Commit graph

9067 commits

Author SHA1 Message Date
Derek Ditch
9d35aa1fef
Add additional 3rd party headers to includes
Adds FIFO Map and JSON headers to include distribution

Fixes #580
2019-09-17 07:40:04 -05:00
Jon Siwek
83180a2553 Merge remote-tracking branch 'origin/topic/timw/coverity-fixes'
* origin/topic/timw/coverity-fixes:
  Add move assignment operator to logging::Tag (Coverity 1357732)
  Throw an error during input::Manager::CreateTableStream if val is null (Coverity 1402730)
  Use ntohl instead of manually swapping bytes in extract_XDR_uint32 (Coverity 1375796 and others)
  Add check for null init variable during make_var. (Coverity 1403419)
  Remove dead check in Val::check_and_promote. (Coverity 1401810)
  Handle failure of fcntl in Pipe. (Coverity 1241934, 1241935)
  Initialize missing field in File. (Coverity 1057851, 1057852, 1057853)
  Add null check for results of dynamic_cast in AssignExpr::TypeCheck. Fixes coverity findings 1403416 and 1403417
  Add null check when getting key size for List types. Fixes coverity finding 1058242
2019-09-16 17:15:32 -07:00
Tim Wojtulewicz
48e7169bd8 Add move assignment operator to logging::Tag (Coverity 1357732) 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
1cf8a530cf Throw an error during input::Manager::CreateTableStream if val is null (Coverity 1402730) 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
68accaa791 Use ntohl instead of manually swapping bytes in extract_XDR_uint32 (Coverity 1375796 and others) 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
aacd2134fa Add check for null init variable during make_var. (Coverity 1403419) 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
53c82cc872 Remove dead check in Val::check_and_promote. (Coverity 1401810) 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
c009cd3289 Handle failure of fcntl in Pipe. (Coverity 1241934, 1241935) 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
dddba3432f Initialize missing field in File. (Coverity 1057851, 1057852, 1057853) 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
0140098adb Add null check for results of dynamic_cast in AssignExpr::TypeCheck. Fixes coverity findings 1403416 and 1403417 2019-09-16 10:56:41 -07:00
Tim Wojtulewicz
40d4004453 Add null check when getting key size for List types. Fixes coverity finding 1058242 2019-09-16 10:56:41 -07:00
Jon Siwek
9c8db5f6ca Stop loading scan detection in local.zeek by default 2019-09-16 10:51:50 -07:00
Robin Sommer
6cedfe81bb Updating submodule(s).
[nomail]
2019-09-09 11:35:19 +00:00
Jon Siwek
506773ba13 Updating submodule(s).
[nomail]
2019-09-06 12:57:24 -07:00
Jon Siwek
cc2ccb7a3c Updating submodule(s).
[nomail]
2019-09-04 19:05:30 -07:00
Jon Siwek
f6f471f4b7 Update Broker include dir search path
Related to https://github.com/zeek/broker/issues/51
2019-09-04 16:29:04 -07:00
Jon Siwek
af5715ec5e Updating submodule(s).
[nomail]
2019-09-04 15:35:57 -07:00
Jon Siwek
c88568db4d Update embedded CAF to 0.17.1 (plus cherry-picked memory leak fix) 2019-09-04 13:42:55 -07:00
Jon Siwek
015464939e Updating submodule(s).
[nomail]
2019-09-04 10:27:26 -07:00
Jon Siwek
d773b6986b Updating submodule(s).
[nomail]
2019-09-03 11:33:22 -07:00
Jon Siwek
655c142d01 Merge branch 'patch-2' of https://github.com/The-Alchemist/zeek
* 'patch-2' of https://github.com/The-Alchemist/zeek:
  fix another minor typo
2019-09-03 10:36:16 -07:00
Jon Siwek
bfa6eb54e8 Merge branch 'patch-1' of https://github.com/The-Alchemist/zeek
* 'patch-1' of https://github.com/The-Alchemist/zeek:
  fix minor typo
2019-09-03 10:34:57 -07:00
The Alchemist
a4e20bb58a
fix another minor typo 2019-08-29 16:10:26 -04:00
The Alchemist
a5e4720204
fix minor typo 2019-08-29 16:09:27 -04:00
Jon Siwek
39161e2192 CID 1404734: fix NetSessions::MemoryAllocation() 2019-08-29 13:06:09 -07:00
Johanna Amann
bb98559c0d Merge remote-tracking branch 'origin/topic/jsiwek/gh-545-weird-addl'
* origin/topic/jsiwek/gh-545-weird-addl:
  GH-545: add "addl" parameter to flow_weird and net_weird events
2019-08-28 14:27:53 -07:00
Johanna Amann
1dd0b2e292 Merge remote-tracking branch 'origin/topic/jsiwek/gh-554-file-signature-optimizations'
* origin/topic/jsiwek/gh-554-file-signature-optimizations:
  GH-554: don't init PIA endpoint matchers if there's only file-magic
  GH-554: remove use of file magic in protocol-based signature logic
2019-08-28 11:39:13 -07:00
Johanna Amann
ec57894a85 Merge remote-tracking branch 'origin/topic/jsiwek/gh-541-ntlm-fix'
* origin/topic/jsiwek/gh-541-ntlm-fix:
  GH-541: add test cases for NTLM AV Pair sequence handling
  GH-541: fix handling of NTLM AV Pair sequences
2019-08-28 11:33:49 -07:00
Johanna Amann
81dea943d3 Merge remote-tracking branch 'origin/topic/jsiwek/simplify-tag-error-check'
* origin/topic/jsiwek/simplify-tag-error-check:
  Make Tag::Error values constant
  Simplify operator bool()'s used for Tag error checks
2019-08-28 10:58:54 -07:00
Johanna Amann
33958fa3da Merge remote-tracking branch 'origin/topic/jsiwek/unspecified-ip-constants'
* origin/topic/jsiwek/unspecified-ip-constants:
  Add/use unspecified IPAddr constants
2019-08-28 09:17:44 -07:00
Jon Siwek
316e8bb671 GH-554: don't init PIA endpoint matchers if there's only file-magic
The logic for initializing PIA endpoint matchers was previously
skipped if "there's no global rule matcher", and that's only true
when no signature files get loaded.

