Commit graph

18744 commits

Author SHA1 Message Date
Benjamin Bannier
b9eabbabba Bump pre-commit hooks 2025-07-01 10:39:47 +02:00
Arne Welzel
6d272038fe Merge remote-tracking branch 'origin/topic/timw/4617-reset-expire-time-on-overwrite'
* origin/topic/timw/4617-reset-expire-time-on-overwrite:
  SQLite: Reset expiration time on overwrite
2025-07-01 09:20:58 +02:00
zeek-bot
7a19e4e7d3 Update doc submodule [nomail] [skip ci] 2025-07-01 00:28:16 +00:00
Tim Wojtulewicz
fd7259f436 SQLite: Reset expiration time on overwrite 2025-06-30 14:41:10 -07:00
Tim Wojtulewicz
5daa83bfa4 Merge remote-tracking branch 'origin/topic/bbannier/readability-isolate-declaration'
* origin/topic/bbannier/readability-isolate-declaration:
  Make clang-tidy warnings report as errors to cause CI build to fail
  Fix a clang-tidy finding in cluster telemetry code
  Fix clang-tidy readability-isolate-declaration warnings
2025-06-30 14:19:37 -07:00
Tim Wojtulewicz
79959310a6 Make clang-tidy warnings report as errors to cause CI build to fail 2025-06-30 14:19:06 -07:00
Tim Wojtulewicz
1bc39cb541 Fix a clang-tidy finding in cluster telemetry code 2025-06-30 14:19:06 -07:00
Benjamin Bannier
627c3ad726 Fix clang-tidy readability-isolate-declaration warnings
I missed one of these in review so a machine is probably better at
catching them.

I fixed the existing instances which where largely in code which look
dated. Where possible I slightly reorganized the code so we do not have
to leave values uninitialized, but did not touch up anything else.
2025-06-30 14:19:06 -07:00
Arne Welzel
c725311d07 Merge remote-tracking branch 'origin/topic/awelzel/cluster-log-websocket-application-name'
* origin/topic/awelzel/cluster-log-websocket-application-name:
  cluster/WebSocket: Include X-Application-Name in cluster.log
2025-06-30 17:56:19 +02:00
Arne Welzel
1d931b5a2f cluster/WebSocket: Include X-Application-Name in cluster.log
A bit ad-hoc formatting for the log, but that's mostly because cluster.log
only has message field and I don't think having a dedicated application_name
column is worth it. That could also be added by custom scripts if it's really
wanted for a given deployment.
2025-06-30 17:55:24 +02:00
Arne Welzel
5847a2d32e Merge remote-tracking branch 'origin/topic/awelzel/cluster-telemetry-follow-up'
* origin/topic/awelzel/cluster-telemetry-follow-up:
  Bump cluster test suite
  cluster/Telemetry: Cache CallExpr locations
  cluster/Telemetry: Avoid unneeded StringVal() construction
  Val: Switch TablePatternMatcher to std::string_view
  RE: Add MatchAll() and MatchSet() for std::string_view
  cluster/websocket: Fix and test for invalid X-Application-Name
  cluster/telemetry: Move topic_normalization redef to zeromq
2025-06-30 13:30:04 +02:00
Arne Welzel
42ed82824e Bump cluster test suite
Since zeek/zeek#4552, metrics are labeled with node, not endpoint,
adapt the tests for that.
2025-06-30 13:22:31 +02:00
Arne Welzel
73e55fa909 cluster/Telemetry: Cache CallExpr locations 2025-06-30 13:22:31 +02:00
Arne Welzel
be8b4747c4 cluster/Telemetry: Avoid unneeded StringVal() construction 2025-06-30 13:22:31 +02:00
Arne Welzel
dad5ccd622 Val: Switch TablePatternMatcher to std::string_view
...and add TableVal::LookupPattern(std::string_view sv).
2025-06-30 13:22:31 +02:00
Arne Welzel
dce51b99e5 RE: Add MatchAll() and MatchSet() for std::string_view 2025-06-30 13:22:31 +02:00
Arne Welzel
5c6a6d9427 cluster/websocket: Fix and test for invalid X-Application-Name 2025-06-30 13:22:31 +02:00
zeek-bot
e79ae5a1d9 Update doc submodule [nomail] [skip ci] 2025-06-27 00:19:29 +00:00
Johanna Amann
dbeadc65ba Merge remote-tracking branch 'origin/topic/johanna/gh-4547'
* origin/topic/johanna/gh-4547:
  Spicy SSL analyzer: make record layer version parsing more strict
2025-06-26 20:21:54 +01:00
Arne Welzel
222f34b4ac Bump cluster testuite for endpoint to node renaming 2025-06-26 19:22:09 +02:00
Arne Welzel
3cd6e1ca06 Merge remote-tracking branch 'origin/topic/vern/if-coverage'
* origin/topic/vern/if-coverage:
  extend script coverage profiling to track whether conditionals evaluate to true/false
2025-06-26 18:49:42 +02:00
Johanna Amann
74b847a122 Spicy SSL analyzer: make record layer version parsing more strict
The Spicy based SSL analyzer was, so far, more permissive with the
record layer versions that it would accept.

