Zeek

Recent Commits

• Arne Welzel (16 Jun 26)

  Merge remote-tracking branch 'origin/topic/awelzel/sip-fix-as-count-error-to-weird' * origin/topic/awelzel/sip-fix-as-count-error-to-weird: sip: Weird on invalid CONTENT-LENGTH headers

• Arne Welzel (16 Jun 26)

  Merge remote-tracking branch 'origin/topic/awelzel/smb1-write-andx-response' * origin/topic/awelzel/smb1-write-andx-response: smb/smb1_writex_and_response: Fix written_high int overflow by using <<

• Arne Welzel (16 Jun 26)

  Merge remote-tracking branch 'origin/topic/awelzel/utils-atoi-n-overflow' * origin/topic/awelzel/utils-atoi-n-overflow: utils/atoi_n: Switch to std::from_chars utils/atoi_n: Reject neg for unsigned, prevent overflow for signed utils/atoi_n: Prevent overflows and fix digit parsing for base < 10

• Arne Welzel (12 Jun 26)

  utils/atoi_n: Switch to std::from_chars This does all the hard work already.

• Arne Welzel (12 Jun 26)

  utils/atoi_n: Reject neg for unsigned, prevent overflow for signed Mostly add tests for parsing edge cases of int8_t before switching to std::from_chars.

• Arne Welzel (11 Jun 26)

  utils/atoi_n: Prevent overflows and fix digit parsing for base < 10 Fuzzing with UBSAN triggered the n = n * base + d line as overflowing, incorporate the atoi_n changes from Spicy also in the Zeek code and add some tests for the edge cases. Reference zeek/spicy#2382 zeek/spicy#2397

• Tim Wojtulewicz (15 Jun 26)

  Merge remote-tracking branch 'origin/topic/timw/circleci-include-plugins-zeekctl-testing' * origin/topic/timw/circleci-include-plugins-zeekctl-testing: Add zeekctl and include-plugin testing to CircleCI config

• Tim Wojtulewicz (11 Jun 26)

  Add zeekctl and include-plugin testing to CircleCI config

• Tim Wojtulewicz (15 Jun 26)

  Update zeek-testing commit hash to latest commit

• Tim Wojtulewicz (15 Jun 26)

  Merge remote-tracking branch 'origin/topic/bbannier/gh-ci-skip-in-private-repo' * origin/topic/bbannier/gh-ci-skip-in-private-repo: Skip GH CI when running in private repos [skip ci]

• Tim Wojtulewicz (15 Jun 26)

  Merge remote-tracking branch 'origin/topic/timw/ignore-libkqueue-headers-for-clang-tidy' * origin/topic/timw/ignore-libkqueue-headers-for-clang-tidy: Ignore build-time-generated libkqueue headers for clang-tidy

• Tim Wojtulewicz (15 Jun 26)

  Merge remote-tracking branch 'origin/topic/timw/circleci-disable-default-buildx-attestations' * origin/topic/timw/circleci-disable-default-buildx-attestations: Disable default buildx attestations when building docker images

• Arne Welzel (15 Jun 26)

  sip: Weird on invalid CONTENT-LENGTH headers Commit b02623bb74772a859eb2f8494c3e86bef1ddcf35 changed to_count() usage to "as count" casts which is stricter for trailing and fronting whitespace. For this specific usage seems better to just weird if the conversion isn't possible. This was found by OSS-Fuzz because it has "abort on scripting" errors enabled. Fix and triage done by me, test PCAP and btest almsot autonomously via an LLM.

• Arne Welzel (15 Jun 26)

  smb/smb1_writex_and_response: Fix written_high int overflow by using << The uint16 written_high is promoted to int before the multiplication and potentially causes the sign-bit of the int be set, causing UBSAN to report an overflow: /src/zeek/build/src/analyzer/protocol/smb/smb_pac.cc:8456:40: runtime error: signed integer overflow: 56387 * 65536 cannot be represented in type 'int' Bit-shifting with 16 has the same effect, but is not undefined with C++20 anymore, so use this. Alternative would be to create a written_high32 intermediary in the &let section, but the data_len of the write_andx_request uses shifting, too.

• Arne Welzel (15 Jun 26)

  Merge remote-tracking branch 'origin/topic/awelzel/fix-some-pedantic-things' * origin/topic/awelzel/fix-some-pedantic-things: telemetry/ProcessStats: Use %lu for rss_pages binpac: Fix %3o / %2x / %x parsing expecting unsigned int zeek.bif: Fix %hhx expecting unsigned char Fix some %p expecting void* warnings BasicThread/Reporter/Debug/AnalyzerSet: Fix stray semicolon

• Tim Wojtulewicz (12 Jun 26)

  Disable default buildx attestations when building docker images

• Tim Wojtulewicz (12 Jun 26)

  Ignore build-time-generated libkqueue headers for clang-tidy

• Tim Wojtulewicz (12 Jun 26)

  Merge remote-tracking branch 'origin/topic/timw/circleci-general-fixes' * origin/topic/timw/circleci-general-fixes: Fix token usage for GH API requests Pass -y to brew in macOS prepare.sh script Set ZEEK_CI_CPUS based on a parameter for some jobs

• Tim Wojtulewicz (12 Jun 26)

  Fix token usage for GH API requests

• Tim Wojtulewicz (11 Jun 26)

  Pass -y to brew in macOS prepare.sh script

• Tim Wojtulewicz (11 Jun 26)

  Set ZEEK_CI_CPUS based on a parameter for some jobs

• Tim Wojtulewicz (12 Jun 26)

  Merge remote-tracking branch 'origin/topic/timw/update-to-latest-upstream-libkqueue' * origin/topic/timw/update-to-latest-upstream-libkqueue: Update to latest upstream libkqueue

• Tim Wojtulewicz (06 May 26)

  Update to latest upstream libkqueue

• Benjamin Bannier (12 Jun 26)

  Skip GH CI when running in private repos [skip ci] The matrix in our GH CI is huge so it requires a lot of compute. This is fine for public repos which have no compute limit, but an issue for private versions where we would run out of credits in days or hours. With this patch we now only run this CI job if we are in a public repo. An alternative approach would have been to hardcode the repo name, but that would have meant that users couldn't run CI in their forks at all, while now we at least gatekeep on public forks.

• Arne Welzel (12 Jun 26)

  telemetry/ProcessStats: Use %lu for rss_pages We read into an unsigned long and the value should always be positive. This squelches: ProcessStats.cc:154:29: warning: format ‘%ld’ expects argument of type ‘long int*’, but argument 6 has type ‘long unsigned int*’ [-Wformat=]

• Arne Welzel (12 Jun 26)

  binpac: Fix %3o / %2x / %x parsing expecting unsigned int

• Arne Welzel (12 Jun 26)

  zeek.bif: Fix %hhx expecting unsigned char

• Arne Welzel (12 Jun 26)

  Fix some %p expecting void* warnings

• Arne Welzel (12 Jun 26)

  BasicThread/Reporter/Debug/AnalyzerSet: Fix stray semicolon

• zeek-bot (12 Jun 26)

  Docs: Regenerated via GitHub workflow [nomail] [skip ci]