Zeek (formerly known as Bro) is an open-source, Unix-based Network
Intrusion Detection System (NIDS) that passively monitors network
traffic and looks for suspicious activity. Zeek detects intrusions
by first parsing network traffic to extract its application-level
semantics and then executing event-oriented analyzers that compare
the activity with patterns deemed troublesome. Its analysis includes
detection of specific attacks (including those defined by signatures,
but also those defined in terms of events) and unusual activities
(e.g., certain hosts connecting to certain services, or patterns
of failed connection attempts).
Zeek is documented in the USENIX 1998 Security Conference proceedings
(as Bro).
===> The following configuration options are available for zeek-9.0.0:
GEOIP2=on: Build with GeoIP2 (MaxMindDB) support
IPSUMDUMP=on: Enables traffic summaries
LBL_CF=on: Unix time to formated time/date filter support
LBL_HF=on: Address to hostname filter support
PERFTOOLS=off: Use Perftools to improve memory & CPU usage
SPICY=on: Enable the Spicy parser generator
ZEEKCTL=on: ZeekControl support (implies IPSUMDUMP)
ZKG=on: Zeek package manager support
====> Options available for the single BUILD_TYPE: you have to select exactly one of them
DEBUG=off: Optimizations off, debug symbols/flags on
MINSIZEREL=off: Optimizations on, debug symbols/flags off
RELEASE=on: Optimizations on, debug symbols/flags off
RELWITHDEBINFO=off: Optimizations/debug symbols on, debug flags off
===> Use 'make config' to modify these settings
Reason: Zeek has been upgraded to 6.0.0 and the NETMAP option was removed;
it was too difficult to build it without zeek being installed in
%%PREFIX%%.
The consensus was that this was a rarely used feature, please
reach out to me if need this (I've done some work on a new
security/zeek-netmap port that is probably the right way forward).
When I upgraded zeek on my systems I found some cruft left over
from previous versions. The way I recommend upgrading from 5.0.9 to
6.0.0 is:
service zeek stop
pkg delete -fy zeek py311-zkg
[clean up leftover files in /usr/local/lib/zeek]
pkg install -y zeek
service zeek deploy
Number of commits found: 116 (showing only 100 on this page) #
security/zeek: drop VSX requirement and enable SPICY on powerpc64*
With the patch, VSX is now not required. SPICY support is already in
place, just requires enabling it in the source. While here, properly
mark spicy files as needing SPICY enabled.
security/zeek: Update to 8.0.10
https://github.com/zeek/zeek/releases/tag/v8.0.10
This release fixes the following vulnerabilities:
- HIGH: SMB: Chains of AndX messages can crash Zeek
- HIGH: DNP3: Memory exhaustion via file control (g70v1) fields
- HIGH: SIP: Memory exhaustion from long request/response paths
- HIGH: DHCP: Memory exhaustion from retained options after analyzer
violation
(Only the first 15 lines of the commit message are shown above )
security/zeek: Address stage-qa issues
Add missing pkg-plist entries for things installed in /var.
Also clean up empty include directories in STAGEDIR.
Reported by: diizzy
security/zeek: Update to 8.0.9
https://github.com/zeek/zeek/releases/tag/v8.0.9
This release fixes the following potential DoS vulnerabilities:
- The NVT, Rlogin, and RSH analyzers have received fixes to avoid
unbounded state growth. Due to the fact that these packets can
be received from remote hosts, these are considered DoS risks.
- A specially crafted WebSocket payload can cause the Spicy WebSocket
analyzer to use excessive memory when processing close, ping,
and pong frames. Due to the fact that these packets can be
received from remote hosts, these are considered a DoS risk.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Unbreak build for current after 86326398b73b
Upstream issue:
https://github.com/zeek/zeek/issues/5557
Upstream analysis:
In C++20 which we use assert is still a mess since it is so
underspecified, but many implementations already perform
conversion of its arguments to bool; this is likely the reason
we missed this. According to your logs the implementation of
assert in your particular build configuration does not do that
Upstream fixes:
https://github.com/zeek/spicy/pull/2399
Do not assume assert performs C++26 contextual conversions
(plus two additional changes)
While here switch to USES=compiler:c++20-lang
Obtained from: Benjamin Bannier
Reported by: pkg-fallout
security/zeek: Update to 8.0.8
https://github.com/zeek/zeek/releases/tag/v8.0.8
This release fixes the following potential DoS vulnerability:
- A specially-crafted series of MIME headers sent via SMTP or HTTP
could cause Zeek to use large amounts of memory and potentially
crash.
