Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
19668 commits 389 branches 195 tags 271 MiB
Commit graph

19668 commits

This branch
This branch
All branches
Author SHA1 Message Date
Tim Wojtulewicz
d75a7b7be6 Merge remote-tracking branch 'origin/topic/timw/4553-debugger-stmts'
Some checks are pending
pre-commit / pre-commit (push) Waiting to run
Details 
* origin/topic/timw/4553-debugger-stmts:
  Add versions of IfStmt and StmtList for use in debugger
 2025-10-10 10:46:21 -07:00
Tim Wojtulewicz
a4cddfbacd Add versions of IfStmt and StmtList for use in debugger 2025-10-10 10:45:35 -07:00
Tim Wojtulewicz
8c9a35fb73 Merge remote-tracking branch 'origin/topic/timw/windows-gmtoff' 
* origin/topic/timw/windows-gmtoff:
  Skip setting tm_gmtoff on Windows
 2025-10-10 09:20:06 -07:00
Tim Wojtulewicz
23f6226217 Skip setting tm_gmtoff on Windows 
tm_gmtoff is a POSIX extension to the tm struct that Windows doesn't
support it. It doesn't appear to change the output from the btest,
so we can just skip it.
 2025-10-10 09:19:09 -07:00
Benjamin Bannier
fed2be36fd Merge branch 'topic/bbannier/ci-freebsd-13' 2025-10-10 12:52:42 +02:00
Benjamin Bannier
823d7935ef Bump CI to freebsd-13.5 2025-10-10 10:47:07 +02:00
Benjamin Bannier
fb27eadb58 Use package cmake-core instead of cmake on FreeBSD 
The package `cmake` seems to have unreliable availability on e.g.,
freebsd-13. Switch to the `cmake-core` subpackage which already has all
the functionality we need.
 2025-10-10 10:44:58 +02:00
zeek-bot
07ddc34ae4 Update doc submodule [nomail] [skip ci] 2025-10-10 00:29:08 +00:00
Arne Welzel
035bca3b62 Merge remote-tracking branch 'origin/topic/awelzel/zval-slot-record-val-size' 
* origin/topic/awelzel/zval-slot-record-val-size:
  Type: Cache tag into TypeDecl
  ZAM: Drop some unneeded DeleteManagedTyped() calls
  RecordVal: Replace std::vector with ZValSlot[]
  RecordType: Inline FieldDecl
  RecordType/RecordVal: Support ZValElement initialization
  logging/Manager: Adapt RawOptField() usage for ZValElement
  RecordVal: Remove rt member
  RecordVal: Replace std::optional<ZVal> with ZValElement
  Val: Introduce ZValElement
  Modifiable: No virtual destructor
  RecordVal: Use const pointer in parse_time_records
 2025-10-09 20:17:31 +02:00
Johanna Amann
ba6f34d849 Merge remote-tracking branch 'origin/topic/johanna/sha512-bifs-opaqueval'
Some checks are pending
pre-commit / pre-commit (push) Waiting to run
Details 
* origin/topic/johanna/sha512-bifs-opaqueval:
  Add SHA512 BiFs and OpaqueVals
 2025-10-09 14:03:32 +01:00
Arne Welzel
54ebda2451 Merge remote-tracking branch 'origin/topic/awelzel/quic-discarded-packet-event' 
* origin/topic/awelzel/quic-discarded-packet-event:
  QUIC: Introduce discarded_packet() event
 2025-10-09 13:13:30 +02:00
Arne Welzel
586b7b94cb QUIC: Introduce discarded_packet() event 
And include its occurrence into the history as X. The event raising is
configurable with a new const redef QUIC::max_discarded_packet_events.
 2025-10-09 13:11:24 +02:00
Arne Welzel
14410bd931 Type: Cache tag into TypeDecl 
TypeDecl instances are fixed and redundantly caching shouldn't hurt,
this avoids an indirection to the field's type just to get its tag.
 2025-10-09 10:48:02 +02:00
Arne Welzel
b5d17f7f49 ZAM: Drop some unneeded DeleteManagedTyped() calls 
The delete happens by assigning to a slot now. Seems the * and ->
operators added to ZValElement correctly works with the remaining
usages for RawOptField() and RawField().
 2025-10-09 10:48:02 +02:00
Arne Welzel
714bcd78c8 RecordVal: Replace std::vector with ZValSlot[] 
A std::vector is 24 bytes, while num_fields + unique_ptr ends up 16
bytes, bringing RecordVal instances down to 64 bytes.
 2025-10-09 10:48:02 +02:00
Arne Welzel
7928f71f02 RecordType: Inline FieldDecl 2025-10-09 10:48:02 +02:00
Arne Welzel
b5f8256ee1 RecordType/RecordVal: Support ZValElement initialization 
This will avoid IsManagedType() calls within the RecordVal constructor
and instead initialize slots based on the RecordType's types directly.

