14:21:44 -07:00
zeek-bot
9b0126e107 Update doc submodule [nomail] [skip ci] 2021-04-04 00:37:56 +00:00
Jon Siwek
c0b8fc4d60 Change TableVal::ToMap() to return ValPtr-indexed maps 2021-04-03 10:08:02 -07:00