Commit graph

2206 commits

Author SHA1 Message Date
Jon Siwek
6184a495f0 Update embedded CAF in Broker to 0.17.2 2019-10-21 09:35:25 -07:00
Johanna Amann
50f7969e15 Merge remote-tracking branch 'origin/topic/neverlord/select-cmake'
* origin/topic/neverlord/select-cmake:
  Fix check for cmake commands on POSIX shells
  Prefer cmake3 command, add --cmake=PATH option
2019-10-21 11:43:10 +02:00
Johanna Amann
af76637c96 Update zeekctl submodule pointer.
This changes the gzip compression level to the default from 9.

Fixes GH-614

 [nomail]
2019-10-17 16:33:37 -07:00
Jon Siwek
1a4aeb91e2 Merge remote-tracking branch 'origin/topic/jsiwek/update-pybind11'
* origin/topic/jsiwek/update-pybind11:
  Update broker submodule to use pybind11 v2.4.3
2019-10-16 10:03:35 -07:00
Johanna Amann
5265613a9e Merge remote-tracking branch 'origin/topic/jsiwek/gh-618-tcp-option-values'
* origin/topic/jsiwek/gh-618-tcp-option-values:
  Add weirds for invalid TCP option lengths
  GH-618: add "tcp_options" event containing TCP option values
  Fix tcp_option event
2019-10-15 16:50:43 -07:00
Johanna Amann
f62a51b41b Merge remote-tracking branch 'origin/topic/jsiwek/fix-table-default-redef'
* origin/topic/jsiwek/fix-table-default-redef:
  Fix redef'ing a table with a new &default attribute
2019-10-14 22:06:35 -07:00
Johanna Amann
66effde97d Merge remote-tracking branch 'origin/topic/seth/624'
* origin/topic/seth/624:
  Support whitespace at end of line for config reader.

This merge fixes a failing test; it also sprinkles a few more spaces
into another test file.

The main change is that this now also works with configuration lines
that don't have a value.
2019-10-14 21:47:59 -07:00
Johanna Amann
705210a035 Merge remote-tracking branch 'origin/topic/dev/bugrpone-narrowing-conversions-base64'
* origin/topic/dev/bugrpone-narrowing-conversions-base64:
  Proof of Concept on Bugprone Narrowing Conversions: Base64

I fixed a few bugs in this while merging; Decode now signals success or
error (which did not work before). I removed the new variables in
mime.cc and just switched more to size_t - the new variables introduced
a bug because they shadowed the changes of the Decode call.

GH-616
2019-10-14 20:19:02 -07:00
Jon Siwek
6a99567a79 Merge remote-tracking branch 'origin/topic/jsiwek/travis-dist-trusty'
* origin/topic/jsiwek/travis-dist-trusty:
  Use Ubuntu 14.04 for Travis CI environment
2019-10-12 10:40:55 -07:00
Johanna Amann
916205e254 Merge remote-tracking branch 'origin/topic/jsiwek/print-raw-bif'
* origin/topic/jsiwek/print-raw-bif:
  Add new BIF: print_raw()
2019-10-08 15:15:55 -07:00
Johanna Amann
e615d1f4a8 Merge remote-tracking branch 'origin/topic/jsiwek/gh-589-sub-microsecond-printing'
* origin/topic/jsiwek/gh-589-sub-microsecond-printing:
  GH-589: improve printing of sub-microsecond intervals
2019-10-07 10:51:40 -07:00
Johanna Amann
09f4053dbc Merge remote-tracking branch 'origin/topic/jsiwek/gh-591-set-enum-config'
* origin/topic/jsiwek/gh-591-set-enum-config:
  GH-591: allow Config::set_value() to use empty/unspecified table/sets
  GH-591: fix reading set[enum] values from input files
2019-10-07 10:46:45 -07:00
Jon Siwek
8ba19cd7d1 Merge remote-tracking branch 'origin/topic/neverlord/issue/612'
* origin/topic/neverlord/issue/612:
  Fix build with external CAF but bundled Broker
2019-10-02 11:04:47 -07:00
Jon Siwek
a5d71ed2d2 Merge remote-tracking branch 'origin/topic/timw/595-json-perf'
* origin/topic/timw/595-json-perf:
  Update COPYING.3rdparty
  Use json::emplace to avoid some extra calls to operator[]
  Use tessil/unordered-map instead of nlohmann/fifo-map to mitigate performance issues when logging JSON
2019-10-01 16:42:59 -07:00
Robin Sommer
e263589140 Merge remote-tracking branch 'origin/topic/jsiwek/fix-to-json-record-leak'
* origin/topic/jsiwek/fix-to-json-record-leak:
  Improve RecordVal JSON formatting
  Fix memory leak in RecordVal JSON formatting
2019-10-01 09:06:30 +00:00
Johanna Amann
1b02aebe4e Merge remote-tracking branch 'origin/topic/jsiwek/paraglob-headers'
* origin/topic/jsiwek/paraglob-headers:
  GH-602: fix paraglob header inclusion, installation, and search paths
2019-09-30 21:10:12 -07:00
Jon Siwek
97519e4350 Merge remote-tracking branch 'origin/topic/timw/606-json-nulls'
* origin/topic/timw/606-json-nulls:
  GH-606: Output nulls into json data if a field isn't set
2019-09-30 17:40:27 -07:00
Jon Siwek
1253a61340 Simplify reassembly code using DataBlockList::LastBlock() 2019-09-24 10:26:09 -07:00
Robin Sommer
e30035910e Add missing commit to previous merge.
(This was a leftover from a merge conflict.)
2019-09-24 10:32:40 +00:00
Robin Sommer
c23764483d Merge remote-tracking branch 'origin/topic/jsiwek/reassembly-improvements-map'
* origin/topic/jsiwek/reassembly-improvements-map:
  Rename a reassembly DataBlockList function
  Add comments to reassembly classes
  Use DataBlock value instead of pointer in reassembly map
  Remove linked list from reassembly data structures
  Use an std::map for reassembly DataBlock searches
  Refactor Reassembler/DataBlock bookkeeping
  Reorganize reassembly data structures
  Remove a superfluous reassembler DataBlock member
2019-09-24 09:16:51 +00:00
Jon Siwek
916491e2b4 Merge remote-tracking branch 'origin/topic/neverlord/scaffolding'
* origin/topic/neverlord/scaffolding:
  Fix second overly specific include_directories
  Add --build-dir as alias for --builddir
  Fix overly specific include_directories usage
2019-09-23 13:09:04 -07:00
Jon Siwek
bd6f89da05 Merge remote-tracking branch 'origin/topic/robin/cid-1402823'
- Fixed a reference counting issue