This release fixes the following potential DoS vulnerability:
- Sqlite storage backends no longer potentially write data into a
single database file across multiple unrelated backend handles.
- A crash in the table code was fixed if reallocation failed while
resizing.
Reported by: Tim Wojtulewicz
security/zeek: Update to 8.0.7
https://github.com/zeek/zeek/releases/tag/v8.0.7
This release fixes the following potential DoS vulnerabilities:
- A series of DNS messages containing long DNS compression chains
can cause Zeek to spend a long time processing packets and
potentially crash. Due to the fact that these packets can be
received from remote hosts, this is a DoS risk.
- A specially-crafted LDAP search request can cause Zeek to spend
a long time processing the packet, resulting in Zeek silently
dropping the LDAP analyzer for the connection. Due to the fact
that these packets can be received from remote hosts, this is
(Only the first 15 lines of the commit message are shown above )
security/zeek: Do not remove state.db on pkg remove
Klemens Nanni reported that "pkg upgrade zeek" was breaking zeekctl
in a cluster installation. Testing showed this was also true for
standalone.
The pkg-message already advises the user that they may need to
manually remove state.db.
Reported by: Klemens Nanni
security/zeek: security/zeek: Update to 8.0.6
https://github.com/zeek/zeek/releases/tag/v8.0.6
This release fixes the following potential DoS vulnerability:
- Zeek's HTTP analyzer can be tricked into interpreting Transfer-Encoding
or Content-Length headers set in MIME entities within HTTP bodies
and change the analyzer behavior.
This release fixes the following bugs:
- A missing state check was added to the finalize_redis hook in
the Redis analyzer
- A bug was fixed when attempting to append a vector to itself
that would cause an infinite loop.
- A memory leak was fixed that occurred when looping over tables
while running Zeek with ZAM enabled.
Reported by: Tim Wojtulewicz
security/zeek: security/zeek: Update to 8.0.5
https://github.com/zeek/zeek/releases/tag/v8.0.5
This release fixes the following bugs:
- The to_subnet() built-in function's parsing of IPv6 subnets was
changed to align with how IPv6 subnet literals are parsed in
Zeek scripts.
- Zeek now reports a better error message when a table constructor
is called without square brackets around the keys.
- ssl.log will now correctly report certificate fingerprints when
a protocol error is encountered after certificates are passed,
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 8.0.4
https://github.com/zeek/zeek/releases/tag/v8.0.4
This release fixes the following bugs:
- Reverts an inadvertent change to Zeekctl's pysubnettree submodule
that was causing Zeekctl to require Python 3.10.
- A potential crash involving deleting items from tables with the
&ordered attribute was fixed.
- zeek-client was updated to the newly-released v1.5.0.
Reported by: Tim Wojtulewicz
security/zeek: Update to 8.0.3
https://github.com/zeek/zeek/releases/tag/v8.0.3
This release fixes the following bugs:
- zeekctl stats should no longer report a Python error.
- The management framework controller configuration has a new
tls_options_websocket variable for setting TLS options for the
controller's Websocket server.
- Fixed Broker errors being visible/sent to WebSocket clients
unrelated to their own connection.
Reported by: Tim Wojtulewicz
security/zeek: Update to 8.0.2
https://github.com/zeek/zeek/releases/tag/v8.0.2
This release fixes the following vulnerability:
- The KRB analyzer can leak information about hosts in analyzed
traffic via external DNS lookups.
This release fixes the following bugs:
- The get_current_packet_header() BIF now populates the returned
record also for fragmented IP datagrams.
