Commit graph

3433 commits

Author SHA1 Message Date
Tim Wojtulewicz
00c2e9afce Merge remote-tracking branch 'J-Gras/topic/jgras/remove-wrapper-analyzer'
* J-Gras/topic/jgras/remove-wrapper-analyzer:
  Remove unused wrapper packet analyzer
2024-08-16 09:06:51 -07:00
Arne Welzel
f21da04c3e Merge remote-tracking branch 'origin/topic/etyp/dns-tkey'
* origin/topic/etyp/dns-tkey:
  Add DNS TKEY event
2024-08-16 16:51:58 +02:00
Arne Welzel
ec1088c3ef Merge remote-tracking branch 'origin/topic/vern/zam-regularization'
* origin/topic/vern/zam-regularization: (33 commits)
  simpler and more robust identification of function parameters for AST profiling
  fixes to limit AST traversal in the face of recursive types
  address some script optimization compiler warnings under Linux
  fix for -O C++ construction of variable names that use multiple module namespaces
  fix for script optimization of "opaque" values that are run-time constants
  fix for script optimization of nested switch statements
  script optimization fix for complex "in" expressions in conditionals
  updates to typos allow-list reflecting ZAM regularization changes
  BTest updates for ZAM regularization changes
  convert new ZAM operations to use typed operands
  complete migration of ZAM to use only public ZVal methods
  "-O validate-ZAM" option to validate generated ZAM instructions
  internal option to suppress control-flow optimization
  exposing some functionality for greater flexibility in structuring run-time execution
  rework ZAM compilation of type switches to leverage value switches
  add tracking of control flow information
  factoring of ZAM operation specifications into separate files
  updates to ZAM operations / gen-zam regularization, other than the operations themselves
  type-checking fix for vector-of-string operations
  ZVal constructor for booleans
  ...
2024-08-16 12:10:33 +02:00
Arne Welzel
ac5cbcc43e Merge remote-tracking branch 'origin/topic/vern/cpp-init'
* origin/topic/vern/cpp-init:
  Func: Add SetCapturesVec()
  marked some recently added BTests as not suitable for -O gen-C++ testing
  robustness improvements for -O gen-C++ generation of lambdas / "when"s
  speedups for compilation of initializers in -O gen-C++ generated code
  fixes for -O gen-C++ generation of floating point constants
  -O gen-C++ fix for dealing with use of more than one module qualifier
  header tweaks to provide gen-C++ script optimization with more flexibility
  fix for script optimization of constants of type "opaque"
  fix for script optimization of "in" operations
  some minor tidying of -O gen-C++ sources
2024-08-15 10:30:48 +02:00
Arne Welzel
52d51f2c63 Merge remote-tracking branch 'origin/topic/awelzel/3880-mysql-caching-sha2-password-successful'
* origin/topic/awelzel/3880-mysql-caching-sha2-password-successful:
  mysql: Implement and test COM_CHANGE_USER
  mysql: Remove auth plugin state
  mysql: Handle server connection phase separately from command phase
2024-08-14 20:12:39 +02:00
Arne Welzel
44a3ed676b Merge remote-tracking branch 'jgras/topic/jgras/packet-analyzer-history-rework'
* jgras/topic/jgras/packet-analyzer-history-rework:
  Deprecate old unknown_protocol event signature
  Use raw pointer for packet analyzer history
  Update external baselines for analyzer history
  Update btest baselines for analyzer history
  Add packet analyzer history
2024-08-13 12:37:41 +02:00
Arne Welzel
f943366e8e Merge remote-tracking branch 'origin/topic/awelzel/spicyz-add-back-port-ports-message'
* origin/topic/awelzel/spicyz-add-back-port-ports-message:
  spicyz: Add back message about removed support for port / ports in evt
2024-08-12 11:07:40 +02:00
Arne Welzel
32cbe953ba Merge remote-tracking branch 'origin/topic/awelzel/rule-parse-fix-coverity-leak'
* origin/topic/awelzel/rule-parse-fix-coverity-leak:
  rule-parse: Remove id_to_str() lookup to squelch coverity warning
2024-08-09 20:57:40 +02:00
Arne Welzel