This change brings the parsing of record layer versions in line with the
binpac based analyzer. This behavioral difference was discovered due to
a test that changed with the recent dpd log changes.
2025-06-26 16:57:51 +01:00
Vern Paxson
0255b5d120 extend script coverage profiling to track whether conditionals evaluate to true/false 2025-06-26 16:10:50 +02:00
Arne Welzel
26f5166d7a cluster/telemetry: Move topic_normalization redef to zeromq 2025-06-26 15:22:11 +02:00
Arne Welzel
22958f7cdf Merge remote-tracking branch 'origin/topic/awelzel/1474-cluster-telemetry'
* origin/topic/awelzel/1474-cluster-telemetry:
  btest/cluster/telemetry: Add smoke testing for telemetry
  cluster/WebSocket: Fetch X-Application-Name header as app label
  cluster/WebSocket: Pass X-Application-Name to dispatcher
  broker/WebSocketShim: Add calls to Telemetry hooks
  cluster/WebSocket: Configure telemetry for WebSocket backends
  broker: Hook up generic cluster telemetry
  cluster: Introduce telemetry component

One bug fix removing static from a variable that shouldn't be static.
2025-06-26 14:54:01 +02:00
Johanna Amann
14e801a709 Merge remote-tracking branch 'origin/topic/johanna/gh-4598'
* origin/topic/johanna/gh-4598:
  Only pass session ticket data in ssl_session_ticket_handshake event
2025-06-26 09:59:16 +01:00
zeek-bot
9f16050d0a Update doc submodule [nomail] [skip ci] 2025-06-26 00:26:06 +00:00
Arne Welzel
771c37b6b2 Merge branch 'rename' of https://github.com/bhaskarbhar/zeek
* 'rename' of https://github.com/bhaskarbhar/zeek:
  Update zeek.bif
  Update init-bare.zeek
  Added Baseline
  Renamed
2025-06-25 19:27:13 +02:00
bhaskarbhar
f9c34f29c7
Update zeek.bif 2025-06-25 22:53:29 +05:30
bhaskarbhar
722381366b
Update init-bare.zeek 2025-06-25 22:51:43 +05:30
root
1fba346f5d Added Baseline 2025-06-25 21:22:21 +05:30
root
da89e7ee6e Renamed 2025-06-25 21:10:08 +05:30
Arne Welzel
0e1431eef4 btest/cluster/telemetry: Add smoke testing for telemetry 2025-06-25 17:13:01 +02:00
Arne Welzel
b28e5f261e cluster/WebSocket: Fetch X-Application-Name header as app label 2025-06-25 17:12:59 +02:00
Arne Welzel
2f7d5eaf2a cluster/WebSocket: Pass X-Application-Name to dispatcher
This is going to be used to add labels to telemetry if the
X-Application-Name header is set.
2025-06-25 17:07:29 +02:00
Arne Welzel
6a84237a95 broker/WebSocketShim: Add calls to Telemetry hooks
WebSocket clients with Broker do not use the normal Broker backend, so
we need to add the telemetry invocations explicitly.
2025-06-25 16:59:49 +02:00
Arne Welzel
376e6dba97 cluster/WebSocket: Configure telemetry for WebSocket backends 2025-06-25 16:59:49 +02:00
Arne Welzel
f011e7e667 broker: Hook up generic cluster telemetry 2025-06-25 16:59:49 +02:00
Arne Welzel
4c34274a6c cluster: Introduce telemetry component 2025-06-25 16:59:49 +02:00
Evan Typanski
d3593e0489 Merge remote-tracking branch 'origin/topic/etyp/remove-list'
* origin/topic/etyp/remove-list:
  Remove `list` from Zeek grammar
2025-06-25 10:36:08 -04:00
Arne Welzel
cd934c460b Merge remote-tracking branch 'origin/topic/christian/extensible-conntuples'
