Commit graph

17497 commits

Author SHA1 Message Date
Arne Welzel
9c5c8b55cc Merge remote-tracking branch 'origin/topic/vern/CPP-standalone-fixes'
* origin/topic/vern/CPP-standalone-fixes:
  BTest updates in support of compiling-scripts-to-C++
  -O gen-standalone-C++ fixes for recent more aggressive AST profiling
2024-12-13 10:57:28 +01:00
Christian Kreibich
94f64a6dc6 Merge remote-tracking branch 'origin/topic/vern/preen-btest-alternatives'
* origin/topic/vern/preen-btest-alternatives:
  removed a bunch of no-longer used BTest alternatives and their associated baselines
2024-12-12 20:11:56 -08:00
Vern Paxson
85ef6e0cb8 removed a bunch of no-longer used BTest alternatives and their associated baselines 2024-12-12 19:16:34 -08:00
zeek-bot
14b59192ba Update doc submodule [nomail] [skip ci] 2024-12-13 00:25:00 +00:00
Vern Paxson
8876ec6f2d BTest updates in support of compiling-scripts-to-C++ 2024-12-12 14:30:23 -08:00
Vern Paxson
0a813a53c7 -O gen-standalone-C++ fixes for recent more aggressive AST profiling 2024-12-12 14:27:12 -08:00
Tim Wojtulewicz
1158757b2b Merge remote-tracking branch 'origin/topic/awelzel/move-broker-to-cluster-publish'
* origin/topic/awelzel/move-broker-to-cluster-publish:
  netcontrol: Move to Cluster::publish()
  openflow: Move to Cluster::publish()
  netcontrol/catch-and-release: Move to Cluster::publish()
  config: Move to Cluster::publish()
  ssl/validate-certs: Move to Cluster::publish()
  irc: Move to Cluster::publish()
  ftp: Move to Cluster::publish()
  dhcp: Move to cluster publish
  notice: Move to Cluster::publish()
  intel: Move to Cluster::publish()
  sumstats: Move to Cluster::publish()
2024-12-12 13:18:21 -07:00
Tim Wojtulewicz
25554fa668 Merge remote-tracking branch 'origin/topic/awelzel/fix-cluster-publish-any'
* origin/topic/awelzel/fix-cluster-publish-any:
  cluster/Backend: Handle unspecified table/set
  cluster: Fix Cluster::publish() of Broker::Data
  cluster: Be noisy when attempting to connect to an unknown node
2024-12-12 13:17:08 -07:00
Tim Wojtulewicz
c3bae4f1f8 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-12-12 11:35:19 -07:00
Tim Wojtulewicz
98ec627404 Merge branch 'topic/timw/7.1-news-updates'
* topic/timw/7.1-news-updates:
  Add note about various dependency updates [nomail] [skip ci]
  NEWS additions for v7.1 [nomail] [skip ci]
2024-12-12 11:33:09 -07:00
Arne Welzel
3d55341690 netcontrol: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
fdf783df65 cluster/Backend: Handle unspecified table/set
Same as what we do in Broker. Use the expected type if publishing
a table() or set() parameter.

This fixes issues when switching sumstats to Cluster::publish()
2024-12-12 17:54:42 +01:00
Arne Welzel
b2df78c0bb openflow: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
100b825561 netcontrol/catch-and-release: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
66f6149662 config: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
32c9c940bf ssl/validate-certs: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
3d3706440b irc: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
387db42fea ftp: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
b372b47f83 dhcp: Move to cluster publish 2024-12-12 17:54:42 +01:00
Arne Welzel
a9243bafcc notice: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
347faf5e86 intel: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
f58a2c2ca8 sumstats: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
Arne Welzel
d9a74cf32d cluster: Fix Cluster::publish() of Broker::Data
The broker serializer leverages the existing data_to_val() function.
During unserialization, if the destination type is any, the logic
simply wraps the broker::data value into a Broker::Data record.
Therefore, events with any parameters are currently exposed to
the Broker::Data type.