39a9b64219 Merge remote-tracking branch 'origin/topic/timw/remove-cluster-interface-field-zeekctl'
* origin/topic/timw/remove-cluster-interface-field-zeekctl:
  Update zeekctl submodule
2024-08-08 10:44:51 +02:00
Tim Wojtulewicz
6041f74601 Merge remote-tracking branch 'origin/topic/timw/7.1-deprecation-removal'
* origin/topic/timw/7.1-deprecation-removal:
  Remove deprecated port/ports fields for spicy analyzers
  Remove deprecated Cluster::Node::interface field
  Remove deprecated signature definition format
  Return an error if GLOBAL:: prefix is used
  Remove deprecated BloomFilter serialization methods
  Remove deprecated OpaqueVal serialization methods
  Remove deprecated DECLARE_OPAQUE_VALUE macro
  Make TypePtr::Capture member variables private
  Remove deprecated Trigger constructor
  Remove deprecated Controller::auto_assign_ports and Controller::auto_assign_start_port
  Remove deprecated load-balacing policy script
  Remove deprecated prometheus telemetry policy script
  Remove deprecated policy/tuning/default package
  Remove deprecated time machine settings
  Remove deprecated json NullDoubleWriter class
  Remove deprecated modbus event definitions
  Remove Connection::AppendAddl
  Remove STMT_ANY statement type
  Remove EventRegistry::Used and EventRegistry::SetUsed
2024-08-07 12:20:44 -07:00
Arne Welzel
97fa7cdc0a Merge remote-tracking branch 'origin/topic/awelzel/ldap-fix-uint8-shift'
* origin/topic/awelzel/ldap-fix-uint8-shift:
  ldap: Promote uint8 to uint64 before shifting
2024-08-07 14:11:30 +02:00
Arne Welzel
2c62ecf57d Merge remote-tracking branch 'origin/topic/awelzel/ci-ubuntu-24-new-ccache'
* origin/topic/awelzel/ci-ubuntu-24-new-ccache:
  ci/ubuntu-24.04: Use ccache 4.10.2
2024-08-07 11:43:33 +02:00
Arne Welzel
b0df736ba7 Merge remote-tracking branch 'origin/topic/awelzel/threading-manager-metrics-follow-up'
* origin/topic/awelzel/threading-manager-metrics-follow-up:
  telemetry/Manager: Check RegisterFd() return value
  telemetry/Manager: Track sent_in and sent_out totals without callback
  threading/Manager: Switch inf bucket from infinity() to max()
  threading/Manager: "lt" to "le" and do not break
2024-08-07 10:55:13 +02:00
Arne Welzel
c845c7cce0 Merge remote-tracking branch 'origin/topic/awelzel/3860-ldap-fuzzer'
* origin/topic/awelzel/3860-ldap-fuzzer:
  Bump auxil/spicy to latest development snapshot
  spicy/runtime-support: Switch ParameterMismatch::_fmt to static
  coverage/lcov_html: Ignore testing/btest/.tmp
  cirrus: Do not disable Spicy for sanitizer builds
  ldap: Avoid unset m$opcode
  fuzzers: Add LDAP fuzzing
2024-08-06 20:09:09 +02:00
Tim Wojtulewicz
d52ec28c89 Merge remote-tracking branch 'origin/topic/timw/dont-install-empty-zam-dirs'
* origin/topic/timw/dont-install-empty-zam-dirs:
  Don't install empty ZAM directories
2024-08-06 09:02:31 -07:00
Tim Wojtulewicz
25f65a705f Updating CHANGES and VERSION. 2024-08-05 14:40:31 -07:00
Tim Wojtulewicz
3c3853dc7d Merge remote-tracking branch 'origin/topic/timw/telemetry-threading'
* origin/topic/timw/telemetry-threading:
  Process metric callbacks from the main-loop thread
2024-08-02 15:50:47 -07:00
Tim Wojtulewicz
4c0c7581c8 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-07-26 10:12:04 -07:00
Arne Welzel
152bbbd680 Merge remote-tracking branch 'origin/topic/awelzel/3853-ldap-spnego-ntlmssp'
* origin/topic/awelzel/3853-ldap-spnego-ntlmssp:
  ldap: Recognize SASL+SPNEGO+NTLMSSP
2024-07-26 15:14:52 +02:00
Tim Wojtulewicz
a40da34915 Merge remote-tracking branch 'botovq/opaque_x509_algor'
* botovq/opaque_x509_algor:
  Use accessor to reach into X509_ALGOR
2024-07-25 09:19:31 -07:00
Arne Welzel
93a430ce15 Merge remote-tracking branch 'origin/topic/awelzel/mysql-amazing-pp-issue-2716-additions'
* origin/topic/awelzel/mysql-amazing-pp-issue-2716-additions:
  mysql: Simplify length computation
  mysql: Improve date and time parsing
  btest/mysql: Clean query-attr.pcapng
  mysql: Support non-string query attributes
  btest/mysql: Add pcap with non-string query attributes
