Commit graph

3675 commits

Author SHA1 Message Date
Jon Siwek
66ca20b737 Increase timeout for a few btests
Saw these start being sensitive running an "ASan -O0" build locally
2020-01-08 10:31:16 -08:00
Jon Siwek
6046da9993 Merge branch 'master' into topic/jsiwek/supervisor 2020-01-07 16:57:58 -08:00
Jon Siwek
d581aa76aa Merge remote-tracking branch 'origin/topic/dev/patterns-in-sets'
Fixes in merge:
- Memory leak in HashKey ctor
- Minor whitespace/style changes

* origin/topic/dev/patterns-in-sets:
  Enable Patterns as Table index in non singleton cases
  Added support to create a Hashkey for PatternVals using their Pattern Texts
2020-01-06 14:15:30 -08:00
Jon Siwek
149d3b4828 Increase a timeout for a btest 2020-01-06 11:20:30 -08:00
Jon Siwek
a1377e1d42 Increase timeout for a btest
May be more timing-sensitive with slower ASAN/LSAN configuration in
addition to already-slower CI environment.
2020-01-02 23:04:22 -08:00
Jon Siwek
e6f4e01041 Remove redundant memory leak btests
Or otherwise convert into a regular btest if it didn't already seem to
be covered.

There's no need for a separate memory leak test group since compiling
with LeakSanitizer now covers leak checking for the full btest suite.
2020-01-02 23:04:22 -08:00
Jon Siwek
0fe2a14d98 Disable LeakSanitizer for btests that have known leaks
E.g. ones that throw interpreter exceptions,  as those are currently
known to potentially cause leaks.  Fixing the underlying leaks involves
the larger task of more IntrusivePtr usage.

Reference cycles may also cause leaks.
2020-01-02 12:05:49 -08:00
Jon Siwek
d917737766 Rewrite the btest for when-statement timeouts
To avoid a memory leak in DNS lookups that's hard to work around and
does not otherwise effect typical operation when Zeek is allowed to
continue to run after zeek_init().
2020-01-02 12:05:49 -08:00
Jon Siwek
d936607cc9 Fix scripting error in a DHCP btest 2020-01-02 12:05:49 -08:00
Jon Siwek
10473d58a9 Fix scripting error in an ftp btest 2020-01-01 12:47:39 -08:00
Jon Siwek
cd9fec7bdb Add Cirrus CI config 2019-12-17 15:28:25 -08:00
Tim Wojtulewicz
679da0b15b Merge remote-tracking branch 'origin/topic/jsiwek/gh-700-zeek-args-bif'
* origin/topic/jsiwek/gh-700-zeek-args-bif:
  GH-700: add zeek_args() BIF
2019-12-05 12:36:35 -07:00
Tim Wojtulewicz
5c85b083b6 Merge remote-tracking branch 'origin/topic/jsiwek/gh-700-packet-sources-bif'
* origin/topic/jsiwek/gh-700-packet-sources-bif:
  GH-700: add packet_sources() BIF
2019-12-05 11:58:06 -07:00
Jon Siwek
30d0b21ecc Merge remote-tracking branch 'origin/topic/dev/print-to-log'
Adjustments during merge:

- kept the UNKNOWN Log::ID as placeholder value
- changed the coverage.find-bro-logs test to check for arbitrary $path
  field values instead of just string literals
- don't force EnumVal to unsigned integer since the relevant union member
  is the signed integer and added the relevant enum values/types to
  .bif files for easier access
- compare FILE* versus file name to check for stdout equality (don't
  think it matters much, just a bit more efficient)
- minor whitespace/style tweaks