There is a bigger issue in that re-publishing such Broker::Data
instances would encode them as a normal record. Explicitly prevent
this by serializing the contained data value directly instead, similar
to what Broker already did when publishing a record.
2024-12-12 17:54:37 +01:00
Arne Welzel
953fe8e029 Merge remote-tracking branch 'origin/topic/justin/pools-cache-node-topic'
* origin/topic/justin/pools-cache-node-topic:
  Pre-compute the node topics for all pool entries.
2024-12-12 14:45:50 +01:00
Arne Welzel
e100a8e698 Merge remote-tracking branch 'origin/topic/christian/fix-zam-analyzer-name'
* origin/topic/christian/fix-zam-analyzer-name:
  Fix ZAM's implementation of Analyzer::name() BiF
2024-12-12 14:45:28 +01:00
Benjamin Bannier
42406ad95e Bump auxil/spicy to latest development snapshot 2024-12-12 13:12:35 +01:00
Arne Welzel
271fc15041 cluster: Be noisy when attempting to connect to an unknown node
Mostly due to spending too much time wondering why nodes didn't connect
when there was a mismatch between "manager" and "manager-1" in the
cluster layout. Remove manager from test-all-policy-cluster test to
avoid connection attempts in this test.
2024-12-12 13:01:04 +01:00
Christian Kreibich
235638815f Fix ZAM's implementation of Analyzer::name() BiF
ZAM's implementation deviates from Zeek's in consideration of remappings, which
means that running ZAM produced conn.log service names prefixed with "spicy_"
whereas regular Zeek doesn't.
2024-12-11 23:16:47 -08:00
zeek-bot
fb74834f4c Update doc submodule [nomail] [skip ci] 2024-12-12 00:44:53 +00:00
Tim Wojtulewicz
b547c7287d Merge remote-tracking branch 'origin/topic/timw/remove-brocontrol-dir'
* origin/topic/timw/remove-brocontrol-dir:
  Update zeekctl submodule to remove BroControl dir
2024-12-11 15:33:17 -07:00
Tim Wojtulewicz
72375abf49 Update zeekctl submodule to remove BroControl dir 2024-12-11 15:32:38 -07:00
Justin Azoff
10438408a5 Pre-compute the node topics for all pool entries.
A zeek script profile showed a small percentage of time spent in
Cluster::node_topic, but this never changes and can be cached.
2024-12-11 15:57:01 -05:00
Tim Wojtulewicz
746d61f399 Run Coverity workflow on ubuntu 22.04 2024-12-11 13:31:49 -07:00
Tim Wojtulewicz
4eebc97355 Add note about various dependency updates [nomail] [skip ci] 2024-12-11 13:00:47 -07:00
Tim Wojtulewicz
7b8f9b5385 NEWS additions for v7.1 [nomail] [skip ci] 2024-12-11 13:00:28 -07:00
Tim Wojtulewicz
9e19b51f41 Merge remote-tracking branch 'origin/topic/johanna/spicysslnews'
* origin/topic/johanna/spicysslnews:
  Add blurb about Spicy SSL to NEWS
2024-12-11 12:59:28 -07:00
Johanna Amann
3711af53d5 Add blurb about Spicy SSL to NEWS 2024-12-11 12:58:35 -07:00
Tim Wojtulewicz
9f1a30d3fe Merge remote-tracking branch 'origin/topic/timw/add-spicy-to-coverity'
* origin/topic/timw/add-spicy-to-coverity:
  Add Spicy analyzers to Coverity builds
2024-12-11 12:38:59 -07:00
Tim Wojtulewicz
b1d077cab9 Add Spicy analyzers to Coverity builds 2024-12-11 12:38:34 -07:00
Tim Wojtulewicz
649cedb693 Merge remote-tracking branch 'origin/topic/timw/python-upgrade'
* origin/topic/timw/python-upgrade: (65 commits)
  Swap pre-commit yapf for ruff/ruff-format, fix findings
  Upgrade package-manager submodule to get python upgrade
  Upgrade broker submodule to get python upgrade
  Upgrade zeekctl submodule to get python upgrade
  Upgrade zeek-client submodule to get python upgrade
  Upgrade btest submodule to get python upgrade
  Require Python 3.9 in CMakeLists.txt
  CI: Install python 3.9 on ubuntu 20
  btest: Avoid loading ZeroMQ if not compiled in
  btest/coverage: Avoid warnings in test-all-policy-cluster
  Broker::publish: Warn on using Broker::publish() when inactive
  Update doc submodule [nomail] [skip ci]
  Update zeek-testing and zeek-testing-cluster commit hashes
  Update ZAM BiF-tracking
  configure: Add --disable-cluster-backend-zeromq
  CMakeLists: Cluster backends output
  zeromq: Conditionally enable by default
  btest/generic: Add publish_hrw(), publish_rr() and logging tests
  generate-docs: Run on Ubuntu 24.04, add cppzmq
  docker: Add cppzmq/libzmq dependencies
  ...
2024-12-11 11:46:02 -07:00
Tim Wojtulewicz
49f82b325b Swap pre-commit yapf for ruff/ruff-format, fix findings 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
b02f812e26 Upgrade package-manager submodule to get python upgrade 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
e65e92edcf Upgrade broker submodule to get python upgrade 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
c98ed621d6 Upgrade zeekctl submodule to get python upgrade 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
38fb76d52d Upgrade zeek-client submodule to get python upgrade 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
641306b912 Upgrade btest submodule to get python upgrade 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
566fa7c6d0 Require Python 3.9 in CMakeLists.txt 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
beb7b5bbbf CI: Install python 3.9 on ubuntu 20 2024-12-11 11:08:37 -07:00
Tim Wojtulewicz
7f3bea7ce1 Merge remote-tracking branch 'origin/topic/awelzel/broker-publish-warn'
* origin/topic/awelzel/broker-publish-warn:
  btest: Avoid loading ZeroMQ if not compiled in
  btest/coverage: Avoid warnings in test-all-policy-cluster
  Broker::publish: Warn on using Broker::publish() when inactive
2024-12-11 11:08:11 -07:00
Arne Welzel
85189ca918 btest: Avoid loading ZeroMQ if not compiled in
...at the same time, add some `TEST-REQUIRES: have-zeromq` which
unfortunately means that developers will usually want libzmq
installed on their system.
2024-12-11 18:08:43 +01:00