Commit graph

11634 commits

Author SHA1 Message Date
Tim Wojtulewicz
f53fb9a22e Merge remote-tracking branch 'olaldiko/master'
* olaldiko/master:
  Add tests for ERSPAN Type I patch
  Add ERSPAN Type I patch
2021-03-17 10:37:14 -07:00
Gorka Olalde Mendia
ec8c5f6c07 Add tests for ERSPAN Type I patch
Co-authored-by: Markel Elorza Alvarez <melorzaalvarez@gmail.com>
Co-authored-by: Ivan Arrizabalaga Cupido <ivanarrcup@gmail.com>
2021-03-17 14:41:29 +01:00
Gorka Olalde Mendia
fcc866567c Add ERSPAN Type I patch
Co-authored-by: Markel Elorza Alvarez <melorzaalvarez@gmail.com>
Co-authored-by: Ivan Arrizabalaga Cupido <ivanarrcup@gmail.com>
2021-03-17 11:43:53 +01:00
Vlad Grigorescu
4557b0907c Expose a configure-time option to set the plugin path.
I believe that this is the last option presented during the build summary which wasn't available to be set by the user.
2021-03-12 21:22:01 -06:00
Jon Siwek
9665f63301 Prevent use of LeakSanitizer on FreeBSD 2021-03-12 13:22:35 -08:00
Jon Siwek
c9c0fea8d0 Update submodule(s) [nomail] 2021-03-12 13:14:48 -08:00
zeek-bot
85a0936ec6 Update doc submodule [nomail] [skip ci] 2021-03-12 00:37:21 +00:00
Jon Siwek
07bad2d40e Merge remote-tracking branch 'origin/topic/seth/fix-smb-ts-fields'
* origin/topic/seth/fix-smb-ts-fields:
  Updating external test commit pointers
  ts fields in SMB logs now default to network_time()
2021-03-11 12:44:04 -08:00
Jon Siwek
6a0eae28a2 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1432-file-extraction-buffered-io'
* origin/topic/jsiwek/gh-1432-file-extraction-buffered-io:
  GH-1432: Use buffered IO for file extraction
2021-03-10 12:29:35 -08:00
Jon Siwek
04f7259e97 Merge remote-tracking branch 'origin/topic/jsiwek/faster-plugin-search'
* origin/topic/jsiwek/faster-plugin-search:
  Avoid searching a directory for dynamic plugins multiple times
2021-03-10 12:06:05 -08:00
Seth Hall
87950cb833 Updating external test commit pointers 2021-03-10 18:23:15 +00:00
Seth Hall
db7aba0835 ts fields in SMB logs now default to network_time()
This avoids a problem identified by amanbansal2709 in pull
request #1288. I fixed it in a different way than that pull request
by making sure the ts field is always set so that this isssue doesn't
return in the future.
2021-03-10 13:52:44 +00:00
Johanna Amann
1d46bcbb81 Merge remote-tracking branch 'origin/topic/johanna/file-framework-mime-type-detection'
* origin/topic/johanna/file-framework-mime-type-detection:
  Fix potential mime type detection bug in IRC/FTP file_transferred event
2021-03-10 13:00:59 +00:00
Johanna Amann
fa4d654a01 Fix potential mime type detection bug in IRC/FTP file_transferred event
The files framework uses strncpy to copy data into the buffer that is
used for IRC/FTP mime type detection. From all I can tell that means
that, in these cases, currently mime type detection will be messed up if
the data being passed in contains zero bytes.
2021-03-10 12:57:01 +00:00
Jon Siwek
1c58a2d86b GH-1432: Use buffered IO for file extraction
This can improve performance significantly: ~3.5x faster when tested on
a large file passing data to the file analysis framework in small chunks
of 20 bytes.
2021-03-09 18:26:48 -08:00
Jon Siwek
36099c5553 Avoid searching a directory for dynamic plugins multiple times 2021-03-09 15:00:27 -08:00
Jon Siwek
f2d3bf3037 Merge remote-tracking branch 'origin/topic/vern/ast-opt'
- Removed a stray `printf()` from script-opt Reduce code

* origin/topic/vern/ast-opt: (23 commits)
  Tweak minor const-ref/std::move things in script-opt code
  Add alternative 'xform' baseline for test: broker.store.create-failure
  Add explicit return value to Reducer::SameOp()
  fixed AST transformation logic for boolean expressions
  don't know how I overlooked these minor test suite updates
  "opt" btest baseline updates due to AST optimizations changing printed code
  "opt" baseline exceptions due to incompatibility with optimize-AST and -u
  new "opt" btest alternative
  update to "xform" test suite baseline due to recent line number changes
  logic for driving AST optimization when requested
  methods implementing AST optimization (aliasing, constant propagation, CSE)
  helper class checking if common-subexpression elimination opportunity is valid
  helper function for comparing collections of definition points
  track more information about temporary variables
  simplify and tidy up some interfaces
  enable setting "-O optimize-AST" option
  fix for reducing operations on boolean vectors
  control whether checking for type-equivalence generates warnings
  remove unneeded virtual method (same as inherited method)
  accessors for additional Expr subclasses
  ...
2021-03-08 18:33:04 -08:00
zeek-bot
8e684609d2 Update doc submodule [nomail] [skip ci] 2021-03-09 00:35:39 +00:00
Jon Siwek
b66f4ad500 Tweak minor const-ref/std::move things in script-opt code 2021-03-08 15:50:04 -08:00
Jon Siwek
4b6369a333 Add alternative 'xform' baseline for test: broker.store.create-failure 2021-03-08 12:59:30 -08:00
Jon Siwek
0ef315d143 Add explicit return value to Reducer::SameOp()
Helps tools that don't realize the implications of [[noreturn]] on
the Reporter::InternalError() in this case.
2021-03-08 12:39:39 -08:00
Jon Siwek
75d3cbda4b Merge branch 'master' into topic/vern/ast-opt 2021-03-08 12:35:04 -08:00
Jon Siwek
285aaa53d7 Merge remote-tracking branch 'origin/topic/jsiwek/improve-broker-store-creation'
* origin/topic/jsiwek/improve-broker-store-creation:
  GH-1426: Improve handling of Broker data store creation failures
2021-03-08 12:29:56 -08:00
Johanna Amann
358d82eb38 Merge branch 'topic/keithjjones/openvpn' of https://github.com/keithjjones/zeek
* 'topic/keithjjones/openvpn' of https://github.com/keithjjones/zeek:
  Replace assert with if statement so OpenVPN can use this over UDP.  And fix spelling.
2021-03-08 11:25:32 +00:00
Jon Siwek
6af436aad3 GH-1426: Improve handling of Broker data store creation failures
Broker::create_master() and Broker::create_clone() now return
a valid value even when there's a failure to open the backend database
(e.g. SQLite filesystem error).  In that case, the returned value can
still be passed into other data store operations, but they'll fail
immediately with an error.  Broker::is_closed() can now also be used to
determine whether the data store creation calls failed.
2021-03-06 02:32:29 -08:00
Jon Siwek
6946cffde2 Simplify some copy_string() usages in threading::Field 2021-03-05 17:38:36 -08:00
Jon Siwek
ff90236df3 Merge remote-tracking branch 'origin/topic/timw/lgtm'
- Fixed leak in threading::Field copy-assignment operator

