Commit graph

3325 commits

Author SHA1 Message Date
Christian Kreibich
af4c21763f Merge branch 'topic/christian/ci-updates'
* topic/christian/ci-updates:
  CI: Use FEDORA40 crypto policy in Fedora 41
  Bump zeekjs to 0.13.0
  CI: bump FreeBSD 13 to 13.4, released in September
  CI: drop Fedora 39, add 41
2024-11-13 17:29:23 -08:00
Tim Wojtulewicz
3c08c57be3 Merge remote-tracking branch 'origin/topic/timw/3915-unknown-ip-protocol'
* origin/topic/timw/3915-unknown-ip-protocol:
  Add NEWS entry for ip_proto feature
  Move IP protocol names table out of policy script to init-bare
  Minor review nits
  Fixes for community ID hashing with new proto values
  Use new_connection instead of connection_state_remove
  Add policy script to remove ip_proto field, rename protocol naming script
  Rename protocol_id field to ip_proto and similar renaming for name field
  Increase size of proto fields to uint16_t, add common default value
  Disable part of core/dict-iteration-expire5 btest to avoid iteration bug
  Add conn.log entries for connections with unhandled IP protocols
2024-11-13 14:36:22 -07:00
Tim Wojtulewicz
0217208c49 Merge remote-tracking branch 'origin/topic/timw/remove-abspath-cleanup'
* origin/topic/timw/remove-abspath-cleanup:
  diff-remove-abspath: Add separate handling of Windows paths
  diff-remove-abspath: Remove capture of windows drive letters from POSIX regex
2024-11-12 12:26:56 -07:00
Robin Sommer
0ea2a35d7a
Merge remote-tracking branch 'origin/topic/robin/spicy-bump'
* origin/topic/robin/spicy-bump:
  Bump Spicy to current `main`.
2024-11-12 16:16:23 +01:00
Arne Welzel
d0bf4e428a Merge remote-tracking branch 'origin/topic/awelzel/pseudo-realtime-again'
* origin/topic/awelzel/pseudo-realtime-again:
  PktSrc: Remove first_timestamp condition check
  PktSrc: Fix includes
  PktSrc/RunState: Scale on first_wallclock and move pseudo realtime logic to RunState
  RunState.h: Deprecate misleadingly named current_packet_timestamp()
  debug: Add processing suspended/continued to debug.log
2024-11-12 16:00:19 +01:00
Arne Welzel
9e27334596 Merge remote-tracking branch 'origin/topic/vern/zam-asan-fixes'
* origin/topic/vern/zam-asan-fixes:
  ZAM fixes for assignments involving "any" record fields
  fixes for (mostly ZAM) vector operation issues found by ASAN

Including a fix for mmdb/explicit-open.zeek to avoid using assert.
2024-11-12 10:29:56 +01:00
Benjamin Bannier
1d38c31071 Merge remote-tracking branch 'origin/topic/etyp/cookie-nullptr-spicy-dpd' 2024-11-11 22:30:50 +01:00
Arne Welzel
50c2b10cfb Merge remote-tracking branch 'origin/topic/awelzel/run-zam-ci-if-changes-include-src-script-opt'
* origin/topic/awelzel/run-zam-ci-if-changes-include-src-script-opt:
  ci: Run ZAM CI if src/script_opt is modified
2024-11-11 10:25:56 +01:00
Arne Welzel
f598c89f17 Merge remote-tracking branch 'origin/topic/timw/update-c-ares-to-latest-release'
* origin/topic/timw/update-c-ares-to-latest-release:
  DNS_Mgr: Remove processing of dns aliases in general
  ci: Add dnsmasq to a few platforms for testing
  DNS_Mgr: Fix aliases memory issues
  btest: Add integration test for DNS_Mgr
  DNS_Mgr: Remove usage of ares_getsock from Lookup
  DNS_Mgr: Remove usage of ares_getsock from GetNextTimeout
  DNS_Mgr: Switch to ares_set_servers_csv
  DNS_Mgr: Use ares_dns_record methods for queries
  Update vcpkg submodule to pick up c-ares v1.34.2
  Update c-ares submodule to v1.34.2
2024-11-11 09:53:04 +01:00
Arne Welzel
d3579c1f34 Merge remote-tracking branch 'origin/topic/awelzel/community-id-new-connection'
* origin/topic/awelzel/community-id-new-connection:
  policy/community-id: Populate conn$community_id in new_connection()
2024-11-11 09:35:49 +01:00
Arne Welzel
346a9233da Merge remote-tracking branch 'origin/topic/vern/zam-any-coerce-leak'
* origin/topic/vern/zam-any-coerce-leak:
  Fixed ZAM memory leak when coercing values to "any"
2024-11-08 18:36:34 +01:00
Arne Welzel
4f8ef3c792 Merge remote-tracking branch 'origin/topic/vern/zam-degenerate-CFT-propagation'
* origin/topic/vern/zam-degenerate-CFT-propagation:
