Tim Wojtulewicz

Use ID name (including module name) to create EventExpr when possible

3

I'm not entirely sure about this one, but it fixes the problem reported in #163. The problem was that we're passing just unscoped event name into the `EventExpr` constructor, so...

Expand fuzzer coverage

4

We currently have coverage for raw packets, pop3, and dns (in a fashion). It would be good to expand our coverage to other major protocols. I'm currently thinking at least...

Add `assert` statement for script-level testing

5

### Discussed in https://github.com/zeek/zeek/discussions/1792 Originally posted by **rsmmr** September 22, 2021 The discussion in #1475 on integrating ZTest led to some of us wondering if we really understand already how...

Store information about the build during 'make install'

3

We ran into some issues with the 4.0-RC testing where we were seeing a bug in an install but couldn't actually know what commits the build was based on. Can...

Add tests that exercise all of the error cases in the expression handling

1

While reviewing https://github.com/zeek/zeek/pull/2277, I realized that we have basically zero tests that exercise the error cases in the `Expr` code. Most of the cases for things like passing strings to...

We recently ran into an issue where we found some different data inside of an Aruba tunnel than expected. This manifested itself on the system as a ton of reporter...

BPF Filtering fails for certain link types

1

This is a follow-up to #1995. When loading a pcap with certain link types, libpcap will return an error that looks like this: ``` fatal error in /Users/tim/Desktop/projects/zeek/scripts/base/frameworks/packet-filter/./main.zeek, line 292:...

ThreadSanitizer build job struggles to complete all tests on Cirrus

1

We recently added a new job on Cirrus that runs the build and btests against ThreadSanitizer. While initial testing of the job looked good and the build passed, it's had...

Find overuse of zeek::id::find in analyzers

1

https://github.com/zeek/zeek/pull/1698 pointed out a few cases in release/4.0 where we were calling `zeek::id::find` for every packet, causing a performance problem. That change needs to be ported to `master` since most...

Events that take EnumTypes as arguments allow other types

6

I discovered a strange effect of using `EnumType` as arguments for events. Apparently our type checking allows something like this to succeed: ``` event test(t : PacketAnalyzer::Tag) { print "3";...