- The decompose_uri() script function now correctly handles URIs
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 7.0.9
This release fixes the following potential DoS vulnerability:
- Very large log records can cause Zeek to overflow memory and
potentially crash.
This release fixes the following bugs:
- The response to BDAT LAST was never recognized by the SMTP
analyzer, resulting in the BDAT LAST commands not being logged
in a timely fashion and receiving the wrong status.
- The ZeekJS submodule was updated to v0.18.0.
Reported by: Tim Wojtulewicz
security/zeek: Unbreak PERFTOOLS
Apparently the pprof has been provided by the devel/pprof port for
quite awhile. Since PERFTOOLS is off by default this wasn't noticed
until reported by Andrea Venturoli.
Reported by: Andrea Venturoli
security/zeek: Update to 7.0.8
https://github.com/zeek/zeek/releases/tag/v7.0.8
This release fixes the following bugs:
- GCC 15.1 failed to build both Zeek and the integrated Paraglob
library.
- The requirement for the BIND library to be present for the build
was removed.
- The Spicy submodule was updated to v1.11.5. This version brings
a fix for a compilation failure when iterating over a byte value.
Reported by: Tim Wojtulewicz
security/zeek: Update to 7.0.7
https://github.com/zeek/zeek/releases/tag/v7.0.7
This release fixes the following bugs:
- The LDAP analyzer now handles GSSAPI-signed traffic correctly
if the response token is missing.
The QUIC analyzer gained the following fixes:
- Traffic where ClientHello/ServerHello messages are fragmented
over multiple packets should now be parsed correctly.
- The wrong connection ID could be used for decryption if the
client started using a different one later in the INITIAL packet.
- ACK ranges should now be parsed correctly.
- Parsing of INITIAL packets could consume the remainder of a UDP
datagram, even if there were possibly other PACKET types in that
datagram.
Reported by: Tim Wojtulewicz
security/zeek: Update to 7.0.6
https://github.com/zeek/zeek/releases/tag/v7.0.6
This release fixes the following bugs:
- ZAM now handles assignment of record fields correctly when
assigning to the result of an in operation.
- The QUIC analyzer was not handling all of the packets in a
multi-packet UDP datagram, which lead it to miss data and have
incomplete logging.
- The QUIC analyzer was not confirming the protocol early enough,
which caused the service field for a connection to possible have
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 7.0.5
https://github.com/zeek/zeek/releases/tag/v7.0.5
This release fixes the following potential DoS vulnerability:
- Large QUIC packets can cause Zeek to overflow memory and potentially
crash. Due to the possibility of receiving these packets from
remote hosts, this is a DoS risk.
This release fixes the following bugs:
- The ZAM script optimization feature gained some fixes for some
minor memory leaks.
- The ZeekJS submodule was updated to v0.14.0. In certain environment,
ZeekJS would fail to start a debugging thread due to limited
stack size, producing spurious log messages
Reported by: Tim Wojtulewicz
security/zeek: Update to 7.0.4
https://github.com/zeek/zeek/releases/tag/v7.0.4
This release fixes the following bugs:
- The community-id-logging.zeek policy script was used to set
c$conn$community_id during new_connection() rather than
connection_state_remove(), allowing other scripts to reuse its
value early.
- The input framework will no longer get stuck and use 100% of the
CPU when encountering lines not immediately terminated by a new
line.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Fix build with clang 19
https://github.com/zeek/zeek/issues/3994https://github.com/zeek/zeek/pull/3997
Clang 19 with libc++ started failing to compile because the
default implementation of std::char_traits was removed, making
uses of std::char_traits<unsigned char> invalid (by consequence,
also std::basic_string<unsigned char>).
security/zeek: Update to 7.0.3
https://github.com/zeek/zeek/releases/tag/v7.0.3
This release fixes the following potential DoS vulnerability:
- Adding to the POP3 hardening in 7.0.2, the parser now simply
discards too many pending commands, rather than any attempting
to process them. Further, invalid server responses do not result
in command completion anymore. Processing out-of-order commands
or finishing commands based on invalid server responses could
result in inconsistent analyzer state, potentially triggering
null pointer references for crafted traffic.
