diff --git a/security/zeek/Makefile b/security/zeek/Makefile index cd53642c8c70..c48a2a51b23f 100644 --- a/security/zeek/Makefile +++ b/security/zeek/Makefile @@ -1,195 +1,195 @@ PORTNAME= zeek DISTVERSION= 8.0.8 CATEGORIES= security MASTER_SITES= https://download.zeek.org/ MAINTAINER= leres@FreeBSD.org COMMENT= System for detecting network intruders in real-time WWW= https://www.zeek.org/ LICENSE= CC-BY-4.0 BUILD_DEPENDS= bison>=3.3:devel/bison \ flex>=2.6:textproc/flex \ swig>=4.0.2:devel/swig LIB_DEPENDS= libcares.so:dns/c-ares \ libzmq.so:net/libzmq4 RUN_DEPENDS= c-ares>=1.25.0:dns/c-ares -USES= bison cmake compiler:c++17-lang cpe gettext-runtime perl5 \ +USES= bison cmake compiler:c++20-lang cpe gettext-runtime perl5 \ python:3.9+ shebangfix ssl USE_LDCONFIG= yes EXTRACT_AFTER_ARGS= --exclude ${DISTNAME}/auxil/c-ares \ --no-same-owner --no-same-permissions BINARY_ALIAS= python3=${PYTHON_CMD} PORTSCOUT= limit:^[0-9]*\.0\. CXXFLAGS_powerpc64= -mpower8-vector SHEBANG_FILES= \ auxil/broker/bindings/python/3rdparty/pybind11/docs/conf.py \ auxil/broker/bindings/python/3rdparty/pybind11/setup.py \ auxil/broker/bindings/python/3rdparty/pybind11/tools/make_changelog.py \ auxil/broker/bindings/python/3rdparty/pybind11/tools/setup_global.py.in \ auxil/broker/bindings/python/3rdparty/pybind11/tools/setup_main.py.in \ auxil/btest/btest \ auxil/btest/btest-setsid \ auxil/netcontrol-connectors/acld/acld.py \ auxil/netcontrol-connectors/command-line/command-line.py \ auxil/netcontrol-connectors/openflow/controller.py \ auxil/netcontrol-connectors/test/simple-client.py \ auxil/package-manager/zkg \ auxil/spicy/3rdparty/benchmark/tools/compare.py \ auxil/spicy/3rdparty/benchmark/tools/strip_asm.py \ auxil/spicy/3rdparty/doctest/scripts/bench/bench.py \ auxil/spicy/3rdparty/doctest/scripts/bench/run_all.py \ auxil/spicy/doc/scripts/spicy-doc-to-rst \ auxil/spicy/tests/Scripts/license-header.py \ auxil/spicy/tests/Scripts/stray_baselines.py \ auxil/vcpkg/ports/gobject-introspection/portfile.cmake \ auxil/zeek-aux/devel-tools/github-manage \ auxil/zeek-client/man/build.py \ auxil/zeek-client/zeek-client \ auxil/zeekctl/ZeekControl/test_cli.py \ auxil/zeekctl/auxil/pysubnettree/setup.py \ auxil/zeekctl/auxil/trace-summary/trace-summary \ auxil/zeekctl/bin/stats-to-csv \ auxil/zeekctl/bin/zeekctl.in \ auxil/zeekctl/bin/zeekctld.in \ auxil/zeekctl/testing/Cfg/bin/zeek__test \ auxil/zeekctl/testing/Scripts/diff-to-bytes-output \ auxil/zeekctl/util/extract-strictly-local-conns \ auxil/zeekctl/util/reformat-stats \ ci/collect-repo-info.py \ testing/coverage/coverage_cleanup.py \ testing/scripts/coverage-calc \ testing/scripts/httpd.py SUB_FILES= pkg-message NO_MTREE= yes CMAKE_ON= BROKER_DISABLE_DOC_EXAMPLES BROKER_DISABLE_TESTS \ BUILD_SHARED_LIBS BUILD_STATIC_BROKER INSTALL_AUX_TOOLS CMAKE_ARGS= -DCARES_ROOT_DIR:PATH=${PREFIX} \ -DCMAKE_EXE_LINKER_FLAGS="${OPENSSL_LDFLAGS}" \ -DDISABLE_JAVASCRIPT:BOOL=ON \ -DINSTALL_BTEST:BOOL=OFF \ -DINSTALL_BTEST_PCAPS:BOOL=OFF \ -DINSTALL_ZKG:BOOL=OFF \ -DPY_MOD_INSTALL_DIR:PATH=${PREFIX}/lib/zeekctl \ -DZEEK_ETC_INSTALL_DIR:PATH=${PREFIX}/etc \ -DZEEK_LOG_DIR:PATH=/var/log/zeek \ -DZEEK_ROOT_DIR:PATH=${PREFIX} \ -DZEEK_SCRIPT_INSTALL_PATH:PATH=${PREFIX}/share/zeek \ -DZEEK_SPOOL_DIR:PATH=/var/spool/zeek ZEEKUSER?= zeek ZEEKGROUP?