* origin/topic/dev/print-to-log:
  Added a non boolean configuration and other changes as suggested by Jon
  Allow Print Statements to be redirected to a Log# This is a combination of 3 commits.
2019-12-02 13:47:09 -08:00
Jon Siwek
57c7cbdb92 GH-700: add zeek_args() BIF
Provides access to all zeek command-line arguments ("argv").
2019-11-28 10:24:48 -08:00
Jon Siwek
6e7b101df2 GH-700: add packet_sources() BIF
Provides access to properties of packet sources, like interface or pcap
file name.
2019-11-28 09:44:38 -08:00
Dev Bali
4be6871df2 Added a non boolean configuration and other changes as suggested by Jon 2019-11-26 21:53:21 -08:00
Johanna Amann
e5db1f085c Merge remote-tracking branch 'origin/topic/jsiwek/gh-684-fix-rpc-parsing'
* origin/topic/jsiwek/gh-684-fix-rpc-parsing:
  GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors

Addresses GH-684
2019-11-21 08:50:28 -08:00
Johanna Amann
5dafa7218d Merge remote-tracking branch 'origin/topic/jsiwek/fix-zeek-profiler-file'
* origin/topic/jsiwek/fix-zeek-profiler-file:
  Fix ZEEK_PROFILER_FILE file format/parsing
2019-11-21 08:37:04 -08:00
Robin Sommer
a00f139f1c Merge remote-tracking branch 'origin/topic/jsiwek/gh-646-conn-removal'
Clarified doc strings a bit.

* origin/topic/jsiwek/gh-646-conn-removal:
  GH-646: add new "successful_connection_remove" event
2019-11-18 12:08:12 +00:00
Jon Siwek
25ae6d90b7 Merge remote-tracking branch 'origin/topic/jsiwek/openbsd'
* origin/topic/jsiwek/openbsd:
  Adjust btests for OpenBSD portability
  Convert pcapng test suite files to pcap format
  Fix undefined symbols loading libbroker on OpenBSD
  Fix compile warnings on OpenBSD
2019-11-15 18:26:50 -08:00
Dev Bali
c9016f1397 Allow Print Statements to be redirected to a Log# This is a combination of 3 commits. 2019-11-13 19:59:42 -08:00
Jon Siwek
37a478ae99 GH-684: Fix parsing of RPC calls with non-AUTH_UNIX flavors
The parsing logic that should be specific to the AUTH_UNIX credential
flavor was previously applied unconditionally to other flavors.
2019-11-13 13:14:14 -08:00
Henri DF
a645e38b78 Recursively handle into container types in record_fields() 2019-11-13 15:28:06 +01:00
Henri DF
26633eb727 Print full container types in record_fields() 2019-11-12 13:19:12 +01:00
Jon Siwek
31f60853c9 GH-646: add new "successful_connection_remove" event
And switch Zeek's base scripts over to using it in place of
"connection_state_remove".  The difference between the two is
that "connection_state_remove" is raised for all events while
"successful_connection_remove" excludes TCP connections that were never
established (just SYN packets).  There can be performance benefits
to this change for some use-cases.

There's also a new event called ``connection_successful`` and a new
``connection`` record field named "successful" to help indicate this new
property of connections.
2019-11-11 19:52:59 -08:00
Jon Siwek
0c71715cf4 Adjust btests for OpenBSD portability 2019-11-08 17:32:44 -08:00
Jon Siwek
7965dcd041 Convert pcapng test suite files to pcap format
The former isn't supported by default on OpenBSD.
2019-11-08 13:08:06 -08:00
Jon Siwek
afb8bc6df8 Fix ZEEK_PROFILER_FILE file format/parsing
Some Zeek script statement descriptions were exceeding the hardcoded
maximum length and also could contain tab characters which were
supposed to be reserved for use as a delimiter in the file format.
2019-11-07 16:47:09 -08:00
Jon Siwek
cc37e505e4 Merge remote-tracking branch 'origin/master' into topic/jsiwek/supervisor 2019-11-05 10:11:47 -08:00
Jon Siwek
63fe835acf Allow record_fields() string arguments that name a record type 2019-11-01 12:46:17 -07:00
Jon Siwek
9c4e44924f GH-664: fix signature matching for payload-carrying SYN packets
Or more generally, signatures would not work correctly for any case
where the first TCP packet seen contained payload data, regardless of
its TCP flags.
2019-10-29 17:20:08 -07:00
Johanna Amann
44086c1f03 Merge remote-tracking branch 'origin/topic/jsiwek/gh-654-coerce-unspecified-table-defaults'
* origin/topic/jsiwek/gh-654-coerce-unspecified-table-defaults:
  GH-654: allow table() in function &default expressions
  GH-654: allow table() in record &default expressions

