Commit graph

16055 commits

Author SHA1 Message Date
Tim Wojtulewicz
97c2d195cc Force pre-commit to use python 3.9 2023-08-15 09:18:45 -07:00
Tim Wojtulewicz
9357a5879b Merge remote-tracking branch 'origin/topic/timw/update-zeek-aux'
* origin/topic/timw/update-zeek-aux:
  CI: update freebsd to 13.2 and 12.4
  Update zeek-aux submodule [nomail]
2023-08-14 11:18:28 -07:00
Tim Wojtulewicz
6761aebef7 CI: update freebsd to 13.2 and 12.4 2023-08-14 11:17:39 -07:00
Tim Wojtulewicz
4dce283a04 Update zeek-aux submodule [nomail] 2023-08-14 11:17:39 -07:00
zeek-bot
c9277bda74 Update doc submodule [nomail] [skip ci] 2023-08-12 00:25:28 +00:00
Tim Wojtulewicz
6bfe78fbcb Update docs submodule [nomail] 2023-08-11 10:36:45 -07:00
Tim Wojtulewicz
e8ef169b27 Merge remote-tracking branch 'origin/topic/timw/3059-set-vector-conversion'
* origin/topic/timw/3059-set-vector-conversion:
  Fix conversion with record types
  Add conversion between set and vector using 'as' keyword
  Add std::move for a couple of variables passed by value
2023-08-11 10:35:06 -07:00
Tim Wojtulewicz
7137a267ad Merge remote-tracking branch 'origin/topic/timw/modbus-overflow'
* origin/topic/timw/modbus-overflow:
  Modbus: Add early return in case of data being too short to parse
2023-08-11 09:52:38 -07:00
Robin Sommer
83029ecafc
[Spicy] Refactor parsing of export in EVT files.
Moving that into its own function and preparing for storing additional
information.
2023-08-11 12:42:55 +02:00
Tim Wojtulewicz
d6ccb85c4c Modbus: Add early return in case of data being too short to parse 2023-08-10 18:06:58 -07:00
Tim Wojtulewicz
fe9926e538 Fix conversion with record types 2023-08-10 13:42:23 -07:00
Johanna Amann
fdd3c55d42 Raw reader: better error handling for posix_spawn
Addressed feedback in GH-3216
2023-08-10 13:20:29 +01:00
Tim Wojtulewicz
af9e852c28 Add conversion between set and vector using 'as' keyword 2023-08-09 14:41:54 -07:00
Tim Wojtulewicz
4022573d48 Merge remote-tracking branch 'origin/topic/bbannier/issue-3177'
* origin/topic/bbannier/issue-3177:
  Explicitly link Zeek executable against Spicy libraries in binary packaging mode.
2023-08-09 09:08:47 -07:00
Johanna Amann
e97f63dbbe Raw reader: use posix_spawn instead of fork + exec
This commit switchexisd the Raw reader to use posix_spawn, instead of
the combination of fork + exec. This should be much more efficient, and
also makes the code smaller, and easier to read and understand.
2023-08-09 16:51:47 +01:00
Benjamin Bannier
26a6bc7dfe Explicitly link Zeek executable against Spicy libraries in binary packaging mode.
Closes #3177.
2023-08-09 11:31:27 +02:00
zeek-bot
646b301b65 Update doc submodule [nomail] [skip ci] 2023-08-09 00:19:23 +00:00
Tim Wojtulewicz
16a69864b4 Merge remote-tracking branch 'origin/topic/timw/3184-modbus-extensions'
* origin/topic/timw/3184-modbus-extensions:
  Pass parsed file record information with ReadFile/WriteFile events
  Add length field from header to ModbusHeaders record type
  Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses
  Modbus: Add support for Diagnostics (FC=8) requests and responses
2023-08-08 10:55:25 -07:00
Tim Wojtulewicz
e3a34e44b5 Revert "Merge remote-tracking branch 'origin/topic/timw/3184-modbus-extensions'"
This reverts commit 30b2afe2ad, reversing
changes made to bacc0dcae3.
2023-08-08 10:54:33 -07:00
zeek-bot
b7a082b145 Update doc submodule [nomail] [skip ci] 2023-08-08 00:31:55 +00:00
Tim Wojtulewicz
30b2afe2ad Merge remote-tracking branch 'origin/topic/timw/3184-modbus-extensions'
* origin/topic/timw/3184-modbus-extensions:
  Pass parsed file record information with ReadFile/WriteFile events
  Add length field from header to ModbusHeaders record type
  Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses
  Modbus: Add support for Diagnostics (FC=8) requests and responses
2023-08-07 14:34:43 -07:00
Tim Wojtulewicz
1dc9235cee Pass parsed file record information with ReadFile/WriteFile events 2023-08-07 13:44:38 -07:00
Tim Wojtulewicz
18fd384469 Add length field from header to ModbusHeaders record type 2023-08-07 13:44:37 -07:00
Tim Wojtulewicz
406a406813 Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses 2023-08-07 13:44:37 -07:00
Tim Wojtulewicz
f14be0de29 Modbus: Add support for Diagnostics (FC=8) requests and responses 2023-08-07 13:44:37 -07:00
Tim Wojtulewicz
bacc0dcae3 Merge remote-tracking branch 'origin/topic/timw/cmake-find-package'
* origin/topic/timw/cmake-find-package:
  Change VERSION variable in CMake config to ZEEK_VERSION_FULL
  Update bifcl and binpac for FindPackage fixes
  Remove usage of FindRequiredPackage
  Update zeekctl and cmake to deprecate FindRequiredPackage
  Update broker submodule for pybind11 + cmake changes
2023-08-07 09:42:02 -07:00
Tim Wojtulewicz
67c8e5192a Change VERSION variable in CMake config to ZEEK_VERSION_FULL 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
cb649795c0 Update bifcl and binpac for FindPackage fixes 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
c743be0c54 Remove usage of FindRequiredPackage 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
2ce94e9855 Update zeekctl and cmake to deprecate FindRequiredPackage 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
0772e205ec Update broker submodule for pybind11 + cmake changes 2023-08-07 08:15:09 -07:00
Arne Welzel
6524127d61 Merge remote-tracking branch 'origin/topic/awelzel/centos-7-bump'
* origin/topic/awelzel/centos-7-bump:
  ci: Bump centos-7
2023-08-07 16:27:05 +02:00
Arne Welzel
7d3ded06c7 ci: Bump centos-7
Failing currently with:

