Commit graph

5118 commits

Author SHA1 Message Date
Christian Kreibich
f2d54db694 Merge remote-tracking branch 'origin/topic/etyp/harden-flaky-test'
* origin/topic/etyp/harden-flaky-test:
  Harden flaky test based on creating a file
2025-01-10 11:15:45 -08:00
Tim Wojtulewicz
0fcbc8546e Update btests for new local-only subnets 2025-01-09 22:16:42 -07:00
Evan Typanski
34f13e7291 Harden flaky test based on creating a file
Closes #4102

Surely it won't take over 10 seconds to create the file
2025-01-09 11:06:04 -05:00
Vern Paxson
7a908a2876 Extended ZAM validation to include macros 2025-01-02 15:32:30 -08:00
Benjamin Bannier
4278ab2b04 Bump auxil/spicy to latest development snapshot 2024-12-20 15:18:20 -07:00
Tim Wojtulewicz
eb8f99da92 Require spicy for spicy.analyzer-id btest 2024-12-20 14:25:04 -07:00
Tim Wojtulewicz
fd4f25965d Add spicy runtime-support current_analyzer_id(), use it to set id in events 2024-12-18 15:44:09 -07:00
Arne Welzel
991bc9644d Merge remote-tracking branch 'origin/topic/vern/ZAM-field-assign-in-op'
* origin/topic/vern/ZAM-field-assign-in-op:
  pre-commit: Bump spicy-format to 0.23
  fix for ZAM optimization of assigning a record field to result of "in" operation
2024-12-18 09:28:44 +01:00
Vern Paxson
6e549554b8 fix for ZAM optimization of assigning a record field to result of "in" operation 2024-12-17 19:49:43 -08:00
Tim Wojtulewicz
6b5d0491aa Return a warning and fail if creating a store at global scope 2024-12-17 11:32:43 -07:00
Tim Wojtulewicz
33eaa5ccda Merge remote-tracking branch 'origin/topic/awelzel/4084-vector-of-pattern-compare'
* origin/topic/awelzel/4084-vector-of-pattern-compare:
  ZAM/relexpr-op NE for patterns
  Expr: Fix folding of pattern values to support == and !=
2024-12-16 12:37:46 -07:00
Vern Paxson
30de8dbea1 ZAM/relexpr-op NE for patterns 2024-12-16 19:56:57 +01:00
Arne Welzel
cd8adb3da5 Expr: Fix folding of pattern values to support == and !=
The fatal error is actually triggered at runtime, so it's a bit
dangerous for users, but not sure there's many use-cases to
compare vectors of patterns.

Closes #4084
2024-12-16 10:56:02 +01:00
Arne Welzel
7bdc856f0d QUIC/decrypt_crypto: Actually check if decryption was successful
...and bail if it wasn't.

PCAP was produced using OSS-Fuzz input from issue 383379789.
2024-12-15 20:39:26 -07:00
Tim Wojtulewicz
db3dcd5ff9 Start of 7.2.0 development 2024-12-13 13:38:53 -07:00
Tim Wojtulewicz
ee6d1374ba Merge remote-tracking branch 'origin/topic/vern/ZAM-assert-streamlining'
* origin/topic/vern/ZAM-assert-streamlining:
  btest/supervisor: Bump one timeout to 30 seconds
  btest/cluster: Bump timeouts to 30 seconds
  btest/validate-ZAM: Update baseline, run always
2024-12-13 12:17:45 -07:00
Arne Welzel
a675aea6bb btest/supervisor: Bump one timeout to 30 seconds 2024-12-13 18:35:39 +01:00
Arne Welzel
21e33fdcd9 btest/cluster: Bump timeouts to 30 seconds
ZAM startup may take a long time, particularly in CI environments, so
bump it up from 10 to 30 seconds.
2024-12-13 18:28:43 +01:00
Arne Welzel
48b26f74f7 btest/validate-ZAM: Update baseline, run always 2024-12-13 18:25:28 +01:00
Arne Welzel
9c5c8b55cc Merge remote-tracking branch 'origin/topic/vern/CPP-standalone-fixes'
* origin/topic/vern/CPP-standalone-fixes:
  BTest updates in support of compiling-scripts-to-C++
  -O gen-standalone-C++ fixes for recent more aggressive AST profiling
2024-12-13 10:57:28 +01:00
Vern Paxson
85ef6e0cb8 removed a bunch of no-longer used BTest alternatives and their associated baselines 2024-12-12 19:16:34 -08:00
Vern Paxson
8876ec6f2d BTest updates in support of compiling-scripts-to-C++ 2024-12-12 14:30:23 -08:00
Tim Wojtulewicz
25554fa668 Merge remote-tracking branch 'origin/topic/awelzel/fix-cluster-publish-any'
* origin/topic/awelzel/fix-cluster-publish-any:
  cluster/Backend: Handle unspecified table/set
  cluster: Fix Cluster::publish() of Broker::Data
  cluster: Be noisy when attempting to connect to an unknown node
2024-12-12 13:17:08 -07:00
Arne Welzel
fdf783df65 cluster/Backend: Handle unspecified table/set
Same as what we do in Broker. Use the expected type if publishing
a table() or set() parameter.

