Commit graph

17976 commits

Author SHA1 Message Date
Robin Sommer
94ddd7f411
Spicy: Port over to Spicy's new tuple representation.
Includes a fix for supporting CMake 4.0.
2025-04-02 14:14:26 +02:00
zeek-bot
71305b0009 Update doc submodule [nomail] [skip ci] 2025-04-02 00:14:44 +00:00
Tim Wojtulewicz
b1cd502a96 Merge remote-tracking branch 'origin/topic/timw/add-ignore-docs-annotation'
* origin/topic/timw/add-ignore-docs-annotation:
  Add comment annotation to disable copying redef value into docs
2025-04-01 12:58:31 -07:00
Tim Wojtulewicz
55e458c5f7 Add comment annotation to disable copying redef value into docs 2025-04-01 10:23:55 -07:00
zeek-bot
b1bb4e72c5 Update doc submodule [nomail] [skip ci] 2025-04-01 00:29:33 +00:00
Arne Welzel
363fbd9e28 Merge remote-tracking branch 'origin/topic/awelzel/fix-canon-name-builtin-plugins'
* origin/topic/awelzel/fix-canon-name-builtin-plugins:
  CI: Upgrade zeekctl task to Debian 12
  Bump cmake submodule
  CI: Add external plugins to builtin plugins task
2025-03-31 18:59:47 +02:00
Arne Welzel
14697ea6ba Merge remote-tracking branch 'origin/topic/neverlord/broker-logging'
* origin/topic/neverlord/broker-logging:
  Integrate review feedback
  Hook into Broker logs via its new API
2025-03-31 18:53:43 +02:00
Christian Kreibich
f068f0da4f Merge branch 'topic/christian/quic-history-u'
* topic/christian/quic-history-u:
  Add "U" to QUIC history docstrings and expand version string docs
2025-03-31 09:37:19 -07:00
Benjamin Bannier
06e41cec3a Merge remote-tracking branch 'origin/topic/bbannier/warning-arg-counting' 2025-03-31 15:08:18 +02:00
Arne Welzel
4f8a6a1dfc Merge remote-tracking branch 'origin/topic/awelzel/4177-4178-custom-event-metadata-prework'
* origin/topic/awelzel/4177-4178-custom-event-metadata-prework:
  Event/EventMgr: protected to private
  EventHandler: Deprecate Call(args, no_remote, ts), add Call(args)
  EventHandler: Header cleanup
  EventMgr: Do not cache current event attributes
  EventMgr: Drop src_val
  Event: Header cleanup
2025-03-31 14:22:17 +02:00
Arne Welzel
dfa2d96d22 CI: Upgrade zeekctl task to Debian 12 2025-03-31 14:19:21 +02:00
Arne Welzel
e269b34df1 Bump cmake submodule 2025-03-31 14:19:21 +02:00
Arne Welzel
c45625b909 CI: Add external plugins to builtin plugins task
This clones a few external plugins to include them in a build. Except
for zeek-kafka, the others are maintained by the Zeek project.

Closes #3535
2025-03-31 14:19:18 +02:00
Benjamin Bannier
b1ddf9e476 Use one-based index in warning message
This was surfacing a zero-based counter to users which was confusing.
2025-03-28 14:09:11 +01:00
zeek-bot
92d2d0c6b8 Update doc submodule [nomail] [skip ci] 2025-03-28 00:23:27 +00:00
Tim Wojtulewicz
edbe8f0831 Merge remote-tracking branch 'origin/topic/timw/pass-tags-for-storage-events'
* origin/topic/timw/pass-tags-for-storage-events:
  Make storage events take a tag for the backend instead of a string
  Add move constructor to Tag class
2025-03-27 16:12:53 -07:00
Tim Wojtulewicz
32ae8f4eaa Make storage events take a tag for the backend instead of a string 2025-03-27 16:12:24 -07:00
Tim Wojtulewicz
989e4adf90 Add move constructor to Tag class 2025-03-27 16:12:24 -07:00
Tim Wojtulewicz
ed47eedd6a Merge remote-tracking branch 'origin/topic/timw/storage-timeout-testing'
* origin/topic/timw/storage-timeout-testing:
  Fix handling of timeout conditions from storage backends
  Reformat plugin.storage btest to be more consistent with other storage tests
2025-03-27 14:10:39 -07:00
Tim Wojtulewicz
85701e4514 Fix handling of timeout conditions from storage backends 2025-03-27 13:52:11 -07:00
Tim Wojtulewicz
046f32a6df Reformat plugin.storage btest to be more consistent with other storage tests 2025-03-27 13:52:11 -07:00
Christian Kreibich
98c203b8cb Add "U" to QUIC history docstrings and expand version string docs
Looks like we overlooked documenting "U" in zeek/zeek#3526 .
2025-03-27 13:29:40 -07:00
Christian Kreibich
656e88eaa8 Merge branch 'topic/christian/unexperimental-quic-histories'
* topic/christian/unexperimental-quic-histories:
  Remove "experimental" from the QUIC history field's comment string [skip ci]
2025-03-27 12:41:03 -07:00
Arne Welzel
2f9b1e21bd Event/EventMgr: protected to private
These classes are final, so deriving isn't possible. No reason to have
protected members.
2025-03-27 19:23:47 +01:00
Arne Welzel
f7425b805d EventHandler: Deprecate Call(args, no_remote, ts), add Call(args)
The ts parameter was only added to Call() for the Broker::auto_publish()
functionality and propagating the network timestamp. By now, the auto-publish
functionality is deprecated, so it'd be good to cleanup that signature. There
won't be any need for no_remote in the future either.