Reported by: Tim Wojtulewicz
security/zeek: Update to 7.0.2
https://github.com/zeek/zeek/releases/tag/v7.0.2
This release fixes the following potential DoS vulnerability:
- The POP3 parser has been hardened to avoid unbounded state growth
in the face of one-sided traffic capture or when enabled for
non-POP3 traffic.
This release fixes the following bugs:
- Support for SASL+SPNEGO+NTLMSSP was added to the LDAP analyzer.
- Telemetry callbacks are now handled via Zeek instead of depending
on the prometehus-cpp library to handle them.
Reported by: Tim Wojtulewicz
security/zeek: Update to 7.0.1
https://github.com/zeek/zeek/releases/tag/v7.0.1
This release fixes the following bugs:
- HTTP passwords with colon characters in them are now correctly
logged.
- The LDAP analyzer now supports handling of non-sealed GSS-API
WRAP tokens.
- Heuristics for parsing SASL encrypted and signed LDAP traffic
have been made more strict and predictable.
- StartTLS support was added to the LDAP analyzer.
- Specify less-strict permissions for directories and files created
by zeek-archiver to play more nicely with user's umask setting.
Reported by: Tim Wojtulewicz
security/zeek: Clean up some stage nits
- Change the legacy lib/broctl symlink from an absolute to a
relative path.
- Remove unnecessary USES=gettext-runtime
- Add @dir pkg-plist entries for empty directories.
Reported by: Daniel Engberg
security/zeek: Update to 7.0.0
https://github.com/zeek/zeek/releases/tag/v7.0.0
This is the latest major version number Long-Term Support (LTS)
release of Zeek.
- The Telemetry framework has had a major rework, and includes a
number of breaking changes. The biggest change is a move towards
a Prometheus-first model.
- All of the metrics-related script-level options, type, and methods
have been
moved to the Telemetry framework.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Fix intermittent crash
Also fix trace-summary python backtrace.
Intermittent crash:
https://github.com/zeek/zeek/commit/8c337bd7693a2002dcfe8a15b35dc92eb9e78de9
threading/MsgThread: Decouple IO source and thread
A MsgThread acting as an IO source itself can result in the
scenario where the threading manager's heartbeat timer deletes
a terminated MsgThread instance, but at the same time this
instance is in the list of ready IO sources as determined by
the IO loop in the current iteration.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 6.0.4
https://github.com/zeek/zeek/releases/tag/v6.0.4
This release fixes the following bugs:
- The Mozilla CA and Google CT lists were updated to their latest
versions.
- A crash with ICMP packets involving errant length checking was
fixed.
- When a shadow file is empty/missing during rotation, Zeek aborts
with an error message, but if the shadow file was empty, it will
still be there after the restart.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 6.0.3
https://github.com/zeek/zeek/releases/tag/v6.0.3
This release fixes the following potential DoS vulnerability:
- A specially-crafted series of packets containing nested MIME
entities can cause Zeek to spend large amounts of time parsing
the entities.
This release fixes the following bugs:
- CMake correctly passes along third-party package information
when building plugins.
(Only the first 15 lines of the commit message are shown above )
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
security/zeek: Update to 6.0.2
https://github.com/zeek/zeek/releases/tag/v6.0.2
This release fixes the following potential DoS vulnerabilities:
- A specially-crafted SSL packet could cause Zeek to leak memory
and potentially crash.
- A specially-crafted series of FTP packets could cause Zeek to
log entries for requests that have already been completed, using
resources unnecessarily and potentially causing Zeek to lose
other traffic.
- A specially-crafted series of SSL packets could cause Zeek to
(Only the first 15 lines of the commit message are shown above )
security/vuxml: Mark zeek < 6.0.2 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v6.0.2
This release fixes the following potential DoS vulnerabilities:
- A specially-crafted SSL packet could cause Zeek to leak memory
and potentially crash.
- A specially-crafted series of FTP packets could cause Zeek to
log entries for requests that have already been completed, using
resources unnecessarily and potentially causing Zeek to lose
other traffic.
