Zeek

Recent Commits

• Tim Wojtulewicz(14 Aug 26)

  Merge remote-tracking branch 'origin/topic/timw/update-ca-ct-lists-for-9.0' * origin/topic/timw/update-ca-ct-lists-for-9.0: Refresh CT/CA lists to the latest versions

• Benjamin Bannier(14 Aug 26)

  Merge branch 'topic/bbannier/issue-5787'

• Benjamin Bannier(14 Aug 26)

  Merge branch 'topic/bbannier/issue-5782'

• Arne Welzel(14 Aug 26)

  Merge remote-tracking branch 'origin/topic/awelzel/doc-news-policy-management-framework-deprecation' * origin/topic/awelzel/doc-news-policy-management-framework-deprecation: doc/NEWS/policy: Deprecate the Management Framework

• Benjamin Bannier(14 Aug 26)

  Guard `hilti/rt/3rdparty` include path against absent Spicy headers Zeek's install tree may split Spicy development headers into a separate component (e.g., a dedicated `-spicy-devel` package). When only the core development files are installed, the `include/hilti/rt/3rdparty` directory does not exist. Previously, `9dbcbc7c08` baked this path into `Zeek::DynamicPluginBase`'s `INTERFACE_INCLUDE_DIRECTORIES` via an `INSTALL_INTERFACE` generator expression. CMake validates all such paths at configure time, so external plugins failed to configure when the Spicy headers were not present. Move the include path addition from the exported target into `ZeekConfig.cmake` where we can check whether the directory actually exists before appending it. Plugins that do need HILTI runtime headers still get the path when available; plugins that do not (or installs without Spicy development files) no longer fail at configure time. Closes #5787.

• Benjamin Bannier(14 Aug 26)

  Fix use-after-free in `TableVal::Assign` when `&on_change` handler deletes the new entry `CallChangeFunc` invokes user script code which could delete the entry that was just inserted. After it returns, `new_entry_val` is a dangling pointer, but `poc_state->OnChange` still dereferences it via `new_entry_val->GetVal()`. We capture the value in an owning `ValPtr` before invoking user code so it remains valid regardless of what the handler does to the table. Introduced in a96ede7476 (v8.2.0).

• Benjamin Bannier(14 Aug 26)

  Fix crash in `TableVal::Remove` for tables with `&on_change` and singleton keys `Remove(const Val&, ...)` called `RecreateIndex` on the hash key returned by `MakeHashKey`. For singleton key types (e.g. a plain `count`), `MakeHashKey` stores the value inline in the `HashKey` union rather than heap-allocating it. `RecoverVals` (called by `RecreateIndex`) asserts the key is heap-allocated, triggering an internal error. We use the already-available `index` parameter directly instead of round-tripping through the hash key representation. Introduced in b027b69f5d (v6.0.3). Closes #5782.

• zeek-bot(14 Aug 26)

  Docs: Regenerated via GitHub workflow [nomail] [skip ci]

• Tim Wojtulewicz(13 Aug 26)

  Merge remote-tracking branch 'origin/topic/bbannier/issue-5698' * origin/topic/bbannier/issue-5698: Exclude unused submodule paths from dist tarball

• Tim Wojtulewicz(13 Aug 26)

  Refresh CT/CA lists to the latest versions

• Arne Welzel(13 Aug 26)

  Merge branch 'topic/mohan/krb-ap-message-logging' of https://github.com/Mohan-Dhawan/zeek * 'topic/mohan/krb-ap-message-logging' of https://github.com/Mohan-Dhawan/zeek: added a new signature for AP request event per the comments update AP message logging

• Mohan Dhawan(12 Aug 26)

  added a new signature for AP request event per the comments

• Mohan Dhawan(03 Aug 26)

  update AP message logging

• Evan Typanski(12 Aug 26)

  Merge remote-tracking branch 'origin/topic/etyp/zam-cat-crash' * origin/topic/etyp/zam-cat-crash: ZAM: Fix `cat()` self-assignment corrupted refcount

• Arne Welzel(05 Aug 26)

  doc/NEWS/policy: Deprecate the Management Framework

• Benjamin Bannier(11 Aug 26)

  Exclude unused submodule paths from dist tarball This adds `DIST_EXCLUDE` to remove paths not exercised by the top-level Zeek build from the release tarball (test frameworks, standalone-only dependencies, duplicate vendored copies). Currently we use it to exclude unused Git submodules, but the variable should also be useful to exclude certain directories like 3rdparty test files from the release tarball. We do not attempt to move rarely used dependencies like `auxil/vcpkg` out of the tarball and require out-of-band manual installation, but this seems like a natural extension on top of the changes here. Closes #5698.

