Commit graph

2813 commits

Author SHA1 Message Date
Arne Welzel
9330a74fe1 Merge remote-tracking branch 'origin/topic/awelzel/zeek-archiver-multiple-loggers'
* origin/topic/awelzel/zeek-archiver-multiple-loggers:
  cluster/supervisor: Multi-logger awareness
  Bump zeek-archiver submodule
2023-05-09 15:20:53 +02:00
Arne Welzel
1facc34e09 Fixup Val.h/Val.cc: Actually move ValFromJSON into zeek::detail
Lost during merge..
2023-05-09 11:23:32 +02:00
Arne Welzel
264284150b Merge remote-tracking branch 'amazing-pp/topic/fupeng/from_json_bif'
* amazing-pp/topic/fupeng/from_json_bif:
  Implement from_json bif

Minor updates during merge: Moved ValFromJSON into zeek::detail for the
time being, removed gotos, normalized some error messages to lower case,
minimal test extension and added a raw reader input framework test reading
"json lines" as a demo, adding notes about the implicit type
conversions.
2023-05-09 10:36:58 +02:00
Tim Wojtulewicz
49b01c3867 Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.May23'
* origin/topic/vern/script-opt-maint.May23:
  BTest baseline updates for -O gen-C++
  updates to C++ maintenance scripts to better handle uncompilable BTests
  added ZEEK_REPORT_UNCOMPILABLE environment variable for "-O report-uncompilable"
  BTest baseline updates for ZAM
2023-05-05 14:08:28 -07:00
Arne Welzel
02b7439d44 Revert "Skip version.h by default for Zeek sources"
This reverts commit 8246baf25c.

Actually fails the include_plugins CI test and I had just
opened another related issue.
2023-05-05 21:05:17 +02:00
Arne Welzel
ab4f231232 Merge remote-tracking branch 'origin/topic/neverlord/gh-3019'
* origin/topic/neverlord/gh-3019:
  Skip version.h by default for Zeek sources
2023-05-05 20:15:12 +02:00
Tim Wojtulewicz
152f7aae40 Merge remote-tracking branch 'origin/topic/timw/docs-action-only-for-master'
* origin/topic/timw/docs-action-only-for-master:
  generate-docs: Only update submodule pointer during scheduled builds
2023-05-05 08:48:28 -07:00
Arne Welzel
630db664a8 Merge remote-tracking branch 'origin/topic/awelzel/2998-ntp-flip-roles'
* origin/topic/awelzel/2998-ntp-flip-roles:
  NTP: Detect out-of-order packets
2023-05-04 20:08:50 +02:00
Tim Wojtulewicz
44b7e91f87 Merge remote-tracking branch 'origin/topic/neverlord/gh-2711'
* origin/topic/neverlord/gh-2711:
  Integrate review feedback
  Include compiler in --show-config output
  Fix CMake option defaults on Windows
  Move build defaults from configure to CMake
2023-05-04 10:56:46 -07:00
Arne Welzel
12252743b1 Merge remote-tracking branch 'origin/topic/awelzel/smb2-state-handling'
* origin/topic/awelzel/smb2-state-handling:
  NEWS: Add entry about SMB::max_pending_messages and state discarding
  scripts/smb2-main: Reset script-level state upon smb2_discarded_messages_state()
  smb2: Limit per-connection read/ioctl/tree state
2023-05-04 09:40:19 +02:00
Tim Wojtulewicz
8eed46dfa1 Merge remote-tracking branch 'origin/topic/johanna/update-ssl-databases'
* origin/topic/johanna/update-ssl-databases:
  Update Mozilla CA and Google CT lists
2023-05-03 11:13:23 -07:00
Tim Wojtulewicz
87636947a6 Merge remote-tracking branch 'origin/topic/timw/zeek-config-quoted-strings'
* origin/topic/timw/zeek-config-quoted-strings:
  Surround string assignments in zeek-config in quotes
2023-05-03 09:31:44 -07:00
Tim Wojtulewicz
7305f2ba9b Merge remote-tracking branch 'origin/topic/timw/2997-ding-dong-bro-init-is-dead'
* origin/topic/timw/2997-ding-dong-bro-init-is-dead:
  Remove parser error message for bro_init, et al
2023-05-03 09:31:26 -07:00
Tim Wojtulewicz
bc82b657c4 Merge remote-tracking branch 'origin/topic/timw/ieee-80211-length-check'
* origin/topic/timw/ieee-80211-length-check:
  Add additional length check to IEEE 802.11 analyzer
2023-05-03 09:31:08 -07:00
Johanna Amann
9742d9a76e Merge branch 'topic/johanna/no-error-message-durning-tls-or-dtls-protocol-violations'
* topic/johanna/no-error-message-durning-tls-or-dtls-protocol-violations:
  SSL: failing analyzer handling - address review feedback
  SSL: do not try to disable failed analyzer