* origin/topic/timw/lgtm:
  Use const-reference in plugin::Manager::MetaHookPost for minor performance gain
  Fix missing assigmnent operator/copy constructor pairings reported by LGTM
  Fix variable shadowing issues reported by LGTM
  Update binpac and broker submodules to fix LGTM findings
2021-03-05 17:28:05 -08:00
Jon Siwek
e41edf78bc Update submodule(s) [nomail] [skip ci] 2021-03-05 16:42:45 -08:00
Jon Siwek
5f7fc043de Merge remote-tracking branch 'origin/topic/christian/canonicalize-zeek-config-includes'
* origin/topic/christian/canonicalize-zeek-config-includes:
  Avoid reporting paths repeatedly in zeek-config --include_dir
2021-03-05 16:14:37 -08:00
Jon Siwek
f5527b5dca Update submodule(s) [nomail] [skip ci] 2021-03-05 16:00:42 -08:00
Keith Jones
6fa02a7db4 Replace assert with if statement so OpenVPN can use this over UDP. And fix spelling. 2021-03-05 10:53:46 -05:00
Christian Kreibich
ca725c1f9b Avoid reporting paths repeatedly in zeek-config --include_dir 2021-03-04 15:40:00 -08:00
Tim Wojtulewicz
0d62ed4783 Use const-reference in plugin::Manager::MetaHookPost for minor performance gain 2021-03-03 10:29:25 -07:00
Tim Wojtulewicz
51f17534d4 Fix missing assigmnent operator/copy constructor pairings reported by LGTM 2021-03-03 10:29:25 -07:00
Tim Wojtulewicz
2f2a265415 Fix variable shadowing issues reported by LGTM 2021-03-03 09:57:16 -07:00
Tim Wojtulewicz
59b40168fb Update binpac and broker submodules to fix LGTM findings 2021-03-03 09:53:08 -07:00
Tim Wojtulewicz
5111b8e386 Fix comment in IP analyzer 2021-03-02 14:04:30 -07:00
Jon Siwek
bca8c3053b Update submodule(s) [nomail] [skip ci] 2021-03-02 12:47:34 -08:00
Vern Paxson
1e316c05c9 fix some unsigned/signed integer warnings 2021-03-01 17:08:14 -08:00
Vern Paxson
602d8a5372 address lint concern about uninitialized variable 2021-03-01 17:08:06 -08:00
Tim Wojtulewicz
150ba6443e Remove use of obsolete forward-declaration macros 2021-03-01 15:43:17 -07:00
Jon Siwek
e2d2c75fe7 Merge remote-tracking branch 'origin/topic/jsiwek/zeekygen-code-links'
- Applied minor spelling/grammar suggestions from Johanna during merge

* origin/topic/jsiwek/zeekygen-code-links:
  Change update-zeekygen-docs.sh to set release branch in Sphinx config
  Teach Zeekygen to produce source-code-range information
  Add normalize_script_path() zeek::zeekygen::detail namespace
  Add starts_with()/ends_with() to zeek::util namespace
2021-03-01 11:37:29 -08:00
Vern Paxson
2ec8b065cc Merge branch 'topic/vern/zval' of github.com:zeek/zeek into topic/vern/zval 2021-02-28 07:23:58 -08:00
Vern Paxson
526ba54f15 fix #include's that lack zeek/ prefixes 2021-02-28 07:23:06 -08:00
Vern Paxson
6aab151d97 explicitly populate holes created in vectors 2021-02-28 07:23:06 -08:00
Vern Paxson
2f47cce8a6 fixes for now-incorrect assumption that GetField always returns an existing ValPtr 2021-02-28 07:23:06 -08:00
Vern Paxson
3a59bc1a37 memory management for assignment to vector elements 2021-02-28 07:22:40 -08:00
Vern Paxson
7adcd1b27b memory management for assignment to record fields 2021-02-28 07:22:31 -08:00
Vern Paxson
498d8c4bde destructor cleanup from ZAM_vector/ZAM_record 2021-02-28 07:22:18 -08:00
Vern Paxson
679ee6ce22 fix #include's that lack zeek/ prefixes 2021-02-27 17:00:37 -08:00