* origin/topic/awelzel/tcp-reassembler-undelivered-data-match-bool-bool-bool-confusion:
TCP_Reassembler: Fix IsOrig() position in Match() call
(cherry picked from commit 4a4cbf2576)
* topic/christian/localversion:
Parse and store localversion string
Remove commented-out code
Check ZEEK_VERSION_LOCAL for dashes
Update version string btests for localversion
Modify version parsing for localversion
Update version used by spicyz
Update build script
Support for configurable localversion
(cherry picked from commit d09584e52e)
* topic/christian/3671-fix-icmp-caplen-violations:
Factor in caplens in ICMPAnalyzer::DeliverPacket length calculations
(cherry picked from commit 7fdbb73511)
OSS-Fuzz managed to produce a MIME multipart message construction with
thousands of nested entities (or that's what Zeek makes out of it anyhow).
Prevent such deep analysis by capping at a nesting depth of 100,
preventing unnecessary resource usage. A new weird named exceeded_mime_max_depth
is reported when this limit is reached.
This change reduces the runtime of the OSS-Fuzz reproducer from ~45 seconds
to ~2.5 seconds.
The test PCAP was produced from a Python script using the email package
and sending the rendered version via POST to a HTTP server.
Closes#208
(cherry picked from commit 4e5849fe82c6097df5d25cd1a74d69ab4fa50f46)
* 'topic/xb-anssi/http_signature_body_end_match' of https://github.com/xb-anssi/zeek:
Let signature framework match HTTP body end
Test how the signature framework matches HTTP body
(cherry picked from commit 8a13155a41)
Limit the number of events raised from an SSL record with content_type
alert (21) to a configurable maximum number (default 10). For TLS 1.3,
the limit is set to 1 as specified in the RFC. Add a new weird for the
in cases where the limit is exceeded.
OSS-Fuzz managed to generate a reproducer that raised ~660k ssl_plaintext
and ssl_alert events together given ~810kb of input data. This prevents
it with hopefully no negative side-effect in the real-world.
The fuzzer generated input where data length left was 14 and the amsdu_len
field set to 14. That caused buffer overread due not taking into account
the amsdu header length of 14.
* origin/topic/awelzel/3190-supervisor-eventmgr-shared-pipe-fix:
event: Reinitialize EventMgr's flare after fork() from stem
(cherry picked from commit 22fb445a7f)
On Slack, a user reported "fortify source" aborts within ares_fds() due
to the FDs used by c-ares exceeding 1024 and thereby larger than the
maximum fd value that a fd_set can hold.
Switch to ares_get_socks() and poll() to avoid this.
Closes#3309.
(cherry picked from commit c4c4a23bfd)
* origin/topic/bbannier/issue-3279:
Fix handling of module scope when checking exported Spicy types for collisions
(cherry picked from commit 30dc6af831)
Setting this option to false does not count missing bytes in files towards the
extraction limits, and allows to extract data up to the desired limit,
even when partial files are written.
When missing bytes are encountered, files are now written as sparse
files.
Using this option requires the underlying storage and utilities to support
sparse files.
(cherry picked from commit afa6f3a0d3b8db1ec5b5e82d26225504c2891089)
In the past, we allocated a buffer with zeroes and wrote that with
fwrite. Now, instead we just fseek to the correct offset.
This changes the way in which the file extract limit is counted a bit;
skipped bytes do no longer count against the file size limit.
(cherry picked from commit 5071592e9b7105090a1d9de19689c499070749d4)
* origin/topic/awelzel/3278-spicy-fix-port-range-off-by-one:
spicy: Do not register port N+1 for port N in .evt file
(cherry picked from commit 6e6a2bee8a)
Avoids loosing state on a connection value when a connection is flipped.
Fixes up the NTP baseline as well where this was visible: analyzer_confirmation_info()
was raised for a connection value which was immediately forgotten due to
the subsequent connection flipping.
Closed#3028
(cherry picked from commit a2214ad611)
* origin/topic/johanna/3205-do-not-parse-udp-padding:
Do not forward more than the remaining data to downstream UDP analyzer
(cherry picked from commit 3c7a52d0a7)
* origin/topic/awelzel/3145-dcerpc-state-clean:
dce-rpc: Test cases for unbounded state growth
dce-rpc: Handle smb2_close_request() in scripts
smb/dce-rpc: Cleanup DCE-RPC analyzers when fid is closed and limit them
dce-rpc: Do not repeatedly register removal hooks
(cherry picked from commit f9904511ab)
* origin/topic/timw/force-std-c++-17:
Force -std=c++17 mode for plugin targets, remove use of RequireCXX17.cmake
(cherry picked from commit 48af56c00b)
* origin/topic/awelzel/3090-propagate-doctest-defines:
Options: Do not output full usage on --test error
CMakeLists: Propagate DOCTEST defines to external plugins
(cherry picked from commit 2fddddbf51)
We previously would reprent port ranges from EVT files element-wise.
This can potentially generate a lot of code (all on a single line
though) which some versions of GCC seem to have trouble with, and which
also causes JIT overhead.
With this patch we switch to directly representing ranges. Single ports
are represented as ranges `[start, start]`.
Closes#3094.
* origin/topic/vern/at-if-analyze:
updates reflecting review comments
change base scripts to use run-time if's or @if ... &analyze
a number of BTests updated with @if ... &analyze
update for scripting coverage BTest demonstrating utility of @if ... &analyze
BTests for new @if ... &analyze functionality
"if ( ... ) &analyze" language feature
classes for tracking "@if (...) &analyze" notion of code being/not being "activated"
RemoveGlobal() method for Scope class + simplifying interfaces
When a Spicy unit type was used in an EVT event definition, it could
end up being cleared out at the time the logic for `export` got to see it.
Closes#3083.
Note: This needs backporting to the legacy plugin.