Commit graph

3452 commits

Author SHA1 Message Date
Johanna Amann
dfa011a3ee Merge remote-tracking branch 'origin/topic/johanna/gh-4237'
* origin/topic/johanna/gh-4237:
  RDP: cookie is optional
2025-03-04 13:41:18 +00:00
Arne Welzel
548a12813a Merge branch 'master' of https://github.com/markoverholser/zeek
* 'master' of https://github.com/markoverholser/zeek:
  Update zeek.bif documentation for to_count and to_int
2025-03-04 12:07:22 +01:00
Arne Welzel
a3a08fa0f3 Merge remote-tracking branch 'origin/topic/awelzel/2311-load-plugin-bare-mode'
* origin/topic/awelzel/2311-load-plugin-bare-mode:
  scan.l: Fix @load-plugin scripts loading
  scan.l: Extract switch_to() from load_files()
  ScannedFile: Allow skipping canonicalization
2025-03-04 09:43:53 +01:00
Tim Wojtulewicz
3c16b0720a Merge remote-tracking branch 'origin/topic/timw/few-btest-jobs-for-zam-ci-tasks'
* origin/topic/timw/few-btest-jobs-for-zam-ci-tasks:
  CI: Use the right variable for the number of test jobs for zeekctl_debian11_task tasks
  CI: Use fewer btest jobs for ZAM tasks
2025-02-25 07:30:00 -07:00
Tim Wojtulewicz
66e3232dcc Merge remote-tracking branch 'markoverholser/master'
* markoverholser/master:
  Fix incorrect syntax for static_cast in to_count that I introduced in a previous merge
  Update baselines after changes to to_count and to_int
  fix to_count in zeek.bif to resolve conflict from bbanier's adjustment to static casting of the return from strtoull
  Fix tests in to_count to reflect appropriate function; add tests for 0x-formatted hex values for to_count and to_int
  update BIFs to_int() and to_count() to accept optional 'base' argument; allows more more exotic conversions from hex, octal, binary
  Fixes #4076; update BIFs to_int() and to_count() to accept optional 'base' argument for more easy conversions of strings representing (for example) hexadecimal, octal, or binary numbers
2025-02-24 11:38:11 -07:00
Arne Welzel
3682a42376 Merge remote-tracking branch 'origin/topic/awelzel/get-geneve-options'
* origin/topic/awelzel/get-geneve-options:
  PacketAnalyzer::Geneve: Add get_options()
  packet_analysis: Track data spans of packet analyzers
2025-02-22 12:33:46 -08:00
Benjamin Bannier
0bc0104eb2 Merge remote-tracking branch 'origin/topic/timw/to-int-zam' 2025-02-21 12:24:43 +01:00
Tim Wojtulewicz
bcecc6ea51 Merge remote-tracking branch 'mnhsrj/innerPktResults'
* mnhsrj/innerPktResults:
  Set original/outer packet flags to reflect inner packet results
2025-02-20 16:41:05 -07:00
Tim Wojtulewicz
07a03bbfe9 Merge remote-tracking branch 'origin/topic/bbannier/integer-conversion-error-handling'
* origin/topic/bbannier/integer-conversion-error-handling:
  Also trim trailing spaces in `to_count`/`to_int` inputs
  Align error handling in `to_int` with existing behavior of `to_count`
  Baseline handling of leading/trailing spaces in `to_count`/`to_int`.
  Add error messages to `to_count`/`to_int` baselines
2025-02-20 15:35:34 -07:00
Tim Wojtulewicz
6609269f3c Merge remote-tracking branch 'origin/topic/awelzel/freebsd-14-1-to-14-2'
* origin/topic/awelzel/freebsd-14-1-to-14-2:
  cirrus: Bump FreeBSD 14 task to 14.2
2025-02-18 08:51:40 -07:00
Tim Wojtulewicz
9c41b6d227 Merge remote-tracking branch 'origin/topic/etyp/locals-to-global'
* origin/topic/etyp/locals-to-global:
  Do not export locals
2025-02-14 11:29:29 -08:00
Johanna Amann
fc233fd8d0 Merge remote-tracking branch 'origin/topic/johanna/dpd-changes'
* origin/topic/johanna/dpd-changes:
  DPD: failed services logging alignment
  DPD: update test baselines; change options for external tests.