TypeDecl might not be the most appropriate place, but it does carry
enough information already and avoids adding a separate member
array-like member to RecordType mirroring the fields. Maybe TypeDecl could
be more thought of as FieldProperties ?
 2025-10-09 10:48:02 +02:00
Arne Welzel
7fbeb56b15 logging/Manager: Adapt RawOptField() usage for ZValElement 2025-10-09 10:46:55 +02:00
Arne Welzel
35340f1033 RecordVal: Remove rt member 
This doesn't seem to be really needed and costs 8 bytes per record value
 2025-10-09 10:46:55 +02:00
Arne Welzel
a6b75bc380 RecordVal: Replace std::optional<ZVal> with ZValElement 
Drop the is_managed reference and DeleteManagedType() helper that
is unused given all that information is stored in ZValElement
itself.
 2025-10-09 10:46:55 +02:00
Arne Welzel
fc48e8c3ef Val: Introduce ZValElement 
This introduces a new class for replacing the std::optional in
RecordVal's record_val vector. It may also be useful within
VectorVal in the future.
 2025-10-09 10:46:28 +02:00
Arne Welzel
85ecec20eb Modifiable: No virtual destructor 
There's only three classes that inherit from Modifiable today. The
virtual destructor adds an extra 8 byte vtable to every instance of
table, record or vector values.
Calling Unregister() explicitly from the destructors saves 8 bytes
of memory for each instance.
 2025-10-09 10:45:26 +02:00
Arne Welzel
af9be9d7e5 RecordVal: Use const pointer in parse_time_records 
It's just an index.
 2025-10-09 10:45:26 +02:00
Johanna Amann
8875b05572 Add SHA512 BiFs and OpaqueVals 2025-10-09 09:43:16 +01:00
Arne Welzel
9345a8c84e Merge remote-tracking branch 'origin/topic/awelzel/4847-quic-discard-fixed-bit-is-zero'
Some checks are pending
pre-commit / pre-commit (push) Waiting to run
Details 
* origin/topic/awelzel/4847-quic-discard-fixed-bit-is-zero:
  QUIC: Skip packets with fixed_bit 0
 2025-10-09 09:16:53 +02:00
Arne Welzel
14429cf297 QUIC: Skip packets with fixed_bit 0 
The RFC specifies that QUIC packets with unset fixed_bit need to be
discarded. Do so.

Fixes #4847
 2025-10-09 09:14:56 +02:00
Arne Welzel
0ae4f4866a Update zeek-aux for zeek-archiver improvements
Some checks are pending
pre-commit / pre-commit (push) Waiting to run
Details
2025-10-08 19:31:30 +02:00
Arne Welzel
050035e33e Merge remote-tracking branch 'origin/topic/awelzel/writer-backend-no-heartbeat'
Some checks are pending
pre-commit / pre-commit (push) Waiting to run
Details 
* origin/topic/awelzel/writer-backend-no-heartbeat:
  logging/writers: Disable heartbeats
  logging/WriterBackend: Support disabling heartbeats
 2025-10-08 09:21:33 +02:00
Tim Wojtulewicz
f2eb709f07 Merge remote-tracking branch 'origin/topic/vern/standalone-global-inits'
Some checks are pending
pre-commit / pre-commit (push) Waiting to run
Details 
* origin/topic/vern/standalone-global-inits:
  Reworked initialization of globals for -O gen-standalone-C++ code
 2025-10-07 09:33:44 -07:00
Vern Paxson
3899e449a7 Reworked initialization of globals for -O gen-standalone-C++ code 2025-10-07 09:18:49 -07:00
Tim Wojtulewicz
cd4c3bce88 Merge remote-tracking branch 'origin/topic/timw/4545-smb-gmtime' 
* origin/topic/timw/4545-smb-gmtime:
  Remove SMB_time and SMB_date record types
  SMB: Init lanman time and set TZ correctly before calling mktime
 2025-10-07 09:16:26 -07:00
Tim Wojtulewicz
8a1937a0e0 Merge remote-tracking branch 'origin/topic/vern/standalone-enum-fix'
Some checks failed
pre-commit / pre-commit (push) Has been cancelled
Details 
* origin/topic/vern/standalone-enum-fix:
  fix to enable -O gen-standalone-C++ code to extend enum types
 2025-10-03 14:07:14 -07:00
Vern Paxson
0358ac3f48 fix to enable -O gen-standalone-C++ code to extend enum types 2025-10-03 14:06:53 -07:00
Tim Wojtulewicz
73746b694e Merge remote-tracking branch 'origin/topic/timw/coverity-fixes' 
* origin/topic/timw/coverity-fixes:
  Fix some recent Coverity findings
 2025-10-03 09:13:39 -07:00
zeek-bot
332f662d6f Update doc submodule [nomail] [skip ci] 2025-10-03 00:21:42 +00:00
Arne Welzel
4de7a2b947 Merge remote-tracking branch 'origin/topic/awelzel/4845-get-current-packet-header-fragmented-syn'
Some checks failed
pre-commit / pre-commit (push) Has been cancelled
Details 
* origin/topic/awelzel/4845-get-current-packet-header-fragmented-syn:
  iosource/Packet: Allow ToRawPktHdrVal() for reassembled packets
 2025-10-02 14:12:22 +02:00
Arne Welzel
ca58c5e6b4 iosource/Packet: Allow ToRawPktHdrVal() for reassembled packets 
Closes #4845
 2025-10-02 14:10:09 +02:00
Arne Welzel
d9af53bdd7 logging/writers: Disable heartbeats 
None of the built-in log writers have a use for heartbeats, disable
sending them to the thread.
 2025-10-02 09:59:43 +02:00
Arne Welzel
65e311b575 logging/WriterBackend: Support disabling heartbeats 
The regular heartbeats to the WriterBackend threads can result in
significant processing overhead when analyzing long and sparse PCAPs
for which the number of heartbeat messages far exceeds the number of
log writes. This patch allows implementors to disable heartbeats.

