Commit graph

2206 commits

Author SHA1 Message Date
Jon Siwek
f2b7764769 Merge branch 'table-error' of https://github.com/ZekeMedley/zeek
* 'table-error' of https://github.com/ZekeMedley/zeek:
  Check table yield type on assignment.

Also extended the type checking to include sets as well as the full
table type (yield type as well as index types).
2019-05-28 10:51:50 -07:00
Jon Siwek
748a4f2ea2 Merge branch '001-dhcp-options' of https://github.com/jrwren/zeek
* '001-dhcp-options' of https://github.com/jrwren/zeek:
  add some dhcp options
2019-05-24 18:08:34 -07:00
Jon Siwek
9192d9289e Merge branch 'topic/christian/inputframework-reporter-filenames' of https://github.com/ckreibich/zeek
* 'topic/christian/inputframework-reporter-filenames' of https://github.com/ckreibich/zeek:
  Add input file name to additional ASCII reader warning messages
2019-05-24 17:06:39 -07:00
Jon Siwek
d886f40728 GH-378: check validity of missing 'val' field in Input::add_table
It's only allowed to be missing when the 'destination' field is a
"set" type, but not for a "table" type.

Fixes GH-378
2019-05-24 10:30:49 -07:00
Jon Siwek
88278214a9 Fix memory leak when no protocol_violation event handler exists 2019-05-24 09:01:45 -07:00
Jon Siwek
7f0fb49612 Add an internal getenv wrapper function: zeekenv
It maps newer environment variable names starting with ZEEK to the
legacy names starting with BRO.
2019-05-23 20:42:42 -07:00
Jon Siwek
ce17ae8ea2 Update broker unit test output.
Due to string representation of Broker vectors changing (they now
use parentheses instead of square brackets).

Related to https://github.com/zeek/broker/issues/43
2019-05-23 18:06:47 -07:00
Jon Siwek
30db17464d Merge remote-tracking branch 'origin/topic/timw/173-port-ranges'
* origin/topic/timw/173-port-ranges:
  GH-173: Support ranges of values for value_list elements in the signature parser
  GH-173: Modify the signature parser so ID components (such as variable names) can't start with numbers
2019-05-23 13:05:50 -07:00
Jon Siwek
812ca7d2ab Remove redundant RecordVal::record_type member
Val objects already store a reference to the type, no need for another.
2019-05-23 12:12:48 -07:00
Jon Siwek
8d6dbc2d46 Fix parse-time RecordVal tracking containing duplicates
The same RecordVal was unintentionally being added to the list within
a loop over its fields instead of just once per ctor.
2019-05-23 10:54:04 -07:00
Jon Siwek
0f2e778216 Merge remote-tracking branch 'origin/topic/johanna/clone'
* origin/topic/johanna/clone:
  Add leak-checks for new copy operations
  Finish implementation of copy method.
  Checkpoint - all non-opaque-types can be cloned.
  Reimplement copy().

Fixed a couple leaks during merge.
2019-05-22 23:59:21 -07:00
Jon Siwek
d6096b1618 Remove state_dir and state_write_delay options
Since associated functionality was already removed
2019-05-21 09:19:28 -07:00
Jon Siwek
8d49b5abf0 Merge remote-tracking branch 'origin/topic/dnthayer/bro-to-zeek'
* origin/topic/dnthayer/bro-to-zeek:
  Additional Bro to Zeek renaming
2019-05-20 21:00:19 -07:00
Jon Siwek
9d67870a81 Merge remote-tracking branch 'origin/topic/johanna/deprecated-attributes'
* origin/topic/johanna/deprecated-attributes:
  Remove deprecated attributes.
2019-05-20 16:21:00 -07:00
Johanna Amann
0080c5ea09 Merge remote-tracking branch 'origin/topic/jsiwek/krb-optional-fields'
* origin/topic/jsiwek/krb-optional-fields:
  Add missing &optional attr to KRB record fields
2019-05-20 09:33:13 -07:00
Jon Siwek
dd173f4961 Always emit scripting errors to stderr during zeek_init
Otherwise, setting Reporter::errors_to_stderr=F causes important
error messages to be lost (and this setting is the default for
ZeekCtl).  E.g. now that we terminate if there's errors during
zeek_init, GH-369 shows that the only error message given was
"fatal error: errors occurred while initializing", which is not
helpful in determining the actual issue.
2019-05-17 14:18:45 -07:00
Jon Siwek
9d07e4f0b8 Merge remote-tracking branch 'origin/topic/dnthayer/bro-renaming'
* origin/topic/dnthayer/bro-renaming:
  More bro-to-zeek renaming in scripts and other files
  More bro-to-zeek renaming in the unit tests
2019-05-16 13:37:49 -07:00
Jon Siwek
bf42dd02bd Merge remote-tracking branch 'origin/topic/dnthayer/gh-359'
* origin/topic/dnthayer/gh-359:
  Changes needed due to bro-to-zeek renaming in broker
2019-05-15 15:03:31 -07:00
Jon Siwek
a8c0cd7dee Fix potential race in openflow broker plugin
Broker::subscribe() after Broker::peer() may result in losing messages,
always best to do the reverse order.

