Commit graph

18834 commits

Author SHA1 Message Date
Tim Wojtulewicz
abac0b577c Merge remote-tracking branch 'origin/topic/timw/update-submodules'
* origin/topic/timw/update-submodules:
  Update package-manager submodule [nomail]
  Update binpac submodule [nomail]
2025-07-15 08:58:11 -07:00
Tim Wojtulewicz
e55c37ae8b Update package-manager submodule [nomail] 2025-07-14 21:40:21 -07:00
Tim Wojtulewicz
4a7c681b99 Update binpac submodule [nomail] 2025-07-14 21:40:21 -07:00
zeek-bot
e0e62e28f6 Update doc submodule [nomail] [skip ci] 2025-07-15 00:30:17 +00:00
Tim Wojtulewicz
dc5d7c3fc9 Merge remote-tracking branch 'origin/topic/timw/std-filesystem'
* origin/topic/timw/std-filesystem:
  Fix some missing #includes resulting from removal of ghc::filesystem
  Remove ghc::filesystem submodule, switch to std::filesystem
2025-07-14 13:09:24 -07:00
Tim Wojtulewicz
55b427142d Merge remote-tracking branch 'origin/topic/johanna/connection-syn-packet-doc'
* origin/topic/johanna/connection-syn-packet-doc:
  Documentation: connection_SYN_packet
2025-07-14 11:26:13 -07:00
Johanna Amann
2fc75009f4 Documentation: connection_SYN_packet
Slightly clarify documentation related to the connection_SYN_packet
event.
2025-07-14 11:25:49 -07:00
Tim Wojtulewicz
1f87382302 Fix some missing #includes resulting from removal of ghc::filesystem 2025-07-14 11:23:54 -07:00
Tim Wojtulewicz
770bc0491e Remove ghc::filesystem submodule, switch to std::filesystem 2025-07-14 11:23:54 -07:00
Tim Wojtulewicz
a843521e78 Merge remote-tracking branch 'origin/topic/timw/cpp20-clang-tidy-updates'
* origin/topic/timw/cpp20-clang-tidy-updates:
  Use ranges::reverse_view to fix a few reverse ranged-for loops
  Disable a few new modernize clang-tidy checkers, enabled by C++20
2025-07-14 09:31:31 -07:00
Tim Wojtulewicz
8640f92b1f Use ranges::reverse_view to fix a few reverse ranged-for loops 2025-07-14 09:30:54 -07:00
Tim Wojtulewicz
832f67e91c Disable a few new modernize clang-tidy checkers, enabled by C++20 2025-07-14 09:30:54 -07:00
Arne Welzel
a014f48e0f Merge remote-tracking branch 'origin/topic/awelzel/4655-putty-org-to-chiark'
* origin/topic/awelzel/4655-putty-org-to-chiark:
  btest: Switch putty.org usage in tests to official URL
2025-07-14 09:31:20 +02:00
Arne Welzel
13f32a6b37 btest: Switch putty.org usage in tests to official URL
Closes #4655
2025-07-14 09:07:58 +02:00
Tim Wojtulewicz
448590270b Merge remote-tracking branch 'origin/topic/timw/move-util-deferred'
* origin/topic/timw/move-util-deferred:
  Move util::Deferred into util-types.h
2025-07-13 19:23:08 -07:00
Tim Wojtulewicz
6e96cb59ec Move util::Deferred into util-types.h 2025-07-13 19:22:02 -07:00
zeek-bot
e91e9c4523 Update doc submodule [nomail] [skip ci] 2025-07-12 00:17:54 +00:00
Evan Typanski
54f9e45597 Merge remote-tracking branch 'origin/topic/etyp/baseline-cleanup'
* origin/topic/etyp/baseline-cleanup:
  Cleanup unused baselines
2025-07-11 15:35:59 -04:00
Tim Wojtulewicz
0e869a5941 Merge remote-tracking branch 'origin/topic/timw/cpp20-NEWS'
* origin/topic/timw/cpp20-NEWS:
  Add NEWS entry about C++ 20 [nomail] [skip ci]
2025-07-11 12:13:54 -07:00
Tim Wojtulewicz
a4acae2dfe Add NEWS entry about C++ 20 [nomail] [skip ci] 2025-07-11 11:57:24 -07:00
Evan Typanski
a739d47835 Merge remote-tracking branch 'origin/topic/vern/add-del-void-exprs'
* origin/topic/vern/add-del-void-exprs:
  crash fixes for constructs that expect add/delete expressions to return values
2025-07-11 12:58:56 -04:00
Vern Paxson
fe5c953d31 crash fixes for constructs that expect add/delete expressions to return values 2025-07-11 12:56:08 -04:00