But when using `zeek -b`, some file-magic signatures still get loaded
by default, so the PIA endpoint matchers still get initialized even
though they don't need to be -- file-magic patterns play no part
in PIA.

For typical use-cases (not using the `-b` flag), this change won't
help any, but we do at least use `-b` often within the test suite.
2019-08-27 16:32:30 -07:00
Jon Siwek
8c9b3bd3ae GH-554: remove use of file magic in protocol-based signature logic
This can be a significant performance/memory improvement since
otherwise the protocol-based rule matching logic ends up superfluously
creating file-matching state per file-matcher per connection/endpoint.
2019-08-27 16:16:39 -07:00
Jon Siwek
289a1e2e8e Merge branch '555-smb3-negotiate-context-fix' of https://github.com/mad/zeek
- Fixed the context list padding to only be used for dialect 0x0311.
  The new test case includes an example where parsing the optional
  padding would fail for another dialect.

* '555-smb3-negotiate-context-fix' of https://github.com/mad/zeek:
  Fix for smb3 negotiate context
2019-08-27 10:08:42 -07:00
Pavel Ershov
de4a83206d Fix for smb3 negotiate context 2019-08-27 12:21:03 +03:00
Jon Siwek
08cdc0871f Merge remote-tracking branch 'origin/topic/timw/main-cleanup'
* origin/topic/timw/main-cleanup:
  main: Properly close down SSL/sqlite at shutdown if net_run never started up
  main: Finish processing program arguments before setting up SSL/sqlite
2019-08-26 14:59:56 -07:00
Tim Wojtulewicz
fa62e5b48c main: Properly close down SSL/sqlite at shutdown if net_run never started up 2019-08-26 10:31:17 -07:00
Tim Wojtulewicz
7edebe179f main: Finish processing program arguments before setting up SSL/sqlite 2019-08-26 10:29:43 -07:00
Jon Siwek
b954767488 GH-541: add test cases for NTLM AV Pair sequence handling 2019-08-26 10:28:46 -07:00
Jon Siwek
13af91febb Make Tag::Error values constant 2019-08-23 16:31:45 -07:00
Jon Siwek
0699b28893 Merge remote-tracking branch 'origin/topic/seth/github-ident-flex'
* origin/topic/seth/github-ident-flex:
  Make github identify our Flex source correctly.
2019-08-23 14:31:51 -07:00
Seth Hall
6268851a68 Make github identify our Flex source correctly. 2019-08-23 14:27:06 -04:00
Jon Siwek
b41e102a7c Simplify operator bool()'s used for Tag error checks 2019-08-23 11:31:18 -04:00
Jon Siwek
ba929ce2c4 Add/use unspecified IPAddr constants
The analyzer-scheduling code was otherwise frequently converting the
unspecified v4/v6 addresses from strings.
2019-08-23 11:15:02 -04:00
Jon Siwek
a9f14bf503 GH-541: fix handling of NTLM AV Pair sequences
Empty AV Pair sequences or AV Pair sequences that lack a terminator
could cause accesses past the end of the parsed vector.
2019-08-23 07:22:18 -04:00
Jon Siwek
48873570b5 Updating submodule(s).
[nomail]
2019-08-23 06:37:27 -04:00
Jon Siwek
e7a2ee6edc Merge remote-tracking branch 'origin/topic/timw/mapping'
- Minor whitespace and comment adjustments

* origin/topic/timw/mapping:
  Fix unit tests for new ordering from NetSessions::Drain
  Change FragReassembler to use a tuple as a key and use std::map for fragments in Sessions
  Rework Session/Connection tracking to use a std::map instead of PDict
2019-08-23 06:28:44 -04:00
Jon Siwek
24a72a76ef Merge remote-tracking branch 'origin/topic/seth/github-linguist-fixes'
- Changed .bif files to be detected as C++

* origin/topic/seth/github-linguist-fixes:
  Adjusting how files are ignored for linguist and adding bif files to ignore.
  Stop incorrect language identification on github.
2019-08-23 05:45:34 -04:00
Jon Siwek
104633737d Merge remote-tracking branch 'origin/topic/seth/zeek-fix-thread-names'
* origin/topic/seth/zeek-fix-thread-names:
  Zeekify thread naming.
2019-08-23 05:40:09 -04:00
Seth Hall
162f4012b5 Adjusting how files are ignored for linguist and adding bif files to ignore. 2019-08-22 22:17:04 -04:00
Seth Hall
1a07df196e Zeekify thread naming.
I copied the same style that caf uses ("zk" with single dot and no space).
This gives some consistency with caf and avoids us wasting more
space beyond "bro: ".  OSs only give 16 characters for thread names
so anything we can gain here is nice.
2019-08-22 22:10:27 -04:00