Also folds in minor feedback from GH-3012
2023-05-03 14:20:44 +01:00
Arne Welzel
df0788252e Merge remote-tracking branch 'origin/topic/awelzel/2994-ip-mf-df-offset'
* origin/topic/awelzel/2994-ip-mf-df-offset:
  ip4_hdr: Add DF, MF, offset and sum fields
2023-05-02 20:45:43 +02:00
Tim Wojtulewicz
c02940e4f3 Merge remote-tracking branch 'origin/topic/timw/windows-setvbuf'
* origin/topic/timw/windows-setvbuf:
  Use workaround for setvbuf on Windows in DebugLogger/Extract file analyzer
  Add ifdef'd implementation of setvbuf to zeek::util
2023-05-02 11:13:03 -07:00
Tim Wojtulewicz
71731ffcb1 Merge remote-tracking branch 'origin/topic/timw/smith-waterman-compare-semantics'
* origin/topic/timw/smith-waterman-compare-semantics:
  Fix smith-waterman sorting to follow correct Compare semantics
2023-05-02 09:42:33 -07:00
Tim Wojtulewicz
a7c9454224 Merge remote-tracking branch 'origin/topic/timw/2980-cirrus-updates'
* origin/topic/timw/2980-cirrus-updates:
  CI: Automatically update opensuse-tumbleweed
  CI: Remove Fedora 36, add Fedora 38
2023-04-28 16:33:56 -07:00
Arne Welzel
f227b30d30 Merge remote-tracking branch 'origin/topic/awelzel/2791-pcap-stat-overflow'
* origin/topic/awelzel/2791-pcap-stat-overflow:
  pcap/Source: Allow more than 32bit for link and dropped stats
2023-04-28 10:02:30 +02:00
Arne Welzel
667cdd5c27 Merge remote-tracking branch 'jgras/topic/jgras/cluster-init-tests'
* jgras/topic/jgras/cluster-init-tests:
  Simplify btests using cluster_started event.
  Remove old cluster start tests.

Reverted removal of old cluster start tests during merge.
2023-04-28 09:37:25 +02:00
Tim Wojtulewicz
f3f139deab Merge remote-tracking branch 'origin/topic/timw/windows-ci-unit-testing'
* origin/topic/timw/windows-ci-unit-testing:
  Modify Windows test cmd file to actually run tests
  Add template file and cmake call for zeek-path setup on Windows
2023-04-27 11:26:00 -07:00
Arne Welzel
a3ef8783b1 Merge remote-tracking branch 'origin/topic/neverlord/gh-2806'
* origin/topic/neverlord/gh-2806:
  test/builtin-plugins: Add plugin using ZEEK_VERSION_NUMBER
  Revert putting plugins into a fresh scope for now
  Propagate zeek-version.h skip via CMake properties
2023-04-27 13:23:14 +02:00
Arne Welzel
004dce2cf2 Merge remote-tracking branch 'origin/topic/awelzel/zeekctl-multiple-loggers'
* origin/topic/awelzel/zeekctl-multiple-loggers:
  NEWS: Add entry for ZeekControl and multi-loggers
  Bump zeekctl to multi-logger version
  logging: Support rotation_postprocessor_command_env
2023-04-27 12:17:02 +02:00
Arne Welzel
ee91201785 Merge remote-tracking branch 'origin/topic/awelzel/topic/bump-zeekjs-0-9-0'
* origin/topic/awelzel/topic/bump-zeekjs-0-9-0:
  Update ZeekJS submodule to 0.9.0
2023-04-27 09:09:44 +02:00
Tim Wojtulewicz
b65697633f Merge remote-tracking branch 'origin/topic/vern/func-coverage'
* origin/topic/vern/func-coverage:
  extend ZEEK_PROFILER_FILE profiling to include summaries for functions/hooks/event handlers
2023-04-26 12:43:00 -07:00
Arne Welzel
8f262df192 Merge remote-tracking branch 'origin/topic/awelzel/bump-af-packet'
* origin/topic/awelzel/bump-af-packet:
  Update AF-Packet submodule
  btest: Add af_packet to TestDirs
  Update AF-Packet submodule
2023-04-26 15:38:17 +02:00
Tim Wojtulewicz
dd26990410 Merge remote-tracking branch 'origin/topic/timw/2324-llc-snap-and-novell-oh-my'
* origin/topic/timw/2324-llc-snap-and-novell-oh-my:
  Update docs and NEWS to include LLC, SNAP, and Novell packet analyzers
  Fix length checks in VLAN/Ethernet analyzers for non-ethertype protocols
  Add forwarding from VLAN analyzer into LLC, SNAP, and Novell 802.3 analyzers
  Remove non-standard way of forwarding out of the Ethernet analyzer
  Add basic LLC, SNAP, and Novell 802.3 packet analyzers
  ARP: add support for IEEE802 hardware type
2023-04-25 13:08:06 -07:00
Tim Wojtulewicz
ff6ebb9257 Merge branch 'topic/timw/2167-aruba-expansion'
* topic/timw/2167-aruba-expansion:
  Add NEWS entry about 802.11 and ARUBA changes
  Remove workaround for tunnels from IEEE 802.11 analyzer
  PPP in the GRE analyzer is actually PP*T*P
  Add support for 802.11 A-MSDU aggregates
  Fix IEEE 802.11 analyzer to properly forward tunneled packets
  Fix IEEE 802.11 analyzer to skip packets with the Protected bit enabled
  Expand support for Aruba protocol types in GRE analyzer
  Default tunnel_type in iosource::Packet to NONE
2023-04-25 11:37:51 -07:00
Arne Welzel
e856e953b8 Merge remote-tracking branch 'origin/topic/christian/sync-ignore_checksums-from-cli'
* origin/topic/christian/sync-ignore_checksums-from-cli:
  Given the -C flag, set script-layer ignore_checksums to true.
  Add btest for "-C" flag vs the script-layer ignore_checksums global.
2023-04-25 12:39:27 +02:00
Arne Welzel
1b69b4d26f Merge branch 'topic/amazingpp/irc-fuid-missing' of github.com:AmazingPP/zeek
* 'topic/amazingpp/irc-fuid-missing' of github.com:AmazingPP/zeek:
  Add irc_dcc_send_ack event and fix missing fields

