Commit graph

6667 commits

Author SHA1 Message Date
Anthony Kasza
8a915b19d7 add: handling for orig SYNEX flags 2020-04-03 10:20:03 -06:00
Anthony Kasza
9b1b8ae292 add: test trace for when RDPEUDP negotiates RDPEUDP2 2020-04-03 09:59:39 -06:00
Anthony Kasza
88951d2d71 add: more SYN PDU parsing structs 2020-04-03 09:48:48 -06:00
Jon Siwek
e66148a13a Merge branch 'topic/ak/rdpeudp'
- Squashed the original commit set
- Cleaned up formatting
- Fixed register_for_ports() for right RDPEUDP analyzer

* topic/ak/rdpeudp:
  Add RDP over UDP analyzer
2020-04-02 18:31:40 -07:00
Anthony Kasza
60644bc85f Add RDP over UDP analyzer 2020-04-02 17:53:47 -07:00
Jon Siwek
8c0e8ecd28 Allow alternate event/hook prototype declarations
The alternates must be some subset of the canonical prototype (the one
that's first declared) and allows users to define handlers for any
such prototype.  Example:

    # Prototype declarations
    global my_event: event(s: string, c: count);
    global my_event: event(c: count);
    global my_event: event();

    # Handler definitions
    event my_event(s: string, c: count) { print s, c; }
    event my_event(c: count) { print c; }
    event my_event() { }

This allows handlers to consume a subset of the arguments or even
re-order them.  This makes it easier to either extend an existing
event/hook's arguments and/or deprecate usages of certain prototypes.
2020-04-01 17:25:28 -07:00
Tim Wojtulewicz
f4765a49a1 Fix uses of GetBool in bifs to use GetTrue/GetFalse 2020-04-01 11:08:20 -07:00
Tim Wojtulewicz
0d695ac453 Change Sessions::dump_this_packet to a bool 2020-04-01 11:08:16 -07:00
Johanna Amann
3ce1c9ffd6 Merge remote-tracking branch 'origin/topic/jsiwek/misc-lambda-fixes'
* origin/topic/jsiwek/misc-lambda-fixes:
  GH-725: fix logic for finding a lambda's usage of outer IDs
  Change record field anonymous functions to use lambda expressions
2020-03-31 15:46:54 -07:00
Johanna Amann
d18f2f8f76 Merge remote-tracking branch 'origin/topic/timw/override'
* origin/topic/timw/override:
  Mark input/output message classes as final, since nothing should be inheriting from them
  Add missing override specifier to a number of methods, remove virtual from some as well
  Add override specifier to Configure() method in almost all of the internal plugins
2020-03-31 08:48:44 -07:00
Tim Wojtulewicz
fd5e15b116 The Great Embooleanating
A large number of functions had return values and/or arguments changed
to use ``bool`` types instead of ``int``.
2020-03-31 06:41:54 +00:00
Tim Wojtulewicz
d614756a7f Mark input/output message classes as final, since nothing should be inheriting from them 2020-03-30 14:54:24 -07:00
Tim Wojtulewicz
186005133b Add missing override specifier to a number of methods, remove virtual from some as well 2020-03-30 14:54:24 -07:00
Tim Wojtulewicz
6aaabceed2 Add override specifier to Configure() method in almost all of the internal plugins 2020-03-30 14:54:24 -07:00
Johanna Amann
3c470ffe13 Merge remote-tracking branch 'origin/topic/jsiwek/gh-887-fix-gre-erspan-dot1q'
* origin/topic/jsiwek/gh-887-fix-gre-erspan-dot1q:
  GH-887: improve GRE/ERSPAN parsing of non-IPv4/IPv6 inner payload
  Fix ERSPAN III optional sub-header parsing
2020-03-30 14:30:00 -07:00
Johanna Amann
bad8283c3c Merge remote-tracking branch 'origin/topic/timw/expr-cleanup'
* origin/topic/timw/expr-cleanup:
  Don't use xor operator for boolean operations
  Fix whitespace issues
  Fix a variable-name-shadowing issue
  Don't allocate a value during a loop if avoidable
  Fix type narrowing on a couple of subtractions
  Fold multiple if cases with the same return value into a single return
  Fold a number of allocations into the if statement where they're used
  Remove unused ListExpr::AllConst method
  Constify a couple of method arguments
  Mark RuntimeError methods in Reporter as noreturn since they throw exceptions
2020-03-30 13:59:27 -07:00
Johanna Amann
0865ef3c45 Merge remote-tracking branch 'origin/topic/timw/remove-cq'
* origin/topic/timw/remove-cq:
  Remove unused cq queue code.
2020-03-30 13:30:32 -07:00
Johanna Amann
2e6eb7795c Merge remote-tracking branch 'origin/topic/jsiwek/tcp-hdr-reserved-bits'
* origin/topic/jsiwek/tcp-hdr-reserved-bits:
  Add a "reserved" field to tcp_hdr record
2020-03-30 13:23:51 -07:00
Jon Siwek
b7dee712d5 GH-887: improve GRE/ERSPAN parsing of non-IPv4/IPv6 inner payload
This changes the decapsulation logic for GRE/ERSPAN payloads to re-use
existing Layer 2 parsing logic that already handles things like 802.1Q
tags correctly before going on to process the inner IPv4/IPv6 payload.
2020-03-27 15:22:00 -07:00
Jon Siwek
42dc2906af Fix ERSPAN III optional sub-header parsing 2020-03-27 15:07:18 -07:00
Jon Siwek
1ca11f11c7 GH-725: fix logic for finding a lambda's usage of outer IDs 2020-03-26 17:05:59 -07:00
Jon Siwek
f032885085 Change record field anonymous functions to use lambda expressions
There was an alternate syntax to assign anonymous functions to record
fields that was never migrated to use the new lambda expression
machinery (and so didn't allow referencing variables in outer scope):