  fixes for ZAM's propagation of control flow information for some degenerate constructs
2024-11-08 15:35:08 +01:00
Arne Welzel
bc75b1811d Merge remote-tracking branch 'origin/topic/vern/zam-vector-loop-leak'
* origin/topic/vern/zam-vector-loop-leak:
  fixed ZAM memory leak when looping over vectors of records
2024-11-08 15:32:57 +01:00
Arne Welzel
8613f821f9 Merge remote-tracking branch 'origin/topic/vern/cat-builtin-tmp'
* origin/topic/vern/cat-builtin-tmp:
  fixed access to uninitialized memory in ZAM's "cat" built-in
2024-11-08 15:23:00 +01:00
Benjamin Bannier
e4dbba20a4 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy' 2024-11-06 11:57:01 +01:00
Benjamin Bannier
2e8d6e86e7 Merge remote-tracking branch 'origin/topic/bbannier/spicy-cookie-nullptr-deref' 2024-11-05 17:39:12 +01:00
Arne Welzel
a3a0155825 Merge remote-tracking branch 'origin/topic/awelzel/sqli-test-followup'
* origin/topic/awelzel/sqli-test-followup:
  btest: Add detect-sqli test script
2024-11-04 19:35:34 +01:00
Arne Welzel
c171d9e8c2 Merge remote-tracking branch 'origin/topic/vern/canonicalize-std-string'
* origin/topic/vern/canonicalize-std-string:
  switched CPPCompile::Canonicalize() to take std::string instead of const char*
2024-11-04 18:47:18 +01:00
Arne Welzel
8935dc9ed4 Merge remote-tracking branch 'origin/topic/vern/script-opt-fnv1a64'
* origin/topic/vern/script-opt-fnv1a64:
  minor ZAM BTest updates for recently added fnv1a64 BiF
2024-11-04 16:33:21 +01:00
Arne Welzel
db497d1da7 Merge remote-tracking branch 'origin/topic/awelzel/pattern-matches-rework'
* origin/topic/awelzel/pattern-matches-rework:
  RuleMatcher: Use a single list for tracking pattern_matches
  ZeekString: Implement move constructor
2024-11-04 16:32:48 +01:00
Arne Welzel
7b3bc891f4 Merge remote-tracking branch 'origin/topic/etyp/ubuntu-clang-ci'
Modified ubuntu24_clang_libcpp_task to be skipped on PRs.

* origin/topic/etyp/ubuntu-clang-ci:
  CI: Upgrade FreeBSD 14 to 14.1
  CI: Add Ubuntu Clang task
  Fix up minor warnings in touched files
  Fix Clang 19 deprecation failure
2024-10-30 14:54:08 +01:00
Arne Welzel
9fa4d6f5ed pre-commit-config: Disable spicy-format
This fails to install currently: bbannier/spicy-format#157
2024-10-30 14:43:42 +01:00
Arne Welzel
fd0181c2cb Merge branch 'modbus-fc-fixes' of https://github.com/zambo99/zeek
* 'modbus-fc-fixes' of https://github.com/zambo99/zeek:
  Fix issues with Modbus message logging
2024-10-30 14:38:53 +01:00
Arne Welzel
00a0f9c920 Merge remote-tracking branch 'origin/topic/awelzel/data-end-offset-v1'
* origin/topic/awelzel/data-end-offset-v1:
  signatures: Add data_end_offset to signature_match() and custom events
  Add pattern_end_offset to signature_state
2024-10-30 14:34:08 +01:00
Johanna Amann
681fd37a6d Merge remote-tracking branch 'origin/topic/awelzel/skip-modbus-when-spicy-ssl-enabled'
* origin/topic/awelzel/skip-modbus-when-spicy-ssl-enabled:
  modbus: Skip non-modbus traffic testing with Spicy SSL
  testing: Add have-spicy-ssl helper and update tests
2024-10-30 11:48:15 +00:00
Arne Welzel
5200b84fb3 Merge branch 'sqli-spaces-encode-to-plus' of https://github.com/cooper-grill/zeek
* 'sqli-spaces-encode-to-plus' of https://github.com/cooper-grill/zeek:
  account for spaces encoding to plus signs in sqli regex detection
2024-10-29 14:08:39 +01:00
Arne Welzel
821218e7b2 Merge remote-tracking branch 'origin/topic/vern/CPP-when-capture-naming'
* origin/topic/vern/CPP-when-capture-naming:
  fixed "-O gen-C++" naming of "when" captures to avoid ambiguities due to inlining
  Simplified & made more robust maintenance helper script for "-O gen-C++" testing
  "-a cpp" baseline updates to reflect recent BTest changes
2024-10-29 13:50:56 +01:00
Christian Kreibich
66173633f4 Merge branch 'topic/christian/telemetry-make-bifs-primary'
* topic/christian/telemetry-make-bifs-primary:
  Telemetry framework: move BIFs to the primary-bif stage
  Minor comment tweaks for init-frameworks-and-bifs.zeek
2024-10-24 07:09:16 -07:00
Christian Kreibich
f2b4c9d553 Update broker submodule [nomail]
This pulls in zeek/broker#424, zeek/broker#430, zeek/broker#431.