- A specially-crafted series of SSL packets could cause Zeek to
(Only the first 15 lines of the commit message are shown above )
security/zeek: Remove duplicated and incorrect build dependency of CMake
CMake binary is provided by devel/cmake-core not devel/cmake which
is a metaport and we don't need to safeguard for a version that's
over 3 years old
Approved by: portmgr (blanket)
security/zeek: Update to 6.0.0
https://github.com/zeek/zeek/releases/tag/v6.0.1
This release fixes the following potential DoS vulnerabilities:
- File extraction limits were not correctly enforced for files
containing large amounts of missing bytes.
- Sessions are sometimes not cleaned up completely within Zeek
during shutdown,
potentially causing a crash when using the -B dpd flag for debug logging.
- A specially-crafted HTTP packet can cause Zeek's filename
extraction code to take a long time to process the data.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Clean up USES=python
- While I'm here, fix PLIST
====> Checking for pkg-plist issues (check-plist)
===> Parsing plist
===> Checking for items in STAGEDIR missing from pkg-plist
Error: Orphaned: @dir lib/%%ZEEKUSER%%/plugins
Error: Orphaned: @dir lib/%%ZEEKUSER%%/spicy
===> Checking for items in pkg-plist which are not in STAGEDIR
===> Error: Plist issues found.
*** Error code 1
Approved by: portmgr (blanket)
With hat: python
security/zeek: revert b6a8929a2551 for pkg-plist
I get package errors with that version (for 13.2/amd64 at least):
=======================<phase: package >============================
===> Building package for zeek-6.0.0
pkg-static: Unable to access file
/wrkdirs/usr/ports/security/zeek/work/stage/usr/local/include/zeek/analyzer/protocol/finger/legacy/events.bif.h:No
such file or directory
pkg-static: Unable to access file
/wrkdirs/usr/ports/security/zeek/work/stage/usr/local/include/zeek/analyzer/protocol/syslog/legacy/events.bif.h:No
such file or directory
pkg-static: Unable to access file
/wrkdirs/usr/ports/security/zeek/work/stage/usr/local/share/zeek/base/bif/plugins/Zeek_Finger.events.bif.zeek:No
such file or directory
pkg-static: Unable to access file
/wrkdirs/usr/ports/security/zeek/work/stage/usr/local/share/zeek/base/bif/plugins/Zeek_Syslog.events.bif.zeek:No
such file or directory
*** Error code 1
Maybe it's an options thing? I have everything set except PERFTOOLS
and BUILD_TYPE set to RELEASE.
While here update LICENSE.
security/zeek: Update to 6.0.0
https://github.com/zeek/zeek/releases/tag/v6.0.0
This is the latest major version number Long-Term Support (LTS)
release of Zeek.
The NETMAP option has been removed; it was too difficult to build
it without zeek being installed in %%PREFIX%%. The consensus was
that this was a rarely used feature, please reach out to me if need
this (I've done some work on a new security/zeek-netmap port that
is probably the right way forward).
When I upgraded zeek on my systems I found some cruft left over
from previous versions. The way I recommend upgrading from 5.0.9
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 5.0.9
https://github.com/zeek/zeek/releases/tag/v5.0.9
This release fixes the following potential DoS vulnerabilities:
- A specially-crafted series of FTP packets with a CMD command
with a large path followed by a very large number of replies
could cause Zeek to spend a long time processing the data.
- A specially-crafted with a truncated header can cause Zeek to
overflow memory and potentially crash.
- A specially-crafted series of SMTP packets can cause Zeek to
generate a very large number of events and take a long time to
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 5.0.8
https://github.com/zeek/zeek/releases/tag/v5.0.8
This release fixes the following potential DoS vulnerabilities:
- A specially-crafted stream of FTP packets containing a command
reply with many intermediate lines can cause Zeek to spend a
large amount of time processing data.
- A specially-crafted set of packets containing extremely large
file offsets cause cause the reassembler code to allocate large
amounts of memory.
