Commit graph

6667 commits

Author SHA1 Message Date
Tim Wojtulewicz
e7412e257f Merge remote-tracking branch 'bbannier/topic/bbannier/more-autoformating'
* bbannier/topic/bbannier/more-autoformating:
  Format Python scripts with yapf.
  Format shell scripts with shfmt.
2021-12-01 10:33:22 -07:00
Tim Wojtulewicz
6a7bbd5268 Merge remote-tracking branch 'origin/topic/vern/CPP-cond'
* origin/topic/vern/CPP-cond:
  fix btest comment to more accurately describe the test
  clang-format issue
  btests for erroneous script conditionals
  avoid compiling-to-C++ for functions potentially influenced by conditionals
  track the use of conditionals in functions and files
  AST profiles track the associated function/body/expression
2021-12-01 10:25:58 -07:00
Tim Wojtulewicz
328411e807 GH-1873: Deprecate the tag types differently to avoid type clashes 2021-12-01 09:43:28 -07:00
Johanna Amann
94ee837398 Fix for the recent patch that allows segment offloaded packets.
We recently added support for segment offloaded packets. It turns out
that this can lead to problems in UDP/ICMP based parsers since I missed
correctly also updating the payloadlength there, and using the capture
length instead when segment offloading is enabled.

Credit to OSS-Fuzz for discovery
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41391
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41394
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41395
(Link to details becomes public 30 days after patch release)
2021-11-30 11:55:30 -07:00
Vern Paxson
46f46e7803 clang-format issue 2021-11-29 13:17:46 -08:00
Tim Wojtulewicz
6a5b51eba8 Merge remote-tracking branch 'origin/topic/timw/coverity-fixes'
* origin/topic/timw/coverity-fixes:
  Fix a number of Coverity findings
2021-11-29 13:47:08 -07:00
Tim Wojtulewicz
fbcebb85a1 Merge remote-tracking branch 'origin/topic/vern/CPP-trim'
* origin/topic/vern/CPP-trim:
  suppress unneeded initializations
  address clang 10 warnings
2021-11-29 13:46:14 -07:00
Tim Wojtulewicz
72604f866b Fix a number of Coverity findings
1466460: Uninitialized field in gtp-analyzer.pac
1462465: Null pointer dereference in CompositeHash::SingleValHash
1462463: Copy/paste error in TCPSessionAdapter::build_syn_packet_val
1462067: Uninitialized fields in Zinst
2021-11-29 10:43:34 -07:00
Vern Paxson
a4b9218771 avoid compiling-to-C++ for functions potentially influenced by conditionals 2021-11-24 15:19:21 -08:00
Vern Paxson
e73351a6e1 track the use of conditionals in functions and files 2021-11-24 15:19:01 -08:00
Vern Paxson
f865897cac AST profiles track the associated function/body/expression 2021-11-24 15:18:40 -08:00
Benjamin Bannier
fd56eddcfb Format Python scripts with yapf.
We also add a very basic yapf configuration file. Most of the changes in
this patch were performed automatically, but we broke one overly long
string into multiple components on `src/make_dbg_constants.py`.
2021-11-24 23:13:24 +01:00
Benjamin Bannier
1f388e3f40 Format shell scripts with shfmt.
All changes in this patch were performed automatically with `shfmt` with
configuration flags specified in `.pre-commit-config.yaml`.

In addition to fixing whitespace the roundtrip through shfmt's AST also
transforms command substitutions

    `cmd`
    # becomes
    $(cmd)