Fixes GH-654
2019-10-28 20:59:39 +01:00
Robin Sommer
9d7c9f37d4 Merge branch 'Fix_http_build_url' of ssh://github.com/Olerdrive/zeek
I changed the format string of the port to %d and added a test.
2019-10-28 09:32:32 +00:00
Jon Siwek
b698c5507a GH-654: allow table() in function &default expressions
Table parameters of functions previously did not coerce unspecified
tables used in their &default attribute to the correct type.
2019-10-25 13:00:46 -07:00
Jon Siwek
34bf78984b GH-654: allow table() in record &default expressions
Table fields of records previously did not coerce unspecified tables
used in their &default attribute to the correct type.
2019-10-25 12:48:52 -07:00
Jon Siwek
81ab0b0d05 Use explicit path name for NTP log stream
For consistency (we do this for all other logs) and just to avoid
the extra path function calls.
2019-10-25 10:38:58 -07:00
Jon Siwek
4bf3c6ff22 Improve &default validation for global vars: exclude sets 2019-10-15 18:24:35 -07:00
Johanna Amann
5265613a9e Merge remote-tracking branch 'origin/topic/jsiwek/gh-618-tcp-option-values'
* origin/topic/jsiwek/gh-618-tcp-option-values:
  Add weirds for invalid TCP option lengths
  GH-618: add "tcp_options" event containing TCP option values
  Fix tcp_option event
2019-10-15 16:50:43 -07:00
Jon Siwek
e46cf88435 Add Supervisor BIF/event API skeleton 2019-10-15 12:59:45 -07:00
Johanna Amann
f62a51b41b Merge remote-tracking branch 'origin/topic/jsiwek/fix-table-default-redef'
* origin/topic/jsiwek/fix-table-default-redef:
  Fix redef'ing a table with a new &default attribute
2019-10-14 22:06:35 -07:00
Johanna Amann
66effde97d Merge remote-tracking branch 'origin/topic/seth/624'
* origin/topic/seth/624:
  Support whitespace at end of line for config reader.

This merge fixes a failing test; it also sprinkles a few more spaces
into another test file.

The main change is that this now also works with configuration lines
that don't have a value.
2019-10-14 21:47:59 -07:00
Seth Hall
cd06cb24cc Support whitespace at end of line for config reader.
This commit addresses issue #624
2019-10-14 11:43:16 -04:00
Jon Siwek
42b6040952 Fix redef'ing a table with a new &default attribute 2019-10-11 18:57:03 -07:00
Johanna Amann
916205e254 Merge remote-tracking branch 'origin/topic/jsiwek/print-raw-bif'
* origin/topic/jsiwek/print-raw-bif:
  Add new BIF: print_raw()
2019-10-08 15:15:55 -07:00
Johanna Amann
e615d1f4a8 Merge remote-tracking branch 'origin/topic/jsiwek/gh-589-sub-microsecond-printing'
* origin/topic/jsiwek/gh-589-sub-microsecond-printing:
  GH-589: improve printing of sub-microsecond intervals
2019-10-07 10:51:40 -07:00
Jon Siwek
052feacbda GH-618: add "tcp_options" event containing TCP option values 2019-10-03 18:59:02 -07:00
Jon Siwek
222e3ad3ea Fix tcp_option event
It was not being raised in all the cases it should have been due to
an incorrect/unnecessary truncation check.
2019-10-03 17:55:07 -07:00
Jon Siwek
39b06e3cee GH-591: allow Config::set_value() to use empty/unspecified table/sets 2019-10-02 22:13:43 -07:00
Jon Siwek
fd66e7b9f6 GH-591: fix reading set[enum] values from input files 2019-10-02 22:09:16 -07:00