  mysql: Introduce mysql_ssl_request event
  mysql: Fix EOFIfLegacyThenResultSet
  mysql: Add data parameter to mysql_auth_plugin
  mysql: Add mysql_auth_plugin, mysql_auth_more_data and mysql_auth_switch_request events
  mysql: AuthSwitchRequest: &enforce a 0xfe / 254 status
  mysql: Make auth_plugin_ a std::string
  mysql: Fix auth_plugin_data_part2 length computation
  Refactored connection phase state handling
  Add support for "auth switch" and "query attrs"
  Add support for parsing the "caching_sha2_password" auth plugin
2024-07-25 12:18:31 +02:00
Tim Wojtulewicz
6527850487 Merge remote-tracking branch 'origin/topic/timw/format-binpac-output-code'
* origin/topic/timw/format-binpac-output-code:
  Update binpac submodule to better format output code [nomail]
2024-07-24 15:29:08 -07:00
Tim Wojtulewicz
bd208f4c54 Merge remote-tracking branch 'origin/topic/timw/smb2-ioctl-errors'
* origin/topic/timw/smb2-ioctl-errors:
  Update 7.0 NEWS with blurb about multi-PDU parsing causing increased load [nomail] [skip ci]
  Fix handling of zero-length SMB2 error responses
2024-07-24 13:26:07 -07:00
Arne Welzel
52bcc92e40 Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.Aug24'
* origin/topic/vern/script-opt-maint.Aug24:
  minor optimization of boolean comparisons
  fix & regression test for GH-3839 (spurious warnings for "when" constructs)
2024-07-24 11:18:18 +02:00
Christian Kreibich
c9d8ceaafa Merge branch 'topic/christian/bump-zeek-testing-cluster'
* topic/christian/bump-zeek-testing-cluster:
  Bump zeek-testing-cluster to reflect deprecation of prometheus.zeek
2024-07-23 19:18:52 -07:00
Tim Wojtulewicz
cb88f6316c Merge remote-tracking branch 'origin/topic/johanna/update-the-ct-list-and-the-ca-list-again'
* origin/topic/johanna/update-the-ct-list-and-the-ca-list-again:
  Update Mozilla CA list and CT list
2024-07-23 08:54:33 -07:00
Tim Wojtulewicz
da7c3d9138 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-07-23 08:51:55 -07:00
Arne Welzel
6a6a5c3d0d Merge remote-tracking branch 'origin/topic/awelzel/ldap-extended-request-response-starttls'
* origin/topic/awelzel/ldap-extended-request-response-starttls:
  ldap: Add heuristic for wrap tokens
  ldap: Ignore ec/rrc for sealed wrap tokens
  ldap: Add LDAP sample with SASL-SRP mechanism
  ldap: Reintroduce encryption after SASL heuristic
  ldap: Fix assuming GSS-SPNEGO for all bindResponses
  ldap: Implement extended request/response and StartTLS support
2024-07-23 12:39:14 +02:00
Arne Welzel
f4a79fa703 Merge remote-tracking branch 'origin/topic/awelzel/deprecate-prometheus-script'
* origin/topic/awelzel/deprecate-prometheus-script:
  telemetry: Deprecate prometheus.zeek policy script
2024-07-23 10:03:13 +02:00
Arne Welzel
e982a18792 Merge remote-tracking branch 'origin/topic/awelzel/3836-input-create-any-abort-crash'
* origin/topic/awelzel/3836-input-create-any-abort-crash:
  input/Manager: Improve type checks of record fields with type any
2024-07-19 19:51:52 +02:00
Christian Kreibich
0ba80d13b4 Merge branch 'topic/christian/bump-cluster-testsuite'
* topic/christian/bump-cluster-testsuite:
  Bump zeek-testing-cluster to pull in tee SIGPIPE fix
2024-07-17 15:37:29 -07:00
Arne Welzel
2ea3a651bd Merge remote-tracking branch 'origin/topic/awelzel/spicy-ldap-krb-wrap-tokens'
* origin/topic/awelzel/spicy-ldap-krb-wrap-tokens:
  ldap: Remove MessageWrapper with magic 0x30 searching
  ldap: Harden parsing a bit
  ldap: Handle integrity-only KRB wrap tokens
2024-07-17 16:48:58 +02:00
Tim Wojtulewicz
9ba7c2ddaf Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-07-16 10:16:15 -07:00
Tim Wojtulewicz
cb56837f07 Merge remote-tracking branch 'origin/topic/timw/fetchcontent_mkdir'
* origin/topic/timw/fetchcontent_mkdir:
  CI: Set FETCH_CONTENT_FULLY_DISCONNECTED flag for configure
  Update broker and cmake submodules [nomail]
2024-07-12 16:02:37 -07:00
Tim Wojtulewicz
b935d2f59a Merge remote-tracking branch 'origin/topic/bbannier/lib-spicy-hooks'
