Awesome Privacy

Recent Commits

• Tim Wojtulewicz (25 Feb 26)

  Merge remote-tracking branch 'maor/ms/windows/build' * maor/ms/windows/build: make build pass on windows

• Maor Hamami (23 Feb 26)

  make build pass on windows

• Arne Welzel (24 Feb 26)

  Merge remote-tracking branch 'origin/topic/awelzel/doc-pf-ring-update' * origin/topic/awelzel/doc-pf-ring-update: cluster/pf_ring: Update instructions to use 9.2.0

• Arne Welzel (24 Feb 26)

  cluster/pf_ring: Update instructions to use 9.2.0 ...and leave a note about the libkqueue/epoll fix that made it into 8.8.0. Seems PF_RING is well and alive, so would definitely keep this section around.

• zeek-bot (21 Feb 26)

  Docs: Regenerated via GitHub workflow [nomail] [skip ci]

• Evan Typanski (20 Feb 26)

  Merge remote-tracking branch 'origin/topic/etyp/prevent-timeouts' * origin/topic/etyp/prevent-timeouts: Add a hook to prevent timeouts

• Evan Typanski (18 Feb 26)

  Add a hook to prevent timeouts For shunting, there is a problem when finding out how to unshunt. We want to use timeouts, but then clusters have issues determining who unshunts what. We do not want to stop the world to clean up the shunt map. Instead, this adds a new feature to Zeek: the ability to prevent a timeout based on external criteria. Then, shunting can rely entirely on Zeek's timeout timers, just hooking in to say "no don't timeout this connection yet, the BPF map says it's still getting shunted packets." This could be generally useful, like when sharing data between Zeek and some other monitoring system. Those are theoretical, though.

• Robin Sommer (20 Feb 26)

  Merge remote-tracking branch 'origin/topic/robin/remove-unused-fields' * origin/topic/robin/remove-unused-fields: Update Spicy integration for new struct field optimization.

• Robin Sommer (11 Feb 26)

  Update Spicy integration for new struct field optimization. Generally Spicy's new struct field optimization is safe in terms of only removing fields that aren't used anywhere, including inside the generated Zeek glue code. There's one exception however: when we pass a struct instance to Zeek through `to_val()`, the Spicy optimizer can't tell that all the fields are required on the receiving side (because the Zeek-side layout is statically determined, either from the Spicy-side type (if using EVT `export`), or by the Zeek user creating the corresponding `record` manually). In other words, we need to tell Spicy not to mess with structs that are passed wholesale through `to_val()`. This change adds corresponding HILTI-side `export` declarations for all types that go, directly or indirectly, through `to_val()`. Internally that needs some care because we can determine the relevant types only once our glue code has been created and fully resolved.

• zeek-bot (19 Feb 26)

  Docs: Regenerated via GitHub workflow [nomail] [skip ci]

• Tim Wojtulewicz (18 Feb 26)

  Merge remote-tracking branch 'origin/topic/timw/disable-additional-windows-btest' * origin/topic/timw/disable-additional-windows-btest: Fix ZAM CI btest failure from previous Windows changes Disable an additional btest on Windows

• Tim Wojtulewicz (18 Feb 26)

  Fix ZAM CI btest failure from previous Windows changes

• Tim Wojtulewicz (18 Feb 26)

  Disable an additional btest on Windows

• Tim Wojtulewicz (18 Feb 26)

  Merge remote-tracking branch 'origin/topic/timw/windows-btest-fixups' * origin/topic/timw/windows-btest-fixups: Skip some tests on Windows that hang indefinitely Add note about running btests on Windows

• Tim Wojtulewicz (18 Feb 26)

  Skip some tests on Windows that hang indefinitely

• Tim Wojtulewicz (18 Feb 26)

  Add note about running btests on Windows

• Arne Welzel (18 Feb 26)

  Merge remote-tracking branch 'origin/topic/awelzel/5204-dpd-http-violation' * origin/topic/awelzel/5204-dpd-http-violation: analyzer/detect-protocols: Honor analyzer_failed()

• Arne Welzel (17 Feb 26)

  analyzer/detect-protocols: Honor analyzer_failed() The detect-protocols script tracks confirmed protocols analyzers for connections and raises notices for detected protocols and servers. It doesn't honor analyzer violation events, however, and so in the case where a HTTP client connects to an SSH server, the HTTP request results in an analyzer confirmation, but the SSH identification string from the server tickles a violation. However, previously Zeek raised notices about an HTTP server running on port 22 despite the analyzer clearly indicating a violation. Closes #5204

• Benjamin Bannier (11 Feb 26)

  Merge branch 'topic/bbannier/issue-5120'

• Benjamin Bannier (10 Feb 26)

  Merge remote-tracking branch 'origin/topic/bbannier/bump-spicy'

• Benjamin Bannier (02 Feb 26)

  Bump auxil/spicy to latest development snapshot We also fix a bug in how we declared the C++ enum for the `AnalyzerType` HILTI enum, and expanded tests for its behavior.

• Benjamin Bannier (06 Feb 26)

  Avoid ABI-breaking use of `DEBUG` Some public classes were depending on `NDEBUG` emit different members or methods. This meant that classes had a different API and ABI depending on whether the user code was built in debug mode or not, and even not using the conditional fields could lead to random failures in user code. The correct approach would have been to use a Zeek-specific preprocessor variable so the Zeek ABI depends on the way Zeek itself was built, and not how the user code was. It seems the affected fields were not really used anymore, so this patch simply removes them. Since we now unconditionally emit debug functions we also need to unconditionally emit declarations used in the signatures of these types. Closes #5120.

• Christian Kreibich (06 Feb 26)

  Contributor update in NEWS

• zeek-bot (06 Feb 26)

  Docs: Regenerated via GitHub workflow [nomail] [skip ci]

• Tim Wojtulewicz (05 Feb 26)

  Merge branch 'topic/timw/better-anonymize-addr-prefix-docs' * topic/timw/better-anonymize-addr-prefix-docs: Add better documentation for prefix anonymization

• Tim Wojtulewicz (03 Feb 26)

  Add better documentation for prefix anonymization

• Tim Wojtulewicz (05 Feb 26)

  Merge remote-tracking branch 'origin/topic/timw/remove-pre-commit-references-from-docs-workflow' * origin/topic/timw/remove-pre-commit-references-from-docs-workflow: Remove install/caching of pre-commit in docs generation workflow

• Tim Wojtulewicz (05 Feb 26)

  Merge branch 'topic/timw/move-bifenum-to-zeek-namespace' * topic/timw/move-bifenum-to-zeek-namespace: Move BifEnum to zeek namespace to match other bif namespaces

• Tim Wojtulewicz (04 Feb 26)

  Remove install/caching of pre-commit in docs generation workflow

• Tim Wojtulewicz (04 Feb 26)

  Move BifEnum to zeek namespace to match other bif namespaces