Arne Welzel

This is a script-only change that unrolls File::Info records into multiple files.log entries if the same file was seen over different connections by single worker. Consequently, the File::Info record gets...

Concretely, the proxies in below scenario take ~16seconds to start and it seems the workers are giving up after `10 * ZEEK_DEFAULT_CONNECT_RETRY` connect attempts. This reproduces with Zeek 5.0.0, but...

Broker::create_master is very slow when using Broker::scheduler_policy = "stealing"

4

Doing more with Broker stores. Below script inserts 1000 entries into a broker backed table (sqlite) and sets Broker::scheduler_policy to "stealing" The very first run populating the database takes ~0.5seconds...

Broker::Store tables with expiration triggering initialization errors (4.2.2 and 5.0.0)

9

Hey, while fuzzing around with Broker::Store, ran into the following issue observed also by @mdhawan on systems he has was working on (suspecting unrelated to any freezing, however). When setting...

Test case: Create a sample plugin with `init-plugin` with the following enum declaration in `src/myplugin.bif`: ``` module MyPlugin; enum MyEnum %{ MyEnumA, MyEnumB, %} ``` Running the following test-script fails...

Concurrent HTTP range requests: Bogus missing_bytes?

4

Running the following 3 independent curl request, picking 3 independent 10k ranges from a 100MB file produces a single `files.log` entry and 3 `http.log` entries. ``` $ curl -s -4...

promtool check metrics inconsistencies in "internal" metrics

1

Running `promtool check metrics` for the broker / caf generated Prometheus metrics indicates some conventions are not adhered to. ``` $ curl -sf http://localhost:4242/metrics | promtool check metrics broker_processed_elements counter...

when statement with missing capture triggering heap-buffer-overflow

3

The following script with Zeek 5.0 and latest master ASAN build causes heap-buffer-overflow reports. Adding `[url]` to `when` solves the warning and appears to fix the crash, but maybe there's...

This goes the hard-exit on conflicts route as IMO it provides better messaging that something is wrong, rather than defaulting to something the user may not expect. Fixes #2403

Support disabling packet analyzers

2

This ticket is about tracking ideas and implementing functionality to disable packet analyzers. Existing analyzers for tunnels have special `enable` flags. https://github.com/zeek/zeek/blob/875e81883c666e2058a976bd84e5ebd734e9faf2/src/const.bif#L18-L22 These are not runtime changeable (though there may...