= zeek PLIST_SUB+= ZEEKGROUP=${ZEEKGROUP} \ ZEEKUSER=${ZEEKUSER} USERS= ${ZEEKUSER} GROUPS= ${ZEEKGROUP} OPTIONS_DEFINE= GEOIP2 IPSUMDUMP LBL_CF LBL_HF PERFTOOLS SPICY ZEEKCTL \ ZKG OPTIONS_SINGLE= BUILD_TYPE OPTIONS_SINGLE_BUILD_TYPE= DEBUG MINSIZEREL RELEASE RELWITHDEBINFO OPTIONS_DEFAULT= GEOIP2 IPSUMDUMP LBL_CF LBL_HF RELEASE ZEEKCTL \ ZKG OPTIONS_DEFAULT_aarch64= SPICY OPTIONS_DEFAULT_amd64= SPICY OPTIONS_DEFAULT_armv6= SPICY OPTIONS_DEFAULT_armv7= SPICY OPTIONS_DEFAULT_i386= SPICY OPTIONS_SUB= yes DEBUG_DESC= Optimizations off, debug symbols/flags on GEOIP2_DESC= Build with GeoIP2 (MaxMindDB) support IPSUMDUMP_DESC= Enables traffic summaries LBL_CF_DESC= Unix time to formated time/date filter support LBL_HF_DESC= Address to hostname filter support MINSIZEREL_DESC= Optimizations on, debug symbols/flags off PERFTOOLS_DESC= Use Perftools to improve memory & CPU usage RELEASE_DESC= Optimizations on, debug symbols/flags off RELWITHDEBINFO_DESC= Optimizations/debug symbols on, debug flags off SPICY_DESC= Enable the Spicy parser generator ZEEKCTL_DESC= ZeekControl support (implies IPSUMDUMP) ZKG_DESC= Zeek package manager support ZEEKCTL_IMPLIES= IPSUMDUMP GEOIP2_LIB_DEPENDS= libmaxminddb.so:net/libmaxminddb IPSUMDUMP_BUILD_DEPENDS= ipsumdump:net/ipsumdump IPSUMDUMP_RUN_DEPENDS= ipsumdump:net/ipsumdump LBL_CF_RUN_DEPENDS= ${LOCALBASE}/bin/cf:sysutils/lbl-cf LBL_HF_RUN_DEPENDS= ${LOCALBASE}/bin/hf:sysutils/lbl-hf PERFTOOLS_BUILD_DEPENDS= ${LOCALBASE}/include/gperftools/tcmalloc.h:devel/google-perftools \ ${LOCALBASE}/bin/pprof:devel/pprof PERFTOOLS_CMAKE_BOOL= ENABLE_PERFTOOLS PERFTOOLS_RUN_DEPENDS= ${LOCALBASE}/lib/libtcmalloc.so.4:devel/google-perftools \ ${LOCALBASE}/bin/pprof:devel/pprof SPICY_CMAKE_OFF= -DDISABLE_SPICY=ON ZEEKCTL_BUILD_DEPENDS= ${LOCALBASE}/bin/bash:shells/bash \ ${PYTHON_PKGNAMEPREFIX}sqlite3>0:databases/py-sqlite3@${PY_FLAVOR} ZEEKCTL_CMAKE_BOOL= INSTALL_ZEEKCTL ZEEKCTL_RUN_DEPENDS= ${LOCALBASE}/bin/bash:shells/bash \ ${PYTHON_PKGNAMEPREFIX}sqlite3>0:databases/py-sqlite3@${PY_FLAVOR} ZKG_RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}zkg>=2.7.1:security/py-zkg@${PY_FLAVOR} .include .if ${PORT_OPTIONS:MDEBUG} CMAKE_BUILD_TYPE= Debug STRIP= .elif ${PORT_OPTIONS:MMINSIZEREL} CMAKE_BUILD_TYPE= MinSizeRel .elif ${PORT_OPTIONS:MRELEASE} CMAKE_BUILD_TYPE= Release .elif ${PORT_OPTIONS:MRELWITHDEBINFO} CMAKE_BUILD_TYPE= RelWithDebInfo STRIP= .endif .if ${PORT_OPTIONS:MZEEKCTL} USE_RC_SUBR= zeek .endif # Let crash-diag find gdb (when installed) post-patch: ${REINPLACE_CMD} -e "2s,^\#,export PATH=${LOCALBASE}/bin"':$${PATH}', \ ${WRKSRC}/auxil/zeekctl/bin/crash-diag post-install: ${MV} ${STAGEDIR}${DATADIR}/site/local.zeek \ ${STAGEDIR}${DATADIR}/site/local.zeek.sample @${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/zeek-cut @${RM} ${STAGEDIR}${PREFIX}/share/zeek/tests ${LN} -s ../btest/data ${STAGEDIR}${PREFIX}/share/zeek/tests post-install-ZEEKCTL-on: ${MKDIR} ${STAGEDIR}/var/spool/zeek/installed-scripts-do-not-touch/auto ${MKDIR} ${STAGEDIR}/var/spool/zeek/installed-scripts-do-not-touch/site .for F in zeekctl.cfg networks.cfg node.cfg ${MV} ${STAGEDIR}${PREFIX}/etc/${F} ${STAGEDIR}${PREFIX}/etc/${F}.sample .endfor # Do this here because later zeek won't be running as root ${RM} ${STAGEDIR}${PREFIX}/share/zeekctl/scripts/zeekctl-config.sh ${LN} -s ../../../../../var/spool/zeek/zeekctl-config.sh \ ${STAGEDIR}${PREFIX}/share/zeekctl/scripts/zeekctl-config.sh ${RM} ${STAGEDIR}${PREFIX}/lib/broctl ${LN} -s zeek/python/zeekctl ${STAGEDIR}${PREFIX}/lib/broctl post-install-SPICY-on: @${RM} -rf ${STAGEDIR}${PREFIX}/include/hilti/rt/3rdparty/SafeInt/Archive @${RM} -rf ${STAGEDIR}${PREFIX}/include/hilti/rt/3rdparty/SafeInt/Test pre-install-ZEEKCTL-on: ${MKDIR} ${STAGEDIR}${PREFIX}/etc/rc.d .include diff --git a/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_configuration.h b/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_configuration.h new file mode 100644 index 000000000000..89b1d7cf051a --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_configuration.h @@ -0,0 +1,11 @@ +--- auxil/spicy/hilti/runtime/include/configuration.h.