- The DNS manager does not correctly expire responses that don't
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 5.0.7
https://github.com/zeek/zeek/releases/tag/v5.0.7
This release fixes the following potential DoS vulnerabilities:
- Receiving DNS responses from async DNS requests (via the
lookup_addr, etc BIF methods) with the TTL set to zero could
cause the DNS manager to eventually stop being able to make new
requests.
- Specially-crafted FTP packets with excessively long usernames,
passwords, or other fields could cause log writes to use large
amounts of disk space.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 5.0.6
https://github.com/zeek/zeek/releases/tag/v5.0.6
This release fixes the following potential DoS vulnerabilities:
- A missing field in the SMB FSControl script-land record could
cause a heap buffer overflow when receiving packets containing
those header types.
- Receiving a series of packets that start with HTTP/1.0 and then
switch to HTTP/0.9 could cause Zeek to spend a large amount of
time processing the packets.
- Receiving large numbers of FTP commands sequentially from the
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 5.0.5
https://github.com/zeek/zeek/releases/tag/v5.0.5
This release fixes the following bugs:
- Update broker to version 2.3.6. This broker release fixes some
failures when building against Python 3.11 and above.
Reported by: Tim Wojtulewicz
security/zeek: Update to 5.0.4
https://github.com/zeek/zeek/releases/tag/v5.0.4
This release fixes the following potential DoS vulnerabilities:
- A specially-crafted series of HTTP 0.9 packets can cause Zeek
to spend large amounts of time processing the packets.
- A specially-crafted FTP packet can cause Zeek to spend large
amounts of time processing the command.
- A specially-crafted IPv6 packet can cause Zeek to overflow memory
and potentially crash.
This release fixes the following bugs:
- Fix a potential stall in Broker’s internal data pipeline.
Reported by: Tim Wojtulewicz
Security: ???
security/zeek: Update to 5.0.3
https://github.com/zeek/zeek/releases/tag/v5.0.3
This release fixes the following potential DoS vulnerabilities:
- Fix an issue where a specially-crafted FTP packet can cause Zeek
to spend large amounts of time attempting to search for valid
commands in the data stream.
- Fix a possible overflow in the Zeek dictionary code that may
lead to a memory leak.
- Fix an issue where a specially-crafted packet can cause Zeek to
spend large amounts of time reporting analyzer violations.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 5.0.2
https://github.com/zeek/zeek/releases/tag/v5.0.2
Security fixes:
- Fix a possible overflow and crash in the ICMP analyzer when
receiving a specially crafted packet
- Fix a possible overflow and crash in the IRC analyzer when
receiving a specially crafted packet
- Fix a possible overflow and crash in the SMB analyzer when
receiving a specially crafted packet
(Only the first 15 lines of the commit message are shown above )
security/zeek: Port improvements
- Remove useless BROKER option.
- Remove USES=ninja (now implied by USES=cmake).
- Make bison, flex, and swig hard dependencies.
- Strip several installed binaries.
- Remove some test files and directories mistakenly installed by
spicy.
- While we're here, run portfmt.
Thanks to @diizzy for the bulk of these changes.
PR: 266345
Reported by: diizzy
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 5.0.1
https://github.com/zeek/zeek/releases/tag/v5.0.1
Security fixes since 5.0.0:
- Fix a possible overflow and crash in the ARP analyzer when
receiving a specially crafted packet.
- Fix a possible overflow and crash in the Modbus analyzer when
receiving a specially crafted packet.
- Fix two possible crashes when converting IP headers for output
via the raw_packet event.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update input framework patch
https://github.com/zeek/zeek/pull/2266
This version of the patch fixes tail -F semantics when want_record=F.
security/zeek: Patch to allow building without ENABLE_ZEEK_UNIT_TESTS
5.0.0 does not build without ENABLE_ZEEK_UNIT_TESTS enabled.
Apply upstream patch which solves this:
https://github.com/zeek/zeek/pull/2256
Obtained from: Benjamin Bannier
security/zeek: Update to 5.0.0 (latest LTS release)
https://github.com/zeek/zeek/releases/tag/v5.0.0
Changes incompatiable with 4.0.7:
- The script-land ``union`` and ``timer`` types have been removed.