zeek-bot
a6776a9f25 Update doc submodule [nomail] [skip ci] 2025-07-11 00:49:08 +00:00
Tim Wojtulewicz
1e55543e86 Merge branch 'topic/timw/c++20'
* topic/timw/c++20:
  Reduce some false-positive warnings from GCC to warnings with -Werror
  Add zeek-namespaced alias for jthread
  Include RequireCXXStd.cmake from main CMakeLists.txt
  Update submodules to C++20-enabled versions
2025-07-10 15:43:09 -07:00
Tim Wojtulewicz
57a3c733d1 Reduce some false-positive warnings from GCC to warnings with -Werror
This also works around some of the same warnings. These are known bugs
in GCC 11+ and GCC 13.x.
2025-07-10 14:07:08 -07:00
Tim Wojtulewicz
cd356ce45d Add zeek-namespaced alias for jthread
Apple Clang (as of version 17.0.0) does not support jthread unless
you enable experimental libcpp features by defining
_LIBCPP_ENABLE_EXPERIMENTAL or passing -fexperimental_library to
the compiler. Even if you don't do those, our 3rdparty jthread
library fails to build because of a bunch of namespace/naming
collisions. I moved our 3rdparty one to the `nonstd` namespace, and
am using an alias under __APPLE__ to avoid the collisions.
2025-07-10 14:07:07 -07:00
Tim Wojtulewicz
350d0859aa Include RequireCXXStd.cmake from main CMakeLists.txt 2025-07-10 14:07:07 -07:00
Tim Wojtulewicz
0de1d8a345 Update submodules to C++20-enabled versions 2025-07-10 14:07:07 -07:00
Evan Typanski
066bbab07b Cleanup unused baselines 2025-07-10 16:46:09 -04:00
Tim Wojtulewicz
c6011e2160 Merge remote-tracking branch 'origin/topic/timw/known-services-with-storage-framework'
* origin/topic/timw/known-services-with-storage-framework:
  Modify known-services policy script to add storage framework support
2025-07-10 08:55:49 -07:00
Tim Wojtulewicz
1f64bb2870 Modify known-services policy script to add storage framework support
This adds a flag to enable using the storage framework instead of Broker stores,
plus a btest for both broker and the the storage framework.
2025-07-10 08:55:01 -07:00
Robin Sommer
6446bdf0dc
Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  [Spicy] Add linker scope to debugging output.
  [Spicy] Remove declarations for unimplemented functions.
  [Spicy] Bump `auxil/spicy/` to latest development snapshot.
2025-07-10 09:41:07 +02:00
Robin Sommer
ce6c7a6cd1
Merge remote-tracking branch 'origin/topic/bbannier/protocol-handle-close-finish'
* origin/topic/bbannier/protocol-handle-close-finish:
  [Spicy] Let `zeek::protocol_handle_close()` send a TCP EOF.
2025-07-10 09:38:11 +02:00
zeek-bot
d06468fd34 Update doc submodule [nomail] [skip ci] 2025-07-10 00:18:59 +00:00
Tim Wojtulewicz
0848ddfb9f Merge remote-tracking branch 'origin/topic/vern/ZAM-incr-op-opt-fix'
* origin/topic/vern/ZAM-incr-op-opt-fix:
  ZAM optimizer fix for += / -= set operations
2025-07-09 15:10:17 -07:00
Vern Paxson
1d43760862 ZAM optimizer fix for += / -= set operations 2025-07-09 13:40:33 -07:00
Robin Sommer
da59c12a9a
[Spicy] Add linker scope to debugging output. 2025-07-09 17:36:05 +02:00
Benjamin Bannier
96b8cd8ee4
[Spicy] Remove declarations for unimplemented functions. 2025-07-09 17:36:05 +02:00
Benjamin Bannier
2307c62a61
[Spicy] Bump auxil/spicy/ to latest development snapshot. 2025-07-09 17:36:05 +02:00
Benjamin Bannier
d6c22295bd
[Spicy] Let zeek::protocol_handle_close() send a TCP EOF.
Zeek's analyzer API makes it hard to determine during analyzer
shutdown whether a regular end-of-data has been reached, or if we're
aborting in the middle of a session (e.g., because Zeek missed the
remaining packets): the corresponding analyzer method, `EndOfData()`
gets called in both cases.

