Commit graph

11289 commits

Author SHA1 Message Date
Christian Kreibich
a6e086b662 Install BTest with Zeek
Configuring with --disable-btest skips the installation. The main
reason for doing this is that many Zeek packages come with testsuites
that nearly always require btest, so providing btest out of the box
makes sense. Note that zkg's recent additions to its PATH environment
variable management mean that this btest instance is automatically
found also when the Zeek installation's binary folder isn't in the
path.
2021-01-20 13:52:14 -08:00
Jon Siwek
50b3012020 Update submodule(s) [nomail] 2021-01-12 20:48:00 -08:00
Jon Siwek
8ff1604126 Merge remote-tracking branch 'origin/topic/vern/lambda-copy-semantics'
* origin/topic/vern/lambda-copy-semantics:
  Add NEWS entries for lambda/capture-list functionality
  Tweak vector append/move logic of Frame::SerializeCopyFrame()
  Switch FuncType capture-list storage to optional<vector<Capture>>
  Fix memory leaks in lambda capture/frame management
  tests added for new capture-by-reference closure semantics & errors
  documentation updates
  test suite updates and additions for new capture semantics & suppression of error cascades
  support for transmitting of capture-semantics closures via Broker, while keeping deprecated functionality
  minor simplifications in using type names, and unordered sets rather than vectors
  changes to Frames to support access to captured-by-copy-semantics variables
  changes to ScriptFunc's to track captures, and LambdaExpr's to check/manage them
  parsing of new []-style captures, and creation of associated data structures
  nit: fixed some 0/1 values that should instead be false/true
  no semantic changes: factored some of the complexity of begin_func() into a pair of static functions for clarity
  simple error propagation fix: don't complain about "unused" values that themselves are due to errors
  no semantic changes: corrected & reflowed some comments, plus a whitespace tweak
2021-01-11 18:12:23 -08:00
zeek-bot
deae8088a6 Update doc submodule [nomail] [skip ci] 2021-01-12 00:57:00 +00:00
Jon Siwek
c166288248 Add NEWS entries for lambda/capture-list functionality 2021-01-11 16:29:39 -08:00
Jon Siwek
0a7e5e67a2 Tweak vector append/move logic of Frame::SerializeCopyFrame()
No functional difference, just simplification.
2021-01-11 16:09:48 -08:00
Jon Siwek
b08112b2e7 Switch FuncType capture-list storage to optional<vector<Capture>>
May help clarify overall mem-mgmt/ownership semantics.
2021-01-11 15:57:58 -08:00
Jon Siwek
ab15a98b28 Fix memory leaks in lambda capture/frame management 2021-01-11 15:07:01 -08:00
Jon Siwek
614fade0a4 Merge branch 'master' into topic/vern/lambda-copy-semantics 2021-01-11 11:48:45 -08:00
Jon Siwek
321a027d07 Remove unusable/broken RocksDB code and options
The Broker RockSDB data store backend was previously unusable
and broken, so all code and options related to it are now removed.
2021-01-11 11:12:59 -08:00
Jon Siwek
54b52eb197 Merge remote-tracking branch 'origin/topic/vern/script-inlining'
* origin/topic/vern/script-inlining:
  cleaner approach for localizing errors associated with duplicated ASTs: virtualize GetLocationInfo
  Add commentary to Frame::GetElement(int) about lack of offset adjustment
  Remove unused local in Inliner::Analyzer()
  Tweak FuncInfo memory management
  Switch InlineExpr from using IDPList* to vector<IDPtr>
  Insert contents of #included script-opt files directly
  Simplify some IntrusivePtr operations in Expr::Duplicate/Inline
  Remove Func::AsScriptFunc() methods
  Remove superflous std::move's from Inliner return values
  Remove SetupResult::parse_only field
  Rename Frame::IncreaseOffset() to Frame::AdjustOffset()
  Update alternative plugins.hooks baselines
  Superficial changes to script-opt related code
  merge glitch
  updates from test suite
  inlining of Zeek script functions
  inlining of Zeek script functions
