Commit graph

2206 commits

Author SHA1 Message Date
Tim Wojtulewicz
6c747a0fca Merge remote-tracking branch 'origin/topic/seth/plugin-dir-fixes'
* origin/topic/seth/plugin-dir-fixes:
  Fixes for the builtin plugin functionality
2021-06-11 11:54:46 -07:00
Tim Wojtulewicz
8b92ba180d Merge remote-tracking branch 'origin/topic/seth/plugin-dir2'
* origin/topic/seth/plugin-dir2:
  Added --include-plugins configure argument
2021-06-10 10:43:20 -07:00
Johanna Amann
e0d284ec9f Merge branch 'logging/script-logdir' of https://github.com/kramse/zeek
* 'logging/script-logdir' of https://github.com/kramse/zeek:
  Copy of ascii-empty test, just changed path in the beginning
  Logdir: Change requested by 0xxon, no problem
  Introduce script-land variable that can be used to set logdir.

Closes GH-772
2021-06-10 12:19:15 +01:00
Tim Wojtulewicz
c621af1e2b Merge remote-tracking branch 'origin/topic/timw/fix-big-sur-build'
* origin/topic/timw/fix-big-sur-build:
  Fix macOS Big Sur builds on Cirrus
2021-06-09 09:12:41 -07:00
Christian Kreibich
289db80270 Merge branch 'topic/johanna/opensuseleap15.3'
* topic/johanna/opensuseleap15.3:
  Add OpenSUSE Leap 15.3 to testing
2021-06-08 13:55:50 -07:00
Robin Sommer
ca106457c2 Update btest submodule and add .cache to .gitignore.
[nomail]
2021-06-07 09:42:59 +02:00
Robin Sommer
ba0a4fe9cf Merge remote-tracking branch 'origin/topic/neverlord/coverity'
* origin/topic/neverlord/coverity:
  Improve assignment operators for IntrusivePtr
2021-06-07 09:39:06 +02:00
Tim Wojtulewicz
9fbbcaad8f Merge remote-tracking branch 'origin/topic/timw/analyzer-deprecations'
* origin/topic/timw/analyzer-deprecations:
  Add deprecated headers for UDP and ICMP analyzers
2021-06-04 08:29:43 -07:00
Tim Wojtulewicz
3dac5ed809 Merge remote-tracking branch 'origin/topic/christian/gh-1572'
* origin/topic/christian/gh-1572:
  Make update-traces fail when the curl invocation fails
2021-06-03 09:28:11 -07:00
Christian Kreibich
cd8beb173a Merge branch 'topic/christian/ci-freebsd-13'
* topic/christian/ci-freebsd-13:
  Add FreeBSD 13 to CI
2021-06-02 15:10:14 -07:00
Tim Wojtulewicz
079ac1654f Merge remote-tracking branch 'origin/topic/timw/1114-tcp-analyzer'
* origin/topic/timw/1114-tcp-analyzer:
  Update NEWS [skip ci]
  Label session adapters in the output of zeek -NN
  Split session adapter code into separate files from the analyzers
  Move adapter-specific code back into the adapter
  Move ICMP counterpart methods outside of ICMPAnalyzer class
  Remove obsolete Skipping()/SetSkip() from Connection
  Remove some code from IPBasedAnalyzer and children that was waiting for TCP to be implemented
  Move TCPStateStats object out of session_mgr
  Move analyzer-to-port mapping out of analyzer::Manager into packet analyzers
  Move packet parsing code out of adapter into analyzer
  Move old TCP analyzer into analyzer adapter in packet analysis tree
2021-06-02 13:22:45 -07:00
Tim Wojtulewicz
b171f94729 Merge remote-tracking branch 'zeek-security/topic/timw/mobile-ipv6-overflow'
* zeek-security/topic/timw/mobile-ipv6-overflow:
  Add some extra length checking when parsing mobile ipv6 packets
2021-06-02 10:02:59 -07:00
Tim Wojtulewicz
9a6959d633 Merge remote-tracking branch 'origin/topic/jsiwek/improve-netbios-toupper'
* origin/topic/jsiwek/improve-netbios-toupper:
  Replace toupper() usages in netbios decoding BIFs
2021-06-01 19:12:09 -07:00
Tim Wojtulewicz
ff79a58f59 Merge remote-tracking branch 'origin/topic/neverlord/telemetry-scraper'
* origin/topic/neverlord/telemetry-scraper:
  Integrate review feedback
  Sync new broker options, fix name inconsistencies
  Integrate new Broker metric exporter parameters
2021-06-01 10:19:46 -07:00
Tim Wojtulewicz
ca4d0321f1 Merge remote-tracking branch 'sigkillchris/sigkillchris-patch-1'
* sigkillchris/sigkillchris-patch-1:
  Update detect-MHR.zeek
2021-06-01 09:52:17 -07:00
Tim Wojtulewicz
7393e13d67 Merge remote-tracking branch 'origin/topic/jsiwek/gh-839-fix-optional-subrecord-table-indices'
* origin/topic/jsiwek/gh-839-fix-optional-subrecord-table-indices:
  GH-839: Fix use of &optional sub-records within table/set indices
2021-06-01 09:39:54 -07:00
Tim Wojtulewicz
5f57daf9d1 Ensure SessionAdapter members are initialized
Fixes Coverity #1453273
2021-05-26 10:53:08 -07:00
Robin Sommer
815b8cbcc9 Merge remote-tracking branch 'origin/topic/robin/file-api-extension'
* origin/topic/robin/file-api-extension:
  Extend the file analyzer API to set source manually.