Allow users to just use Call() instead.
2025-03-27 19:23:47 +01:00
Arne Welzel
b535f03382 EventHandler: Header cleanup 2025-03-27 19:23:47 +01:00
Arne Welzel
7dadbb0c1d EventMgr: Do not cache current event attributes
Avoid proliferation of various members on EventMgr by storing the
pointer of the current event instead.

This subtly changes the behavior of some builtin functions as they would
have returned the prior event's data when executed outside of event
draining (e.g. C++ level hook invocations), but I think that's actually
for the better.
2025-03-27 19:23:30 +01:00
Arne Welzel
bef923ebeb EventMgr: Drop src_val
This is a left over and hasn't been used since a while.
2025-03-27 11:16:31 +01:00
Arne Welzel
277e6d4129 Event: Header cleanup 2025-03-27 11:16:29 +01:00
Christian Kreibich
2199cb1ddd Remove "experimental" from the QUIC history field's comment string [skip ci]
We're unlikely to fundamentally change (or remove) this field at this point, and
some users wondered whether we might do so, given the labeling.
2025-03-26 14:03:52 -07:00
Arne Welzel
acab4236e2 Merge remote-tracking branch 'origin/topic/awelzel/zeromq-no-fprintf-at-overload'
* origin/topic/awelzel/zeromq-no-fprintf-at-overload:
  cluster/zeromq: Improve XPUB stall behavior, add a metric
2025-03-26 14:24:02 +01:00
Arne Welzel
bfffc8dac8 cluster/zeromq: Improve XPUB stall behavior, add a metric
Instead of fprintf, track the number of occurrences via a metric and
change the sleep loop to a blocking send instead.
2025-03-26 14:23:09 +01:00
Arne Welzel
cd9b37e4a5 Merge remote-tracking branch 'origin/topic/awelzel/4309-telemetry-collect-calbacks'
* origin/topic/awelzel/4309-telemetry-collect-calbacks:
  telemetry: Run callbacks at collect time
2025-03-26 14:08:40 +01:00
Arne Welzel
c3c6ee5a2b telemetry: Run callbacks at collect time
Calling collect_metrics() from a script would not invoke metric
callbacks, resulting in most of the process metrics to be zero
when a Zeek process isn't scraped via Prometheus.

Fixes #4309
2025-03-26 12:07:27 +01:00
Arne Welzel
33d7e5a7bf Merge remote-tracking branch 'origin/topic/awelzel/zeromq-unsubscription-visibility'
* origin/topic/awelzel/zeromq-unsubscription-visibility:
  cluster/OnLoop: Add metric for queue stalling instead of fprintf
  btest/cluster/websocket: ZeroMQ backend test
  cluster/OnLoop: Switch to condition variable
  cluster/zeromq: Fix node_topic() and nodeid_topic()
  cluster/websocket: Fix null deref at WebSocket server shutdown
  btest/cluster/websocket: Harden multi-client tests
  cluster/zeromq: Fix unsubscription visibility
2025-03-24 19:46:20 +01:00
Arne Welzel
52143a5712 cluster/OnLoop: Add metric for queue stalling instead of fprintf 2025-03-24 19:44:08 +01:00
Arne Welzel
50b26fcea8 btest/cluster/websocket: ZeroMQ backend test
This test ensures that WebSocket clients connected to the same node see
each other's messages.
2025-03-24 18:36:52 +01:00
Arne Welzel
387237e9c2 cluster/OnLoop: Switch to condition variable
The busy polling wasn't clever and usually resulted in delays. For now,
switch to mutex/condition variable and log an error if the timeouts are
immense.
2025-03-24 18:36:45 +01:00
Arne Welzel
2963c49f27 cluster/zeromq: Fix node_topic() and nodeid_topic()
Due to prefix matching, worker-1's node_topic() also matched worker-10,
worker-11, etc. Suffix the node topic with a `.`. The original implementation
came from NATS, where subjects are separated by `.`.