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/hilti/runtime/include/configuration.h +@@ -76,7 +76,7 @@ inline const Configuration& unsafeGet() { + * matters. + */ + inline const Configuration& unsafeGet() { +- assert(detail::__configuration); ++ assert(detail::__configuration.get()); + return *detail::__configuration; + } + diff --git a/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_types_stream.h b/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_types_stream.h new file mode 100644 index 000000000000..1aa2ea7c0a33 --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_types_stream.h @@ -0,0 +1,20 @@ +--- auxil/spicy/hilti/runtime/include/types/stream.h.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/hilti/runtime/include/types/stream.h +@@ -691,7 +691,7 @@ class SafeConstIterator { (private) + + void _ensureValidChain() const { + // This must have been checked at this point already. +- assert(_chain); ++ assert(_chain.get()); + + if ( ! _chain->isValid() ) + throw InvalidIterator("stream object no longer available"); +@@ -1752,7 +1752,7 @@ class Stream { (public) + + /** Destructor. */ + ~Stream() { +- assert(_chain); ++ assert(_chain.get()); + _chain->invalidate(); + } + diff --git a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_include_compiler_printer.h b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_include_compiler_printer.h new file mode 100644 index 000000000000..b66c0a9c7765 --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_include_compiler_printer.h @@ -0,0 +1,11 @@ +--- auxil/spicy/hilti/toolchain/include/compiler/printer.h.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/hilti/toolchain/include/compiler/printer.h +@@ -59,7 +59,7 @@ class Stream { (public) + Stream(std::ostream& s) : _stream(s) {} + + auto& state() const { +- assert(detail::State::current); ++ assert(detail::State::current.get()); + return *detail::State::current; + } + diff --git a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_ast_ast-context.cc b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_ast_ast-context.cc new file mode 100644 index 000000000000..be8f3ff70565 --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_ast_ast-context.cc @@ -0,0 +1,11 @@ +--- auxil/spicy/hilti/toolchain/src/ast/ast-context.cc.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/hilti/toolchain/src/ast/ast-context.cc +@@ -328,7 +328,7 @@ void ASTContext::garbageCollect() { + changed = false; + + for ( auto& n : _nodes ) { +- assert(n); ++ assert(n.get()); + + if ( n->isRetained() ) { + ++retained; diff --git a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_compiler_driver.cc b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_compiler_driver.cc new file mode 100644 index 000000000000..15ef25453916 --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_compiler_driver.cc @@ -0,0 +1,20 @@ +--- auxil/spicy/hilti/toolchain/src/compiler/driver.cc.