Commit graph

9358 commits

Author SHA1 Message Date
Max Kellermann
cb4258434c util: use getrandom() on Linux if available
Unlike /dev/urandom, getrandom() doesn't need a file descriptor and
works when there is no /dev.  It requires Linux 3.17 and glibc 2.25,
but there is a fallback to the old code.

For simplicity, this patch uses __has_include() to detect the
availability of this API, but maybe we should move that to cmake.

(It might be useful to refactor the whole random gathering code to a
separate function.)
2020-01-28 11:45:25 +01:00
Jon Siwek
0412cb3996 Merge branch 'topic/frerich/gh-750-uri-with-empty-portnum' of https://github.com/frerich/zeek
* 'topic/frerich/gh-750-uri-with-empty-portnum' of https://github.com/frerich/zeek:
  Document recent fix for decompose_uri in release notes
  Fixed decompose_uri choking on URIs with empty port component
  Adding test for decompose_uri parsing URI with empty port
2020-01-24 15:16:14 -08:00
Frerich Raabe
4955356a52 Document recent fix for decompose_uri in release notes 2020-01-24 22:24:05 +01:00
Frerich Raabe
bb879fc2aa Fixed decompose_uri choking on URIs with empty port component
A call such as

  decompose_uri("git://git.kernel.org:/pub/scm/linux/");

would raise an error along the lines of

  error in /usr/local/zeek-3.0.0/share/zeek/base/utils/urls.zeek, line 122: bad conversion to count (to_count(parts[1]) and )

This was because an empty string got passsed to the to_count()
function.

Let's improve the behaviour and rather consider the portnum component
of the URI to be uninitialized.
2020-01-24 22:24:00 +01:00
Frerich Raabe
440468a0dc Adding test for decompose_uri parsing URI with empty port
I'd expect the portnum component to remain uninitialized in case the
given URI specifies no port number -- however, decompose_uri() raises an
error instead. Will address this in a subsequent commit.
2020-01-24 22:23:50 +01:00
Jon Siwek
cc8d28089b Updating submodule(s).
[nomail]
2020-01-24 13:18:33 -08:00
Jon Siwek
f45c2cf06b Skip check for outdated docs in Cirrus CI for PRs 2020-01-23 18:10:17 -08:00
Johanna Amann
97bea7c4f1 Merge remote-tracking branch 'origin/topic/jsiwek/fix-create-stream-priorities'
* origin/topic/jsiwek/fix-create-stream-priorities:
  Use consistent zeek_init priority for Log::create_stream calls
2020-01-23 15:31:06 -08:00
Robin Sommer
fc1c95725b Update Broker submodule.
Includes a test baseline update for change in Broker error message.
2020-01-23 13:51:29 +00:00
Robin Sommer
01b7db5b46 Merge remote-tracking branch 'origin/topic/jsiwek/smb-transaction-strings'
* origin/topic/jsiwek/smb-transaction-strings:
  Improve creation of SMB transaction data strings
2020-01-23 13:19:11 +00:00
Robin Sommer
11850088ee Merge remote-tracking branch 'origin/topic/jsiwek/ftp-word'
* origin/topic/jsiwek/ftp-word:
  Improve FTP word/whitespace handling
2020-01-23 13:14:46 +00:00
Jon Siwek
fce4bb3f50 Improve FTP word/whitespace handling 2020-01-22 19:50:14 -08:00
Jon Siwek
c75519ca88 Improve creation of SMB transaction data strings 2020-01-22 15:41:50 -08:00
Jon Siwek
7a748526c0 Use consistent zeek_init priority for Log::create_stream calls
Typically in base scripts, Log::create_stream() is called in zeek_init()
handler with &priority=5 such that it will have already been created
in the default zeek_init() &priority=0.
2020-01-22 13:58:20 -08:00
Robin Sommer
270702cacb Updating CHANGES and VERSION. 2020-01-18 14:32:30 +00:00
Robin Sommer
8170baabef Merge remote-tracking branch 'origin/topic/timw/595-rapidjson'
Tweaks:
    - Small change to the logic for removing quotes around strings.
    - Updated NEWS & COPYING.3rdparty
    - Use of intrusive_ptr for stack-allocated StringVals
    - Little bit of refactoring (I would love to merge the two BuildJSON() functions, too, but that's a larger task)