2021-01-07 17:06:09 -08:00
Vern Paxson
eb1848c547 cleaner approach for localizing errors associated with duplicated ASTs: virtualize GetLocationInfo 2021-01-07 15:14:22 -08:00
Johanna Amann
7e1401d552 Update COPYING to 2021 2021-01-07 09:56:59 +00:00
Jon Siwek
c0a5328f8e Add commentary to Frame::GetElement(int) about lack of offset adjustment 2021-01-06 22:21:09 -08:00
Jon Siwek
10ae10d4e4 Remove unused local in Inliner::Analyzer() 2021-01-06 22:13:31 -08:00
Jon Siwek
64631a2d9f Merge branch 'master' into topic/vern/script-inlining 2021-01-06 22:08:29 -08:00
Jon Siwek
b543b97d27 Update submodule(s) [nomail] 2021-01-06 21:43:15 -08:00
Jon Siwek
1d24b8a857 Update cmake module to fix ZeekPluginDynamic's find_package(CAF)
Fixes GH-1347
2021-01-06 20:45:44 -08:00
Jon Siwek
eebc80da5e Update submodule(s) [nomail] 2021-01-04 15:42:03 -08:00
Vern Paxson
35421b07f1 tests added for new capture-by-reference closure semantics & errors 2021-01-04 14:38:12 -08:00
Vern Paxson
4884b191e8 documentation updates 2021-01-04 14:36:25 -08:00
Vern Paxson
fd309676bd test suite updates and additions for new capture semantics & suppression of error cascades 2021-01-04 14:34:18 -08:00
Vern Paxson
80f7d36582 support for transmitting of capture-semantics closures via Broker, while keeping deprecated functionality 2021-01-04 14:29:07 -08:00
Vern Paxson
e531b2a7ca minor simplifications in using type names, and unordered sets rather than vectors 2021-01-04 14:25:50 -08:00
Vern Paxson
8f4b616d65 changes to Frames to support access to captured-by-copy-semantics variables 2021-01-04 14:17:56 -08:00
Vern Paxson
627fb8616e changes to ScriptFunc's to track captures, and LambdaExpr's to check/manage them 2021-01-04 14:07:41 -08:00
Vern Paxson
955384291d parsing of new []-style captures, and creation of associated data structures 2021-01-04 13:58:20 -08:00
Vern Paxson
f673f85acc nit: fixed some 0/1 values that should instead be false/true 2021-01-04 13:49:50 -08:00
Vern Paxson
98529ae4ec no semantic changes: factored some of the complexity of begin_func() into a pair of static functions for clarity 2021-01-04 13:40:37 -08:00
Vern Paxson
9cb506ad97 simple error propagation fix: don't complain about "unused" values that themselves are due to errors 2021-01-04 13:39:22 -08:00
Vern Paxson
c8be7ec795 no semantic changes: corrected & reflowed some comments, plus a whitespace tweak 2021-01-04 13:38:36 -08:00
Tim Wojtulewicz
fa61a715bc Merge remote-tracking branch 'origin/topic/jsiwek/add-lgtm-config'
* origin/topic/jsiwek/add-lgtm-config:
  Add LGTM config file
2020-12-28 15:37:37 -07:00
Jon Siwek
f5b1d9c519 Update submodule(s) [nomail] 2020-12-23 10:39:01 -08:00
Jon Siwek
7cf08d4e58 Merge remote-tracking branch 'origin/topic/neverlord/1336'
* origin/topic/neverlord/1336:
  Fix subtle race on data store initialization
2020-12-23 10:36:09 -08:00
zeek-bot
a782c985ae Update doc submodule [nomail] [skip ci] 2020-12-23 00:46:34 +00:00
Dominik Charousset
8d726ed07a Fix subtle race on data store initialization 2020-12-22 21:15:17 +01:00
Jon Siwek
604fbea00d Merge remote-tracking branch 'origin/topic/johanna/1323'
* origin/topic/johanna/1323:
  TLS 1.3 changes: Address review feedback
  Add one more TLS 1.3 testcase and update NEWS
  Fix TLS 1.3 session resumption detection.
  Introduce ssl_probable_encrypted_handshake_message event
  SSL Analyzer: ignore CCS for TLS 1.3
  TLS analyzer: change logic to track TLS 1.3 connection establishment
2020-12-22 11:00:59 -08:00
Jon Siwek
b4968de3ea Merge remote-tracking branch 'origin/topic/christian/ci-big-sur-support'
* origin/topic/christian/ci-big-sur-support:
  Add MacOS Big Sur to CI, now that Cirrus supports it
2020-12-21 10:55:37 -08:00
Christian Kreibich
4c3ef91965 Add MacOS Big Sur to CI, now that Cirrus supports it 2020-12-18 09:40:48 -08:00
Johanna Amann
886d7178ef TLS 1.3 changes: Address review feedback
Only minor changes, new consts, and documentation updates.

