Commit graph

12960 commits

Author SHA1 Message Date
Tim Wojtulewicz
c2bf602d94 Add out_ptr, use for c-ares interface calls 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
c4cac72fd7 Use shared_ptrs for DNS_Mapping objects 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
b531ec97ef Similar map changes for async requests 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
e8f833b8a6 Store all mappings in a single map instead of split by type
This opens up the possibility of storing other request types outside
of T_A, T_PTR and T_TXT without requiring redoing the caching. It
also fixes the caching code in DNS_Mapping, adding a version number
to the start of the cache file so the cache structure can be modified
and old caches invalidated more easily.
2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
fb59239f41 Don't split ipv4/ipv6 mappings into separate pointers 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
c7284686a4 Handle cancelled/destruction statuses in callback methods 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
a201ccaefa Pass dns_mgr down into the DNS_Request objects 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
c5b70cc286 Move PTR request handling to ares_create_query() 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
3bdc744b14 Add merging to DNS_Mgr::AddResult() to support both ipv4 and ipv6 responses simultaneously 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
9f197aa458 Rework DNS_Mgr API to be more consistent and to support more request types 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
336c6ae5c2 Replace nb_dns library with C-Ares 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
e6e9144da6 Add unit testing for DNS_Mgr and related classes 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
824bc372c5 Update doc gen VM to ubuntu-latest, output cmake version during configure 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
2d43aaf7cc Use doctest macro to tie Reporter output to test cases 2022-04-22 13:10:37 -07:00
Tim Wojtulewicz
93ee353f30 Add const versions of dereference operators for DictEntry 2022-04-22 13:10:31 -07:00
Tim Wojtulewicz
f588cef65e Add DNS fuzzer 2022-04-22 13:08:37 -07:00
Tim Wojtulewicz
91db2e984e Merge remote-tracking branch 'bbannier/topic/bbannier/generate_docs_action_forks'
* bbannier/topic/bbannier/generate_docs_action_forks:
  Fix generate-docs action for running on forks.
2022-04-22 07:01:07 -07:00
Benjamin Bannier
1691f73b67 Fix generate-docs action for running on forks.
The generate-docs action previously always required secrets to run so
that it could possibly perform a push (if run from a schedule), and to
send out an email on failure. Since secrets are unavailable for forks
this meant that this action would always fail for PRs from forks.

In this patch we use an unauthenticated clone unless running from a
schedule. This is fine as for PRs this action would just regenerate the
docs to check for errors, but not to actually update them (no push
performed). We also change the failure notification step to only execute
for scheduled runs.
2022-04-22 10:40:46 +02:00
Christian Kreibich
5ccc19db56 Merge branch 'topic/christian/fix-docker-test-dots'
* topic/christian/fix-docker-test-dots:
  Suppress progress dots in zkg's output in Docker package-install check
2022-04-21 13:34:58 -07:00
Christian Kreibich
8ba6016598 Suppress progress dots in zkg's output in Docker package-install check
These introduced unpredictability in the output, occasionally breaking the
test.
2022-04-21 12:48:32 -07:00
Tim Wojtulewicz
a49601d9fd Merge remote-tracking branch 'origin/topic/timw/enable-vptr-check'
* origin/topic/timw/enable-vptr-check:
  Enable vptr undefined behavior check
2022-04-21 09:17:37 -07:00
Tim Wojtulewicz
c6023774a3 Enable vptr undefined behavior check 2022-04-20 17:18:57 -07:00
Tim Wojtulewicz
5dbc5dbed2 Merge remote-tracking branch 'origin/topic/timw/bump-libkqueue'
* origin/topic/timw/bump-libkqueue:
  Update libkqueue for Coverity and build warning fixes
2022-04-20 17:18:10 -07:00
Tim Wojtulewicz
ba3b142183 Update libkqueue for Coverity and build warning fixes 2022-04-20 16:18:06 -07:00
Tim Wojtulewicz
13150b039f Merge remote-tracking branch 'origin/topic/timw/handle-regex-characters-in-path'
* origin/topic/timw/handle-regex-characters-in-path:
  Escape special characters in paths before using them as regexes
2022-04-19 09:42:39 -07:00
zeek-bot
c22847cbf0 Update doc submodule [nomail] [skip ci] 2022-04-19 00:33:22 +00:00
Christian Kreibich
2d73edb04c Merge branch 'topic/christian/management-print-cmd'
* topic/christian/management-print-cmd:
  Management framework: bump external testsuite
  Management framework: allow selecting cluster nodes in get_id_value
  Management framework: minor tweaks to logging component
  Management framework: bump zeek-client to pull in get-id-value command
  Avoid whitespace around function type strings in JSON rendering
  Management framework: improve handling of node run states
  Management framework: add get_id_value dispatch
  Management framework: allow dispatching "actions" on cluster nodes.
  Management framework: some renaming to avoid the term "data cluster"
  Management framework: allow agents to communicate with cluster nodes
2022-04-18 16:40:49 -07:00
Tim Wojtulewicz
468f90b99e Disable TSan CI task temporarily while we sort out some intermittent test failures 2022-04-18 15:34:58 -07:00
Christian Kreibich
e2d0db73a5 Management framework: bump external testsuite 2022-04-18 13:11:03 -07:00
Tim Wojtulewicz
090c55bdf7 Merge remote-tracking branch 'origin/topic/vern/func-ids'
* origin/topic/vern/func-ids:
  state-holding fix: track unique identifiers for Func's in CompHash's, not Func's themselves
2022-04-18 12:45:17 -07:00
Christian Kreibich
7edd1a2651 Management framework: allow selecting cluster nodes in get_id_value
This adds an optional set of cluster node names to narrow the querying to. It
similarly expands the dispatch mechanism, since it likely most sense for any
such request to apply only to a subset of nodes.