* origin/topic/christian/extensible-conntuples:
  btest/plugins: Add test for custom ConnKey factory
  NEWS updates for pluggable connection tuples.
  Add a VLAN-aware flow tuple implementation.
  Deprecate ConnTuple and related APIs.
  Deprecate the old Connection constructor and detail::ConnKey class.
  Switch to virtualized use of new zeek::ConnKey class tree
  Provide a connkey factory for Zeek's default five-tuples.
  Add IP-specific ConnKey implementation.
  Establish plugin infrastructure for ConnKey factories.
  Add new ConnKey abstraction.
2025-06-25 14:17:49 +02:00
Arne Welzel
e7b1b174f0 btest/plugins: Add test for custom ConnKey factory
This just counts DoInits() and adds that information to the conn_id
record, but without including it into the hash. Mostly for smoke
testing.
2025-06-25 13:19:26 +02:00
Christian Kreibich
a040f550f4 NEWS updates for pluggable connection tuples. 2025-06-25 13:19:26 +02:00
Christian Kreibich
29b0f844c0 Add a VLAN-aware flow tuple implementation.
This is a first "real" implementation of a custom tuple, adding additional
fields over the standard five-tuple.

Includes test cases.
2025-06-25 13:19:26 +02:00
Christian Kreibich
a5122b5032 Deprecate ConnTuple and related APIs.
Given IP-aware ConnKeys, ConnTuples aren't really required any more. ConnTuple
had two benefits:

- It preserved the original src/dst orientation from the packet headers it was
based on, which IPBasedConnKey now tracks and provides accessor methods for.

- In IPBasedAnalyzer::AnalyzePacket() its instance survived past the std:move()
of the key into NewConn(), which we sidestep by keeping the original src address
and port around until we need after the connection is obtained.
2025-06-25 13:19:26 +02:00
Christian Kreibich
7548dc9e96 Deprecate the old Connection constructor and detail::ConnKey class.
The new key-based Connection constructor replaces the former, and the new
ConnKey class tree replaces the latter.
2025-06-25 13:19:26 +02:00
Christian Kreibich
52d6228b06 Switch to virtualized use of new zeek::ConnKey class tree
This touches quite a few places, but each just swaps out existing
APIs and/or zeek::detail::ConnKey instances.
2025-06-25 13:19:26 +02:00
Christian Kreibich
b8f82ff659 Provide a connkey factory for Zeek's default five-tuples.
Since the base factory is pure virtual this is now the first full
implementation, but still a bit of a special case because it implements Zeek's
default behavior and doesn't add "custom" content to the tuple.
2025-06-25 13:18:08 +02:00
Christian Kreibich
5af8fc242a Add IP-specific ConnKey implementation.
The InitTuple() implementation here is a placeholder for a fuller one following
later, when we do away with the need for ConnTuple.
2025-06-25 13:18:08 +02:00
Christian Kreibich
0c64f6a7b9 Establish plugin infrastructure for ConnKey factories.
ConnKey factories are intermediaries that encapsulate the details of how to
instantiate ConnKeys, which codify the hash input for connection lookups.
2025-06-25 13:18:07 +02:00