Commit graph

15389 commits

Author SHA1 Message Date
Johanna Amann
e97f63dbbe Raw reader: use posix_spawn instead of fork + exec
This commit switchexisd the Raw reader to use posix_spawn, instead of
the combination of fork + exec. This should be much more efficient, and
also makes the code smaller, and easier to read and understand.
2023-08-09 16:51:47 +01:00
zeek-bot
646b301b65 Update doc submodule [nomail] [skip ci] 2023-08-09 00:19:23 +00:00
Tim Wojtulewicz
16a69864b4 Merge remote-tracking branch 'origin/topic/timw/3184-modbus-extensions'
* origin/topic/timw/3184-modbus-extensions:
  Pass parsed file record information with ReadFile/WriteFile events
  Add length field from header to ModbusHeaders record type
  Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses
  Modbus: Add support for Diagnostics (FC=8) requests and responses
2023-08-08 10:55:25 -07:00
Tim Wojtulewicz
e3a34e44b5 Revert "Merge remote-tracking branch 'origin/topic/timw/3184-modbus-extensions'"
This reverts commit 30b2afe2ad, reversing
changes made to bacc0dcae3.
2023-08-08 10:54:33 -07:00
zeek-bot
b7a082b145 Update doc submodule [nomail] [skip ci] 2023-08-08 00:31:55 +00:00
Tim Wojtulewicz
30b2afe2ad Merge remote-tracking branch 'origin/topic/timw/3184-modbus-extensions'
* origin/topic/timw/3184-modbus-extensions:
  Pass parsed file record information with ReadFile/WriteFile events
  Add length field from header to ModbusHeaders record type
  Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses
  Modbus: Add support for Diagnostics (FC=8) requests and responses
2023-08-07 14:34:43 -07:00
Tim Wojtulewicz
1dc9235cee Pass parsed file record information with ReadFile/WriteFile events 2023-08-07 13:44:38 -07:00
Tim Wojtulewicz
18fd384469 Add length field from header to ModbusHeaders record type 2023-08-07 13:44:37 -07:00
Tim Wojtulewicz
406a406813 Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses 2023-08-07 13:44:37 -07:00
Tim Wojtulewicz
f14be0de29 Modbus: Add support for Diagnostics (FC=8) requests and responses 2023-08-07 13:44:37 -07:00
Tim Wojtulewicz
bacc0dcae3 Merge remote-tracking branch 'origin/topic/timw/cmake-find-package'
* origin/topic/timw/cmake-find-package:
  Change VERSION variable in CMake config to ZEEK_VERSION_FULL
  Update bifcl and binpac for FindPackage fixes
  Remove usage of FindRequiredPackage
  Update zeekctl and cmake to deprecate FindRequiredPackage
  Update broker submodule for pybind11 + cmake changes
2023-08-07 09:42:02 -07:00
Tim Wojtulewicz
67c8e5192a Change VERSION variable in CMake config to ZEEK_VERSION_FULL 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
cb649795c0 Update bifcl and binpac for FindPackage fixes 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
c743be0c54 Remove usage of FindRequiredPackage 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
2ce94e9855 Update zeekctl and cmake to deprecate FindRequiredPackage 2023-08-07 09:33:52 -07:00
Tim Wojtulewicz
0772e205ec Update broker submodule for pybind11 + cmake changes 2023-08-07 08:15:09 -07:00
Arne Welzel
6524127d61 Merge remote-tracking branch 'origin/topic/awelzel/centos-7-bump'
* origin/topic/awelzel/centos-7-bump:
  ci: Bump centos-7
2023-08-07 16:27:05 +02:00
Arne Welzel
7d3ded06c7 ci: Bump centos-7
Failing currently with:

    Failed to start an instance! Failed to pull null image! Repository does not exist or may require authentication.
    Container errored with 'ImagePullBackOff: Back-off pulling image "gcr.io/cirrus-ci-community/zeek/zeek/ci/centos-7/dockerfile:a0c25357a3a7dc08f6c1e61e6f81ad36"'
2023-08-07 15:47:40 +02:00
Arne Welzel
bb9faab83b Merge remote-tracking branch 'origin/topic/timw/tsan-upgrade'
* origin/topic/timw/tsan-upgrade:
  Suppress new tsan findings from Ubuntu 22 upgrade
  Update tsan build to ubuntu22
2023-08-07 10:22:38 +02:00
Tim Wojtulewicz
f56b6bdb2b Pass parsed file record information with ReadFile/WriteFile events 2023-08-04 19:15:25 -07:00
Tim Wojtulewicz
8318dfc169 Add length field from header to ModbusHeaders record type 2023-08-04 16:16:49 -07:00
Tim Wojtulewicz
0fdff44cf0 Suppress new tsan findings from Ubuntu 22 upgrade 2023-08-04 14:18:00 -07:00
Tim Wojtulewicz
60d0241782 Update tsan build to ubuntu22 2023-08-04 14:16:54 -07:00
Arne Welzel
0d229ee84a Merge remote-tracking branch 'origin/topic/awelzel/2668-default-create-insert-assign-or-so'
* origin/topic/awelzel/2668-default-create-insert-assign-or-so:
  TableVal: Unify &default and &default_insert lookups
  Add &default_insert attribute for tables
2023-08-04 12:32:06 +02:00
Arne Welzel
73a7fdad95 TableVal: Unify &default and &default_insert lookups
Introduce DefaultAttr() helper to avoid a bit of duplicated code.
2023-08-04 12:31:27 +02:00
Arne Welzel
431767d04b Add &default_insert attribute for tables
This is based on the discussion in zeek/zeek#2668. Using &default with tables
can be confusing as the default value is not inserted. The following example
prints an empty table at the end even new Service records was instantiated.

    type Service: record {
        occurrences: count &default=0;
        last_seen: time &default=network_time();
    };

    global services: table[string] of Service &default=Service();

    event zeek_init()
        {
        services["http"]$occurrences += 1;
        services["http"]$last_seen = network_time();

        print services;
        }

Changing above &default to &default_insert will insert the newly created
default value upon a missed lookup and act less surprising.

Other examples that caused confusion previously revolved around table of sets
 or table of vectors and `add` or `+=` not working as expected.

    tbl_of_vector["http"] += 1
    add tbl_of_set["http"][1];
2023-08-04 12:30:36 +02:00
Johanna Amann
81ce83590d Merge remote-tracking branch 'origin/topic/johanna/tcp-padding'
* origin/topic/johanna/tcp-padding:
  Do not forward padding to downstream TCP packet analyzer
2023-08-03 07:18:49 +01:00
Tim Wojtulewicz
d00a89a5a1 Merge remote-tracking branch 'origin/topic/timw/rename-bro-plugin'
* origin/topic/timw/rename-bro-plugin:
  Rename magic __bro_plugin__ file to __zeek_plugin__
2023-08-02 10:11:31 -07:00
Tim Wojtulewicz
1f415a7775 Rename magic __bro_plugin__ file to __zeek_plugin__ 2023-08-02 10:10:44 -07:00
Johanna Amann
940e3afab4 Do not forward padding to downstream TCP packet analyzer
This is similar to GH-3206. There do not seem to be practical
consequences - but we should still fix it.