2024-10-23 05:52:07 -07:00
Arne Welzel
daa358c840 Merge remote-tracking branch 'origin/topic/awelzel/3947-telemetry-hook-scrape'
* origin/topic/awelzel/3947-telemetry-hook-scrape:
  btest/telemetry: Fix "Note compilable" typo
  misc/stats: Add zeek_net_timestamp_seconds
  telemetry/Manager: Remove variant include
  telemetry: Invoke Telemetry::sync() only at scrape/collection time
2024-10-22 19:04:51 +02:00
Arne Welzel
d74b073852 Merge remote-tracking branch 'origin/topic/awelzel/3978-zeekjs-0.12.1-bump'
* origin/topic/awelzel/3978-zeekjs-0.12.1-bump:
  Bump zeekjs to 0.12.1
2024-10-22 11:25:05 +02:00
Arne Welzel
4763282f36 Merge branch 'modbus-fixes' of https://github.com/zambo99/zeek
* 'modbus-fixes' of https://github.com/zambo99/zeek:
  Prevent non-Modbus on port 502 to be reported as Modbus
2024-10-21 15:54:11 +02:00
Christian Kreibich
2e576b058d Merge branch 'topic/vern/script-opt-headers-factoring'
* topic/vern/script-opt-headers-factoring:
  factored CPP source's main header into collection of per-source-file headers
  renamed script optimization Attrs.h header to prepare for factoring large Compile.h
  factored ZAM source's main header into collection of per-source-file headers
2024-10-18 17:51:19 -07:00
Christian Kreibich
c28442a9a1 Merge remote-tracking branch 'origin/topic/bbannier/fix-docs-ci-again'
* origin/topic/bbannier/fix-docs-ci-again:
  Fix installation of Python packages in generate docs CI job again
2024-10-18 09:55:33 -07:00
Benjamin Bannier
cb612cd48a Merge branch 'topic/bbannier/fix-sphinx-build' 2024-10-15 17:12:22 +02:00
Benjamin Bannier
391fb4de07 Merge remote-tracking branch 'origin/topic/etyp/enshrine-event-order' 2024-10-15 09:57:36 +02:00
Christian Kreibich
1208555ee3 Merge remote-tracking branch 'origin/topic/vern/remove-teredo-gtpv1-script-opt-insts'
* origin/topic/vern/remove-teredo-gtpv1-script-opt-insts:
  removed specialized ZAM instructions for GTPv1 and Teredo cleanup BiFs
2024-10-09 15:36:52 -07:00
Christian Kreibich
2651de64bf Merge remote-tracking branch 'origin/topic/vern/script-opt-baselines.Oct24'
* origin/topic/vern/script-opt-baselines.Oct24:
  -a zam baseline updates reflecting recent changes to main baselines
2024-10-09 15:36:21 -07:00
Christian Kreibich
2a23e9fc19 Merge branch 'topic/awelzel/3957-raw-reader-spinning'
* topic/awelzel/3957-raw-reader-spinning:
  input/Raw: Rework GetLine()
2024-10-09 14:26:54 -07:00
Christian Kreibich
d70bb6a889 Merge branch 'topic/christian/bump-cluster-testing'
* topic/christian/bump-cluster-testing:
  Bump zeek-testing-cluster to pull in a baseline update
2024-10-04 12:45:22 -07:00
Arne Welzel
c826118385 Merge remote-tracking branch 'origin/topic/etyp/centos-missing-file-test-fail'
* origin/topic/etyp/centos-missing-file-test-fail:
  Fix flaky `missing-file-initially` test
2024-10-04 19:32:48 +02:00
Benjamin Bannier
ac5522f03a Merge branch 'topic/bbannier/spicyz-usage' 2024-10-04 13:34:49 +02:00
Arne Welzel
e118887771 Merge remote-tracking branch 'origin/topic/etyp/bg-test-nondeterminism'
* origin/topic/etyp/bg-test-nondeterminism:
  Fix input error test nondeterminism
2024-10-02 20:17:38 +02:00
Arne Welzel
6aeb302bfc Merge remote-tracking branch 'origin/topic/etyp/remove-duplicate-table-warns'