2021-05-26 08:08:09 +02:00
Jon Siwek
7185a71960 Update Broker submodule for bump of embedded CAF to 0.18.3 2021-05-24 15:05:19 -07:00
Tim Wojtulewicz
aa09e02117 Merge remote-tracking branch 'origin/topic/timw/1114-analyzers'
* origin/topic/timw/1114-analyzers:
  Add type field to session::Key to help avoid collisions in map
  Move bad UDP checksum handling into adapter object
  Rename IPBasedTransportAnalyzer to SessionAdapter
  Move building session analyzer tree out of analyzer::Manager
  Rework the packet flow through the IP-based analyzers
  Add new UDP packet analyzer, remove old one
  Add new ICMP packet analyzer, remove old one
  Add base class for IP-based packet analyzers
  Move SessionManager::ParseIPPacket to IP analyzer's namespace
  Added skeletons for TCP/UDP/ICMP packet analysis plugins.
2021-05-24 12:40:00 -07:00
Jon Siwek
82fb5722a1 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1244-print-small-floating-point'
* origin/topic/jsiwek/gh-1244-print-small-floating-point:
  Omit unneeded decimal points in modp_dtoa2() scientific notation output
  GH-1244: Change modp_dtoa2() to use scientific notation for small values
2021-05-18 11:47:56 -07:00
Tim Wojtulewicz
f66b4f5340 Merge remote-tracking branch 'origin/topic/timw/dict-iterator-construction'
* origin/topic/timw/dict-iterator-construction:
  GH-1546: Make DictIterator() public, add copy/move operators
2021-05-17 11:58:17 -07:00
Jon Siwek
31f73f6e92 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1555-gh-1558-config-enum-fixes'
* origin/topic/jsiwek/gh-1555-gh-1558-config-enum-fixes:
  GH-1558: Fix reading `vector of enum` types from config files
  GH-1555: Fix reading empty set[enum] values from config files
2021-05-17 11:35:20 -07:00
Johanna Amann
1d25def759 Merge branch 'master' of https://github.com/kramse/zeek
* 'master' of https://github.com/kramse/zeek:
  Added note about default configuration
  More precise description of the example
  Removed tcpdump file, as it may not even work.
  Just a few ideas for improving the manual page
2021-05-17 13:14:50 +01:00
Tim Wojtulewicz
67e8a05fc1 Merge remote-tracking branch 'origin/topic/timw/zeek-string-tests'
* origin/topic/timw/zeek-string-tests:
  Add unit tests to ZeekString.cc
2021-05-11 09:26:57 -07:00
Jon Siwek
37b7c65310 Merge remote-tracking branch 'origin/topic/vern/cpp'
* origin/topic/vern/cpp: (34 commits)
  fixed cut-and-paste botch (redundant line of code)
  Fix LGTM warnings in script_opt/CPP code
  bug fixes for stand-alone compiles with empty records
  remove -O force-C++, and also some inadvertently replicated code
  better initial workflow, thanks to Jon Siwek
  remove optimization no longer needed
  removed redundant Traverse invocation
  style nit: removed std:: where not needed due to "using" clause
  Fix various compiler/linter warnings in script_opt/CPP code
  first cut at embedding filenames in C++ function names - for Justin to test
  fixes for personal build scripts - will go away once workflow is streamlined
  whoops removed a std:: from generated code
  decluttered code by removing "std::" - no semantic changes (also some whitespace fixes)
  porting fixes from Justin
  documenting poor run-time error messages
  README documentation
  minor tweaks tidyness tweaks
  notes for tests that are problematic when using compile-to-C++
  new "-a cpp" btest alternative
  hooks for activating the compiler & associated BiF
  ...