They haven't had any actual semantics backing them for some time
and shouldn't have functioned in any useable way. We opted to
skip the deprecation cycle for these types for that reason.
- Broker now uses a new network backend with a custom network
protocol that is incompatible with the pre-5.0 backend. In
practice, this means Zeek 4.x will not be able to exchange events
with Zeek 5.x. Going forward, this new backend will allow us to
keep the Broker protocol more stable and add new capabilities
in a backwards compatible way.
While we're here add a comment explaining why we really need uname
-p instead of using ARCH (uname -m). Also solve a portlint nag.
Reported by: Tim Wojtulewicz
security/zeek: Patch to provide tail -F semantics for input framework
MODE_STREAM
This is a backport of this github pull request:
https://github.com/zeek/zeek/pull/2097
security/zeek: Update to 4.0.7
https://github.com/zeek/zeek/releases/tag/v4.0.7
Security fixes since 4.0.6:
- Fix potential hang in the DNS analyzer when receiving a
specially-crafted packet. Due to the possibility of this happening
with packets received from the network, this is a potential DoS
vulnerability.
Other changes:
- Fix issue with broken libpcaps that return repeat packets, most
notably the version provided with Myricom hardware.
Reported by: Tim Wojtulewicz
security/zeek: Update to 4.0.6
https://github.com/zeek/zeek/releases/tag/v4.0.6
Security fixes since 4.0.5:
- Fix potential unbounded state growth in the FTP analyzer when
receiving a specially-crafted stream of commands. This may lead
to a buffer overflow and cause Zeek to crash. Due to the possibility
of this happening with packets received from the network, this
is a potential DoS vulnerabilty.
Other changes:
- Empty table constructors with &default attributes may cause a
crash.
- Fix a bug in ZAM when a function containing a loop is inlined
- Fix a number of bugs with robust dictionary iteration.
- Fix missing "Reporter" entries when reporting hooks via zeek.
Reported by: Tim Wojtulewicz
security/zeek: Update to 4.0.5
Changes since 4.0.4:
- The highwayhash module was updated to fix a build failure on
FreeBSD.
- A number of fixes for various problems on the CI infrastructure.
- Writers were not being cleaned up correctly when recreating log
streams with the same ID as an existing stream. This could lead
to a crash.
- IP packets with bad/incorrect IP header lengths were not reporting
weirds as they should be.
Reported by: Tim Wojtulewicz
security/zeek: Update to 4.0.4
https://github.com/zeek/zeek/releases/tag/v4.0.4
This release fixes two vulnerabilities:
- Paths from log stream make it into system() unchecked, potentially
leading to commands being run on the system unintentionally.
This requires either bad scripting or a malicious package to be
installed, and is considered low severity.
- Fix potential unbounded state growth in the PIA analyzer when
receiving a connection with either a large number of zero-length
packets, or one which continues ack-ing unseen segments. It is
possible to run Zeek out of memory in these instances and cause
(Only the first 15 lines of the commit message are shown above )
security/zeek: Add @sample for local.zeek
This github issue:
https://github.com/zeek/zeekctl/issues/35
complained about the lack of a local.zeek file on a fresh install;
adding @sample for local.zeek solves this.
Reported by: shadonet
security/zeek: fix build on powerpc64*
In file included from
/wrkdirs/usr/ports/security/zeek/work/zeek-4.0.3/auxil/highwayhash/highwayhash/arch_specific.cc:27:
/usr/include/sys/sysctl.h:1185:25: error: unknown type name 'u_int'
int sysctl(const int *, u_int, void *, size_t *, const void *, size_t);
security/zeek: Unbreak build under 14.0-CURRENT
According to the cpuset(2) man page, sys/param.h must be included
before sys/cpuset.h. This was fixed in zeek (in the highwayhash
submodule) in May of 2020 and undone in August of 2020. Add a patch
that matches the pull request I just created with upstream:
https://github.com/zeek/highwayhash/pull/1
Thanks to @pluknet for diagnosing the build failure.
