Commit graph

6667 commits

Author SHA1 Message Date
Jon Siwek
c03ef308c9 Improve Zeekygen output for long attribute expressions
Long inline-literals often don't wrap pleasantly in HTML renders and
we had a few &default or &deprecated attributes whose expressions
evaluate to a value long enough to warrant different formatting or
even truncation.
2019-07-03 11:09:10 -07:00
Johanna Amann
c0e3b8c66f Deprecate rfb_event.
Fixes GH-446
2019-07-03 02:15:34 -07:00
Tim Wojtulewicz
ba02b03f7e Update submodules for JSON work 2019-07-02 13:16:23 -07:00
Tim Wojtulewicz
9b76e8faf4 Modify JSON log writer to use the external JSON library 2019-07-02 13:14:52 -07:00
Tim Wojtulewicz
33a7927704 Add proper JSON serialization via C++, deprecate json.zeek 2019-07-02 12:52:26 -07:00
Tim Wojtulewicz
385de9b0e7 Add new method for escaping UTF8 strings for JSON output 2019-07-02 12:52:26 -07:00
Tim Wojtulewicz
2cb87c3309 Move do_sub method from zeek.bif to StringVal class method 2019-07-02 12:52:26 -07:00
Tim Wojtulewicz
528bad72de Move record_fields method from zeek.bif to Val class method 2019-07-02 12:52:25 -07:00
Tim Wojtulewicz
dffefe0683 Add ToStdString method for StringVal 2019-07-02 12:52:25 -07:00
Zeke Medley
f18464f1f8 remove some leftover debug output 2019-07-01 14:26:02 -07:00
Zeke Medley
6e84a5eb8e Merge branch 'master' of https://github.com/zeek/zeek into topic/zeke/closures 2019-07-01 13:43:48 -07:00
Zeke Medley
409f27955b Call parent constructor from LambdaExpr. 2019-07-01 13:36:28 -07:00
Tim Wojtulewicz
20c320d62b Add clang-tidy rule to CMake including a base configuration 2019-07-01 12:09:55 -07:00
Johanna Amann
3cdda7647f Merge remote-tracking branch 'origin/topic/jsiwek/gh-443-fix-timestamp-0-logs'
* origin/topic/jsiwek/gh-443-fix-timestamp-0-logs:
  GH-443: fix uses of timestamp 0 in cluster diagnostic logs
2019-07-01 01:29:41 -07:00
Johanna Amann
1ebd3adf20 Merge remote-tracking branch 'origin/topic/jsiwek/gh-243-wrap-up-deprecation-removal'
* origin/topic/jsiwek/gh-243-wrap-up-deprecation-removal:
  Improve deprecation warning messages
  Remove deprecated DNS events
  Remove BackDoor analyzer
  Remove InterConn analyzer
  Remove deprecated/unused irc_servers option
  Remove deprecated print_hook event
  Remove dead code: dump_used_event_handlers
  Remove unused software_version_found events
  Remove deprecated open_log_file and log_file_name functions
  Remove deprecated/unused "packet" type
  Un-deprecate anonymizer BIFs
  Un-deprecate file rotation functions
2019-07-01 01:14:29 -07:00
Johanna Amann
8d5b7007ec Merge remote-tracking branch 'origin/topic/jsiwek/gh-380-bypass-caf-spinlock-problems'
* origin/topic/jsiwek/gh-380-bypass-caf-spinlock-problems:
  Switch default CAF scheduler policy to work sharing
2019-07-01 00:53:07 -07:00
Johanna Amann
85cd38a3e1 Update 3rdparty submodule.
This updates sqlite to 3.28.0.

Fixes GH-448

 [nomail]
2019-07-01 00:47:08 -07:00
Jon Siwek
5b64c35185 Switch default CAF scheduler policy to work sharing
It may generally be better for our default use-case, as workers may
save a few percent cpu utilization as this policy does not have to
use any polling like the stealing policy does.

This also helps avoid a potential issue with the implementation of
spinlocks used in the work-stealing policy in current CAF versions,
where there's some conditions where lock contention causes a thread
to spin for long periods without relinquishing the cpu to others.
2019-06-28 16:34:33 -07:00
Zeke Medley
f47390f66a Merge branch 'master' of https://github.com/zeek/zeek into topic/zeke/closures 2019-06-28 16:22:18 -07:00
Seth Hall
9795782ecb
Merge pull request #324 from zeek/topic/jsiwek/gh-320
Improve RFB (VNC) protocol parsing
2019-06-28 17:27:16 -04:00
Jon Siwek
430f9a92c6 GH-443: fix uses of timestamp 0 in cluster diagnostic logs
For broker.log and cluster.log: there was a race condition.  A worker's
first IOSource that it processes is potentially Broker if there were
no packets available yet and thread scheduling happens to work out
such that network connections (inside CAF threads) become established
before we enter the main I/O loop.  Such peering establishments would
generate logs with timestamp 0 as there was not yet any code path
taken that would update network_time.

