Zeek

Recent Commits

• Arne Welzel(03 Sept 26)

  Merge remote-tracking branch 'origin/topic/awelzel/5795-ldap-del-abandon-fix' * origin/topic/awelzel/5795-ldap-del-abandon-fix: btest/Traces: Use Scapy for new ldap generator scripts ldap: Fix DelRequest using implicit tagging ldap: Fix AbandonRequest using implicit tagging

• Evan Typanski(02 Sept 26)

  Merge branch 'topic/jumptoskyfree/gh-5825-vector-oob-write' of https://github.com/jumptoskyfree/zeek * 'topic/jumptoskyfree/gh-5825-vector-oob-write' of https://github.com/jumptoskyfree/zeek: vector: Fix OOB assignment leading to crash in VectorVal::Assign

• JumpToSkyFree(28 Aug 26)

  vector: Fix OOB assignment leading to crash in VectorVal::Assign vector: Fix OOB assignment in detail::copy_vec_elem

• Benjamin Bannier(02 Sept 26)

  Merge branch 'topic/bbannier/docker-multistage'

• Benjamin Bannier(11 Aug 26)

  Use regular Dockerfile instead of shell-orchestrated build pipeline We previously used a rather complicated setup of building multiple Docker images, all orchestrated by a `Makefile`. This seems to have been done to be able to use ccache when building the images in CI. At the same time, this made local running without the `Makefile` hard and pretty obscure (e.g., exact sequence of shell commands required, but `docker` hardcoded in `Makefile` and little regard for existing tags or tag pollution). This patch replaces what we have with a less unusual setup where on can directly invoke e.g., `docker build -f docker/Dockerfile ...` to produce a working container image. The only feature we loose is reliable caching of compiler artifacts in CI, but we keep that functionality for local runs by using a layer cache. Given that we only rebuild the Docker image for merges to `master` this seems an acceptable trade-off to me, especially since the local workflow becomes less awkward. Other than caching this should produce identical images.

• Arne Welzel(01 Sept 26)

  Merge remote-tracking branch 'origin/topic/awelzel/minor-btest-broker-remote-id-fixup' * origin/topic/awelzel/minor-btest-broker-remote-id-fixup: btest/broker/remote_id: Remove Broker::PEER_UNAVAILABLE errors from stderr

• Arne Welzel(01 Sept 26)

  Merge branch 'topic/dmodium-corelight/fix-readerfrontend-fmt-reentrancy' of https://github.com/dmodium-corelight/zeek * 'topic/dmodium-corelight/fix-readerfrontend-fmt-reentrancy' of https://github.com/dmodium-corelight/zeek: Modernize ReaderFrontend::name to std::string

• Arne Welzel(01 Sept 26)

  btest/Traces: Use Scapy for new ldap generator scripts This was done by Opus 4.8. There's a Scapy API for LDAP, but it said the Abandon and Delete requests didn't work out.

• Arne Welzel(01 Sept 26)

  ldap: Fix DelRequest using implicit tagging Similar to AbandonRequest, the DelRequest directly contains the LDAPDN octetstring. PCAP generator script taken from #5795 directly.

• Arne Welzel(01 Sept 26)

  ldap: Fix AbandonRequest using implicit tagging The integer is encoded directly within an AbandonRequest. The included messageId is at most 4 bytes long (32 bit). PCAP generator script taken from #5795 directly.

• Devendra Modium(24 Aug 26)

  Modernize ReaderFrontend::name to std::string Replace the raw char* name member with std::string, removing the manual copy_string/delete[] lifecycle and the dependency on util::fmt()'s static buffer.

• Arne Welzel(01 Sept 26)

  btest/broker/remote_id: Remove Broker::PEER_UNAVAILABLE errors from stderr When sender peers too early, it produces the following output on stderr: Broker error (Broker::PEER_UNAVAILABLE): (00000000-0000-0000-0000-000000000000, *127.0.0.1:1618, "unable to connect to remote peer") Remove it via TEST_DIFF_CANONIFIER from stderr as done elsewhere.