2021-05-10 12:57:56 -07:00
Johanna Amann
f76a95a2c2 Merge remote-tracking branch 'origin/topic/christian/install-btest-tooling'
* origin/topic/christian/install-btest-tooling:
  Explain zeek-config options in help output
  Sort variables at top of zeek-config alphabetically
  Install Zeek's btest tooling with the distribution
2021-05-10 10:26:59 +01:00
Tim Wojtulewicz
6454f59369 Merge remote-tracking branch 'origin/topic/timw/session-coverity'
* origin/topic/timw/session-coverity:
  Minor cleanup in IPAddr.h
  Fix a few Coverity warnings from the session manager work
2021-05-05 14:06:25 +00:00
Jon Siwek
932a83bb60 Merge remote-tracking branch 'origin/topic/vern/record-holes'
* origin/topic/vern/record-holes:
  switched RecordVal's to use std::optional for tracking missing fields
  added constructors for directly building ZVal's
2021-05-03 18:21:42 -07:00
Jon Siwek
9e8eb30620 Add missing zeek/ prefix to a telemetry header's includes 2021-04-30 18:29:34 -07:00
Tim Wojtulewicz
72ba93d9a3 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1534-better-duplicate-enum-error'
* origin/topic/jsiwek/gh-1534-better-duplicate-enum-error:
  GH-1534: Fix excessive coredump for duplicate enum definitions
2021-04-30 09:42:40 -07:00
Tim Wojtulewicz
ad67d810be Merge remote-tracking branch 'origin/topic/jsiwek/fix-netbios-decode-bifs'
* origin/topic/jsiwek/fix-netbios-decode-bifs:
  Fixes to `decode_netbios_name` and `decode_netbios_name_type` BIFs
2021-04-30 09:40:46 -07:00
Tim Wojtulewicz
af3814792a Merge remote-tracking branch 'origin/topic/timw/1114-sessions-manager'
* origin/topic/timw/1114-sessions-manager:
  Rename ConnID and ConnIDKey
  Remove Session prefix from some session-related classes and files
  Move session code into new directory and into zeek::session namespace
  Move SessionKey into a separate file, added comments
  Review cleanup
  Rework stats to store handles to the counters
  Rename some connection-specific methods in Session and SessionManager
  Add deprecated version of Sessions.h
  Rename NetSessions to SessionManager
  Store a single map of Sessions instead of split maps of Connections.
  Convert session stats to use the new telemetry API
  Add test for get_conn_stats BIF before reworking session stats
  Add new Session base class
  Move packet filter out of NetSessions
  Move some code out of NetSessions
2021-04-29 11:29:59 -07:00
Tim Wojtulewicz
14ffd9646f Merge remote-tracking branch 'origin/topic/bbannier/issue-1517'
* origin/topic/bbannier/issue-1517:
  Add basic testing for Geneve protocol analyzer
  GH-1517: Add Geneve decap support
2021-04-29 09:01:11 -07:00
Jon Siwek
aaabb75f66 Merge remote-tracking branch 'origin/topic/jsiwek/misc-table-stuff'
* origin/topic/jsiwek/misc-table-stuff:
  Add a fatal error condition for invalid Dictionary insertion distances
  Fix using clear_table() within an &expire_func
  Remove saving/restoring of value pointer after calling expire_func
  Avoid allocating a HashKey for no-op table expiry iterations
2021-04-28 13:49:31 -07:00
Jon Siwek
333957df22 Fix -Wsign-compare warnings in Debug{Cmds}.cc 2021-04-28 13:10:38 -07:00
Tim Wojtulewicz
6b8699fbda Merge remote-tracking branch 'origin/topic/timw/1528-remove-queue'
* origin/topic/timw/1528-remove-queue:
  GH-1528: Remove broken Queue/PQueue class, replace with std::deque
2021-04-28 09:27:35 -07:00
Jon Siwek
b44ae62ce4 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1483-mismatch-ctor-init-errors'
* origin/topic/jsiwek/gh-1483-mismatch-ctor-init-errors:
  GH-1483: Improve error for mismatched container initialization types
2021-04-26 11:15:34 -07:00
Tim Wojtulewicz
d9f40abf6d Merge remote-tracking branch 'origin/topic/timw/mobile-ipv6-test'
* origin/topic/timw/mobile-ipv6-test:
  Update btest baselines for --enable-mobile-ipv6 builds
  Build ubuntu18 on CI with --enable-mobile-ipv6
2021-04-26 09:54:19 -07:00
Jon Siwek
d166250961 Merge remote-tracking branch 'origin/topic/timw/zeek-cut-lgtm'
* origin/topic/timw/zeek-cut-lgtm:
  Fix LGTM finding in zeek-cut with uses of localtime and gmtime
2021-04-20 15:21:12 -07:00
Jon Siwek
e8247c2472 Merge remote-tracking branch 'origin/topic/vern/vector-holes'
* origin/topic/vern/vector-holes:
  Remove NEWS entry regarding changed vector-holes functionality
  Fix potential segfaults in VectorVal Insert/Remove methods
  Fix copy() to work with a vector that has trailing holes
  update test suite for vector holes now being supported for numeric types
  add vector tests for creating holes, "in" operator, "?" operator, copying vectors with holes
  restore support for vectors with holes remove vestigial comment
  fix using ++/-- to vectors that contain holes
2021-04-20 14:43:01 -07:00
Jon Siwek
f176da200e Merge remote-tracking branch 'origin/topic/jsiwek/gh-1506-fix-broker-func-indices'
- Extended a btest to cover tables/sets with index types
  (this was originally broken until fixed by GH-1514)

* origin/topic/jsiwek/gh-1506-fix-broker-func-indices:
  GH-1506: Fix Broker unserialization of set/table function indices
2021-04-16 16:03:29 -07:00
Tim Wojtulewicz
df22bdd52e Merge remote-tracking branch 'origin/topic/timw/1487-not-valid-enum'
* origin/topic/timw/1487-not-valid-enum:
  Move an assert() in input/Manager.cc to account for ValueToVal errors
  Add test for config framework
  Fix similar issues with ValueTo* methods in the input framework
  GH-1487: Handle error from ValueToVal instead of ignoring it
2021-04-16 08:08:59 -07:00
Jon Siwek
846cc53780 Merge remote-tracking branch 'origin/topic/jsiwek/fix-table-vector-index'
* origin/topic/jsiwek/fix-table-vector-index:
  Fix indexing of set/table types with a vector
2021-04-15 17:59:31 -07:00
Tim Wojtulewicz
97288134c2 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1496-fix-armv7-build'
* origin/topic/jsiwek/gh-1496-fix-armv7-build:
  GH-1496: Fix build on armv7 architecture
2021-04-15 11:55:04 -07:00
Tim Wojtulewicz
fc3438bda5 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1450-large-double-format'
* origin/topic/jsiwek/gh-1450-large-double-format:
  GH-1450: Improve printing/logging of large double/interval/time values
2021-04-14 16:06:11 -07:00
Tim Wojtulewicz
d579dd4318 Merge remote-tracking branch 'origin/topic/jsiwek/crlf-parsing'
* origin/topic/jsiwek/crlf-parsing:
  Add btest for unterminated pattern parsing error behavior
  GH-1497: Support CRLF line-endings in Zeek scripts and signature files
  Escape non-printables in "unrecognized character" parser error messages
2021-04-14 15:54:42 -07:00
Tim Wojtulewicz
0ab4cc8237 Merge remote-tracking branch 'origin/topic/jsiwek/pcap-null-data-check'
* origin/topic/jsiwek/pcap-null-data-check:
  Add a check for null packet data in pcap IOSource
2021-04-14 15:52:05 -07:00
Jon Siwek
361c99cc26 Add explanation of vector holes/in-operator changes to NEWS [skip ci] 2021-04-12 18:07:30 -07:00
Jon Siwek
0c93e2fcb8 Merge remote-tracking branch 'origin/topic/christian/orig-resp-explanation'
* origin/topic/christian/orig-resp-explanation:
  Reference the manual's explanation of originator and responder from conn_id
2021-04-09 12:18:19 -07:00