Commit graph

11634 commits

Author SHA1 Message Date
Jon Siwek
08cdc0871f Merge remote-tracking branch 'origin/topic/timw/main-cleanup'
* origin/topic/timw/main-cleanup:
  main: Properly close down SSL/sqlite at shutdown if net_run never started up
  main: Finish processing program arguments before setting up SSL/sqlite
2019-08-26 14:59:56 -07:00
Tim Wojtulewicz
fa62e5b48c main: Properly close down SSL/sqlite at shutdown if net_run never started up 2019-08-26 10:31:17 -07:00
Tim Wojtulewicz
7edebe179f main: Finish processing program arguments before setting up SSL/sqlite 2019-08-26 10:29:43 -07:00
Jon Siwek
b954767488 GH-541: add test cases for NTLM AV Pair sequence handling 2019-08-26 10:28:46 -07:00
Jon Siwek
13af91febb Make Tag::Error values constant 2019-08-23 16:31:45 -07:00
Jon Siwek
0699b28893 Merge remote-tracking branch 'origin/topic/seth/github-ident-flex'
* origin/topic/seth/github-ident-flex:
  Make github identify our Flex source correctly.
2019-08-23 14:31:51 -07:00
Seth Hall
6268851a68 Make github identify our Flex source correctly. 2019-08-23 14:27:06 -04:00
Jon Siwek
b41e102a7c Simplify operator bool()'s used for Tag error checks 2019-08-23 11:31:18 -04:00
Jon Siwek
ba929ce2c4 Add/use unspecified IPAddr constants
The analyzer-scheduling code was otherwise frequently converting the
unspecified v4/v6 addresses from strings.
2019-08-23 11:15:02 -04:00
Jon Siwek
a9f14bf503 GH-541: fix handling of NTLM AV Pair sequences
Empty AV Pair sequences or AV Pair sequences that lack a terminator
could cause accesses past the end of the parsed vector.
2019-08-23 07:22:18 -04:00
Jon Siwek
48873570b5 Updating submodule(s).
[nomail]
2019-08-23 06:37:27 -04:00
Jon Siwek
e7a2ee6edc Merge remote-tracking branch 'origin/topic/timw/mapping'
- Minor whitespace and comment adjustments

* origin/topic/timw/mapping:
  Fix unit tests for new ordering from NetSessions::Drain
  Change FragReassembler to use a tuple as a key and use std::map for fragments in Sessions
  Rework Session/Connection tracking to use a std::map instead of PDict
2019-08-23 06:28:44 -04:00
Jon Siwek
24a72a76ef Merge remote-tracking branch 'origin/topic/seth/github-linguist-fixes'
- Changed .bif files to be detected as C++

* origin/topic/seth/github-linguist-fixes:
  Adjusting how files are ignored for linguist and adding bif files to ignore.
  Stop incorrect language identification on github.
2019-08-23 05:45:34 -04:00
Jon Siwek
104633737d Merge remote-tracking branch 'origin/topic/seth/zeek-fix-thread-names'
* origin/topic/seth/zeek-fix-thread-names:
  Zeekify thread naming.
2019-08-23 05:40:09 -04:00
Seth Hall
162f4012b5 Adjusting how files are ignored for linguist and adding bif files to ignore. 2019-08-22 22:17:04 -04:00
Seth Hall
1a07df196e Zeekify thread naming.
I copied the same style that caf uses ("zk" with single dot and no space).
This gives some consistency with caf and avoids us wasting more
space beyond "bro: ".  OSs only give 16 characters for thread names
so anything we can gain here is nice.
2019-08-22 22:10:27 -04:00
Seth Hall
ac7e64bcad Stop incorrect language identification on github.
If you look at the languages that github is implemented in according
to our page on github, it has several incorrect things. PAC files and
SIG files being the big misidentifications. In my opinion it would look
better to mark these as no language so that javascript and ML stop showing
up as languages that Zeek is implemented in.