* origin/topic/robin/cid-1402823:
  Fix for CIDs 1402823 and 1394050.
2019-09-20 10:42:58 -07:00
Jon Siwek
0a2d84284c Update header include guard in zeek-config.h/bro-config.h 2019-09-19 16:41:04 -07:00
Jon Siwek
aeef4bf030 Merge branch 'topic/jgras/dpd-late-match' of https://github.com/J-Gras/zeek
* 'topic/jgras/dpd-late-match' of https://github.com/J-Gras/zeek:
  Improve dpd_late_match event generation.
  Improve logging of speculative service.
  Update test-all-policy script.
  Add speculative service script.
  Allow to handle late DPD matches.
2019-09-17 11:17:41 -07:00
Robin Sommer
6f9d1ec72d Merge remote-tracking branch 'origin/topic/jsiwek/gh-566-fix-ssh-encrypted-packet'
* origin/topic/jsiwek/gh-566-fix-ssh-encrypted-packet:
  GH-566: fix cases where ssh_encrypted_packet event wasn't raised
2019-09-17 17:22:27 +00:00
Jon Siwek
1affbad4b7 Merge remote-tracking branch 'origin/topic/neverlord/header-guards'
* origin/topic/neverlord/header-guards:
  Switch from header guards to pragma once
2019-09-17 10:09:04 -07:00
Jon Siwek
b19ffba25f Merge branch 'patch-1' of https://github.com/dcode/zeek
* 'patch-1' of https://github.com/dcode/zeek:
  Add additional 3rd party headers to includes
2019-09-17 09:33:46 -07:00
Jon Siwek
83180a2553 Merge remote-tracking branch 'origin/topic/timw/coverity-fixes'
* origin/topic/timw/coverity-fixes:
  Add move assignment operator to logging::Tag (Coverity 1357732)
  Throw an error during input::Manager::CreateTableStream if val is null (Coverity 1402730)
  Use ntohl instead of manually swapping bytes in extract_XDR_uint32 (Coverity 1375796 and others)
  Add check for null init variable during make_var. (Coverity 1403419)
  Remove dead check in Val::check_and_promote. (Coverity 1401810)
  Handle failure of fcntl in Pipe. (Coverity 1241934, 1241935)
  Initialize missing field in File. (Coverity 1057851, 1057852, 1057853)
  Add null check for results of dynamic_cast in AssignExpr::TypeCheck. Fixes coverity findings 1403416 and 1403417
  Add null check when getting key size for List types. Fixes coverity finding 1058242
2019-09-16 17:15:32 -07:00
Jon Siwek
9c8db5f6ca Stop loading scan detection in local.zeek by default 2019-09-16 10:51:50 -07:00
Jon Siwek
f6f471f4b7 Update Broker include dir search path
Related to https://github.com/zeek/broker/issues/51
2019-09-04 16:29:04 -07:00
Jon Siwek
c88568db4d Update embedded CAF to 0.17.1 (plus cherry-picked memory leak fix) 2019-09-04 13:42:55 -07:00
Jon Siwek
655c142d01 Merge branch 'patch-2' of https://github.com/The-Alchemist/zeek
* 'patch-2' of https://github.com/The-Alchemist/zeek:
  fix another minor typo
2019-09-03 10:36:16 -07:00
Jon Siwek
39161e2192 CID 1404734: fix NetSessions::MemoryAllocation() 2019-08-29 13:06:09 -07:00
Johanna Amann
bb98559c0d Merge remote-tracking branch 'origin/topic/jsiwek/gh-545-weird-addl'
* origin/topic/jsiwek/gh-545-weird-addl:
  GH-545: add "addl" parameter to flow_weird and net_weird events
2019-08-28 14:27:53 -07:00
Jon Siwek
289a1e2e8e Merge branch '555-smb3-negotiate-context-fix' of https://github.com/mad/zeek
- Fixed the context list padding to only be used for dialect 0x0311.
  The new test case includes an example where parsing the optional
  padding would fail for another dialect.

