Commit graph

9777 commits

Author SHA1 Message Date
Christian Kreibich
96384be689 af_packet: Avoid Zeek script double-loading problems
The plugin mechanism automatically picks up the scripts folder for
plugin-related Zeek scripts. When a package's zkg.meta also declares the scripts
folder the location for package-level scripts, the scripts get installed
redundantly in two places. Zeek cannot recognize them as duplicates, triggering
various errors relating to double-defined symbols.

This moves the package-level scripts to a subdirectory with a placeholder. The
placeholder avoids the zkg install-time warning, whose original fix in e3aea1
introduced this problem.
2025-08-20 08:52:25 -07:00
Jan Grashoefer
74f9d11776 af_packet: Fix Zeek version dependency. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
e945e2c8bb af_packet: Increase version number. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
45b3dbf267 af_packet: Slightly reorder README. 2025-08-20 08:52:25 -07:00
Johanna Amann
e4aa85d2a6 af_packet: Add FANOUT_CBPF and FANOUT_EBPF 2025-08-20 08:52:25 -07:00
Michael Dopheide
79842b25c1 af_packet: Namespace changes adding zeek:: as well as zeek/ prefix for include files. 2025-08-20 08:52:25 -07:00
Vlad Grigorescu
e3c5865684 af_packet: GetFanoutMode: Fix case statement (missing breaks).
Without this, you can't actually set the fanout mode to anything but HASH.
2025-08-20 08:52:25 -07:00
Jan Grashoefer
62356c38dd af_packet: Fixed test baseline to include defrag option. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
130f7f7272 af_packet: Increase version number. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
4deb8f6402 af_packet: Add support for defragmentation of IP packets. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
57dd239917 af_packet: Increase version number. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
8aa35fed6f af_packet: Add upgrade note to README. 2025-08-20 08:52:25 -07:00
Tim Wojtulewicz
8d0bc4a804 af_packet: Add some missing includes due to changes in Zeek 3.1 2025-08-20 08:52:25 -07:00
Tim Wojtulewicz
a7195a7a75 af_packet: File naming and build system changes to support deprecation changes in Zeek 3.0 2025-08-20 08:52:25 -07:00
Jan Grashoefer
1f1627ad73 af_packet: Increased version number. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
5e3ae6227b af_packet: Updated README. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
eb3dc4b563 af_packet: Include info files for distribution. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
9cc01769b4 af_packet: Minor improvements to fix compiler warnings. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
b6e52b262c af_packet: Increased version number. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
4eaa201821 af_packet: Updated README regarding --with-latest-kernel. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
3adaef434b af_packet: Added buffer_size option to broctl plugin.
The buffer size can now be set in node.cfg using the
af_packet_buffer_size key.
2025-08-20 08:52:25 -07:00
Jan Grashoefer
a89379c353 af_packet: Added bro-pkg instructions to the README. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
1a107bd838 af_packet: Increased version number. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
1dfb115e35 af_packet: Fixed broctl example. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
478265b4f2 af_packet: Fixed compatibility for kernel versions < 3.14. 2025-08-20 08:52:25 -07:00
Jan Grashoefer
742b0820bc af_packet: Imported version 1.1 of the plugin. 2025-08-20 08:52:25 -07:00
Evan Typanski
111583602e Fix Coverity issue with new Attributes ctor 2025-08-20 08:28:18 -04:00
Arne Welzel
c44ce78591 logging/Manager: Also pass non-null vector and set
Primarily to align with strings and also to keep the plugin
API the same.
2025-08-19 20:04:08 +02:00
Arne Welzel
247931f2df logging/Manager: Non-null strings for empty strings
After #4724, empty strings would result in nullptrs being stored in the
threading::Value's string_val.data field instead of a valid pointer to
an empty strings. This upsets UBSAN's  nonnull check for memcpy()

    [01:29:45.807]   ../../src/SerializationFormat.cc:80:33: runtime error: null pointer passed as argument 2, which is declared to never be null
    [01:29:45.807]   /usr/include/string.h:44:28: note: nonnull attribute specified here
    [01:29:45.807]       #0 0x5b2e9c933a3f in zeek::detail::SerializationFormat::WriteData(void const*, unsigned long) /zeek/build/src/../../src/SerializationFormat.cc:80:5
    [01:29:45.807]       #1 0x5b2e9c935184 in zeek::detail::BinarySerializationFormat::Write(char const*, int, char const*) /zeek/build/src/../../src/SerializationFormat.cc:371:40