This also includes the udp-testcase that was forgotten in GH-3206.
2023-08-02 17:17:01 +01:00
Arne Welzel
1a54e66b53 Merge branch 'topic/awelzel/3122-attribute-expression-seeds'
* topic/awelzel/3122-attribute-expression-seeds:
  UsageAnalyzer: Collect identifiers found in attributes as seeds
2023-08-02 09:52:41 +02:00
Arne Welzel
97e31bf6a1 Merge remote-tracking branch 'origin/topic/timw/refresh-ci-vm-images'
* origin/topic/timw/refresh-ci-vm-images:
  Force refresh of all CI docker images
2023-08-02 09:22:16 +02:00
Tim Wojtulewicz
59454b8184 Force refresh of all CI docker images
There's something going on with the image cache on Cirrus where the images
are sometimes vanishing from the cache, thus causing builds to fail
because it can't load them. This forces a rebuild of all of the images,
thus refreshing the cached version of all of them.
2023-08-01 12:18:59 -07:00
Tim Wojtulewicz
39ed39c30e Modbus: Add support for Encapsulation Interface Transport (FC=2B) requests and responses 2023-08-01 12:14:33 -07:00
Tim Wojtulewicz
346271d8ca Modbus: Add support for Diagnostics (FC=8) requests and responses 2023-08-01 12:14:33 -07:00
Tim Wojtulewicz
a090fb936a Merge remote-tracking branch 'origin/topic/timw/script-opt-memory-leak'
* origin/topic/timw/script-opt-memory-leak:
  Fix memory leak in script_opt's Expr code
2023-08-01 09:58:13 -07:00
Arne Welzel
ab388844bf UsageAnalyzer: Collect identifiers found in attributes as seeds
This marks every identifier used within an attribute as seeds. The scenario
this avoids is functions referenced through attributes on unused tables or
record types (&default, &expire_func, ...) being dinged as unused as
that's rather confusing.

Also adds test for the above and a light smoke test into language/ as it
doesn't appear we had coverage here.

Closes #3122
2023-08-01 15:46:10 +02:00
Tim Wojtulewicz
430d344ec2 Fix memory leak in script_opt's Expr code 2023-07-31 16:09:04 -07:00
Tim Wojtulewicz
3c7a52d0a7 Merge remote-tracking branch 'origin/topic/johanna/3205-do-not-parse-udp-padding'
* origin/topic/johanna/3205-do-not-parse-udp-padding:
  Do not forward more than the remaining data to downstream UDP analyzer
2023-07-31 15:59:59 -07:00
Arne Welzel
9c291dc397 Merge remote-tracking branch 'origin/topic/timw/refresh-windows-ci-image'
* origin/topic/timw/refresh-windows-ci-image:
  Force rebuild of windows CI image
2023-07-31 10:47:31 +02:00
Tim Wojtulewicz
190728ab40 Force rebuild of windows CI image 2023-07-28 12:40:32 -07:00
zeek-bot
85e6dff741 Update doc submodule [nomail] [skip ci] 2023-07-28 00:23:09 +00:00
Johanna Amann
a391367c36 Do not forward more than the remaining data to downstream UDP analyzer
This fixes a bug introduced in 2b9de839b0
/ GH-3080, which causes UDP padding to be sent to UDP based analyzers.

Fixes GH-3205.
2023-07-27 13:35:41 +01:00
Tim Wojtulewicz
bd75d72f3f Merge remote-tracking branch 'origin/topic/vern/zam-memory-reduction'
* origin/topic/vern/zam-memory-reduction:
  Baseline "-a zam" update
  increase BTest wait time to abide ZAM compilation times
  avoid script coverage overhead (especially memory) when using ZAM
  fixes for correctly tracking which functions have been fully inlined
  support for discarding ASTs once compiled via ZAM script optimization
  some code simplifications and streamlining
2023-07-26 14:46:23 -07:00
Vern Paxson
ed75b82b3b Baseline "-a zam" update 2023-07-26 13:32:00 -07:00
Vern Paxson
35a6efbfa7 increase BTest wait time to abide ZAM compilation times 2023-07-26 13:32:00 -07:00
Vern Paxson
2355f5af47 avoid script coverage overhead (especially memory) when using ZAM 2023-07-26 13:32:00 -07:00
Vern Paxson
3f64858335 fixes for correctly tracking which functions have been fully inlined 2023-07-26 13:32:00 -07:00
Vern Paxson
91d70e6dd4 support for discarding ASTs once compiled via ZAM script optimization 2023-07-26 13:32:00 -07:00
Tim Wojtulewicz
b3940b6db3 Merge remote-tracking branch 'origin/topic/vern/lambda-scope-tweak'
* origin/topic/vern/lambda-scope-tweak:
  fix for installing identifiers for lambdas into the global scope
2023-07-25 10:23:59 -07:00