Commit graph

3749 commits

Author SHA1 Message Date
Tim Wojtulewicz
0604df01e3 Merge remote-tracking branch 'origin/topic/bbannier/issue-1780'
* origin/topic/bbannier/issue-1780:
  Add Github action exercising pre-commit
  Add pre-commit config.
  Format code with `clang-format`
  Remove stale files `src/DebugCmdInfoConstants.*`
  Disable formatting for files in `testing/btest/plugins`
  Move 3rdparty source files to `3rdparty/`
2021-11-09 10:30:14 -07:00
Tim Wojtulewicz
8429ef746d Merge remote-tracking branch 'origin/topic/timw/1819-hashing-segfault'
* origin/topic/timw/1819-hashing-segfault:
  GH-1819: Handle recursive types when describing type in binary mode
2021-11-09 09:46:08 -07:00
Tim Wojtulewicz
9fdc70634f Merge remote-tracking branch 'origin/topic/timw/remove-false-teredo-test'
* origin/topic/timw/remove-false-teredo-test:
  Remove no-op false-teredo test
2021-11-09 09:28:43 -07:00
Benjamin Bannier
b23eb76043 Disable formatting for files in testing/btest/plugins
Files in that folder were previously not formatted. With this patch we
now disable formatting in that folder explicitly by adding a dedicated
`clang-format` config which deactivates any formatting changes.
2021-11-09 07:20:18 +01:00
Tim Wojtulewicz
e0b116154a GH-1819: Handle recursive types when describing type in binary mode 2021-11-08 15:19:57 -07:00
Tim Wojtulewicz
f2ea56379b Remove no-op false-teredo test 2021-11-05 15:51:22 -07:00
Robin Sommer
34eaf42b92 Add new hook HookLoadFileExtended that allows plugins to supply Zeek script code to parse.
The new hooks works similar to the existing `HookLoadFile` but,
additionally, allows the plugin to return a string that contains the
code to be used for the file being loaded. If the plugin does so, the
content of any actual file on disk will be ignored (in fact, there
doesn't even need to be a file on disk in that case). This works for
both Zeek scripts and signatures.

There's a new test that covers the new functionality, testing loading
both scripts and signatures from memory. I also manually tested that the
debugger integration works, but I don't see much of a way to add a
regression test for that part.

We keep the existing hook as well for backwards compatibility. We could
decide to deprecate it, but not sure that buys us much, so left that
out.

Closes #1757.
2021-11-05 13:01:19 +01:00
Robin Sommer
1efaf8d7a4 Move logic to execute HookLoadFile for signatures into rule matcher code.
This (1) fixes an issue where signature files supplied on the command
line wouldn't pass through the hooks, and (2) prepares for allowing
hooks to supply the content of a signature file directly.
2021-11-05 12:58:38 +01:00
Yacin Nadji
cdb52e6460 Curse you tabs! 2021-11-03 15:46:17 -04:00
Yacin Nadji
d426e285eb Add reverse order intersection check 2021-11-03 14:52:45 -04:00
Yacin Nadji
75e584cb73 Change set intersection test to be correct 2021-11-03 14:21:02 -04:00
Tim Wojtulewicz
ceaec09024 GH-693: use pcap_dump_open_append where supported 2021-11-02 17:09:39 -07:00
Johanna Amann
e14b695497 Accept packets that use tcp segment offloading.
When checksum offloading is enabled, we now forward packets that
have 0 header lengths set - and assume that they have TSO enabled.

If checksum offloading is not enabled, we drop the packets.