• zeek-bot(01 Sept 26)

  Docs: Regenerated via GitHub workflow [nomail] [skip ci]

• Tim Wojtulewicz(31 Aug 26)

  Merge remote-tracking branch 'origin/topic/timw/clarify-ai-assisted-contribution-guidance' * origin/topic/timw/clarify-ai-assisted-contribution-guidance: Clarify AI-assisted contribution guidance

• Tim Wojtulewicz(27 Aug 26)

  Clarify AI-assisted contribution guidance

• Tim Wojtulewicz(31 Aug 26)

  Merge remote-tracking branch 'origin/topic/timw/document-security-model' * origin/topic/timw/document-security-model: Document Zeek security model GHCI: Skip builds for branches on changing Markdown files and NEWS

• kyle-elliott-tob(31 Jul 26)

  Document Zeek security model

• Tim Wojtulewicz(26 Aug 26)

  GHCI: Skip builds for branches on changing Markdown files and NEWS

• Arne Welzel(31 Aug 26)

  Merge remote-tracking branch 'origin/topic/awelzel/dict-too-far-to-reach-include-call-stack' * origin/topic/awelzel/dict-too-far-to-reach-include-call-stack: Func/render_call_stack: Avoid null dereferences for global statements Dict: Switch location info to get_current_script_location() or no_location Dict: Include better location info for distance-too-far error Func/render_call_stack: Support skipping args rendering Func: Add get_current_script_location()

• Arne Welzel(31 Aug 26)

  Func/render_call_stack: Avoid null dereferences for global statements Frame might not have a valid function during execution of global global / top-level statements.

• Evan Typanski(31 Aug 26)

  Merge remote-tracking branch 'origin/topic/etyp/delay-test-fix' * origin/topic/etyp/delay-test-fix: Fix flaky timing test (hopefully)

• Christian Kreibich(31 Aug 26)

  Merge branch 'topic/christian/5833-disable-broker-identifier-updates' * topic/christian/5833-disable-broker-identifier-updates: Disable Broker's identifier updates by default

• Christian Kreibich(28 Aug 26)

  Disable Broker's identifier updates by default Zeek now drops transmission and receipt of Broker `IndentifierUpdate` messages by default, to prevent one class of unintended runtime updates to Zeek configuration settings. Reporter errors result instead. The new `Broker::enable_identifier_updates` toggle, defaulting to false, allows restoring the original behavior. The Control framework's `configuration_update` command, the sole known user of identifier updates, now errors out in the controller when updates are disabled.

• Evan Typanski(28 Aug 26)

  Fix flaky timing test (hopefully) Coded by GPT-5.5.

• Arne Welzel(28 Aug 26)

  Merge remote-tracking branch 'origin/topic/awelzel/build-status-badge' * origin/topic/awelzel/build-status-badge: README.md: Fix build status badge

• Tim Wojtulewicz(28 Aug 26)

  Merge remote-tracking branch 'origin/topic/awelzel/revert-python-venv-dependency-additons' * origin/topic/awelzel/revert-python-venv-dependency-additons: Revert "Fix missing python3-venv in a few builds" Revert "CI: Add python3-venv to all of the Ubuntu/Debian dockerfiles"

• Arne Welzel(28 Aug 26)

  README.md: Fix build status badge

• Arne Welzel(28 Aug 26)

  Dict: Switch location info to get_current_script_location() or no_location detail::GetCurrentLocation() is for parse time location information and not better than no_location.

• Arne Welzel(26 Aug 26)

  Dict: Include better location info for distance-too-far error The new detail::get_current_script_location() only works in non-ZAM environments, use no-location as a fallback otherwise. Will still include the script call stack.

• Arne Welzel(28 Aug 26)

  Revert "Fix missing python3-venv in a few builds" This reverts commit d2cd5e2c69f0990143f79bb20b4d06ff82911619.