In an earlier change, we had stopped signaling Spicy analyzers a
regular finish when that `EndOfData()` method executes, because doing
so could trigger a parse error if it wasn't a regular shutdown—-which
isn't desired, a user request was to just silently stop processing in
this case.

However, that behavior now seems unfortunate in the case that one
deliberately calls `zeek::protocol_handle_close()` to terminate an
analyzer: this feels like a regular shutdown that should just
immediately happen. We achieve this now in this function by
additionally signaling the shutdown at the TCP layer as an "end of
file", which, for Spicy analyzers, happens to run the final, orderly
tear-down.

Not exactly great, but ti seems to thread the needle to achieve the
desired semantics in both cases.
2025-07-09 17:28:19 +02:00
Benjamin Bannier
92868804b1 Merge branch 'topic/bbannier/bump-pre-commit-hook-spicy-format' 2025-07-09 11:56:03 +02:00
Benjamin Bannier
b959ba3395 Bump spicy-format pre-commit hook
pre-commit ignores Cargo.lock files for Rust projects, so any movement
in a Rust project's dependencies can break a hook, even if no code in
the hook changed. I have tried to work with upstream on a fix, but they
basically told me they weren't interested and to get lost.

This bumps the `spicy-format` pre-commit hook to a new version which
explicitly deals with bumps of its dependencies. Having to do this
semi-regularly is not fun, and ideally somebody interested in using this
hook would help set up infrastructure in the hook so it just pulls
pre-built binaries. This is not directly supported by pre-commit, but
many projects work around this by declaring a Python module which then
pulls pre-build binaries which already exist for spicy-format.
2025-07-09 11:40:25 +02:00
Christian Kreibich
9322687823 Merge branch 'topic/christian/rdp-cookie-clarification'
* topic/christian/rdp-cookie-clarification:
  Clarify the cookie field's origin in the RDP log.
2025-07-08 17:45:27 -07:00
zeek-bot
8be80f8c18 Update doc submodule [nomail] [skip ci] 2025-07-09 00:27:47 +00:00
Christian Kreibich
2ca0fb6539 Clarify the cookie field's origin in the RDP log. 2025-07-08 16:31:57 -07:00
Arne Welzel
0c60f2a70a Merge branch 'topic/jgras/connection-packet-threshold' of https://github.com/J-Gras/zeek
* 'topic/jgras/connection-packet-threshold' of https://github.com/J-Gras/zeek:
  Add NEWS entry for generic packet thresholds
  Allow for multiple generic packet thresholds
  Add btest for conn_generic_packet_threshold_crossed event
  Update dump-events btest baseline
  Add conn_generic_packet_threshold_crossed event
2025-07-08 17:54:27 +02:00
Johanna Amann
8ba77da152 Merge remote-tracking branch 'origin/topic/johanna/gh-4602'
* origin/topic/johanna/gh-4602:
  PPPoE: don't forward more bytes than header indicates
2025-07-08 11:44:53 +01:00
Johanna Amann
4c46c02aec Merge remote-tracking branch 'origin/topic/johanna/random-indentation'
* origin/topic/johanna/random-indentation:
  Fix indentation of scripts / tests
2025-07-08 11:41:37 +01:00
Jan Grashoefer
50ab72efc2 Add NEWS entry for generic packet thresholds 2025-07-08 11:30:38 +02:00
Jan Grashoefer
e6d8c3b072 Allow for multiple generic packet thresholds
Co-authored-by: Arne Welzel <arne.welzel@corelight.com>
2025-07-08 11:29:06 +02:00