Addresses GH-1829
2021-10-28 17:12:54 +02:00
Johanna Amann
fe4e06e8ca TLS decryption: remove payload from ssl_encrypted_data again.
There is no reason to make the payload available in the event - it is
still encrypted.
2021-10-19 17:36:48 +02:00
Johanna Amann
b8b6ac744e Merge remote-tracking branch 'origin/master' into topic/johanna/tls12-decryption 2021-10-13 10:49:29 +01:00
FlyingWithJerome
605d4024e4 remove excussive fields in dns_svcb_rr 2021-10-12 21:40:56 -04:00
FlyingWithJerome
ac1ea204fe newlines at the end of test outputs 2021-10-12 17:43:32 -04:00
FlyingWithJerome
d5a6896171 add svcb test case 2021-10-12 17:43:32 -04:00
FlyingWithJerome
ca4b181d35 add a dns https test case 2021-10-12 17:43:32 -04:00
FlyingWithJerome
0849332eb9 fix a few syntax errors 2021-10-12 17:43:32 -04:00
Christian Kreibich
a8ab977b0e Expand table/set tests to cover new index types 2021-10-01 14:03:08 -07:00
Christian Kreibich
b7603faf3d Whitespace tweak in a btest, no other change 2021-10-01 14:03:08 -07:00
Tim Wojtulewicz
e5b163290d Merge remote-tracking branch 'origin/topic/vern/remove-uu'
* origin/topic/vern/remove-uu:
  fix up for linking w/ doc update
  documentation update
  script simplification that removes an unnecessary &is_assigned
  removing -uu functionality and associated script analysis now no longer needed
2021-09-24 10:31:56 -07:00
Robin Sommer
dd5d6e1756 Merge branch 'topic/foxds/dcerpc_auth' of ssh://github.com/fox-ds/zeek
* 'topic/foxds/dcerpc_auth' of ssh://github.com/fox-ds/zeek:
  Fix protocol forwarding in dce_rpc-auth
  Fix protocol forwarding in dce_rpc-auth
2021-09-23 17:50:00 +02:00
FOX-DS
fef4531f78 Fix protocol forwarding in dce_rpc-auth 2021-09-23 08:50:11 -04:00
Robin Sommer
47c35190a4 Sanity-check the method passed into ActiveHTTP.
Reported by Pierre Gaulon.
2021-09-23 12:21:23 +02:00
Tim Wojtulewicz
0a0ed65306 Merge remote-tracking branch 'origin/topic/robin/gh-54-sanitize'
* origin/topic/robin/gh-54-sanitize:
  Sanitize log files names before they go into system().
2021-09-22 12:17:05 -07:00
Vern Paxson
509428a9dc removing -uu functionality and associated script analysis now no longer needed 2021-09-22 11:17:28 -07:00
Christian Kreibich
cfcf1f83cc Add btests for new functionality
- Expand language.set to cover sets of sets
- Expand language.table to cover tables indexed with tables
- Add language.table-nested-set-ordering to capture the reproducer from GHI-1753
2021-09-20 17:51:43 -07:00
Robin Sommer
31d3fb0f6c Merge https://github.com/gpotter2/zeek.
Changes during merge:
  - Add dedicated test (w/ trace "client_timestamp_enabled.pcapng" from Cloudshark)
  - Change types from signed to unsigned.
  - Add cast for bit-shifting operand.
  - clang-format run
2021-09-20 11:41:29 +02:00
gpotter2
d4db9bf6d0 Add TSval and TSecr to TCPSyn 2021-09-17 11:35:16 +02:00
Arne Welzel
b7690bb367 ignore_checksums_nets: Add test for multiple subnets
This test fails with Zeek 4.1 and Zeek 4.0.3.
2021-09-14 21:17:01 +02:00
Tim Wojtulewicz
8414d13030 Merge remote-tracking branch 'origin/topic/vern/vector-hole-loops'
* origin/topic/vern/vector-hole-loops:
  fix for looping over vectors with holes per https://github.com/zeek/zeek/issues/1763
  btest for https://github.com/zeek/zeek/issues/1763
2021-09-08 12:04:56 -07:00
Tim Wojtulewicz
b7e264f8ef Merge remote-tracking branch 'origin/topic/seth/tsv-logs-utf8-by-default'
* origin/topic/seth/tsv-logs-utf8-by-default:
  Fix mis-usage of string::append that leads to an overflow
  Use json_escape_utf8 for all utf8 data in ODesc
  Switch the TSV Zeek logs to be UTF8 by default.
2021-09-08 12:04:13 -07:00
Vern Paxson
acaaa0d36a fix race condition in btest output ordering 2021-09-08 10:23:39 -07:00
Vern Paxson
74fbfa3aae whoops, forgot to canonicalize filenames in new btest 2021-09-08 10:23:39 -07:00
Vern Paxson
9d896d114b extend btest to include a coercion overflow 2021-09-08 10:23:39 -07:00
Vern Paxson
7f3ab84e5c fixed a typo in a comment 2021-09-08 10:23:39 -07:00
Vern Paxson
9757d37332 test case for vector coercions, including holes 2021-09-08 10:23:39 -07:00
Vern Paxson
9b2eb2c373 Baseline variants for "-a zam" 2021-09-08 10:23:38 -07:00
Vern Paxson
9722b4216f new "-a ZAM" testing baseline alternative 2021-09-08 10:23:38 -07:00
Vern Paxson
f89ed411cf updates for usage issues: support for -uu, maybe/definitely distinctions 2021-09-08 10:23:38 -07:00
Vern Paxson
87fce26a0b btest for https://github.com/zeek/zeek/issues/1763 2021-09-07 10:21:50 -07:00
Tim Wojtulewicz
404fed6923 Use json_escape_utf8 for all utf8 data in ODesc 2021-09-07 09:16:53 -07:00
Seth Hall
a4ceb98bf8 Switch the TSV Zeek logs to be UTF8 by default.
There is a paired zeek-testing branch for some updates there.
2021-09-07 09:16:53 -07:00
Tim Wojtulewicz
0746ef7ecc Merge remote-tracking branch 'origin/topic/vlad/analyzer_coverage'
* origin/topic/vlad/analyzer_coverage:
  Add btests for DNS WKS and BINDS
  Add btest for DNS WKS RR.
  Add btest for DNS NSEC3PARAM RR.
2021-09-03 18:12:28 +00:00
Tim Wojtulewicz
0369ca01bc Disable the scripts.base.frameworks.logging.sqlite.simultaneous-writes test under TSan
Due to a bug (or intentional code) in SQLite, we disabled enabling the shared cache
in sqlite3 if running under ThreadSanitizer (see cf1fefbe0b0a6163b389cc92b5a6878c7fc95f1f).
Unfortunately, this has the side-effect of breaking the simultaneous-writes test because
the shared cache is disabled. This is hopefully a temporary fix until SQLite fixes the
issue on their side.
2021-09-03 10:38:15 -07:00
Tim Wojtulewicz
569552b320 GH-1589: Avoid extracting IP-like strings from SMTP headers 2021-09-03 17:35:10 +00:00
Christian Kreibich
b999448e3d Minor updates to the external-testsuite scripts
Delete the unused Baseline folder, remove a Bro-era name from gitignore,
change create-new-repo to work with a second argument that is actually
a URL, and tweak whitespace. Expand description in README and update the
explanation of OPENSSL_ENABLE_MD5_VERIFY in subdir-btest.cfg.
2021-09-01 17:29:40 -07:00
Vlad Grigorescu
f9c36f5c37 Add btests for DNS WKS and BINDS 2021-09-01 12:00:50 -05:00