    Failed to start an instance! Failed to pull null image! Repository does not exist or may require authentication.
    Container errored with 'ImagePullBackOff: Back-off pulling image "gcr.io/cirrus-ci-community/zeek/zeek/ci/centos-7/dockerfile:a0c25357a3a7dc08f6c1e61e6f81ad36"'
2023-08-07 15:47:40 +02:00
Arne Welzel
bb9faab83b Merge remote-tracking branch 'origin/topic/timw/tsan-upgrade'
* origin/topic/timw/tsan-upgrade:
  Suppress new tsan findings from Ubuntu 22 upgrade
  Update tsan build to ubuntu22
2023-08-07 10:22:38 +02:00
Tim Wojtulewicz
f56b6bdb2b Pass parsed file record information with ReadFile/WriteFile events 2023-08-04 19:15:25 -07:00
Tim Wojtulewicz
8318dfc169 Add length field from header to ModbusHeaders record type 2023-08-04 16:16:49 -07:00
Tim Wojtulewicz
0fdff44cf0 Suppress new tsan findings from Ubuntu 22 upgrade 2023-08-04 14:18:00 -07:00
Tim Wojtulewicz
60d0241782 Update tsan build to ubuntu22 2023-08-04 14:16:54 -07:00
Arne Welzel
0d229ee84a Merge remote-tracking branch 'origin/topic/awelzel/2668-default-create-insert-assign-or-so'
* origin/topic/awelzel/2668-default-create-insert-assign-or-so:
  TableVal: Unify &default and &default_insert lookups
  Add &default_insert attribute for tables
2023-08-04 12:32:06 +02:00
Arne Welzel
73a7fdad95 TableVal: Unify &default and &default_insert lookups
Introduce DefaultAttr() helper to avoid a bit of duplicated code.
2023-08-04 12:31:27 +02:00
Arne Welzel
431767d04b Add &default_insert attribute for tables
This is based on the discussion in zeek/zeek#2668. Using &default with tables
can be confusing as the default value is not inserted. The following example
prints an empty table at the end even new Service records was instantiated.

    type Service: record {
        occurrences: count &default=0;
        last_seen: time &default=network_time();
    };

    global services: table[string] of Service &default=Service();

    event zeek_init()
        {
        services["http"]$occurrences += 1;
        services["http"]$last_seen = network_time();

        print services;
        }

Changing above &default to &default_insert will insert the newly created
default value upon a missed lookup and act less surprising.

Other examples that caused confusion previously revolved around table of sets
 or table of vectors and `add` or `+=` not working as expected.

    tbl_of_vector["http"] += 1
    add tbl_of_set["http"][1];
2023-08-04 12:30:36 +02:00
Johanna Amann
81ce83590d Merge remote-tracking branch 'origin/topic/johanna/tcp-padding'
* origin/topic/johanna/tcp-padding:
  Do not forward padding to downstream TCP packet analyzer
2023-08-03 07:18:49 +01:00
Tim Wojtulewicz
d00a89a5a1 Merge remote-tracking branch 'origin/topic/timw/rename-bro-plugin'
* origin/topic/timw/rename-bro-plugin:
  Rename magic __bro_plugin__ file to __zeek_plugin__
2023-08-02 10:11:31 -07:00
Tim Wojtulewicz
1f415a7775 Rename magic __bro_plugin__ file to __zeek_plugin__ 2023-08-02 10:10:44 -07:00
Johanna Amann
940e3afab4 Do not forward padding to downstream TCP packet analyzer
This is similar to GH-3206. There do not seem to be practical
consequences - but we should still fix it.

This also includes the udp-testcase that was forgotten in GH-3206.
2023-08-02 17:17:01 +01:00
Arne Welzel
1a54e66b53 Merge branch 'topic/awelzel/3122-attribute-expression-seeds'
* topic/awelzel/3122-attribute-expression-seeds:
  UsageAnalyzer: Collect identifiers found in attributes as seeds
2023-08-02 09:52:41 +02:00
Arne Welzel
97e31bf6a1 Merge remote-tracking branch 'origin/topic/timw/refresh-ci-vm-images'
* origin/topic/timw/refresh-ci-vm-images:
  Force refresh of all CI docker images
2023-08-02 09:22:16 +02:00
Tim Wojtulewicz
59454b8184 Force refresh of all CI docker images
There's something going on with the image cache on Cirrus where the images
are sometimes vanishing from the cache, thus causing builds to fail
because it can't load them. This forces a rebuild of all of the images,
thus refreshing the cached version of all of them.
2023-08-01 12:18:59 -07:00
Tim Wojtulewicz
39ed39c30e Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses 2023-08-01 12:14:33 -07:00
Tim Wojtulewicz
346271d8ca Modbus: Add support for Diagnostics (FC=8) requests and responses 2023-08-01 12:14:33 -07:00