Also possibly improved chance of unstable unit test output order.
2019-05-15 10:12:32 -07:00
Johanna Amann
2bb529f5b7 Merge remote-tracking branch 'origin/topic/jsiwek/dns-mgr-fixes'
* origin/topic/jsiwek/dns-mgr-fixes:
  Fix timing out DNS lookups that were already resolved
  Remove an unhelpful/optimistic DNS_Mgr optimization
  Fix DNS_Mgr priority_queue usage
  Remove dead code from DNS_Mgr
  Improve DNS_Mgr I/O loop: prevent starvation due to busy Broker
  Fix a ref counnting bug in DNS_Mgr
2019-05-15 09:02:41 -07:00
Jon Siwek
b3c4b986ef Fix maybe-uninitialized compiler warning 2019-05-14 19:01:41 -07:00
Jon Siwek
13867f53c3 Update btest.cfg path to use zeek-aux 2019-05-14 18:36:20 -07:00
Jon Siwek
385a3a5ae8 Update CMake to use aux/zeekctl and aux/zeek-aux submodules
Instead of the old "bro" versions of those which are no symlinks.
2019-05-14 17:48:18 -07:00
Jon Siwek
f37a16b715 Rename broctl submodule to zeekctl 2019-05-14 17:42:01 -07:00
Jon Siwek
6ad7099f7e Merge remote-tracking branch 'origin/topic/robin/gh-239'
* origin/topic/robin/gh-239:
  Undo a change to btest.cfg from a recent commit
  Updating submodule.
  Fix zeek-wrapper
  Update for renaming BroControl to ZeekControl.
  Updating submodule.
  GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
2019-05-14 13:27:40 -07:00
Jon Siwek
58d55d0f95 GH-365: improve un-indexable type error message 2019-05-13 20:04:03 -07:00
Jon Siwek
cb6b9a1f1a Allow tuning Broker log batching via scripts
Via redefining "Broker::log_batch_size" or "Broker::log_batch_interval"
2019-05-08 12:44:55 -07:00
Johanna Amann
312713810f Merge remote-tracking branch 'origin/topic/jsiwek/force-idle-broker'
* origin/topic/jsiwek/force-idle-broker:
  Force the Broker IOSource to idle periodically
2019-05-08 09:04:25 -07:00
Johanna Amann
6f82899466 Merge remote-tracking branch 'origin/topic/jsiwek/gh-353'
* origin/topic/jsiwek/gh-353:
  GH-353: Add `/<re>/i` case-insensitive signature syntax
2019-05-08 08:58:41 -07:00
Jon Siwek
9029acd7e5 Merge remote-tracking branch 'origin/topic/johanna/243'
* origin/topic/johanna/243:
  Fix missing include file on Linux
  Deprecations: Update NEWS, and tie up a few loose ends.
  Remove support for using &&/|| with patterns.
  Remove RemoteSerializer and related code/types.
  Remove PersistenceSerializer.
  Remove synchrnized and persistent attributes.
2019-05-06 18:45:10 -07:00
Jon Siwek
eda7610806 Fix sporadic openflow/broker test failure
Looked like a possible race condition in how the test was structured: an
endpoint sees its peer got lost and likewise exits immediately before
having a chance to process events the peer had sent just before exiting.
Fix is to reverse which endpoint initiates the termination sequence so
we can be sure we see the required events.
2019-05-03 11:22:56 -07:00
Jon Siwek
c640dd70cc Install local.zeek as symlink to pre-existing local.bro
This a convenience for those that are upgrading.  If we didn't do
this, then deployments can silently break until the user intervenes
since BroControl now prefers to load the initially-vanilla local.zeek
instead of the formerly-customized local.bro.
2019-05-02 23:06:52 -07:00
Jon Siwek
84ca12fdb4 Rename Zeexygen to Zeekygen 2019-05-02 21:39:21 -07:00
Jon Siwek
f2f06d66c0 Remove previously deprecated policy/protocols/smb/__load__ 2019-05-02 20:50:30 -07:00
Jon Siwek
1a77c1b287 Merge remote-tracking branch 'origin/topic/johanna/remove-deprecated-functions-events'
* origin/topic/johanna/remove-deprecated-functions-events:
  Remove deprecated functions/events
2019-05-02 19:18:45 -07:00
Johanna Amann
6d47077222 Merge remote-tracking branch 'origin/topic/jsiwek/gh-340'
* origin/topic/jsiwek/gh-340:
  GH-340: Improve IPv4/IPv6 regexes, extraction, and validity functions
2019-05-02 12:28:31 -07:00
Johanna Amann
29d9b5b554 Merge remote-tracking branch 'origin/topic/jsiwek/plist-and-event-cleanup'
* origin/topic/jsiwek/plist-and-event-cleanup:
  Add comments to QueueEvent() and ConnectionEvent()
  Add methods to queue events without handler existence check
  Cleanup/improve PList usage and Event API
2019-05-01 08:41:13 -07:00
Jon Siwek
9a461d26e4 Updating CHANGES and VERSION. 2019-04-29 18:34:40 -07:00
Jon Siwek
49908ac865 Fix parsing of hybrid IPv6-IPv4 addr literals with no zero compression 2019-04-26 19:29:40 -07:00
Jon Siwek
05b4d2a26c Add Zeexygen cross-reference links for some events 2019-04-25 10:23:00 -07:00
Jon Siwek
4c6b35970d Merge remote-tracking branch 'origin/topic/vern/expose-TCP-statics'
* origin/topic/vern/expose-TCP-statics:
  expose some TCP analyzer utility functions for use by derived classes
2019-04-23 18:43:54 -07:00
Jon Siwek
aebcb1415d GH-234: rename Broxygen to Zeexygen along with roles/directives
* All "Broxygen" usages have been replaced in
  code, documentation, filenames, etc.

