Zeek

Recent Commits

• Tim Wojtulewicz(21 Aug 26)

  Regenerate docs to include limit_reached_weird [nomail]

• Tim Wojtulewicz(21 Aug 26)

  Start of v9.1.0 development

• Tim Wojtulewicz(21 Aug 26)

  Add a few additional entries to the 9.0 NEWS

• Tim Wojtulewicz(21 Aug 26)

  Fix environment variable usage in coverage upload

• Tim Wojtulewicz(21 Aug 26)

  Merge remote-tracking branch 'origin/topic/timw/limitreachedweird-bif' * origin/topic/timw/limitreachedweird-bif: Rename HIST_UNKNOWN_PKT to HIST_ANALYZER_LIMIT_REACHED Use limit_reached_weird in a few instances Add a BIF to exercise Reporter::LimitReachedWeird() from scripts Move LimitReachedWeird() to Conn, delegate to it from Analyzer

• Tim Wojtulewicz(21 Aug 26)

  Rename HIST_UNKNOWN_PKT to HIST_ANALYZER_LIMIT_REACHED

• Tim Wojtulewicz(20 Aug 26)

  Use limit_reached_weird in a few instances

• Tim Wojtulewicz(12 Aug 26)

  Add a BIF to exercise Reporter::LimitReachedWeird() from scripts

• Tim Wojtulewicz(14 Aug 26)

  Move LimitReachedWeird() to Conn, delegate to it from Analyzer

• Tim Wojtulewicz(21 Aug 26)

  Merge remote-tracking branch 'origin/topic/bbannier/redis-fixes' * origin/topic/bbannier/redis-fixes: Guard against empty `reply_queue` in Redis `DoExpire` Use binary-safe `DEL` in Redis `DoExpire`

• Tim Wojtulewicz(21 Aug 26)

  Merge remote-tracking branch 'origin/topic/etyp/btest-diagnosing-failures' * origin/topic/etyp/btest-diagnosing-failures: doc/btest: Move non-pcap tests earlier doc/btest: Add "Diagnosing Test Failures" section

• Evan Typanski(21 Aug 26)

  doc/btest: Move non-pcap tests earlier This section was moving further and further away from the content it was contrasting. I think it makes sense here.

• Evan Typanski(21 Aug 26)

  doc/btest: Add "Diagnosing Test Failures" section We don't ever talk about btest failures. In fact, I tend to diagnose failures poorly, overly rely on `-U`, and remember struggling with multi-file tests. This hopefully clarifies most of these points with a simple example for users. There are some caveats. `btest -U` seems to struggle with the `.btest.failed.dat` file, probably from some lack of use. I would rather we clean that up than describe the annoying behavior here. So, here it clarifies intent. Then, users can use their human brain judgement to figure out if what's happening actually makes sense.

• Evan Typanski(21 Aug 26)

  Merge remote-tracking branch 'origin/topic/etyp/dual-transport-crash' * origin/topic/etyp/dual-transport-crash: tcp: Error on mismatched analyzer transport

• Tim Wojtulewicz(20 Aug 26)

  Merge remote-tracking branch 'sujalavnelavai/patch-4' * sujalavnelavai/patch-4: Update doc/security-considerations.rst Update doc/security-considerations.rst docs: add security guidance for ZeekControl SSH access

• Tim Wojtulewicz(20 Aug 26)

  Update zeek-aux submodule [nomail]

• Sujala Vasanthasena Nelavai(20 Aug 26)

  Update doc/security-considerations.rst Made changes as suggested by the maintainer. Co-authored-by: Tim Wojtulewicz <[email protected]>

• Sujala Vasanthasena Nelavai(20 Aug 26)

  Update doc/security-considerations.rst Improved the sentence as suggested by the maintainer. Co-authored-by: Tim Wojtulewicz <[email protected]>

• Evan Typanski(18 Aug 26)

  tcp: Error on mismatched analyzer transport When a Spicy analyzer `replace`'d a TCP analyzer with a UDP analyzer, Zeek would happily `static_cast` it into a TCP analyzer, thus crashing. This does two things: 1) Guard those casts behind a guard that ensures it's TCP 2) Prevent the analyzer from attaching to that port in the first place This should still allow the analyzer to function, but it will error and avoid registering if we're replacing TCP with UDP. This way we don't need any silent behavior. Note that the analyzer will still function with UDP traffic, but it will emit an error for TCP traffic. Fixes #3787 Fixes #5793

• Tim Wojtulewicz(20 Aug 26)

  Merge remote-tracking branch 'origin/topic/timw/circleci-remove-docker-date-naming' * origin/topic/timw/circleci-remove-docker-date-naming: Remove DOCKER_BUILDIMAGE_LOGIN environment variable CCI: Add hashes of Dockerfiles to setup parameters

• Tim Wojtulewicz(20 Aug 26)

  Merge remote-tracking branch 'origin/topic/awelzel/5806-systemd-generator-do-not-set-capability-bounding-set' * origin/topic/awelzel/5806-systemd-generator-do-not-set-capability-bounding-set: tools/systemd-generator: Add multi-user.target.wants/zeek.target symlink doc/systemd: Document AmbientCapabilities default and customization options tools/systemd-generator: Set working directory for zeek-setup.service tools/systemd-generator: Drop setting CapabilityBoundingSet

• Tim Wojtulewicz(20 Aug 26)

  Merge remote-tracking branch 'origin/topic/bbannier/bump-package-manager' * origin/topic/bbannier/bump-package-manager: Bump `auxil/package-manager`

• Tim Wojtulewicz(20 Aug 26)

  Merge remote-tracking branch 'origin/topic/johanna/ssh-kex-group18' * origin/topic/johanna/ssh-kex-group18: SSH: Recognize diffie-hellman-group18-sha512 as fixed-group DH KEX

• Tim Wojtulewicz(20 Aug 26)

  Merge remote-tracking branch 'origin/topic/bbannier/bump-zeekctl' * origin/topic/bbannier/bump-zeekctl: Bump `auxil/zeekctl` for zeek/zeekctl#110

• Arne Welzel(20 Aug 26)

  tools/systemd-generator: Add multi-user.target.wants/zeek.target symlink This is needed to make systemd start the zeek.target together with multi-user.target automatically, instead of requiring and extra symlink in /etc/systemd/system/ or so.

• Arne Welzel(20 Aug 26)

  doc/systemd: Document AmbientCapabilities default and customization options

• Benjamin Bannier(20 Aug 26)

  Bump `auxil/package-manager`

• Arne Welzel(20 Aug 26)

  tools/systemd-generator: Set working directory for zeek-setup.service Run zeek-setup.service within the configured base_dir. This allows to use relative paths in drop-in files for zeek-setup.service.

• Arne Welzel(20 Aug 26)

  tools/systemd-generator: Drop setting CapabilityBoundingSet Closes #5806

• Johanna Amann(19 Aug 26)

  SSH: Recognize diffie-hellman-group18-sha512 as fixed-group DH KEX The key exchange algorithm ladder in update_kex() checked diffie-hellman-group16-sha512 twice, so group18 never matched. It fell through to the ssh_unknown_kex_algorithm weird without setting a parse state, leaving both directions in KEX_INIT, and the client's following SSH_MSG_KEXDH_INIT was then parsed as another KEXINIT. Add a btest with a trace captured from OpenSSH 10.3 connecting to OpenSSH 10.2 with the client restricted to group18 via KexAlgorithms=diffie-hellman-group18-sha512. This change was AI-assisted, produced with Claude Code. Co-Authored-By: Claude Opus 5 <[email protected]>