For reporter.log: any non-worker (packet-processing) node would just
unnecessarily use a timestamp of 0 for their reporter messages.
2019-06-27 23:00:42 -07:00
Jon Siwek
7d2d63551d Improve deprecation warning messages 2019-06-27 18:36:27 -07:00
Jon Siwek
0edc7c6cbb Remove deprecated DNS events
- dns_full_request
- non_dns_request
2019-06-27 18:30:48 -07:00
Jon Siwek
7dc3fca754 Remove BackDoor analyzer 2019-06-27 18:25:43 -07:00
Jon Siwek
a940cf3fb5 Remove InterConn analyzer 2019-06-27 18:05:32 -07:00
Jon Siwek
a520433636 Remove deprecated/unused irc_servers option 2019-06-27 17:48:01 -07:00
Jon Siwek
e9fefa6501 Remove deprecated print_hook event 2019-06-27 17:43:20 -07:00
Jon Siwek
5343924eb9 Remove dead code: dump_used_event_handlers 2019-06-27 17:43:20 -07:00
Jon Siwek
2655a65331 Remove unused software_version_found events
- software_version_found
- software_unparsed_version_found
- software_parse_error
2019-06-27 17:43:20 -07:00
Jon Siwek
b635cc240b Remove deprecated/unused "packet" type 2019-06-27 17:43:20 -07:00
Jon Siwek
88ffe06004 Un-deprecate anonymizer BIFs 2019-06-27 17:43:20 -07:00
Jon Siwek
ea43c154cf Un-deprecate file rotation functions
- rotate_file
- rotate_file_by_name
- calc_next_rotate

These still have use-cases even though no longer used for our logging
functionality.  E.g. rotate_file_by_name may be used to rotate
pcap dump files.

Also the log_rotate_base_time option was marked deprecated, but still
used in the new logging framework.
2019-06-27 16:13:22 -07:00
Zeke Medley
fef8aeb123 Merge branch 'master' of https://github.com/zeek/zeek into topic/zeke/closures 2019-06-27 14:39:08 -07:00
Zeke Medley
28253b24f9 Table defaults capture closures. 2019-06-27 14:38:38 -07:00
Jon Siwek
dafc44e8b9 Merge remote-tracking branch 'origin/topic/johanna/gh-375-remove-brofile-cache'
* origin/topic/johanna/gh-375-remove-brofile-cache:
  Remove the BroFile cache

Fixes GH-375
2019-06-27 12:09:31 -07:00
Johanna Amann
5052dc03fc Remove the BroFile cache
GH-375
2019-06-26 16:32:18 -07:00
Zeke Medley
8ed18ca194 Make ClosureFrame safe & cleanup
TODO: make anonymous-funcs associated with tables capture closures,
implement copy constructor for Frame, & other cleanup.
2019-06-26 15:05:57 -07:00
Seth Hall
eb690a18cc
Merge branch 'master' into topic/jsiwek/gh-320 2019-06-26 14:47:01 -04:00
Johanna Amann
44b657687a Fix creating a StringVal from std::string.
Currently, creating a StringVal from a std::string did not work with
data that contains \0 characters. This easy fix changes this - and
should also lead to a small speed increase for code using this
constructor.

This obviously means that more data might copied now in some cases that
were previously cut off at the first 0-byte. Our test-suite did not
reveal any such cases.
2019-06-26 11:41:39 -07:00
Zeke Medley
670816ad48 Merge branch 'master' of https://github.com/zeek/zeek into topic/zeke/closures 2019-06-25 10:48:39 -07:00
Johanna Amann
750fa2e226 Merge remote-tracking branch 'origin/topic/jsiwek/gh-427-fix-zeekygen-default-vals'
* origin/topic/jsiwek/gh-427-fix-zeekygen-default-vals:
  GH-427: improve default ID values shown by Zeekygen
2019-06-25 10:39:15 -07:00
Jon Siwek
9e9440e88d GH-427: improve default ID values shown by Zeekygen
The default value of an ID is now truly the one used to initialize it,
unaltered by any subsequent redefs.

Redefs are now shown separately, along with the expression that
modifies the ID's value.
2019-06-24 19:02:05 -07:00
Johanna Amann
c139ad07f4 Unbreak build on Linux.
Turns out os-x does not to include memory...
2019-06-24 15:51:04 -07:00
Johanna Amann
31973f76ce Rename paraglob_get to paraglob_match
After going back to the original bug, I think this naming makes things a
bit more understandable.

GH-268
2019-06-24 15:44:21 -07:00
Johanna Amann
54613ad2b8 Merge remote-tracking branch 'origin/topic/jsiwek/gh-435-rpc-crash'
* origin/topic/jsiwek/gh-435-rpc-crash:
  GH-435: fix null pointer deref in RPC analyzer
2019-06-24 15:26:27 -07:00
Johanna Amann
5f9a9bbcbe Merge branch 'paraglob' of https://github.com/ZekeMedley/zeek
* 'paraglob' of https://github.com/ZekeMedley/zeek:
  Add leak test to paraglob.
  Catch paraglob serialization errors in DoClone.
  Update paraglob serialization.
  Stop execution on paraglob error.
  Update paraglob submodule
  Change C++11 detection in paraglob.
  Make paraglob serializable and copyable.
  Initial paraglob integration.

I made a bunch of small changes:
 * paraglob now deals better with \0 characters
 * I rolled back the changes to Binary Serialization format,
 * there were some small formatting issue
 * the error output was slightly unsafe
 * build_unique is now in util.h.

and perhaps a few more small things.
2019-06-24 15:21:46 -07:00
Jon Siwek
8cb8c83daf GH-435: fix null pointer deref in RPC analyzer
Was possible for some failed parsing calls in
RPC_Interpreter::DeliverRPC to set buf to a null-pointer, only for it
to later access it when checking whether the message length appeared
to be legit.

Adding the null-initialization of buf in RPC_Interpreter::Timeout()
was just precautionary -- didn't look like any real bugs with anyone
accessing its uninitialized state at the moment.
2019-06-24 10:43:35 -07:00
Zeke Medley
6fd7d8c4d4 Sync with master for merge. 2019-06-24 09:40:43 -07:00
Zeke Medley
f27209e84c Merge branch 'master' of https://github.com/zeek/zeek into topic/zeke/closures 2019-06-21 12:31:34 -07:00
Zeke Medley
b280c62ea5 ClosureFrame takes ownership of its captured vals. 2019-06-21 12:31:10 -07:00