Part of GH-1335. Addresses GH-1323.
2020-12-18 10:51:36 +00:00
Jon Siwek
ed4afa95d3 Merge remote-tracking branch 'origin/topic/neverlord/cmake-cleanup'
* origin/topic/neverlord/cmake-cleanup:
  Remove explicit use of config mode for finding CAF
2020-12-17 16:11:58 -08:00
Tim Wojtulewicz
819c5c1e0b Update submodules [nomail] 2020-12-17 10:57:47 -07:00
Jon Siwek
b0d8ca06af Merge branch 'create-shadow-files-atomically' of https://github.com/awelzel/zeek
* 'create-shadow-files-atomically' of https://github.com/awelzel/zeek:
  logging/ascii: Atomically create .shadow files using rename()
2020-12-16 15:10:39 -08:00
Jon Siwek
4d06ea635f Update submodule(s) [nomail] 2020-12-16 15:07:03 -08:00
Arne Welzel
ef7206bb99 logging/ascii: Atomically create .shadow files using rename()
A logger process being terminated/killed while in the process of creating
a new .shadow file may leave an empty (invalid) one around. This in turn
causes the logger to error and exit during startup.

    $ $ ls -lha .shadow.*
    -rw-r--r-- 1 root root 0 Dec 16 18:48 .shadow.dns.log
    -rw-r--r-- 1 root root 0 Dec 16 18:48 .shadow.packet_filter.log

    $ zeek LogAscii::enable_leftover_log_rotation=T Log::default_rotation_interval=30sec -i wlp0s20f3
    error in <params>, line 1: failed to process leftover log 'dns.log': Found leftover log, 'dns.log', but the associated shadow  file, '.shadow.dns.log', required to process it is invalid
    error in <params>, line 1: failed to process leftover log 'packet_filter.log': Found leftover log, 'packet_filter.log', but the associated shadow  file, '.shadow.packet_filter.log', required to process it is invalid
    $ ...

Prevent creating invalid .shadow files by atomically creating them.
2020-12-16 19:03:00 +01:00
Johanna Amann
22ed75c3ce Add one more TLS 1.3 testcase and update NEWS 2020-12-15 16:57:26 +00:00
Johanna Amann
3c95c9a956 Fix TLS 1.3 session resumption detection.
Now we detect TLS 1.3 session resumption by looking if both sides have
the PSK extension set, which is much more exact than the previous
approach.
2020-12-15 16:34:47 +00:00
Jon Siwek
206c674cc9 Merge EDNS ECS option parsing security/bug fixes 2020-12-15 08:03:40 -08:00
Johanna Amann
84315b54c3 Introduce ssl_probable_encrypted_handshake_message event
This event is raised for messages that (probably) are TLS 1.3 handshake
messages, including finished. This allows scripts to examine handshake
messages without having to handle all encrypted messages.
2020-12-15 15:52:24 +00:00
Johanna Amann
232777ca9b SSL Analyzer: ignore CCS for TLS 1.3
In TLS 1.3, the ChangeCipherSpec message is meaningless; it only is
included to convince middleboxes that the devices actually are speaking
TLS 1.2. Nowadays some TLS 1.3 implementations also just don't send the
packet.

In a push to unify our handling of TLS 1.3 connections - ignore CCS and
always go with application data packet counting to determine if
connections are or are not encrypted.
2020-12-15 15:22:31 +00:00