Requests for invalid nodes trigger Response records in error state.
2022-04-18 12:38:54 -07:00
Christian Kreibich
438cd9b9f7 Management framework: minor tweaks to logging component
Use an enum with explicitly assigned values since we rely on enum_to_int() to
reason about log levels, and bump the default level from DEBUG to INFO.
2022-04-18 12:38:20 -07:00
Christian Kreibich
748db5cf73 Management framework: bump zeek-client to pull in get-id-value command 2022-04-18 12:38:18 -07:00
Vern Paxson
323b919eef state-holding fix: track unique identifiers for Func's in CompHash's, not Func's themselves 2022-04-18 10:59:22 -07:00
Tim Wojtulewicz
0235541a95 Merge remote-tracking branch 'origin/topic/christian/gh-2052'
* origin/topic/christian/gh-2052:
  Add "Reporter" entry to fix plugin hook_name() vs HookType imbalance
  Expand plugin.reporter-hook testcase to verify -NN output
2022-04-18 09:22:51 -07:00
Christian Kreibich
76ff976e83 Avoid whitespace around function type strings in JSON rendering
Callable types were rendered with a trailing "\n" in to_json() output. Tweaking
the Describe() calls to stop producing the newline is prone to test failures, so
this focuses on the JSON string production to suppress it, which doesn't affect
any tests.
2022-04-15 18:51:56 -07:00
Christian Kreibich
fcef7f4925 Management framework: improve handling of node run states
When agents receive a configuration, we don't currently honor requested run
states (there's no such thing as registering a node but not running it, for
example). To reflect this, we now start off nodes in state PENDING as we
launch them via the Supervisor, and move them to RUNNING when they check
in with us via Management::Node::API::notify_node_hello.
2022-04-15 18:51:56 -07:00
Christian Kreibich
497b2723d7 Management framework: add get_id_value dispatch
This adds support for retrieving the value of a global identifier from any
subset of cluster nodes. It relies on the lookup_ID() BiF to retrieve the val,
and to_json() to render the value to an easily parsed string. Ideally we'd send
the val directly, but this hits several roadblocks, including the fact that
Broker won't serialize arbitrary values.
2022-04-15 18:51:56 -07:00
Christian Kreibich
788348f9d6 Management framework: allow dispatching "actions" on cluster nodes.
This adds request/response event pairs to enable the controller to dispatch
"actions" (pre-implemented Zeek script actions) on subsets of Zeek cluster nodes
and collect the results. Using generic events to carry multiple such "run X on
the nodes" scenarios simplifies adding these in the future.
2022-04-15 18:51:56 -07:00
Christian Kreibich
0020cc4af0 Management framework: some renaming to avoid the term "data cluster" 2022-04-15 18:51:56 -07:00
Christian Kreibich
337c7267e0 Management framework: allow agents to communicate with cluster nodes
This provides Broker-level plumbing that allows agents to reach out to their
managed Zeek nodes and collect responses.

As a first event, it establishes Management::Node::API::notify_agent_hello,
to notify the agent when the cluster node is ready to communicate.

Also a bit of comment rewording to replace use of "data cluster" with simply
"cluster", to avoid ambiguity with data nodes in SumStats, and expansion of
test-all-policy.zeek and related/dependent tests, since we're introducing new
scripts.
2022-04-15 18:51:54 -07:00
Christian Kreibich
397e4c9718 Add "Reporter" entry to fix plugin hook_name() vs HookType imbalance
The hook_name() list was missing an entry corresponding to HOOK_REPORTER.

Co-authored-by: Peter Cullen <peter.cullen@corelight.com>
2022-04-14 15:20:44 -07:00
Christian Kreibich
2d93a19f45 Expand plugin.reporter-hook testcase to verify -NN output 2022-04-14 15:20:08 -07:00
Christian Kreibich
acaa9ec01e Bump gen-zam submodule to pull in GCC 12 fix [nomail] 2022-04-14 14:26:47 -07:00
Tim Wojtulewicz
f8de297c6f Escape special characters in paths before using them as regexes 2022-04-14 12:38:14 -07:00
Tim Wojtulewicz
37df5a30b1 Merge remote-tracking branch 'endace/topic/endace/non-selectable-pktsrc-timeout'
* endace/topic/endace/non-selectable-pktsrc-timeout:
  GH-2038: Don't sleep when non-selectable PktSrc has data available
2022-04-14 10:26:41 -07:00
Tim Wojtulewicz
a3b022ed98 Merge remote-tracking branch 'origin/topic/robin/loads-sigs-path'
* origin/topic/robin/loads-sigs-path:
  Re-instantiate providing location information to `LoadFile` hooks.
2022-04-14 10:13:35 -07:00
Tim Wojtulewicz
2aa90616f6 Merge remote-tracking branch 'origin/topic/robin/gh-2032-dict-fixes'
* origin/topic/robin/gh-2032-dict-fixes:
  Add tests exercising dictionary iteration during modification.
  Fix another crash during dictionary iteration.
  Fix assertions in dictionary that can trigger for benign reasons.
  Fix robust iterators when modifying dictionary during iteration.
2022-04-14 10:13:08 -07:00
Tim Wojtulewicz
c98a6ca064 Merge remote-tracking branch 'origin/topic/timw/tsan-builds'
* origin/topic/timw/tsan-builds:
  Split asan/ubsan CI builds, add tsan build
2022-04-14 09:51:31 -07:00
Tim Wojtulewicz
903f4bcc8e Split asan/ubsan CI builds, add tsan build 2022-04-14 09:51:00 -07:00