Commit graph

8459 commits

Author SHA1 Message Date
Jon Siwek
dbb49b17f4 Reduce data copying in Broker message processing 2019-05-07 20:15:31 -07:00
Jon Siwek
9029acd7e5 Merge remote-tracking branch 'origin/topic/johanna/243'
* origin/topic/johanna/243:
  Fix missing include file on Linux
  Deprecations: Update NEWS, and tie up a few loose ends.
  Remove support for using &&/|| with patterns.
  Remove RemoteSerializer and related code/types.
  Remove PersistenceSerializer.
  Remove synchrnized and persistent attributes.
2019-05-06 18:45:10 -07:00
Johanna Amann
9b49c7cbc6 Fix missing include file on Linux 2019-05-06 18:56:47 +00:00
Johanna Amann
72ec093d56 Deprecations: Update NEWS, and tie up a few loose ends.
Broccoli was still present in the source in a few places, debug outputs
that do no longer exist were too.

Part of GH-243
2019-05-06 11:12:47 -07:00
Johanna Amann
ed644e39a0 Remove support for using &&/|| with patterns.
This was never documented and previously deprecated.
2019-05-03 15:26:21 -07:00
Johanna Amann
4c19e60488 Merge remote-tracking branch 'origin/master' into topic/johanna/remove-deprecated-functions-events 2019-05-03 15:15:22 -07:00
Johanna Amann
dcd6454530 Remove RemoteSerializer and related code/types.
Also removes broccoli from the source tree.
2019-05-03 15:00:13 -07:00
Jon Siwek
eda7610806 Fix sporadic openflow/broker test failure
Looked like a possible race condition in how the test was structured: an
endpoint sees its peer got lost and likewise exits immediately before
having a chance to process events the peer had sent just before exiting.
Fix is to reverse which endpoint initiates the termination sequence so
we can be sure we see the required events.
2019-05-03 11:22:56 -07:00
Jon Siwek
c640dd70cc Install local.zeek as symlink to pre-existing local.bro
This a convenience for those that are upgrading.  If we didn't do
this, then deployments can silently break until the user intervenes
since BroControl now prefers to load the initially-vanilla local.zeek
instead of the formerly-customized local.bro.
2019-05-02 23:06:52 -07:00
Jon Siwek
84ca12fdb4 Rename Zeexygen to Zeekygen 2019-05-02 21:39:21 -07:00
Jon Siwek
f2f06d66c0 Remove previously deprecated policy/protocols/smb/__load__ 2019-05-02 20:50:30 -07:00
Jon Siwek
1a77c1b287 Merge remote-tracking branch 'origin/topic/johanna/remove-deprecated-functions-events'
* origin/topic/johanna/remove-deprecated-functions-events:
  Remove deprecated functions/events
2019-05-02 19:18:45 -07:00
Johanna Amann
ca1b1dd6bb Remove PersistenceSerializer. 2019-05-02 13:45:36 -07:00
Johanna Amann
61c84a0a40 Remove synchrnized and persistent attributes.
Code that was used by them is still there.
2019-05-02 13:10:37 -07:00
Johanna Amann
6d47077222 Merge remote-tracking branch 'origin/topic/jsiwek/gh-340'
* origin/topic/jsiwek/gh-340:
  GH-340: Improve IPv4/IPv6 regexes, extraction, and validity functions
2019-05-02 12:28:31 -07:00
Johanna Amann
5d44735209 Remove deprecated functions/events
This commit removed functions/events that have been deprecated in Bro
2.6. It also removes the detection code that checks if the old
communication framework is used (since all the functions that are
checked were removed).

Addresses parts of GH-243
2019-05-02 12:06:39 -07:00
Jon Siwek
375b151a4b Update external pointer to zeek-testing repo 2019-05-01 14:18:05 -07:00
Johanna Amann
29d9b5b554 Merge remote-tracking branch 'origin/topic/jsiwek/plist-and-event-cleanup'
* origin/topic/jsiwek/plist-and-event-cleanup:
  Add comments to QueueEvent() and ConnectionEvent()
  Add methods to queue events without handler existence check
  Cleanup/improve PList usage and Event API
2019-05-01 08:41:13 -07:00
Jon Siwek
c67da0a3cb Add comments to QueueEvent() and ConnectionEvent()
And also their "Fast" variants.
2019-04-29 19:21:18 -07:00
Jon Siwek
9a461d26e4 Updating CHANGES and VERSION. 2019-04-29 18:34:40 -07:00
Jon Siwek
f7c1cde7c7 Remove 'dns_resolver' option, replace w/ ZEEK_DNS_RESOLVER env. var.
The later simply doesn't work well in conjunction with hostname
literals.  i.e. "google.com" (without quotes) needs to be resolved
to a set of addresses at parse-time, so if a user wishes to use a
custom resolver, we need that to be configured independently from
the order in which scripts get parsed.  Configuring 'dns_resolver'
via scripting "redef" is clearly dependent on parse order.