and some redirects

    >&2 echo "msg"
    # becomes
    echo >&2 "msg"
2021-11-24 23:13:02 +01:00
Tim Wojtulewicz
8e1d770966 Merge remote-tracking branch 'origin/topic/vern/record-empty-vector-fix'
* origin/topic/vern/record-empty-vector-fix:
  fixes for constructing and assigning records with fields that are empty vectors
2021-11-24 13:32:45 -07:00
Vern Paxson
a2cec7463f suppress unneeded initializations 2021-11-24 12:17:16 -08:00
Vern Paxson
a830c269ab address clang 10 warnings 2021-11-24 11:56:01 -08:00
Vern Paxson
06bbd167cd fixes for constructing and assigning records with fields that are empty vectors 2021-11-24 11:16:33 -08:00
Tim Wojtulewicz
e0b4659488 Merge remote-tracking branch 'origin/topic/vern/CPP-speedup'
* origin/topic/vern/CPP-speedup:
  use iterator-based idiom for check-if-present-then-access
  const-ify member function
  switch looping over vectors to use iterators
  remove unused local variables
  efficiency fix - return a reference rather than a copy of a map
  fix for case-sensitive file systems
  geez sometimes it's signed sometimes it's not
  documentation updates
  remove -O add-C++ and -O update-C++ options
  extensive rewrite of generation & execution of run-time initialization
  factoring out CPPEscape to be a standalone function
  removing unused SubNetType class
2021-11-23 19:44:57 -07:00
Tim Wojtulewicz
e82a78616b Update NEWS and some minor fixes for docs/zeekygen 2021-11-23 19:39:36 -07:00
Tim Wojtulewicz
9135345fa8 Remove the old session-based tunnel analyzers 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
2044fbe53b Add GTPv1 packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
dc0ecf9811 Add Teredo packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
05574ecce1 Add VXLAN packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
cbb0bcd49c Add Geneve packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
7e40094f2c Add AYIYA packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
612212568a Add analyzer_confirmation and analyzer_violation events 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
7bffd2eccd Add utility function for tunnel analyzers to setup encapsulation 2021-11-23 19:36:50 -07:00
Tim Wojtulewicz
f93c5a6942 Store some additional information in the packet during processing
- Session related to the packet
- is_orig information if a UDP header was found
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
5f58ce8a5d Minor fix in UDP to avoid duplicating tunnels 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
1dede6dd70 Fix error text in IPTunnel analyzer 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
ed798c6aba Change Packet::ip_hdr to be a shared_ptr so it can be copied into EncapsulatingConn 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
d4f57a6100 Add method for packet analyzers to register for protocol detection 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
a7d3cb48ef Add concept of "parent" tag namespaces
This allows us to create an EnumType that groups all of the analyzer
tag values into a single type, while still having the existing types
that split them up. We can then use this for certain events that benefit
from taking all of the tag types at once.
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
7d66f4252f Unify plugin::Component and plugin::TaggedComponent into a single class
These two are almost always used in conjunction with each other, and
TaggedComponent is never used by itself. Combining them together into
a single class will help simplify some of the code around managing
the mapping between Tags and Components.
2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
8b544d648d Remove uses of deprecated Tag types 2021-11-23 19:36:49 -07:00
Tim Wojtulewicz
331161138a Unify all of the Tag types into one type
- Remove tag types for each component type (analyzer, etc)
- Add deprecated versions of the old types
- Remove unnecessary tag element from templates for TaggedComponent and ComponentManager
- Enable TaggedComponent to pass an EnumType when initializing Tag objects
- Update some tests that are affected by the tag enum values changing order
2021-11-23 19:36:49 -07:00
Johanna Amann
12d81b27ed Merge remote-tracking branch 'origin/master' into topic/johanna/openssl-3-compat 2021-11-23 10:23:12 +00:00
Johanna Amann
48ee7db3c1 Merge remote-tracking branch 'origin/topic/johanna/gh-1829'
* origin/topic/johanna/gh-1829:
  Add documentation for GH-1829
  Packets with TSO: address review feedback.
  Accept packets that use tcp segment offloading.

Fixes GH-1829
2021-11-23 10:20:07 +00:00
Vern Paxson
84423369b4 use iterator-based idiom for check-if-present-then-access 2021-11-22 15:28:15 -08:00
Vern Paxson
735d584d9f const-ify member function 2021-11-22 10:55:38 -08:00
Vern Paxson
ffbbacd3b1 switch looping over vectors to use iterators 2021-11-18 08:58:04 -08:00
Vern Paxson
6f82c1610e remove unused local variables 2021-11-18 08:57:03 -08:00
Vern Paxson
8e77e3e92c efficiency fix - return a reference rather than a copy of a map 2021-11-18 08:56:24 -08:00
Johanna Amann
ff0bc86021 OpenSSL 3: normalize self-signed-cert error message
The message changed between OpenSSL 1.1 and 3.0 - we just use the old
one to not mess up the external test baselines.
2021-11-17 17:21:21 +00:00
Johanna Amann
253d214126 OpenSSL 3: fix warnings and tests
This commit fixes the compile-time warnings that OpenSSL 3.0 raises for
our source-code. For the cases where this was necessary we now have two
implementations - one for OpenSSL 1.1 and earlier, and one for OpenSSL
3.0.

This also makes our testsuite pass with OpenSSL 3.0

Relates to GH-1379
2021-11-17 13:33:49 +00:00
Johanna Amann
6217851d6d Switch OpaqueVal hashing back to legacy OpenSSL implementation
This commit switches hashing from the more modern EVP message digest to
the older direct function calls, that are deprecated as of OpenSSL 3.0.

The reason is that we require the ability to store the internal state of
hash operations to disk. This is no longer possible with the
architecture that is used by the EVP digests; it is, however, possible
when using the legacy methods.

There might be a way to do this more cleanly in OpenSSL 3.1 - but for
the moment this seems like the easiest solution - even though I am not
really happy about it.

For details see zeek/zeek#1379 and openssl/openssl#14222
2021-11-16 15:33:31 +00:00
Tim Wojtulewicz
d0f8c50417 Fix whitespace in help output 2021-11-12 09:30:26 -07:00
Tim Wojtulewicz
92b84a00f9 Add command-line option to write unprocessed packets to a file
This commit also changes the PcapDumper to automatically flush after
every called to Dump(). This is because pcap_dump has an internal buffer
of some sort that only writes to the file after a set amount of bytes.
When using the new option on a low-traffic network, it might be a while
before you see any packets written since it has to overcome that buffer
limit first.
2021-11-12 09:30:26 -07:00
Tim Wojtulewicz
fe932944c4 GH-1620: Add event and plugin hook to track packets not processed 2021-11-12 09:30:26 -07:00
Tim Wojtulewicz
87d17cf56d Merge remote-tracking branch 'origin/topic/bbannier/install-3rdparty-headers'
* origin/topic/bbannier/install-3rdparty-headers:
  Install include headers from `src/3rdparty/`.
2021-11-10 10:20:13 -07:00