This change should make fix that on github according to:
	https://github.com/github/linguist#overrides
2019-08-22 22:00:38 -04:00
Jan Grashoefer
5901b6d33c Allow to handle late DPD matches.
If dpd_match_only_beginning is disabled, matches of protocol signatures
can be handeld using protocol_late_match. To prevent further matching in
this case, dpd_late_match_stop may be activated.
2019-08-22 19:00:11 +02:00
Tim Wojtulewicz
01207c0720 Fix unit tests for new ordering from NetSessions::Drain 2019-08-21 09:24:02 -04:00
Tim Wojtulewicz
a4b8aa1f30 Change FragReassembler to use a tuple as a key and use std::map for fragments in Sessions 2019-08-21 09:24:02 -04:00
Tim Wojtulewicz
57f29f3e7c Rework Session/Connection tracking to use a std::map instead of PDict 2019-08-21 09:24:02 -04:00
Jon Siwek
2d7c926291 GH-545: add "addl" parameter to flow_weird and net_weird events 2019-08-20 22:45:22 -04:00
Robin Sommer
8ab0650c1e Merge remote-tracking branch 'origin/topic/jsiwek/gh-532-improve-disable-analyzer'
Includes fix for potential iterator invalidation during iteration.

* origin/topic/jsiwek/gh-532-improve-disable-analyzer:
  GH-532: improve disable_analyzer BIF
2019-08-16 18:46:35 +00:00
Robin Sommer
f592ffe672 Updating submodule. 2019-08-16 18:01:59 +00:00
Jon Siwek
6255ab6584 Fix misc. Coverity warnings 2019-08-14 16:19:56 -07:00
Jon Siwek
47235b57a6 Merge remote-tracking branch 'origin/topic/timw/deprecate-int-types'
* origin/topic/timw/deprecate-int-types:
  Deprecate the internal int/uint types in favor of the cstdint types they were based on

Merge adjustments:
  * A bpf type mistakenly got replaced (inside an unlikely #ifdef)
  * Did a few substitutions that got missed (likely due to
    pre-processing out of DEBUG macros)
2019-08-14 15:49:24 -07:00
Jon Siwek
03c50fe520 Change file_analysis::Manager::ignored to use std::set 2019-08-14 13:48:39 -07:00
Jon Siwek
814d0ea969 Updating submodule(s).
[nomail]
2019-08-14 13:26:39 -07:00
Jon Siwek
396c1cb066 Update documentation for string_to_pattern BIF 2019-08-14 13:22:02 -07:00
Jon Siwek
6a3e53547c Updating submodule(s).
[nomail]
2019-08-14 10:18:34 -07:00
Jon Siwek
94c380297e Merge remote-tracking branch 'origin/topic/timw/easy-pdict-replacements'
* origin/topic/timw/easy-pdict-replacements:
  Cleanups related to PDict -> std::map replacements
  Remove other simple uses of PDict
  Protocols: Remove uses of PDict
  g_dbgfilemaps: Remove uses of PDict
  Scope: remove uses of PDict
  DFA: remove uses of PDict
  EventRegistry: remove uses of PDict
2019-08-13 20:16:02 -07:00
Jon Siwek
87f85ecca1 Cleanups related to PDict -> std::map replacements 2019-08-13 19:57:42 -07:00
Tim Wojtulewicz
e6558d1f19 Remove other simple uses of PDict 2019-08-13 19:57:42 -07:00
Tim Wojtulewicz
8beb710a5e Protocols: Remove uses of PDict 2019-08-13 19:57:42 -07:00
Tim Wojtulewicz
d0e8af9343 g_dbgfilemaps: Remove uses of PDict 2019-08-13 19:57:42 -07:00
Tim Wojtulewicz
a3deb0446c Scope: remove uses of PDict 2019-08-13 19:57:42 -07:00
Robin Sommer
00987c4411 Merge remote-tracking branch 'origin/topic/timw/clang-tidy'
* origin/topic/timw/clang-tidy:
  Change over to whitelisting clang-tidy options instead of blacklisting
  Use FindClangTidy in the cmake submodule to make things easier
2019-08-13 23:45:16 +00:00
Robin Sommer
4ee9276e3a Updating submodule(s).
[nomail]
2019-08-13 23:41:55 +00:00
Robin Sommer
ecd6139d09 Merge remote-tracking branch 'origin/topic/jsiwek/replace-pcap-lookupdev'
* origin/topic/jsiwek/replace-pcap-lookupdev:
  Replace use of deprecated pcap_lookupdev()
2019-08-13 23:02:43 +00:00
Robin Sommer
8167320bb7 Merge remote-tracking branch 'origin/topic/jsiwek/fatal-error-exit-behavior'
* origin/topic/jsiwek/fatal-error-exit-behavior:
  Use _exit() in Reporter::FatalError
2019-08-13 22:40:06 +00:00
Robin Sommer
59c306905c Merge remote-tracking branch 'origin/topic/jsiwek/gh-533-libdir'
* origin/topic/jsiwek/gh-533-libdir:
  GH-533: use consistent "lib" install dir
2019-08-13 22:39:13 +00:00
Jon Siwek
9ccf3549fd Merge remote-tracking branch 'origin/topic/timw/360-log-gzip'
* origin/topic/timw/360-log-gzip:
  Add new LogAscii::gzip_file_extension option.