  DPD: change policy script for service violation logging; add NEWS
  DPD changes - small script fixes and renames.
  Update public and private test suite for DPD changes.
  Allow to track service violations in conn.log.
  Make conn.log service field ordered
  DPD: change handling of pre-confirmation violations, remove max_violations
  DPD: log analyzers that have confirmed
  IRC analyzer - make protocol confirmation more robust.
2025-02-07 07:35:30 +00:00
Arne Welzel
02494d2146 Merge remote-tracking branch 'origin/topic/christian/gh-3595-warnings'
* origin/topic/christian/gh-3595-warnings:
  Downgrade internal errors to reporter warnings in file/directory BiFs
2025-02-06 10:05:22 +01:00
Arne Welzel
fbdefd1451 Merge remote-tracking branch 'origin/topic/awelzel/zeromq-fix-fmt-call-thanks-tsan'
* origin/topic/awelzel/zeromq-fix-fmt-call-thanks-tsan:
  cluster/zeromq: Call DoTerminate() in destructor
  cluster/zeromq: Use lambda for thread trampoline
  cluster/zeromq: Do not call util::fmt() from thread
2025-02-05 16:40:55 +01:00
Arne Welzel
da673d6577 Merge remote-tracking branch 'origin/topic/awelzel/4136-cluster-backend-pre-work'
* origin/topic/awelzel/4136-cluster-backend-pre-work:
  cluster/zeromq: Fix Unsubscribe() bug caused by \x00 prefix
  cluster: Add SubscribeCallback support
  cluster/zeromq: Fix XSUB threading issues
  cluster/zeromq: Use NodeId(), drop my_node_id
  cluster/Backend: Pass node_id via Init()
  cluster/Backend: Make backend event processing customizable
  cluster/broker/Serializer: Fix adaptor to adapter
  cluster/Backend: Do not use const std::string_view&
  cluster/serializer/broker: Fix handler lookup
  broker/Manager: Move name in PublishEvent()
  btest/zeromq/test-bootstrap: Fix port parsing
  EventHandler: Support operator!=
2025-02-05 11:10:36 +01:00
Johanna Amann
5ef6902331 Merge remote-tracking branch 'origin/topic/johanna/jbaggs-ignore-mdns'
* origin/topic/johanna/jbaggs-ignore-mdns:
  IPv6 support for detect-external-names and testcase
  Add  `skip_resp_host_port_pairs` option.
2025-02-05 09:09:01 +00:00
Christian Kreibich
aa5adba013 Merge branch 'topic/christian/fix-cluster-testsuite-races'
* topic/christian/fix-cluster-testsuite-races:
  Bump cluster testsuite to pull in resilience to agent connection timing [skip ci]
2025-02-04 14:50:59 -08:00
Arne Welzel
8d9f258f78 Merge remote-tracking branch 'origin/topic/awelzel/4209-save-seeds-load-seeds'
* origin/topic/awelzel/4209-save-seeds-load-seeds:
  util/init_random_seed: write_file implies deterministic
2025-02-04 16:50:57 +01:00
Arne Welzel
280e7acc6e Merge remote-tracking branch 'origin/topic/awelzel/4035-btest-openssl-sha1-certs'
* origin/topic/awelzel/4035-btest-openssl-sha1-certs:
  external/subdir-btest.cfg: Set OPENSSL_ENABLE_SHA1_SIGNATURES=1
  btest/x509_verify: Drop OpenSSL 1.0 hack
  testing/btest: Use OPENSSL_ENABLE_SHA1_SIGNATURES
2025-02-04 09:52:55 +01:00
Arne Welzel
0290a73544 Merge remote-tracking branch 'origin/topic/timw/add-missing-quic-zam-baseline'
* origin/topic/timw/add-missing-quic-zam-baseline:
  Add ZAM baseline for new scripts.base.protocols.quic.analyzer-confirmations btest
2025-02-04 09:18:42 +01:00
Tim Wojtulewicz
c8eab363fb Merge remote-tracking branch 'philipp-tg/asrep_enc_part'
* philipp-tg/asrep_enc_part:
  Make enc_part value from kerberos response available to scripts
2025-02-03 18:41:53 -07:00
Tim Wojtulewicz