Note 'dns_resolver' hasn't been in any release version yet, so
I'm removing it outright, no deprecation.  The ZEEK_DNS_RESOLVER
environment variable now serves the original purpose.
2019-04-29 18:09:29 -07:00
Jon Siwek
49908ac865 Fix parsing of hybrid IPv6-IPv4 addr literals with no zero compression 2019-04-26 19:29:40 -07:00
Jon Siwek
cc83b8ce8e Updating submodule(s).
[nomail]
2019-04-26 09:43:57 -07:00
Jon Siwek
a93e9317d5 Updating submodule(s).
[nomail]
2019-04-25 12:00:21 -07:00
Jon Siwek
05b4d2a26c Add Zeexygen cross-reference links for some events 2019-04-25 10:23:00 -07:00
Jon Siwek
4c6b35970d Merge remote-tracking branch 'origin/topic/vern/expose-TCP-statics'
* origin/topic/vern/expose-TCP-statics:
  expose some TCP analyzer utility functions for use by derived classes
2019-04-23 18:43:54 -07:00
Vern Paxson
85acdc14e4 expose some TCP analyzer utility functions for use by derived classes 2019-04-23 16:40:58 -07:00
Jon Siwek
aebcb1415d GH-234: rename Broxygen to Zeexygen along with roles/directives
* All "Broxygen" usages have been replaced in
  code, documentation, filenames, etc.

* Sphinx roles/directives like ":bro:see" are now ":zeek:see"

* The "--broxygen" command-line option is now "--zeexygen"
2019-04-22 19:45:50 -07:00
Johanna Amann
5ba46eaa71 update SSL consts from TLS 1.3 2019-04-22 22:57:45 +02:00
Jon Siwek
d5803d7047 Merge remote-tracking branch 'origin/topic/vern/content-gap-history'
* origin/topic/vern/content-gap-history:
  Refined state machine update placement to (1) properly deal with gaps capped by clean FIN handshakes, and (1) fix failure to detect split routing.
  added 'g' $history character for content gaps
2019-04-22 12:40:40 -07:00
Jon Siwek
f15c99c82e Updating submodule(s).
[nomail]
2019-04-22 11:19:52 -07:00
Vern Paxson
9c8ad11d92 Refined state machine update placement to (1) properly deal with gaps capped
by clean FIN handshakes, and (1) fix failure to detect split routing.

Fixed typo flagged by Pierre Lalet.
2019-04-22 09:13:23 -07:00
Jon Siwek
3ea34d6ea3 GH-236: Add zeek_script_loaded event, deprecate bro_script_loaded 2019-04-19 12:02:22 -07:00
Jon Siwek
a994be9eeb Merge remote-tracking branch 'origin/topic/seth/zeek_init'
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
2019-04-19 11:24:29 -07:00
Jon Siwek
7144661930 GH-340: Improve IPv4/IPv6 regexes, extraction, and validity functions
* is_valid_ip() is now implemented as a BIF instead of in
  base/utils/addrs

* The IPv4 and IPv6 regular expressions provided by base/utils/addrs
  have been improved/corrected (previously they could possibly match
  some invalid IPv4 decimals, or various "zero compressed" IPv6 strings
  with too many hextets)

* extract_ip_addresses() should give better results as a result of
  the above two points
2019-04-18 19:04:39 -07:00
Johanna Amann
9421ee0293 Merge branch 'topic/jsbarber/fix-topk-merge-core-dump' of https://github.com/jsbarber/bro
* 'topic/jsbarber/fix-topk-merge-core-dump' of https://github.com/jsbarber/bro:
  Prevent topk_merge from crashing when second argument is empty set
2019-04-18 09:36:48 +02:00
Jon Siwek
5f3e608b60 Fix unit test failures on case-insensitive file systems
The original casing mistake in the test only pops up now due to the
new .zeek over .bro file loading preference
2019-04-17 16:47:01 -07:00
Jon Siwek
31e9ae0fed Updating submodule(s).
[nomail]
2019-04-17 16:02:38 -07:00
Vern Paxson
915189a06a added 'g' $history character for content gaps 2019-04-17 14:20:48 -07:00
Jon Siwek
ae4129d2b6 Updating submodule(s).
[nomail]
2019-04-16 18:06:55 -07:00
Jon Siwek
f21e11d811 GH-237: add @load foo.bro -> foo.zeek fallback
When failing to locate a script with explicit .bro suffix, check for
whether one with a .zeek suffix exists and use it instead.
2019-04-16 17:49:37 -07:00
Jon Siwek
8f82ecc66d Updating submodule(s).
[nomail]
2019-04-16 16:37:12 -07:00
Jon Siwek
1e57e3f026 Use .zeek file suffix in unit tests 2019-04-16 16:08:57 -07:00
Jon Siwek
93d384adeb Updating submodule(s).
[nomail]
2019-04-16 12:43:44 -07:00
Jon Siwek
4574799609 Merge branch 'master' of https://github.com/dnthayer/zeek
* 'master' of https://github.com/dnthayer/zeek:
  Update tests and baselines due to renaming all scripts
  Rename all scripts to have ".zeek" file extension
  Update a few tests due to scripts with new file extension
  Add test cases to verify new file extension is recognized
  Fix the core/load-duplicates.bro test
  Update script search logic for new file extension
  Remove unnecessary ".bro" from @load directives
2019-04-16 11:57:16 -07:00
Seth Hall
9d676d368b Some more testing fixes. 2019-04-14 09:58:30 -04:00
Seth Hall
5db766bd88 Update docs and tests for bro_(init|done) -> zeek_(init|done) 2019-04-14 08:49:12 -04:00
Seth Hall
8cefb9be42 Implement the zeek_init handler.
Implements the change and a test.
2019-04-14 08:37:35 -04:00
Daniel Thayer
9cbeb44986 Merge remote-tracking branch 'upstream/master' 2019-04-14 01:35:50 -05:00
Jon Siwek
f96bc81f85 Updating submodule(s).
[nomail]
2019-04-12 16:44:14 -07:00