Arne Welzel

Populate script_id$type_name with what the type_name() bif would produce for the same identifier. Closes #3490

zeek.bif: Add find_in_zeekpath() helper

4

Relates to #3594. This helper can be used to determine the path that will be used by @load, if at all. Usage example: @if ( find_in_zeekpath("my-package") != "" ) @load...

spicyz: ccache busting due to current time in generated _spicy_init.cc files

1

Observing ineffective ccache usage and looking, the C++ code generated by the spicyz glue-compiler includes the current time, resulting in ccache being ineffective for the `_spicy_init.cc` files. ``` $ diff...

Add prof.log metrics to telemetry

1

Some of the `prof.log` data produced would be useful to be exposed via the telemetry framework and Prometheus directly. Either by leveraging the C++ API or scripting. Reference to method...

fuzzers: Disable other protocol analyzers

1

This came up when creating a fuzzer for the WebSocket analyzer: WebSocket is just a thin framing protocol and running the fuzzer locally indicated that it very quickly tickled all...

Dict: Assertion `iter->next == Capacity()' failed.

1

While fuzzing around with the test case for#3537 , found the following scenario tickling a separate issue: In a non-debug build it causes segfaults instead of assertion errors, happens with...

With #3354 we broke the OpaqueVal API for plugins without noticing. Prior breakage was failing to propagate OpenSSL include headers on OSX. @ckreibich [suggests](https://zeekorg.slack.com/archives/CTGDG83B8/p1704493777584509?thread_ts=1704408047.819209&cid=CTGDG83B8) > using a couple of external...

Null-deref in WhenStmt description

1

This doesn't happen with 6.0.2, but triggers with latest master (zeek version 6.2.0-dev.134) ``` $ cat x.zeek function f() { local x = 1; local y = 2; when [x,...

HTTP rule matching: Multipart data fed twice to matcher and state reset

1

The way HTTP entities are processed and data fed to the rule matcher via `DeliverBodyClear()` causes multipart body content to be fed to the matcher twice. The following btest triggers...

There's currently no functionality for a Spicy protocol analyzer to forward data into the signature framework. Think `Rule::HTTP_REQUEST_BODY` for the HTTP analyzer.