I've moved IRC_Data back into the zeek::analyzer::file namespace, but
we did move the declaration from protocol/file/File.h to protocol/irc/IRC.h.
But, if someone actually customized IRC_Data and didn't include protocol/irc/IRC.h
for other reasons, I'll be surprised (and also just suggest to update the include).
2023-04-24 18:22:50 +02:00
Arne Welzel
9b1bfe63f4 Merge remote-tracking branch 'origin/topic/awelzel/replace-more-bro-plugin-install-path'
* origin/topic/awelzel/replace-more-bro-plugin-install-path:
  cmake: Fixup BRO_PLUGIN_INSTALL_PATH references
2023-04-24 14:36:53 +02:00
Arne Welzel
1b710d5534 Merge remote-tracking branch 'origin/topic/neverlord/plugin-dir'
* origin/topic/neverlord/plugin-dir:
  Fix install directory for plugins
2023-04-24 10:33:40 +02:00
Arne Welzel
ffb73e4de9 Merge remote-tracking branch 'origin/topic/awelzel/add-community-id'
* origin/topic/awelzel/add-community-id:
  testing/external: Bump hashes for community_id addition
  NEWS: Add entry for Community ID
  policy: Import zeek-community-id scripts into protocols/conn frameworks/notice
  Add community_id_v1() based on corelight/zeek-community-id
2023-04-24 10:12:56 +02:00
Arne Welzel
0b22f792a5 Merge remote-tracking branch 'origin/topic/awelzel/file-analysis-manager-runstate-include'
* origin/topic/awelzel/file-analysis-manager-runstate-include:
  file_analysis/Manager: Remove RunState.h include
2023-04-24 09:24:42 +02:00
Christian Kreibich
4ab7ff262f Merge branch 'topic/jgras/cluster-init' of github.com:/J-Gras/zeek
* 'topic/jgras/cluster-init' of github.com:/J-Gras/zeek:
  Update NEWS to cover cluster framework changes.
  Add cluster_started restart tests.
  Add basic cluster_started tests.
  Add cluster_started and node_fully_connected events.
  Add hook into cluster connection setup.
  Add broadcast_topics set.
  Generalize Cluster::worker_count.
2023-04-21 14:05:19 -07:00
Christian Kreibich
379624404c Merge branch 'topic/christian/news-edits'
* topic/christian/news-edits:
  Edit pass over the current 6.0 NEWS entries. [nomail] [skip ci]
2023-04-20 16:04:18 -07:00
Arne Welzel
ba085630b3 Merge remote-tracking branch 'origin/topic/awelzel/2935-publish-hrw-rr-type-check'
* origin/topic/awelzel/2935-publish-hrw-rr-type-check:
  zeek.bif: Remove cat_sep() fully var_arg changes
  broker/messaging: Runtime type checks for pool
  bifcl: Bump for runtime-type checks in var_arg bifs
2023-04-19 20:05:41 +02:00
Tim Wojtulewicz
71109a13f8 Merge remote-tracking branch 'origin/topic/timw/2485-script-profile-call-stacks'
* origin/topic/timw/2485-script-profile-call-stacks:
  Add call stacks to script profiler output
2023-04-19 09:15:15 -07:00
Arne Welzel
89c828ac14 Merge remote-tracking branch 'origin/topic/vern/record-optimizations.Apr23B'
* origin/topic/vern/record-optimizations.Apr23B:
  different fix for MSVC compiler issues
  more general approach for addressing MSVC compiler issues with IntrusivePtr
  restored RecordType::Create, now marked as deprecated tidying of namespaces and private class members simplification of flagging record field initializations that should be skipped address peculiar MSVC compilation complaint for IntrusivePtr's
  clarifications and tidying for record field initializations
  optimize record construction by deferring initializations of aggregates
  compile-scripts-to-C++ speedups by switching to raw record access
  logging speedup by switching to raw record access
  remove redundant record coercions