f0d7984bac Merge remote-tracking branch 'origin/topic/timw/add-note-about-pe-pcap'
* origin/topic/timw/add-note-about-pe-pcap:
  Add note to Traces/README about possible malware in pe/pe.trace
  Fix formatting of Traces/README entry for modbus-eit.trace
2025-02-03 18:34:15 -07:00
Christian Kreibich
073aad9241 Merge branch 'topic/christian/remove-supervisednode-initcluster-decl'
* topic/christian/remove-supervisednode-initcluster-decl:
  Remove unused SupervisedNode::InitCluster declaration
2025-02-03 16:53:23 -08:00
Arne Welzel
44304973fb Merge remote-tracking branch 'origin/topic/awelzel/4198-4201-quic-maintenance'
* origin/topic/awelzel/4198-4201-quic-maintenance:
  QUIC/decrypt_crypto: Rename all_data to data
  QUIC: Confirm before forwarding data to SSL
  QUIC: Parse all QUIC packets in a UDP datagram
  QUIC: Only slurp till packet end, not till &eod
2025-02-03 17:52:20 +01:00
Christian Kreibich
8ef333ff32 Merge branch 'topic/christian/management-multinode-metrics-ports'
* topic/christian/management-multinode-metrics-ports:
  Bump cluster testsuite to pull in updated Prometheus tests
  Management framework: move up addition of agent IPs into deployable cluster configs
  Support multiple instances per host addr in auto metrics generation
  When auto-generating metrics ports for worker nodes, get them more uniform across instances.
2025-01-31 15:59:22 -08:00
Tim Wojtulewicz
7172b682f2 Merge remote-tracking branch 'origin/topic/timw/packing'
* origin/topic/timw/packing:
  Pack some classes for better memory usages
2025-01-30 10:51:23 -07:00
Tim Wojtulewicz
99023b14d5 Merge remote-tracking branch 'origin/topic/etyp/type-const'
* origin/topic/etyp/type-const:
  Make types into constants
2025-01-24 15:47:40 -07:00
Tim Wojtulewicz
5d9aa52122 Revert "Merge remote-tracking branch 'origin/topic/etyp/type-const'"
This reverts commit 53982aabfa, reversing
changes made to 8c28e47dc1.
2025-01-24 15:47:01 -07:00
Tim Wojtulewicz
53982aabfa Merge remote-tracking branch 'origin/topic/etyp/type-const'
* origin/topic/etyp/type-const:
  Make types into constants
2025-01-24 15:43:06 -07:00
Tim Wojtulewicz
8c28e47dc1 Merge remote-tracking branch 'origin/topic/timw/rst-linting'
* origin/topic/timw/rst-linting:
  Fix errors from rst linting on the generated docs
2025-01-24 11:42:32 -07:00
Tim Wojtulewicz
cc1fdb4203 Merge remote-tracking branch 'origin/topic/etyp/options-segfault-fix'
* origin/topic/etyp/options-segfault-fix:
  Fix options parsing segfault
2025-01-23 11:49:59 -07:00
Tim Wojtulewicz
ec0b44e5b0 Merge remote-tracking branch 'origin/topic/timw/merge-init-bare-sections'
* origin/topic/timw/merge-init-bare-sections:
  Minor whitespace cleanup in init-bare.zeek
  Add missing export blocks to init-bare.zeek
  Merge some GLOBAL module sections in init-bare
  Merge Tunnel module sections in init-bare
2025-01-23 11:21:38 -07:00
Arne Welzel
cb44a6ca53 Merge remote-tracking branch 'origin/topic/awelzel/lookup-connection-zam-follow-up'
* origin/topic/awelzel/lookup-connection-zam-follow-up:
  script_opt: Use emit_builtin_error() for Lookup-Conn
2025-01-23 16:46:43 +01:00
Tim Wojtulewicz
7e5a9c3a82 Merge remote-tracking branch 'origin/topic/awelzel/lookup-connection-tweaks'
* origin/topic/awelzel/lookup-connection-tweaks:
  session/Manager: Emit explicit errors for FindConnection() with proto=65535
  IPAddr/ConnKey: Protect from uninitialized conn_id
  IPAddr/ConnKey: Promote transport to uint16_t