Continue to allocate the empty string for now as a fix.
2025-08-19 20:03:23 +02:00
Tim Wojtulewicz
18b3303b54 Add a missing header for the broker cluster serializer 2025-08-18 14:00:24 -07:00
Evan Typanski
59e84e06f6 Merge remote-tracking branch 'origin/topic/etyp/fix-optional-attr-errors'
* origin/topic/etyp/fix-optional-attr-errors:
  Fix parameter attributes pretending to be records
  Only allow `&optional` in records
2025-08-18 14:49:56 -04:00
Arne Welzel
8d0a942101 cluster/serializer/broker: Drop unused include 2025-08-18 14:52:21 +02:00
Arne Welzel
f4e7c4afe8 cluster/serializer/broker: fixup inconsistent param comment
Thanks clang-tidy.

References #4754 #4756
2025-08-18 14:51:40 +02:00
Arne Welzel
c0a863cba0 Merge remote-tracking branch 'origin/topic/vern/stmt-line-numbers'
* origin/topic/vern/stmt-line-numbers:
  maintenance updates for ZAM BiF-tracking
  fix line numbers associated with "if" and initialization statements
2025-08-17 17:29:09 +02:00
Arne Welzel
f57a1263d4 cluster/serializer/broker: Do not special case Broker::Data anymore
The previous approach ignored the fact that nested / inner values might
also be Broker::Data values. I'm not super sure about the validity of
the test, because it's essentially demonstrating any-nesting, but
it's not leading to extra Broker::Data encoding.
2025-08-17 16:56:20 +02:00
Arne Welzel
9e70d8b8ad broker/Data: Support unwrapping Broker::Data records
Calling val_to_data() on a Broker::Data ends up wrapping the
Broker::Data record instead of using the contained broker::value
directly.

Seems this should be the default behavior and wonder if the flag
even makes sense, but for a 8.0 backport that seems more reasonable.
2025-08-17 16:56:20 +02:00
Vern Paxson
5b74b3d0ac maintenance updates for ZAM BiF-tracking 2025-08-16 14:10:17 -07:00
Vern Paxson
46d0b55417 fix line numbers associated with "if" and initialization statements 2025-08-16 14:09:32 -07:00
Tim Wojtulewicz
e64ec54172
Revert "Move BinPAC, bifcl, af_packet, and gen_zam submodules into main zeek repo" 2025-08-15 15:11:22 -07:00
Tim Wojtulewicz
a1f5f0a40e Fix some clang-tidy findings in generated BIF code 2025-08-15 13:57:27 -07:00
Tim Wojtulewicz
5ccf64102b Move zeek-af_packet-plugin code into the main Zeek repository
This is based on commit b89a6f64123f778090d1dd6ec48e6b8e8906ea11 from
the zeek-af_packet-plugin repository.
2025-08-15 13:57:27 -07:00
Evan Typanski
4445bc1daf Fix parameter attributes pretending to be records
Parameters relied on is_record for a couple of validations, but they are
not records and should not be treated as such. This way we can validate
&optional better.
2025-08-14 12:00:15 -04:00
Evan Typanski
4e5a56c5e0 Only allow &optional in records
There was some confusing behavior with &optional and locals, so this
should get rid of that by making it an error. However, there is a case
where function parameters are still allowed to have &optional - this is
because there are checks for &default in parameters as well.
2025-08-14 11:38:19 -04:00
Tim Wojtulewicz
39814816af Tag truncated values with a flag, plus pack threading::Value better 2025-08-12 17:31:29 -07:00
Tim Wojtulewicz
29425688da Make total_size counter a member in logging::Manager 2025-08-12 17:31:29 -07:00
Tim Wojtulewicz
98a77b5f25 Remove using numeric_limits and just check for zero instead 2025-08-12 17:31:29 -07:00
Tim Wojtulewicz
0ec2161b04 Add options to filter at the stream level as well as globally 2025-08-12 17:31:28 -07:00
Tim Wojtulewicz
339d46ae26 Add a weird that gets emitted when strings/containers are over the limits 2025-08-12 17:31:28 -07:00
Tim Wojtulewicz
837fde1a08 Add metrics to track string and container fields limited by length 2025-08-12 17:31:28 -07:00
Tim Wojtulewicz
cd74a4e138 Replace unused stream argument from RecordToLogRecord with WriterInfo
This also adds a WriterInfo argument to ValToLogVal and passes the one from
RecordToLogRecord into it.
2025-08-12 17:31:28 -07:00