* origin/topic/etyp/remove-duplicate-table-warns:
  Report suppressed warnings count
  Avoid duplicating warnings when reading table
2024-10-01 11:52:02 +02:00
Christian Kreibich
b4c43e1607 Merge branch 'topic/vern/script-opt-maint.Sep24B'
* topic/vern/script-opt-maint.Sep24B:
  factoring of logic used by ZAM's low-level optimizer when adjusting control flow info
  BTest baseline update for more complete function/lambda names
  tweak to -O gen-C++ maintenance script to avoid treating plugins as BTests
  fixed lambda hash collision bug due to function descriptions lacking full parameter information
  fixes (to avoid collisions) for AST profiling's function hash computations
  removed unused ZAM cast-to-any operation
  fixes for ZAM tracking the return type associated with function calls
  ZAM control-flow tracking now explicitly includes the ends of loops
  fix for ZAM identification of common subexpressions
  "-O dump-final-ZAM" option similar to "dump-ZAM" only prints final version of functions
  fix for setting object locations to avoid use-after-free situation
  extended "-O allow-cond" to apply to both gen-C++ and gen-standalone-C++
  -O gen-C++ fix for run-time warnings for "when" lambdas
  fix to -O gen-C++ for recent AST profiling changes for identifying function parameters
  fix to -O gen-C++ for dealing with "hidden" parameters
  tweak to prevent an incorrect warning for scripts compiled to C++
  fixed overly narrow Spicy test for manipulating packet analyzers
  fixed memory leak for recursive ZAM functions that exit via an exception
  remove unnecessary header include
2024-09-27 15:20:21 -07:00
Arne Welzel
c36ae2f1a3 Merge branch 'pr/3946'
* pr/3946:
  Honor no plaintext password logging for PASS cmd

Closes #3946 - squashed commits into a single one.
2024-09-27 16:52:44 +02:00
Arne Welzel
989730c241 Merge remote-tracking branch 'origin/topic/awelzel/cluster-backends-pre-work-v1'
* origin/topic/awelzel/cluster-backends-pre-work-v1:
  NEWS: Update
  scripts/base/cluster: Move active node management into node_down()
  logging/Manager: Extract another CreateWriter() helper
  logging/Manager: Extract path_func invocation into helper
  logging: Dedicated log flush timer
  all: Change to use Func::GetName()
  script_opt: Use Func::GetName()
  Func: Add std::string name accessors, deprecate const char* versions
  plugin/ComponentManager: Support lookup by EnumValPtr
2024-09-27 15:37:47 +02:00
Arne Welzel
4aca6290a7 Merge remote-tracking branch 'origin/topic/awelzel/debug-stream-env'
* origin/topic/awelzel/debug-stream-env:
  zeek-setup: Support enabling debug streams through env variable
2024-09-27 15:00:04 +02:00
Tim Wojtulewicz
702fb031a4 Merge remote-tracking branch 'origin/topic/awelzel/3936-pop3-and-redis'
* origin/topic/awelzel/3936-pop3-and-redis:
  pop3: Remove unused headers
  pop3: Prevent unbounded state growth
  btest/pop3: Add somewhat more elaborate testing
2024-09-23 11:00:06 -07:00
Arne Welzel
b22ec06568 Merge remote-tracking branch 'origin/topic/etyp/enum-port-sizeof'
* origin/topic/etyp/enum-port-sizeof:
  Add enum value negative check
  Fix port/enum values `SizeOf` not being a count
2024-09-18 19:10:59 +02:00