Removed the `#if 0` hunk during merging: Probably could have gone with a
doctest instead.
2023-04-19 11:59:56 +02:00
Arne Welzel
683cb80f61 Merge remote-tracking branch 'origin/topic/neverlord/gh-2953'
* origin/topic/neverlord/gh-2953:
  Improve CMake variables, update cmake submodule
  Fix builds with plugins that use zeek-config

Bumped cmake and used update-changes with explicit -p because
it wasn't detecting the right commit to start with. Suspect
something went off with the last bump.
2023-04-19 10:14:33 +02:00
Tim Wojtulewicz
f222c15374 Merge remote-tracking branch 'origin/topic/awelzel/2885-log-caching-cluster-flaky'
* origin/topic/awelzel/2885-log-caching-cluster-flaky:
  log-caching-cluster: Wait for X509::known_log_certs to populate
2023-04-18 11:11:53 -07:00
Arne Welzel
75245bd365 Merge remote-tracking branch 'origin/topic/awelzel/javascript'
* origin/topic/awelzel/javascript:
  ci/debian-11: Install libnode-dev, too
  CMakeLists: Convert string append to list append
  Add experimental JavaScript support when libnode is available
2023-04-14 13:02:57 +02:00
Arne Welzel
5db2e5fd8e Merge remote-tracking branch 'origin/topic/awelzel/revert-type-manager-intro'
* origin/topic/awelzel/revert-type-manager-intro:
  Revert "Type: Add TypeManager->TypeList() and use for ListVal()"
2023-04-14 10:33:01 +02:00
Tim Wojtulewicz
13acd45383 Merge remote-tracking branch 'origin/topic/neverlord/cmake-redesign-phase1'
* origin/topic/neverlord/cmake-redesign-phase1:
  Add NEWS entry for the CMake changes
  Redesign subdir-libs and plugin scaffolding
2023-04-13 15:54:12 -07:00
Tim Wojtulewicz
ca43ada578 Merge remote-tracking branch 'origin/topic/timw/2920-initialized-container-options'
* origin/topic/timw/2920-initialized-container-options:
  GH-2920: Don't warn on uninitialized container options
2023-04-13 09:05:40 -07:00
Tim Wojtulewicz
c5ce82143a Merge remote-tracking branch 'origin/topic/timw/2947-input-config-regex'
* origin/topic/timw/2947-input-config-regex:
  Reimplement fixes to handle commas at the end of config parser lines
  Revert "Convert config framework to use std::regex"
  Revert "GH-636: Fix regex to handle commas at the end of config parser lines"
2023-04-13 08:57:30 -07:00
Arne Welzel
b739bdbbfb Merge remote-tracking branch 'origin/topic/awelzel/rotation-format-func-segfault'
* origin/topic/awelzel/rotation-format-func-segfault:
  logging/Manager: Fix crash for rotation format function not returning
2023-04-13 09:24:47 +02:00
Tim Wojtulewicz
6ac72a31bf Merge remote-tracking branch 'origin/topic/arne.welzel/fix-poll-interval-is-live'
* origin/topic/arne.welzel/fix-poll-interval-is-live:
  iosource/Manager: Fix poll_interval updating using not-yet valid IsLive()
2023-04-12 13:23:46 -07:00
Tim Wojtulewicz
149ad57742 Merge remote-tracking branch 'origin/topic/timw/silence-noisy-compiler-flag'
* origin/topic/timw/silence-noisy-compiler-flag:
  Only use -Wno-changes-meaning if it exists
2023-04-11 15:41:46 -07:00