A race condition could cause unstable output: if the thread reading the
file is fast, often you see both "pred" functions execute and then both
"line" events execute with both entries already in the table, but if the
thread reading the file is slow, you see pred, event, pred, event, with
only one entry available in the first event.
The order in which &expire_func's get called isn't well-defined, so
separate the output from either to ensure diffs against the Baseline are
always consistent.
* max/optimize:
plugin/Manager: migrate to std::string_view
util: optimize the normal_path() common case
util: pass string_view to without_bropath_component()
module_util: make GLOBAL_MODULE_NAME constexpr
Scope: convert Scope::Lookup() and others to template
Scope: Vars() returns const reference
Anon: remove unnecessary {map,vector}::clear() calls
Dict: make the destructor non-virtual
Obj: make the Location constructors `constexpr`
Obj: remove unused fields Location::{timestamp,text}
Obj: remove Location::delete_data, nobody ever sets it
Obj: make the Location destructor non-virtual
* origin/topic/johanna/table-on-change:
&on_change: Address feedback of Jon.
&on_change: incooperate feedback of Jon.
&on_change wrapup: documentation, tests, whitespacing
Table expiry now raises &on_change handlers
Prevent recursion of &on_change handlers.
Make bro_broker::val_to_data take a const Val* instead of a Val
&on_change: add insertion/change notifications.
&on_change working for removals from tables.
Change signature of &on_change handler
Beginning implementation of &on_change for tables.
threading::Manager is currently never deleted, but if that ever changes,
deleting the stored HeartbeatTimer pointer would be a double-free
since TimerMgr owns it.
- Also removed the setting of BinPAC_ROOT_DIR in the configure
script's --with-binpac= option as that breaks the cross-compilation
use-case
* 'master' of https://github.com/ffontaine/zeek:
CMakeLists.txt: fix cross-compilation with binpac
* origin/topic/timw/ioloop-followup:
Increase timeout value for live interfaces without file descriptors
Use ranged-for loops in a few places in iosource Manager
Change order of includes in iosource Manager, fixes build on FreeBSD 11
- Minor changes in merge: extended unit test, prefer emplace_back(),
remove unused "found" count in new function
* 'optimize_normalize_path' of https://github.com/MaxKellermann/zeek:
util: add a tokenize_string() overload which returns string_views
util: store std::string_view in "final_components" vector
util: use "auto" in normalize_path()
util: reserve space in normalize_path()
util: skip "." completely in normalize_path()
util: pass std::string_view to normalize_path()
util: pass std::string_view to tokenize_string()
util: don't modify the input string in tokenize_string()
* origin/topic/timw/264-alternative:
Add better error messaging when RegisterFd/UnregisterFd fail
Update Supervisor code for the new IOSource API
Show percentage of packets dropped in the final process output
Update NEWS and docs submodule
Remove concept of multiple timer managers
Test changes caused by minor order-of-operation changes related to the new loop architecture
Have terminate_processing() raise SIGTERM instead of calling the signal handler directly
PktSrc iosource changes to match the new IOSource API
Broker manager changes to match the new IOSource API and loop architecture
DNS_Mgr changes to match the new IOSource API and loop architecture
Threading changes for the new loop architecture
Add Trigger manager for managing triggers created by things like 'when' statements
Make TimerMgr an IOSource
Modify IOSource Manager to implement new loop architecture
Minor amount of code cleanup in Pcap IO source
IOSource API changes for new loop architecture
Type and variable usage cleanup in Net.h
Remove #include of some iosource files from Net.h
Only allow a single trace file (-r) or interface (-i) option on the command-line
Remove CQ_TimerMgr in favor of PQ_TimerMgr
During merge I split the test for bro_init/bro_done/bro_script_loaded
event errors into individual tests since the other testing of the zeek
versions of those events seemed fine to otherwise keep.
* origin/topic/robin/631-deprecation-v2:
Update NEWS for naming changes.
Small cleanup and updating submodules.
Remove test for legacy plugin.
Remove legancy symlinks in aux/.
Add warnings when loading scripts ending in ".bro", or using legacy environment variables.
Fix missing rename.
No longer symlink local.zeek to local.bro.
Update notice user agent.
Remove old_comm_usage_is_ok.
Remove bro-config.h.in and bro-path-dev.in.
Change Bro wrapper script to now abort when old executable names are still used.
Remove APIs that were explicitly deprecated to be removed in 3.1.
* origin/topic/jsiwek/supervisor: (44 commits)
Add note that Supervisor script APIs are unstable until 4.0
Move command-line arg parsing functions to Options.{h,cc}
Add btests for supervisor stem/leaf process revival
Move supervisor control events into SupervisorControl namespace
Fix supervisor "destroy" call on nodes not currently alive
Move supervisor source files into supervisor/
Address supervisor code re-factoring feedback from Robin
Convert supervisor internals to rapidjson
Add Supervisor documentation
Add supervisor btests
Improve logging of supervised node errors
Fix supervised node inheritence of command-line script paths
Improve normalize_path() util function
Use a timer to check for death of supervised node's parent
Improve supervisor checks for parent process termination
Improve handling of premature supervisor stem exit
Improve supervisor signal handler safety
Remove unused supervisor config options
Cleanup minor Supervisor TODOs
Improve supervisor debug logging
...
- Removed the superfluous check for C++17 in the merge since that's
a requirement enforced at the CMake-level.
* 'getrandom' of https://github.com/MaxKellermann/zeek:
util: use getrandom() on Linux if available
* 'topic/frerich/gh-750-uri-with-empty-portnum' of https://github.com/frerich/zeek:
Document recent fix for decompose_uri in release notes
Fixed decompose_uri choking on URIs with empty port component
Adding test for decompose_uri parsing URI with empty port
* origin/topic/timw/bit-fields:
Use bools instead of single-bit bitfields in Ident and TCP protocol analyzers
Bit of code-modernization cleanup in BroString
Use fixed types in NetbiosSSN.h and Timer.h instead of bit fields