* Sphinx roles/directives like ":bro:see" are now ":zeek:see"

* The "--broxygen" command-line option is now "--zeexygen"
2019-04-22 19:45:50 -07:00
Johanna Amann
5ba46eaa71 update SSL consts from TLS 1.3 2019-04-22 22:57:45 +02:00
Jon Siwek
d5803d7047 Merge remote-tracking branch 'origin/topic/vern/content-gap-history'
* origin/topic/vern/content-gap-history:
  Refined state machine update placement to (1) properly deal with gaps capped by clean FIN handshakes, and (1) fix failure to detect split routing.
  added 'g' $history character for content gaps
2019-04-22 12:40:40 -07:00
Jon Siwek
3ea34d6ea3 GH-236: Add zeek_script_loaded event, deprecate bro_script_loaded 2019-04-19 12:02:22 -07:00
Jon Siwek
a994be9eeb Merge remote-tracking branch 'origin/topic/seth/zeek_init'
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
2019-04-19 11:24:29 -07:00
Johanna Amann
9421ee0293 Merge branch 'topic/jsbarber/fix-topk-merge-core-dump' of https://github.com/jsbarber/bro
* 'topic/jsbarber/fix-topk-merge-core-dump' of https://github.com/jsbarber/bro:
  Prevent topk_merge from crashing when second argument is empty set
2019-04-18 09:36:48 +02:00
Jon Siwek
5f3e608b60 Fix unit test failures on case-insensitive file systems
The original casing mistake in the test only pops up now due to the
new .zeek over .bro file loading preference
2019-04-17 16:47:01 -07:00
Jon Siwek
f21e11d811 GH-237: add @load foo.bro -> foo.zeek fallback
When failing to locate a script with explicit .bro suffix, check for
whether one with a .zeek suffix exists and use it instead.
2019-04-16 17:49:37 -07:00
Jon Siwek
1e57e3f026 Use .zeek file suffix in unit tests 2019-04-16 16:08:57 -07:00