This fixes issues when switching sumstats to Cluster::publish()
2024-12-12 17:54:42 +01:00
Arne Welzel
d9a74cf32d cluster: Fix Cluster::publish() of Broker::Data
The broker serializer leverages the existing data_to_val() function.
During unserialization, if the destination type is any, the logic
simply wraps the broker::data value into a Broker::Data record.
Therefore, events with any parameters are currently exposed to
the Broker::Data type.

There is a bigger issue in that re-publishing such Broker::Data
instances would encode them as a normal record. Explicitly prevent
this by serializing the contained data value directly instead, similar
to what Broker already did when publishing a record.
2024-12-12 17:54:37 +01:00
Arne Welzel
271fc15041 cluster: Be noisy when attempting to connect to an unknown node
Mostly due to spending too much time wondering why nodes didn't connect
when there was a mismatch between "manager" and "manager-1" in the
cluster layout. Remove manager from test-all-policy-cluster test to
avoid connection attempts in this test.
2024-12-12 13:01:04 +01:00
Christian Kreibich
235638815f Fix ZAM's implementation of Analyzer::name() BiF
ZAM's implementation deviates from Zeek's in consideration of remappings, which
means that running ZAM produced conn.log service names prefixed with "spicy_"
whereas regular Zeek doesn't.
2024-12-11 23:16:47 -08:00
Tim Wojtulewicz
49f82b325b Swap pre-commit yapf for ruff/ruff-format, fix findings 2024-12-11 11:08:37 -07:00
Arne Welzel
85189ca918 btest: Avoid loading ZeroMQ if not compiled in
...at the same time, add some `TEST-REQUIRES: have-zeromq` which
unfortunately means that developers will usually want libzmq
installed on their system.
2024-12-11 18:08:43 +01:00
Arne Welzel
c6c6d88b4c btest/coverage: Avoid warnings in test-all-policy-cluster 2024-12-11 17:20:45 +01:00
Arne Welzel
0ad3210177 Broker::publish: Warn on using Broker::publish() when inactive
This is mostly for transitioning base scripts to Cluster::publish() and
avoid silent surprises why certain things don't work when using ZeroMQ.
2024-12-11 17:20:42 +01:00
Arne Welzel
f674fc2634 Merge remote-tracking branch 'origin/topic/timw/update-zeek-testing'
* origin/topic/timw/update-zeek-testing:
  Update zeek-testing and zeek-testing-cluster commit hashes
2024-12-11 13:19:33 +01:00
Arne Welzel
4ee2f9256b Merge remote-tracking branch 'origin/topic/awelzel/pluggable-cluster-backends-part4'
* origin/topic/awelzel/pluggable-cluster-backends-part4:
  Update ZAM BiF-tracking
  configure: Add --disable-cluster-backend-zeromq
  CMakeLists: Cluster backends output
  zeromq: Conditionally enable by default
  btest/generic: Add publish_hrw(), publish_rr() and logging tests
  generate-docs: Run on Ubuntu 24.04, add cppzmq
  docker: Add cppzmq/libzmq dependencies
  tsan_suppressions: Add called_from_lib: libzmq
  ci: Add cppzmq and libzmq to most platforms
  cluster/backend/zeromq: Add ZeroMQ based cluster backend
  cluster/backend/zeromq: Add cppzmq submodule
  cluster: Add Cluster::node_id(), allow redef of node_topic(), nodeid_topic()
  cluster: Move publish_hrw() and publish_rr() to cluster.bif
2024-12-11 09:52:41 +01:00
Tim Wojtulewicz
0701895132 Merge remote-tracking branch 'J-Gras/topic/jgras/add-unknown-proto-count'
* J-Gras/topic/jgras/add-unknown-proto-count:
  Add btest for unknown_protocols.log
  Add protocol_id count to unknown protocol record
2024-12-10 16:16:12 -07:00
Tim Wojtulewicz
f61ba4df29 Update zeek-testing and zeek-testing-cluster commit hashes 2024-12-10 16:13:00 -07:00
Arne Welzel
759281dabd Update ZAM BiF-tracking 2024-12-10 20:35:41 +01:00
Arne Welzel
d816bfb249 btest/generic: Add publish_hrw(), publish_rr() and logging tests
They currently use zeromq, but technically they should be valid for
any other backend, too, even broker.
2024-12-10 20:33:02 +01:00
Arne Welzel
35c79ab2e3 cluster/backend/zeromq: Add ZeroMQ based cluster backend
This is a cluster backend implementation using a central XPUB/XSUB proxy
that by default runs on the manager node. Logging is implemented leveraging
PUSH/PULL sockets between logger and other nodes, rather than going
through XPUB/XSUB.