Relates to discussion #4731
 2025-10-02 09:50:04 +02:00
Arne Welzel
4e9b40f290 Merge remote-tracking branch 'origin/topic/awelzel/conn-class-layout-packing' 
* origin/topic/awelzel/conn-class-layout-packing:
  Conn: Improve packing, drop bitfields and boolenize
  Conn: Lazily initialize weird_state when needed
 2025-10-02 09:15:33 +02:00
Arne Welzel
d1051df887 Conn: Improve packing, drop bitfields and boolenize 
There's a few holes in Conn, particularly now that TransportProto has
become a uint8_t. Pack things a bit more neatly.
 2025-10-02 09:13:03 +02:00
Arne Welzel
d5045e08e3 Conn: Lazily initialize weird_state when needed 
A std::unordered_map takes 56 bytes on my system. Switch to a unique_ptr
an initialize weird_state lazily. That saves ~48 bytes per connection.
Particularly for scan or non-weird traffic, this should allow some
memory savings.
 2025-10-02 09:13:03 +02:00
Tim Wojtulewicz
66f9695927 Fix some recent Coverity findings 2025-09-30 15:57:17 -07:00
Tim Wojtulewicz
8b4707a284 Merge remote-tracking branch 'origin/topic/vern/id-redecl'
Some checks failed
pre-commit / pre-commit (push) Has been cancelled
Details 
* origin/topic/vern/id-redecl:
  fixes for re-declaring type identifiers in inconsistent ways - addresses GH-2686
 2025-09-30 20:46:38 +00:00
Tim Wojtulewicz
99fa163db2 Merge remote-tracking branch 'origin/topic/vern/standalone-BiF-access' 
* origin/topic/vern/standalone-BiF-access:
  Fix for standalone initializations that require BiFs, and streamlining of standalone BiF-tracking
 2025-09-30 20:45:28 +00:00
Tim Wojtulewicz
63291eca75 Merge remote-tracking branch 'origin/topic/vern/opt-skip-file-fix' 
* origin/topic/vern/opt-skip-file-fix:
  fixed bug in logic for including/excluding files for script optimization
 2025-09-30 20:12:24 +00:00
Tim Wojtulewicz
85b4cec76e Merge remote-tracking branch 'origin/topic/timw/remove-checks-for-very-old-openssl-versions' 
* origin/topic/timw/remove-checks-for-very-old-openssl-versions:
  Remove checks for OpenSSL 1.x versions
  Remove some additional LibreSSL checks
 2025-09-30 19:12:16 +00:00
Vern Paxson
6471a7bf7b Fix for standalone initializations that require BiFs, and streamlining of standalone BiF-tracking 2025-09-30 11:11:50 -07:00
Vern Paxson
fada719620 fixed bug in logic for including/excluding files for script optimization 2025-09-30 10:40:01 -07:00
Tim Wojtulewicz
a27cc89335 Remove checks for OpenSSL 1.x versions 2025-09-29 10:23:28 -07:00