* '555-smb3-negotiate-context-fix' of https://github.com/mad/zeek:
  Fix for smb3 negotiate context
2019-08-27 10:08:42 -07:00
Jon Siwek
08cdc0871f Merge remote-tracking branch 'origin/topic/timw/main-cleanup'
* origin/topic/timw/main-cleanup:
  main: Properly close down SSL/sqlite at shutdown if net_run never started up
  main: Finish processing program arguments before setting up SSL/sqlite
2019-08-26 14:59:56 -07:00
Jon Siwek
0699b28893 Merge remote-tracking branch 'origin/topic/seth/github-ident-flex'
* origin/topic/seth/github-ident-flex:
  Make github identify our Flex source correctly.
2019-08-23 14:31:51 -07:00
Jon Siwek
48873570b5 Updating submodule(s).
[nomail]
2019-08-23 06:37:27 -04:00
Robin Sommer
8ab0650c1e Merge remote-tracking branch 'origin/topic/jsiwek/gh-532-improve-disable-analyzer'
Includes fix for potential iterator invalidation during iteration.

* origin/topic/jsiwek/gh-532-improve-disable-analyzer:
  GH-532: improve disable_analyzer BIF
2019-08-16 18:46:35 +00:00
Jon Siwek
6255ab6584 Fix misc. Coverity warnings 2019-08-14 16:19:56 -07:00
Jon Siwek
47235b57a6 Merge remote-tracking branch 'origin/topic/timw/deprecate-int-types'
* origin/topic/timw/deprecate-int-types:
  Deprecate the internal int/uint types in favor of the cstdint types they were based on

Merge adjustments:
  * A bpf type mistakenly got replaced (inside an unlikely #ifdef)
  * Did a few substitutions that got missed (likely due to
    pre-processing out of DEBUG macros)
2019-08-14 15:49:24 -07:00
Jon Siwek
03c50fe520 Change file_analysis::Manager::ignored to use std::set 2019-08-14 13:48:39 -07:00
Jon Siwek
396c1cb066 Update documentation for string_to_pattern BIF 2019-08-14 13:22:02 -07:00
Jon Siwek
94c380297e Merge remote-tracking branch 'origin/topic/timw/easy-pdict-replacements'
* origin/topic/timw/easy-pdict-replacements:
  Cleanups related to PDict -> std::map replacements
  Remove other simple uses of PDict
  Protocols: Remove uses of PDict
  g_dbgfilemaps: Remove uses of PDict
  Scope: remove uses of PDict
  DFA: remove uses of PDict
  EventRegistry: remove uses of PDict
2019-08-13 20:16:02 -07:00
Robin Sommer
00987c4411 Merge remote-tracking branch 'origin/topic/timw/clang-tidy'
* origin/topic/timw/clang-tidy:
  Change over to whitelisting clang-tidy options instead of blacklisting
  Use FindClangTidy in the cmake submodule to make things easier
2019-08-13 23:45:16 +00:00
Robin Sommer
ecd6139d09 Merge remote-tracking branch 'origin/topic/jsiwek/replace-pcap-lookupdev'
* origin/topic/jsiwek/replace-pcap-lookupdev:
  Replace use of deprecated pcap_lookupdev()
2019-08-13 23:02:43 +00:00
Jon Siwek
9ccf3549fd Merge remote-tracking branch 'origin/topic/timw/360-log-gzip'
* origin/topic/timw/360-log-gzip:
  Add new LogAscii::gzip_file_extension option.

Adjusted documentation during merge.
2019-08-13 13:49:45 -07:00
Jon Siwek
6e48bdeb38 Merge remote-tracking branch 'origin/topic/jazoff/memory-reduction-contentline'
* origin/topic/jazoff/memory-reduction-contentline:
  Remove redundant buffering in contentline

Adjusted NVT analyzer during merge for cases where it may have been
assuming the buffer was already resized before DoDeliver().
2019-08-13 12:04:15 -07:00
Jon Siwek
c91b12863e Add tests for {http,mime}_all_headers events
And remove unnecessary check for mime_all_headers in HTTP entities
(they ony raise the http_all_headers event, never mime_all_headers).
2019-08-13 11:28:00 -07:00
Jon Siwek
7fc664b545 Merge remote-tracking branch 'origin/topic/jazoff/memory-reduction-mime'
* origin/topic/jazoff/memory-reduction-mime:
  Avoid buffering all http headers

Adjusted during merge:
  * whitespace
  * logic for HTTP needs to consider whether either mime_all_headers
    or http_all_headers events are being used
2019-08-12 19:34:42 -07:00