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/hilti/toolchain/src/compiler/driver.cc +@@ -683,7 +683,7 @@ Result Driver::compileUnits() { + } + + Result Driver::compileUnits() { +- assert(_builder); ++ assert(_builder.get()); + + if ( auto rc = context()->astContext()->processAST(_builder.get(), this); ! rc ) { + // hilti::detail::printer::print(std::cerr, context()->astContext()->root()); +@@ -723,7 +723,7 @@ Result Driver::run() { + Result Driver::run() { + assert(! _builder); + initialize(); +- assert(_builder); ++ assert(_builder.get()); + + for ( const auto& i : _driver_options.inputs ) { + if ( auto rc = addInput(i); ! rc ) diff --git a/security/zeek/files/patch-auxil_spicy_spicy_runtime_include_configuration.h b/security/zeek/files/patch-auxil_spicy_spicy_runtime_include_configuration.h new file mode 100644 index 000000000000..500d7bce576a --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_spicy_runtime_include_configuration.h @@ -0,0 +1,11 @@ +--- auxil/spicy/spicy/runtime/include/configuration.h.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/spicy/runtime/include/configuration.h +@@ -43,7 +43,7 @@ inline const Configuration& unsafeGet() { + * matters. + */ + inline const Configuration& unsafeGet() { +- assert(rt::detail::globalState()->configuration); ++ assert(rt::detail::globalState()->configuration.get()); + return *rt::detail::globalState()->configuration; + } + diff --git a/security/zeek/files/patch-auxil_spicy_spicy_runtime_src_sink.cc b/security/zeek/files/patch-auxil_spicy_spicy_runtime_src_sink.cc new file mode 100644 index 000000000000..b41dff63a260 --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_spicy_runtime_src_sink.cc @@ -0,0 +1,11 @@ +--- auxil/spicy/spicy/runtime/src/sink.cc.orig 2026-06-10 16:58:45 UTC ++++ auxil/spicy/spicy/runtime/src/sink.cc +@@ -431,7 +431,7 @@ void Sink::_close(bool orderly) { + fmt("error in connected unit %s during close (%s)", s->parser->name, err.what())); + } + +- assert(s->resumable); // must have conluded after freezing/aborting ++ assert(static_cast(s->resumable)); // must have conluded after freezing/aborting + } + } + diff --git a/security/zeek/files/patch-auxil_spicy_spicy_toolchain_include_compiler_detail_codegen_productions_while.h b/security/zeek/files/patch-auxil_spicy_spicy_toolchain_include_compiler_detail_codegen_productions_while.h new file mode 100644 index 000000000000..d6834009e69c --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_spicy_toolchain_include_compiler_detail_codegen_productions_while.h @@ -0,0 +1,11 @@ +--- auxil/spicy/spicy/toolchain/include/compiler/detail/codegen/productions/while.h.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/spicy/toolchain/include/compiler/detail/codegen/productions/while.h +@@ -55,7 +55,7 @@ class While : public Production { (public) + * loop body. This method must be called only after `preprocessLookAhead()`. + */ + const production::LookAhead* lookAheadProduction() const { +- assert(_body_for_grammar); // set by preprocessLookAhead() return ++ assert(_body_for_grammar.get()); // set by preprocessLookAhead() return + return _body_for_grammar->as(); + } + diff --git a/security/zeek/files/patch-auxil_spicy_spicy_toolchain_src_compiler_codegen_grammar-builder.cc b/security/zeek/files/patch-auxil_spicy_spicy_toolchain_src_compiler_codegen_grammar-builder.cc new file mode 100644 index 000000000000..8685ba0688c7 --- /dev/null +++ b/security/zeek/files/patch-auxil_spicy_spicy_toolchain_src_compiler_codegen_grammar-builder.cc @@ -0,0 +1,11 @@ +--- auxil/spicy/spicy/toolchain/src/compiler/codegen/grammar-builder.cc.orig 2026-05-12 18:14:47 UTC ++++ auxil/spicy/spicy/toolchain/src/compiler/codegen/grammar-builder.cc +@@ -354,7 +354,7 @@ hilti::Result GrammarBuilder::run(type + Grammar g(id.str(), unit->location()); + auto pf = ProductionFactory(cg(), this, &g); + auto root = pf.createProduction(unit); +- assert(root); ++ assert(root.get()); + + if ( auto rc = g.setRoot(std::move(root)); ! rc ) + return rc.error();