  session/Manager: Header cleanup
2025-01-21 16:49:09 -07:00
Arne Welzel
92f2f66a60 Merge remote-tracking branch 'origin/topic/vern/standalone-lambdas'
* origin/topic/vern/standalone-lambdas:
  fixes for -O gen-standalone-C++ generation of lambdas
2025-01-20 10:27:46 +01:00
Arne Welzel
868eb129bf Merge remote-tracking branch 'origin/topic/awelzel/fix-writer-info-in-logging-hooks'
* origin/topic/awelzel/fix-writer-info-in-logging-hooks:
  logging: Fix reporter message
  logging: Avoid repeated writer name lookups for plugin hooks
  logging: Fix HookLogInit() and HookLogWrite() info usage
2025-01-14 21:39:31 +01:00
Benjamin Bannier
c6f9dfb155 Merge branch 'topic/bbannier/coverity' 2025-01-14 18:20:11 +01:00
Johanna Amann
b2222e97a1 Merge remote-tracking branch 'origin/topic/johanna/gh-4061'
* origin/topic/johanna/gh-4061:
  Update BiF-tracking, add is_event_handled
  Address review comments and small updates for DNS warnings
  Raise warnings when for DNS events that are not raised due to dns_skip_all_addl
2025-01-14 14:39:56 +00:00
Arne Welzel
5f91f8485c Merge remote-tracking branch 'origin/topic/vern/C++-standalone-record-redef'
* origin/topic/vern/C++-standalone-record-redef:
  support for record extensions when using -O gen-standalone-C++
2025-01-14 11:14:25 +01:00
Benjamin Bannier
300b3788e2 Merge branch 'topic/bbannier/coverity' 2025-01-14 08:44:22 +01:00
Tim Wojtulewicz
8931c352ef Merge remote-tracking branch 'origin/topic/bbannier/fix-spicy-ssl-includes'
* origin/topic/bbannier/fix-spicy-ssl-includes:
  Fix incomplete includes in Spicy SSL analyer C++ code
2025-01-13 08:31:04 -07:00
Tim Wojtulewicz
3ae6904b7c Merge branch 'topic/timw/add-security-md'
* topic/timw/add-security-md:
  Add SECURITY.md, pointing at the website
2025-01-13 08:22:13 -07:00
Tim Wojtulewicz
36737657ea Merge remote-tracking branch 'origin/topic/timw/non-routeable-subnets'
* origin/topic/timw/non-routeable-subnets:
  Update zeekctl submodule [nomail]
2025-01-13 08:20:09 -07:00
Benjamin Bannier
8910415659 Merge branch 'topic/bbannier/bump-spicy' 2025-01-11 17:36:54 +01:00
Christian Kreibich
f2d54db694 Merge remote-tracking branch 'origin/topic/etyp/harden-flaky-test'
* origin/topic/etyp/harden-flaky-test:
  Harden flaky test based on creating a file
2025-01-10 11:15:45 -08:00
Tim Wojtulewicz
c10b18253a Merge remote-tracking branch 'origin/topic/timw/non-routeable-subnets'
* origin/topic/timw/non-routeable-subnets:
  Update btests for new local-only subnets
  Add recommended non-routable subnets
2025-01-09 22:18:03 -07:00
Tim Wojtulewicz
a919226b24 Merge remote-tracking branch 'origin/topic/vern/macro-descriptions'
* origin/topic/vern/macro-descriptions:
  Add missing include for <vector>
  Extended ZAM validation to include macros
2025-01-09 13:47:57 -07:00
Tim Wojtulewicz
7df5298fcd Merge remote-tracking branch 'origin/topic/vern/zam-header-factoring'
* origin/topic/vern/zam-header-factoring:
  factoring of some ZAM header files for better modularity
2025-01-09 12:09:16 -07:00
Tim Wojtulewicz
f57e650242 Merge remote-tracking branch 'origin/topic/vern/CPP-standalone-fixes'
* origin/topic/vern/CPP-standalone-fixes:
  fixes for initializing globals when using -O gen-standalone-C++
2025-01-09 12:02:55 -07:00
Arne Welzel
0fc7a8ca4b Merge remote-tracking branch 'origin/topic/etyp/copying-2025'
* origin/topic/etyp/copying-2025:
  Update COPYING date to now and fix some [skip CI]
2025-01-09 16:34:28 +01:00