Reported by: pkg-fallout
security/zeek: Update to 4.0.3
https://github.com/zeek/zeek/releases/tag/v4.0.3
This release fixes the following bugs:
- Zeek now accepts unset fields in the input data only when the
corresponding record field is &optional.
- The version field in ssh.log is now optional and will not be set
if we cannot determine the version that was negotiated by the
client and server.
- Zeekctl could crash at startup on certain compilers and platforms
due to a memory corruption issue in the Broker python bindings.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Update to 4.0.2
https://github.com/zeek/zeek/releases/tag/v4.0.2
This release fixes several potential DoS vulnerabilities:
- Fix potential Undefined Behavior in decode_netbios_name() and
decode_netbios_name_type() BIFs. The latter has a possibility
of a remote heap-buffer-overread, making this a potential DoS
vulnerability.
- Add some extra length checking when parsing mobile ipv6 packets.
Due to the possibility of reading invalid headers from remote
sources, this is a potential DoS vulnerability.
(Only the first 15 lines of the commit message are shown above )
security/zeek: Add fine grained DEBUG options
Allow the user to pick from DEBUG, MINSIZEREL, RELEASE, and
RELWITHDEBINFO options instead of just DEBUG. Don't STRIP with DEBUG
or RELWITHDEBINFO. Make some minor whitespace changes suggested by
portfmt.
security/zeek: Update to 4.0.1 to fix null-pointer dereference and potential DOS
https://github.com/zeek/zeek/releases/tag/v4.0.1
This release fixes the following vulnerability:
- Fix null-pointer dereference when encountering an invalid enum
name in a config/input file that tries to read it into a set[enum].
For those that have such an input feed whose contents may come
from external/remote sources, this is a potential DoS vulnerability.
Other fixes:
- Fix mime type detection bug in IRC/FTP file_transferred event
for file data containing null-bytes
(Only the first 15 lines of the commit message are shown above )
security/zeek: Unbreak armv7 build and fix testport issue
Add a patch from upstream to fix building on armv7 (used by pfsense):
https://github.com/zeek/zeek/issues/1496
Thanks to @garga for the pointer.
Fix a testport "left over" file @adridg reported. When zeek is run
as part of package installation, it copies some config files to
spool/installed-scripts-do-not-touch/site and local.zeek.sample
hitches a ride and needs to be removed on uninstall. But it is not
really a @sample candidate.
While we're here fix some minor portlint (env -> ${SETENV}) and
clean up some commented out directives.
Reported by: garga adridg
security/zeek: fix build on powerpc64 elfv2
-mpowerp8-vector is now necessary due to use of highwayhash.
Fix typo on sysctlbyname.
Also correct typo in BROKEN entries.
security/zeek: Update to 3.0.13
https://github.com/zeek/zeek/releases/tag/v3.0.13
This release fixes the following vulnerability:
- Fix ASCII Input reader's treatment of input files containing
null-bytes. An input file containing null-bytes could lead to a
buffer-over-read, crash Zeek, and be exploited to cause Denial
of Service.
And fixes the following bugs:
- MIME sub-entities overwrote top-level header values cause
misleading SMTP log
- Fix incorrect major_subsys_version field in pe_optional_header
event
Reported by: Jon Siwek
security/zeek: Install cmake files
Unstream requested that share/zeek/cmake/* be installed as the files
are used to build zeek plugins.
While here update some pkg-plist @preunexec entries (*.bro -> *.zeek).
Reported by: Robin Sommer, Benjamin Bannier
security/zeek: Improve the pkg upgrade experience
Don't remove %%PREFIX%%/spool/state.db otherwise when zeek is
upgraded zeekctl doesn't detect the running instance and "restart"
fails.
Split uninstall related info in pkg-message.in to a new remove
section (and fix some typos).
security/zeek: Remove deprecated security/broccoli option
Upstream confirms that support for the broccoli protocol will be
removed in a future version of zeek. And given that security/broccoli
requires python2 which will be deprecated at the end of December,
lets remove broccoli support from zeek now.
Number of commits found: 116 (showing only 100 on this page)
