Arne Welzel

heap-use-after-free when builtin plugin is also installed into `lib/plugins`

5

Somewhere in the corner of asking for trouble: When building Zeek with AF_Packet support builtin (#2401) and then also building and installing the plugin externally, there's a `heap-user-after-free` triggered on...

dns_mgr priming test failures in ci

2

I've seen this twice now, so opening an issue. This happened in a `centos-7` job. ``` [doctest] doctest version is "2.4.8" [doctest] run with "--help" for options =============================================================================== ../../src/DNS_Mgr.cc:1614: TEST...

Include in Jan's AF_PACKET plugin as builtin plugin

10

This has come up a few times and the motivation is mainly better "first timer" experience with Zeek. Concretely, if one wants to run a Zeek cluster with multiple workers...

Introduce generic analyzer_confirmation_info and analyzer_violation_info

7

Introduce two new events for analyzer confirmation and analyzer violation reporting. The current analyzer_confirmation and analyzer_violation events assume connection objects and analyzer ids are available which is not always the...

spicy/justrx: src/re-parse.y:3:2: error: unterminated conditional directive (macosx_monterey only)

1

The macosx_monterey task is failing regularly. @rsmmr suggested it's a compiler error and I finally looked. There's some issue with spicy, justrx, __clang_analyzer__. https://cirrus-ci.com/task/5958948548247552 ``` ... [ 10%] Building C...

Runtime of copy() for tables of different sizes varies hugely

9

Splitting this out from #2386: Runtime for copying a table of a simple string to count table varies wildly and unexpectedly. Initial population time and pure iteration time appear to...

copy() of table with 10mio (and 5.0mio and 2.3mio) entries: fatal error: Dictionary (size 1452082) insertion distance too far: 65535

2

@Mohan-Dhawan reports fatal/errors when copying a table with 10 million entries crashes with "fatal error: Dictionary (size 1452082) insertion distance too far: 65535". Tested with Zeek 4.2.2 and Zeek 5.0....

Could broker::table be unordered_map instead?

8

Testing some scenarios in zeek/zeek#2394, `_Rb_tree` code is standing out in the profiles for publish_id of a table with 1mio entries. Maybe using `std::unordered_map` for `broker::table` could improve performance for...

vector::erase() performance bottleneck

5

In zeek/zeek#2394 a performance bottleneck pointing at `vector::erase()` was observed. The following test reproduced this by starting 16 workers and a manager, then produces 1mio Intel items in quick succession...

Make sure these boxes are signed before submitting your Pull Request -- thank you. - [x] I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html - [x] I have signed...