Adapt nodeid_topic() for consistency.
2025-03-24 18:36:26 +01:00
Arne Welzel
26441e0c24 cluster/websocket: Fix null deref at WebSocket server shutdown
WebSocket clients that connected with the wrong URL do not have
a backend attached. If a dispatcher is terminated while these
clients are still connected, a null deref would happen.

This was found while running all cluster/websocket tests in a loop
for a long time, tickling a segfault during the bad-url test.
2025-03-24 18:36:26 +01:00
Arne Welzel
888af244b2 btest/cluster/websocket: Harden multi-client tests
These test were very sensible to the speed at which ZeroMQ distributes
subscriptions in the cluster and showed to be unreliably when testing with
zeek/btest#113.

The main fix here is to have individual WebSocket clients subscribe to unique
topics, e.g /test/client-0 and /test/client-1, instead of just a shared topic.

This ensures the WebSocket handshake completes only when they observed their
own subscriptions and not prematurely when observing the shared topic.

This seems mainly relevant for tests: In the real world one shouldn't
rely on subscription visibility - you miss messages if you're too late
to the party.
2025-03-24 18:36:26 +01:00
Arne Welzel
3885871e7d cluster/zeromq: Fix unsubscription visibility
When two workers connect to zeek.cluster.worker, the central ZeroMQ
proxy would not propagate unsubscription information to other nodes
once they both left. Set ZMQ_XPUB_VERBOSER on the proxies XPUB socket
for visibility.
2025-03-24 18:36:16 +01:00
zeek-bot
6045c8ee64 Update doc submodule [nomail] [skip ci] 2025-03-22 00:15:29 +00:00
Tim Wojtulewicz
bc38dbcc99 Merge remote-tracking branch 'origin/topic/timw/storage-framework-followup'
* origin/topic/timw/storage-framework-followup:
  Redis: Handle other errors from requests, fix KEY_EXISTS for put operations
  SQLite: handle existing keys when overwrite=F correctly
  Remove unnecessary type aliases from storage btests
  Avoid thread-leak in scripts.base.frameworks.file-analysis.bifs.enable-disable btest
  Fix data-race with calling DBG_LOG from a separate thread
  Fix data-race with ReturnCode objects in Sqlite::DoExpire
  Fix data race with calling run_state::network_time from a separate thread
  Add NEWS entry for Storage, reduce CHANGES spam
  Fix Coverity findings in the SQLite backend
  Remove inclusion of non-existent expected-lite path during dynamic plugin builds
  Squash code from OperationResultCallback into ResultCallback
  Add hiredis to generate-docs workflow to enable Redis backend
2025-03-21 11:57:17 -07:00
Tim Wojtulewicz
855c530b64 Redis: Handle other errors from requests, fix KEY_EXISTS for put operations 2025-03-21 11:56:27 -07:00
Tim Wojtulewicz
3d7fcfb428 SQLite: handle existing keys when overwrite=F correctly 2025-03-21 11:56:27 -07:00
Tim Wojtulewicz
ba9cf1e4db Remove unnecessary type aliases from storage btests 2025-03-21 11:56:27 -07:00
Tim Wojtulewicz
d5ebaf476d Avoid thread-leak in scripts.base.frameworks.file-analysis.bifs.enable-disable btest
This btest uses the exit() BIF to shut down, which immediately calls
::exit() and kills Zeek without doing any shutdown. This will sometimes
leave the thread running the storage manager, which causes TSan to
complain about a thread leak. Switch to use the terminate() BIF instead
which cleanly shuts down all of Zeek.
2025-03-21 11:56:27 -07:00
Tim Wojtulewicz
78267c382c Fix data-race with calling DBG_LOG from a separate thread 2025-03-21 11:56:27 -07:00
Tim Wojtulewicz
a67e138d4e Fix data-race with ReturnCode objects in Sqlite::DoExpire 2025-03-21 11:56:27 -07:00