Adjusted documentation during merge.
2019-08-13 13:49:45 -07:00
Jon Siwek
6e48bdeb38 Merge remote-tracking branch 'origin/topic/jazoff/memory-reduction-contentline'
* origin/topic/jazoff/memory-reduction-contentline:
  Remove redundant buffering in contentline

Adjusted NVT analyzer during merge for cases where it may have been
assuming the buffer was already resized before DoDeliver().
2019-08-13 12:04:15 -07:00
Jon Siwek
c91b12863e Add tests for {http,mime}_all_headers events
And remove unnecessary check for mime_all_headers in HTTP entities
(they ony raise the http_all_headers event, never mime_all_headers).
2019-08-13 11:28:00 -07:00
Jon Siwek
bc06768a67 Updating submodule(s).
[nomail]
2019-08-13 11:06:29 -07:00
Jon Siwek
7fc664b545 Merge remote-tracking branch 'origin/topic/jazoff/memory-reduction-mime'
* origin/topic/jazoff/memory-reduction-mime:
  Avoid buffering all http headers

Adjusted during merge:
  * whitespace
  * logic for HTTP needs to consider whether either mime_all_headers
    or http_all_headers events are being used
2019-08-12 19:34:42 -07:00
Jon Siwek
55fb48d04d GH-533: use consistent "lib" install dir
Previously, some sub-projects, like binpac, use GNUInstallDirs.cmake
to choose the default name of the library install directory while
others hard-code "lib" as the default.  The former may pick "lib64"
on some platforms, so for now, when installing such sub-projects as
part of Zeek, it's overridden to consistently be "lib".
2019-08-12 18:19:27 -07:00
Jon Siwek
41882263db Use _exit() in Reporter::FatalError
Using exit() here may generally not work well since:

* That will result in calling global destructors

* We have global state that we potentially modify at run-time and
  are in the middle of modiying at the time the FatalError occurs.
  E.g. out-of-memory is one situation where it's likely we could
  call the dtor of an object in which operation on it's internal
  state is no longer consistent/safe.
2019-08-12 14:13:46 -07:00
Tim Wojtulewicz
2e6e1aa5a8 Change over to whitelisting clang-tidy options instead of blacklisting 2019-08-12 13:59:17 -07:00
Tim Wojtulewicz
b42e726a8e Use FindClangTidy in the cmake submodule to make things easier 2019-08-12 13:59:17 -07:00