* origin/topic/bbannier/lib-spicy-hooks:
  Do not emit hook files for builtin modules
2024-07-12 09:51:55 -07:00
Tim Wojtulewicz
7a38cee81f Merge remote-tracking branch 'origin/topic/bbannier/lib-spicy-hooks'
* origin/topic/bbannier/lib-spicy-hooks:
  Do not emit hook files for builtin modules
2024-07-12 09:48:12 -07:00
Tim Wojtulewicz
e4716b6c91 Merge remote-tracking branch 'origin/topic/timw/grealpath-make-dist-warning'
* origin/topic/timw/grealpath-make-dist-warning:
  Fix warning about grealpath when running 'make dist' on Linux
2024-07-12 09:46:51 -07:00
Tim Wojtulewicz
822102382c Start of 7.1.0 development 2024-07-11 13:19:15 -07:00
Christian Kreibich
c4bc9078ef Merge branch 'topic/christian/broker-prometheus-cpp'
* topic/christian/broker-prometheus-cpp:
  Update the scripts.base.frameworks.telemetry.internal-metrics test
  Revert "Temporarily disable the scripts/base/frameworks/telemetry/internal-metrics btest"
  Bump Broker to pull in new Prometheus support and pass in Zeek's registry
2024-07-11 12:15:16 -07:00
Arne Welzel
a9c4daaa22 Merge remote-tracking branch 'jgras/topic/jgras/log-disable-analyzer'
* jgras/topic/jgras/log-disable-analyzer:
  Extend btest for logging of disabled analyzers
  Add logging of disabled analyzers to analyzer.log
2024-07-10 18:51:26 +02:00
Arne Welzel
1c8fedaf09 Merge remote-tracking branch 'origin/topic/awelzel/move-hilti-jit-parallelism-to-btest-cfg'
* origin/topic/awelzel/move-hilti-jit-parallelism-to-btest-cfg:
  testing/btest: Default to HILTI_JIT_PARALLELISM=1
  Revert "CI: Use ccache and a single CPU when building spicy analyzers for btests"
2024-07-10 11:06:46 +02:00
Tim Wojtulewicz
b309c423f8 Merge remote-tracking branch 'origin/topic/timw/ci-reduce-spicy-test-load'
* origin/topic/timw/ci-reduce-spicy-test-load:
  CI: Use ccache and a single CPU when building spicy analyzers for btests
2024-07-09 15:12:29 -07:00
Tim Wojtulewicz
b64f0e8fd8 Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'
* origin/topic/bbannier/bump-spicy:
  Bump auxil/spicy to latest development snapshot
2024-07-09 14:53:49 -07:00
Tim Wojtulewicz
c557b2156a Merge remote-tracking branch 'origin/topic/vern/script-opt-maint.Jul24'
* origin/topic/vern/script-opt-maint.Jul24:
  minor script optimization updates to reflect recent changes, Coverity findings
2024-07-09 10:15:26 -07:00
Arne Welzel
e102715bc8 Merge remote-tracking branch 'cknill/topic/cknill/display_cmake_fix'
* cknill/topic/cknill/display_cmake_fix:
  Fix for --display-cmake in configure Moved build directory creation further down in the script so that --display-cmake has a chance to happen before build tree setup.
2024-07-09 17:10:28 +02:00
Christian Kreibich
6552c4e0fe Merge branch 'topic/christian/management-telemetry-additions'
* topic/christian/management-telemetry-additions:
  Management framework: bump cluster testsuite to pull in telemetry tests
  Management framework: bump zeek-client
  Management framework: augment deployed configs with instance IP addresses
  Management framework: add auto-enumeration of metrics ports
  Management framework: propagate metrics port from agent
  Management framework: add metrics port in management & Supervisor node records
  Harden the telemetry manager against unset Telemetry::metrics_address
  Comment-only tweaks for telemetry-related settings.
2024-07-09 00:08:28 -07:00
Tim Wojtulewicz
4d31335391 Merge branch 'topic/timw/update-submodules'
* topic/timw/update-submodules:
  Update submodules [nomail]
2024-07-08 15:00:26 -07:00
Arne Welzel
66cdb490ff Merge remote-tracking branch 'origin/topic/awelzel/ci-macos-sonoma-only'
* origin/topic/awelzel/ci-macos-sonoma-only:
  CMakeLists: Ensure Threads::Threads target exists
  ci/macos: Only use sonoma image
2024-07-04 17:34:42 +02:00
Benjamin Bannier
ecc1c4c215 Merge remote-tracking branch 'origin/topic/bbannier/bump-zeek-aux' 2024-07-04 17:22:53 +02:00
Benjamin Bannier
15b12c399a Merge branch 'topic/bbannier/bump-spicy' 2024-07-04 15:16:17 +02:00