The test-all-policy-cluster baseline changed: Previously, Broker::peer()
would be called from setup-connections.zeek, causing the IO loop to be
alive. With the ZeroMQ backend, the IO loop is only alive when
Cluster::init() is called, but that doesn't happen anymore.
2024-12-10 20:33:02 +01:00
Arne Welzel
210b54799e cluster: Move publish_hrw() and publish_rr() to cluster.bif
From this point on, Cluster::publish_hrw() and Cluster::publish_rr()
go through cluster/Backend.cc code.
2024-12-10 20:33:02 +01:00
Arne Welzel
7449b050b3 Update BiF-tracking, add get_current_packet_ts()
Also, run the ZAM-bif-tracking test in non-ZAM environments so
failures are caught immediately. There's nothing overly ZAM specific about
running this test.

I'm not sure I like the fact that any new contributor adding a BiF
will need to dig into this... it might be a bit intimidating.
2024-12-10 20:07:56 +01:00
Arne Welzel
77465a90b5 Merge remote-tracking branch 'jgras/topic/jgras/fix-packet-lag'
* jgras/topic/jgras/fix-packet-lag:
  Introduce get_packet_lag()
  Add btest for get_current_packet_ts()
  Introduce get_current_packet_ts to fix packet lag
2024-12-10 18:26:54 +01:00
Jan Grashoefer
1805afe5d9 Add btest for unknown_protocols.log 2024-12-10 14:54:19 +01:00
Arne Welzel
9034e135d1 Merge remote-tracking branch 'origin/topic/awelzel/fix-dns-binds-complte-typo'
* origin/topic/awelzel/fix-dns-binds-complte-typo:
  DNS/dns_binds_rr: Fix complte to complete typo, switch to count
2024-12-10 09:57:00 +01:00
Christian Kreibich
1c42bfc715 Merge branch 'topic/christian/disconnect-slow-peers'
* topic/christian/disconnect-slow-peers:
  Bump cluster testsuite to pull in Broker backpressure tests
  Expand documentation of Broker events.
  Add sleep() BiF.
  Add backpressure disconnect notification to cluster.log and via telemetry
  Remove unneeded @loads from base/misc/version.zeek
  Add Cluster::nodeid_to_node() helper function
  Support re-peering with Broker peers that fall behind
  Add Zeek-level configurability of Broker slow-peer disconnects
  Bump Broker to pull in disconnect feature and infinite-loop fix
  No need to namespace Cluster:: functions in their own namespace
2024-12-09 23:33:35 -08:00
Tim Wojtulewicz
6e75417032 Merge remote-tracking branch 'origin/topic/vern/CPP-streamlining'
* origin/topic/vern/CPP-streamlining:
  BTest baseline updates for compile-to-C++
  mark ZAM regression BTests as not suitable for compile-to-C++
  fix for -O gen-C++ maintenance helper to skip BTest intermediary files
  introduced simplified initialization for non-standalone -O gen-C++ code tied -O gen-standalone-C++ to use of --optimize-files
  streamline generated -O C++ code by relying on per-function profiles rather than aggregate profile
  when reporting available/unavailble C++ script bodies, flag those that are skipped
  modified AST profiling to mark (and fully skip) non-optimizable functions
  modified merge_types() to skip work if given identical types, which also preserves type names (useful for -O gen-C++)
2024-12-09 12:16:00 -07:00
Tim Wojtulewicz
832b9b6cf0 Merge remote-tracking branch 'origin/topic/timw/python-magic-numbers'
* origin/topic/timw/python-magic-numbers:
  Move python signatures to a separate file
  Add signatures for Python bytecode for 3.8-3.14
2024-12-09 12:09:20 -07:00
Tim Wojtulewicz
ccefd66d37 Move python signatures to a separate file 2024-12-09 11:08:30 -07:00
Arne Welzel
f6c44e3f7a DNS/dns_binds_rr: Fix complte to complete typo, switch to count
From my reading in the docs the complete_flag should only ever be a
single byte, so add a weird for when it is longer, but use count
as the new type.
2024-12-09 19:02:28 +01:00
Jan Grashoefer
6977c07a25 Add btest for get_current_packet_ts() 2024-12-09 16:39:38 +01:00
Arne Welzel
99989b8055 Disable CTU-SME test under TSAN 2024-12-09 09:26:42 +01:00