• Benjamin Bannier(12 Aug 26)

  Merge branch 'topic/bbannier/issue-5769'

• Benjamin Bannier(11 Aug 26)

  Expose HILTI runtime include paths to dynamic plugins Out-of-tree plugins that transitively include HILTI runtime headers (e.g., `hilti/rt/fmt.h` via `zeek/spicy/manager.h`) fail to compile because `zeek_dynamic_plugin_base` did not propagate the necessary include paths. Add both the HILTI runtime include directory and its 3rdparty subdirectory to the dynamic plugin interface target. The issue was introduced by zeek/spicy@307d94c43, first pulled into Zeek via 1f85a507d4. Closes #5769.

• Arne Welzel(10 Aug 26)

  Merge branch 'fix/in6-addr-include' of https://github.com/neilpang/zeek * 'fix/in6-addr-include' of https://github.com/neilpang/zeek: tools/systemd-generator: build the systemd generator on Linux only

• Tim Wojtulewicz(07 Aug 26)

  Merge remote-tracking branch 'origin/topic/timw/upgrade-gitpython-for-docs-builds' * origin/topic/timw/upgrade-gitpython-for-docs-builds: Bump version of GitPython used by docs builds

• Tim Wojtulewicz(07 Aug 26)

  Bump version of GitPython used by docs builds

• neil(07 Aug 26)

  tools/systemd-generator: build the systemd generator on Linux only

• Evan Typanski(06 Aug 26)

  Merge remote-tracking branch 'origin/topic/etyp/spicy-loc-canonifier' * origin/topic/etyp/spicy-loc-canonifier: Canonify Spicy locations in tests as `<location>`

• Evan Typanski(05 Aug 26)

  Canonify Spicy locations in tests as `<location>` Many locations had exact line numbers, which are brittle in tests. This removes those in favor of a new line/column number canonifier. A number of tests had workarounds already, so this replaces them with the new canonifier.

• Evan Typanski(06 Aug 26)

  Merge remote-tracking branch 'origin/topic/etyp/test-fail-weird' * origin/topic/etyp/test-fail-weird: Fix test failure from #5759

• Evan Typanski(05 Aug 26)

  Fix test failure from #5759

• Arne Welzel(05 Aug 26)

  Merge remote-tracking branch 'origin/topic/awelzel/analyzer-weirdx-helper' * origin/topic/awelzel/analyzer-weirdx-helper: Analyzer: Add LimitReachedWeird() helper

• Arne Welzel(05 Aug 26)

  Analyzer: Add LimitReachedWeird() helper There is this evolving pattern of limiting protocol analysis to certain configurable limits. When such limits are reached, Zeek raises a weird mentioning the analyzer name, the limit's variable name and "exceeded" or "reached" and also places a big X into the connection's history. This hasn't been around for very long and only started with the Tunnel::max_depth setting, but has been extended to more protocol analyzers (MIME depth, FTP command length, ...) recently and we're introducing more and more limits. This change adds a new LimitReachedWeird() method to the protocol Analyzer class to do both steps at the same time and updates all existing protocol analyzer users where the limit is known. We have some users in packet analysis, too, but it's not always clear if there's a session/connection, so skipping it there for now.

• Arne Welzel(05 Aug 26)

  Merge remote-tracking branch 'origin/topic/awelzel/skip-plugin-opaque-type-for-zam' * origin/topic/awelzel/skip-plugin-opaque-type-for-zam: btest/plugins/opaque-type: Skip with ZAM enabled

• Arne Welzel(05 Aug 26)

  btest/plugins/opaque-type: Skip with ZAM enabled I had made the test to actually be able to reference NanoTime in script and the default initialization path works with the tree-walking interpreter, but the ZAM side isn't hooked up, so skip for now to prevent this error: error: <...>/zeek/testing/btest/.tmp/plugins.opaque-type/opaque-type.zeek, line 23: value used but not set: nanos fatal error: Optimized script execution aborted due to errors