* origin/topic/timw/595-rapidjson:
  Use the list of files from clang-tidy when searching for unit tests
  Optimize json_escape_utf8 a bit by removing repeated calls to string methods
  Expand unit test for json_escape_utf8 to include all of the strings from the ascii-json-utf8 btest
  GHI-595: Convert from nlohmann/json to rapidjson for performance reasons
  Convert type-checking macros to actual functions
2020-01-18 10:49:15 +00:00
Robin Sommer
c8c6621a0e Merge remote-tracking branch 'origin/topic/timw/bit-fields'
* origin/topic/timw/bit-fields:
  Use bools instead of single-bit bitfields in Ident and TCP protocol analyzers
  Bit of code-modernization cleanup in BroString
  Use fixed types in NetbiosSSN.h and Timer.h instead of bit fields
2020-01-17 11:55:00 +00:00
Robin Sommer
eafd818505 Updating submodule(s).
[nomail]
2020-01-17 11:43:00 +00:00
Robin Sommer
0d29a80519 Merge remote-tracking branch 'origin/topic/jsiwek/ftp-adat-fix'
* origin/topic/jsiwek/ftp-adat-fix:
  Handle invalid Base64 encodings in FTP ADAT analyzer
2020-01-16 13:27:03 +00:00
Jon Siwek
1db7a222a0 Handle invalid Base64 encodings in FTP ADAT analyzer 2020-01-15 12:44:10 -08:00
Tim Wojtulewicz
227d29db80 Use the list of files from clang-tidy when searching for unit tests
The previous method for searching for these files included everything from src/3rdparty, which breaks when rapidjson is included. We don't want to include that directory anyways. We already had a good list of files to scan from the previous clang-tidy and adding any that are missing is an easy task.
2020-01-14 15:44:59 -07:00
Tim Wojtulewicz
23f551876c Optimize json_escape_utf8 a bit by removing repeated calls to string methods 2020-01-14 15:43:25 -07:00
Tim Wojtulewicz
ee0619f999 Expand unit test for json_escape_utf8 to include all of the strings from the ascii-json-utf8 btest 2020-01-14 15:43:25 -07:00
Tim Wojtulewicz
46e7308422 GHI-595: Convert from nlohmann/json to rapidjson for performance reasons 2020-01-14 15:43:25 -07:00
Jon Siwek
f59e3da4f7 Merge remote-tracking branch 'origin/sethhall-fix-ssl-files-warning'
* origin/sethhall-fix-ssl-files-warning:
  Fix warning when reading files from non-network sources
2020-01-14 09:46:19 -08:00
Seth Hall
d9ed76c90a
Fix warning when reading files from non-network sources
If files are being read from non-network sources, there was a warning in the SSL base scripts about missing the f$conns field.
2020-01-14 10:53:02 -05:00
Jon Siwek
9c353f56f1 Updating submodule(s).
[nomail]
2020-01-13 10:08:21 -08:00
Jon Siwek
6cb73e505b Updating submodule(s).
[nomail]
2020-01-13 09:32:15 -08:00
Robin Sommer
bcf9dbac94 Update submodules. 2020-01-13 12:11:08 +00:00
Robin Sommer
ae9e79969e Fix method returning a reference to a temporary.
Found by cppcheck, via by Arthur Wong.
2020-01-13 11:24:20 +00:00
Jon Siwek
6218f99b96 Update timeouts for a btest 2020-01-09 19:05:23 -08:00
Jon Siwek
b34d7a8443 Update doc submodule 2020-01-09 19:04:41 -08:00
Tim Wojtulewicz
03eb1d43d2 Merge remote-tracking branch 'origin/topic/jsiwek/btest-asan-options'
* origin/topic/jsiwek/btest-asan-options:
  Extend ASAN_OPTIONS in btests instead of overwrite
2020-01-09 13:39:49 -08:00
Jon Siwek
da0185a60f Update external test repo commit hash 2020-01-09 12:29:02 -08:00
Tim Wojtulewicz
50a0835b41 Convert type-checking macros to actual functions 2020-01-09 11:43:09 -08:00
Tim Wojtulewicz
1e41d7f583 Merge remote-tracking branch 'origin/topic/jsiwek/doctest-leakcheck'
* origin/topic/jsiwek/doctest-leakcheck:
  Enable LeakSanitizer for unit tests run via doctest
2020-01-09 11:38:28 -08:00
Tim Wojtulewicz
d845627daa Merge remote-tracking branch 'origin/topic/jazoff/ntlm-field-error'
* origin/topic/jazoff/ntlm-field-error:
  fix NTLM field value access
2020-01-09 10:26:00 -08:00
Jon Siwek
a4089bc659 Enable LeakSanitizer for unit tests run via doctest 2020-01-08 21:14:40 -08:00
Jon Siwek
1f3ec434a8 Extend ASAN_OPTIONS in btests instead of overwrite 2020-01-08 21:04:18 -08:00
Jon Siwek
66ca20b737 Increase timeout for a few btests
Saw these start being sensitive running an "ASan -O0" build locally
2020-01-08 10:31:16 -08:00
Justin Azoff
80469a1fde fix NTLM field value access
The fields being checked for existence were not the same as the fields
being accessed.
2020-01-08 11:40:28 -05:00
Jon Siwek
3273169385 Preserve optimization setting for sanitizer build 2020-01-07 20:58:35 -08:00
Tim Wojtulewicz
0f8f53808e Use bools instead of single-bit bitfields in Ident and TCP protocol analyzers 2020-01-07 12:07:58 -07:00
Tim Wojtulewicz
9d38419e8a Bit of code-modernization cleanup in BroString
- Convert single-bit bit fields into bools
- Use bool for a number of function arguments that were previously ints
- Use delegated constructors to reduce repetition in the other constructors
2020-01-07 11:48:52 -07:00
Tim Wojtulewicz
a463c5763f Use fixed types in NetbiosSSN.h and Timer.h instead of bit fields 2020-01-07 11:48:52 -07:00
Jon Siwek
0c55b01ec9 Merge remote-tracking branch 'origin/topic/timw/fix-x509-build-warning'
* origin/topic/timw/fix-x509-build-warning:
  Fix build warning in X509 plugin
2020-01-06 16:46:17 -08:00
Tim Wojtulewicz
a20c3a195a Fix build warning in X509 plugin 2020-01-06 15:38:28 -07:00
Jon Siwek
d581aa76aa Merge remote-tracking branch 'origin/topic/dev/patterns-in-sets'
Fixes in merge:
- Memory leak in HashKey ctor
- Minor whitespace/style changes

* origin/topic/dev/patterns-in-sets:
  Enable Patterns as Table index in non singleton cases
  Added support to create a Hashkey for PatternVals using their Pattern Texts
2020-01-06 14:15:30 -08:00
Tim Wojtulewicz
71e6893441 Merge remote-tracking branch 'origin/topic/jsiwek/fix-hexdump-warning'
* origin/topic/jsiwek/fix-hexdump-warning:
  Fix snprintf compiler warning in hexdump BIF
2020-01-06 14:16:55 -07:00
Jon Siwek
99faaf811d Fix snprintf compiler warning in hexdump BIF 2020-01-06 12:29:03 -08:00