    type myrec: record {
        foo: function(a: string);
    };

    local o = "o";
    local mr = myrec($foo(a: string) = { print a + o; });
2020-03-26 15:48:18 -07:00
Jon Siwek
29a7222563 Func::DescribeDebug: move a NumFields() call out of loop 2020-03-26 15:21:51 -07:00
Jon Siwek
13391806ba Add a "reserved" field to tcp_hdr record
This record is available by handling either raw_packet or new_packet
events.
2020-03-26 11:48:53 -07:00
Jon Siwek
e7e5cf0f89 Use const-ref parameter for zeek::val_list_to_args()
It ended up being used a bit more than initially expected and this
is closer to the style we're generally aiming for.
2020-03-26 11:32:01 -07:00
Jon Siwek
599dda9ae9 Fix missing IntrusivePtr.h include and ambiguous ODesc::Add call 2020-03-25 19:37:06 -07:00
Jon Siwek
54bc3bd5c6 Remove TimerMgr arg from event queuing/scheduling methods
It's not useful for anything since there's only ever a single TimerMgr.
2020-03-25 19:05:17 -07:00
Jon Siwek
5e496e43b7 Deprecate Analyzer::ConnectionEvent()
And update usages to Analyzer::EnqueueConnEvent()
2020-03-25 18:40:49 -07:00
Jon Siwek
e394ea38bc Deprecate file_analysis::File::FileEvent methods using val_list args
And update usages to the overload that takes a zeek::Args instead.
2020-03-25 18:40:49 -07:00
Jon Siwek
de47a50dde Deprecate Connection::ConnectionEvent methods
And update usages to Connection::EnqueueEvent
2020-03-25 18:39:56 -07:00
Jon Siwek
6980f63a91 Deprecate EventMgr::QueueEventFast() and update usages to Enqueue() 2020-03-25 16:09:33 -07:00
Jon Siwek
0db484cc7a Deprecate EventMgr::QueueEvent() and update usages to Enqueue() 2020-03-25 16:09:33 -07:00
Tim Wojtulewicz
67e4179454 Remove unused cq queue code.
This code isn't used anymore now that the Timer code uses PQ all the time.
2020-03-25 15:45:48 -07:00
Jon Siwek
b667c637df Deprecate Func::Call(val_list*, ...)
The version taking a vector of intrusive pointers should be used
instead.  A variadic version is also added that forwards all arguments.
2020-03-24 20:48:32 -07:00
Jon Siwek
4e1ac4e124 Use vector<IntrusivePtr<Val>> for Func::Call and Event queuing args
This change may break BIFs that use @ARGS@, @ARG@, or @ARGC@ since their
types have changed.
2020-03-24 16:50:18 -07:00
Tim Wojtulewicz
7ec96f25ac Don't use xor operator for boolean operations 2020-03-24 13:39:56 -07:00
Tim Wojtulewicz
10f0fffe29 Fix whitespace issues 2020-03-24 13:39:56 -07:00
Tim Wojtulewicz
12f2153f67 Fix a variable-name-shadowing issue 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
91f05f19ef Don't allocate a value during a loop if avoidable 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
f2a6ad63ed Fix type narrowing on a couple of subtractions 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
499729bd8e Fold multiple if cases with the same return value into a single return 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
e4a36678ba Fold a number of allocations into the if statement where they're used 2020-03-24 13:39:55 -07:00
Tim Wojtulewicz
a5a08b3bf3 Remove unused ListExpr::AllConst method 2020-03-24 13:13:35 -07:00
Tim Wojtulewicz
0817b2d16a Constify a couple of method arguments 2020-03-24 13:00:14 -07:00
Tim Wojtulewicz
b51879da83 Mark RuntimeError methods in Reporter as noreturn since they throw exceptions 2020-03-24 12:58:41 -07:00
Jon Siwek
94656c2308 Fix memory leak in Zeek when-statement bodies with runtime errors 2020-03-23 22:01:03 -07:00
Jon Siwek
b045ce4bb3 Change TableVal::RecoverIndex() to return IntrusivePtr 2020-03-23 22:01:03 -07:00
Jon Siwek
0b5a18495d Use IntrusivePtr in TableVal::CallExpireFunc 2020-03-23 22:01:03 -07:00
Jon Siwek
7a4ce9fb51 Fix memory leak when runtime error occurs in a Zeek for-loop 2020-03-23 22:01:03 -07:00
Jon Siwek
427150b27a Merge remote-tracking branch 'origin/topic/jsiwek/gh-857-rebuild-tables-on-record-redef'
* origin/topic/jsiwek/gh-857-rebuild-tables-on-record-redef:
  Initialize RecordVal default fields when redef'd
  GH-857: fix redefining record types used to index tables
  Change RecordVals to get resized at time of RecordType redef
2020-03-20 11:31:11 -07:00