security/zeek9.0.0

security/zeek: fix build on powerpc64

The 9.0.0 update dropped the powerpc64 patches from 144863452393. Bring back
the ones still needed: the VSX hash kernel stays off on big-endian (it
computes wrong hashes there) and the bundled fiber library enables its
ppc64 ELFv2 assembly on big-endian too (upstream simonfxr/fiber
dc084920bc81). The hilti stack-direction change is upstream now.

security/zeek: Update to 9.0.0

This is the next long-term support (LTS) release of zeek.

    https://github.com/zeek/zeek/releases/tag/v9.0.0
    https://zeek.org/2026/08/zeek-9-0-development-update/

Reported by:	Tim Wojtulewicz

security/zeek: drop VSX requirement and enable SPICY on powerpc64*

With the patch, VSX is now not required.  SPICY support is already in
place, just requires enabling it in the source.  While here, properly
mark spicy files as needing SPICY enabled.

security/zeek: Update to 8.0.10

https://github.com/zeek/zeek/releases/tag/v8.0.10

This release fixes the following vulnerabilities:

 - HIGH: SMB: Chains of AndX messages can crash Zeek

 - HIGH: DNP3: Memory exhaustion via file control (g70v1) fields

 - HIGH: SIP: Memory exhaustion from long request/response paths

 - HIGH: DHCP: Memory exhaustion from retained options after analyzer
   violation

 - HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
   entries

 - HIGH: SMB: DCE/RPC memory exhaustion from fragment state

 - HIGH: Analyzer manager: Equivalent scheduled analyzers could
   exhaust memory

 - HIGH: ZIP: Unbounded decompression

 - HIGH: Redis: Parsed Redis traffic memory exhaustion

 - HIGH: Invalid IPv6 fragments can lead to unbounded state growth

 - HIGH: SSH: Quadratic KEX algorithm CPU exhaustion

 - HIGH: NVT: Oversized line recovery writes before heap buffer

 - HIGH: DHCP: Unbounded state growth via join_data

 - HIGH: FTP: Unbounded state growth via ftp_data_expected

 - HIGH: OCSP: Empty byName responder ID crashes Zeek

 - HIGH: ARP: Tunneled ARP traffic crashes Zeek

 - HIGH: LDAP: Unbounded per-connection script state

 - HIGH: IRC DCC SEND has unbounded state growth

 - HIGH: tunnel_changed event limit bypass on direct/tunneled toggles

 - HIGH: Recursive stack exhaustion from deep packet analyzer chains

 - MEDIUM: Telnet: AUTH STATUS options before a NAME is received
   results in event argument mismatch

 - MEDIUM: UDP: udp_contents events could trigger out-of-bounds
   reads

 - MEDIUM: NetBIOS: Memory exhaustion from declared session lengths

 - MEDIUM: IRC: Single DCC Send packet can result in scripting error

 - MEDIUM: IRC: Invalid DCC Send host/port fields can lead to
   unexpected parsing results

This release fixes the following bugs:

 - IN_ANYWHERE is now allowed as a wildcard in Intel files for the
   interface field.

 - The Prometheus service discovery endpoint for the telemetry
   framework was not rendering IPv6 addresses correctly.

   The unknown_protocols.log previously included the IP next protocol
 - field as a 16 bit value, with the first byte value set to the
   next protocol followed by a zero byte due to a spurious use of
   htons().

 - Fixed file descriptors of the WebSocket server and WebSocket
   client connections (Cluster::listen_websocket()) being inherited
   by child processes. E.g., when using system() in Zeek scripts
   or the Input Framework's raw reader functionality.

Reported by:	Tim Wojtulewicz
Security:	e6a17802-cda9-4f53-8870-b629e4ac3d40

security/zeek: Remove /var/spool/zeek/zeekctl-config.sh on uninstall

... and remove from pkg-plist as it is automatically generated.

security/zeek: Address stage-qa issues

Add missing pkg-plist entries for things installed in /var.
Also clean up empty include directories in STAGEDIR.

Reported by:	diizzy

security/zeek: Update to 8.0.9

https://github.com/zeek/zeek/releases/tag/v8.0.9

This release fixes the following potential DoS vulnerabilities:

 - The NVT, Rlogin, and RSH analyzers have received fixes to avoid
   unbounded state growth. Due to the fact that these packets can
   be received from remote hosts, these are considered DoS risks.

 - A specially crafted WebSocket payload can cause the Spicy WebSocket
   analyzer to use excessive memory when processing close, ping,
   and pong frames. Due to the fact that these packets can be
   received from remote hosts, these are considered a DoS risk.

 - A specially crafted series of Finger packets can cause the Spicy
   Finger analyzer to use excessive amounts of memory and potentially
   crash Zeek. Due to the fact that these packets can be received
   from remote hosts, this is considered a DoS risk.

 - A specially crafted Kerberos packet can cause the Kerberos
   analyzer to enter an invalid state and potentially crash Zeek.
   Due to the fact that these packets can be received from remote
   hosts, this is considered a DoS risk.

 - A specially crafted series of RDP packets can cause the RDP
   analyzer to use excessive amounts of memory and potentially crash
   Zeek. Due to the fact that these packets can be received from
   remote hosts, this is considered a DoS risk.

 - A specially crafted IP packet can cause the IP analyzer to read
   past the end of the contents of the packet when emitting the
   packet_contents event and possibly crash. Due to the fact that
   these packets can be received from remote hosts, this is considered
   a DoS risk.

 - A specially crafted IP packet can cause the packet discarding
   code to read off the end of the packet when looking for follow-on
   header data. This may potentially lead to a crash of Zeek. Due
   to the fact that these packets can be received from remote hosts,
   this is considered a DoS risk.

 - A specially crafted series of Gnutella packets may cause Zeek
   to continue accumulating memory and eventually crash. Due to the
   fact that these packets can be received from remote hosts, this
   is considered a DoS risk.

 - A specially crafted ICMPv6 packet can cause the ICMP analyzer
   to skip part of the packet and not report corresponding events
   and logs. Due to the fact that these packets can be received
   from remote hosts, this is considered an evasion risk.

 - A specially crafted SSH packet can cause the SSH analyzer to
   throw BinPAC exceptions for extremely large packets and skip
   logging them otherwise. Due to the fact that these packets can
   be received from remote hosts, this is considered an evasion
   risk.

 - A number of issues with the HTTP analyzer were found involving
   unusual Content-Length, Transfer-Encoding and Expect header
   usage. Due to the fact that these packets can be received from
   remote hosts, this is considered an evasion risk.

 - A series of fixes were applied to the serialization code in Zeek
   to avoid buffer overreads with both Broker and ZeroMQ traffic.
   On debug builds, these hit various abort() conditions and cause
   Zeek to exit. Due to the fact that all of these states require
   direct access to the Broker/ZeroMQ ports (meaning access to the
   local network to some degree), this isn’t considered a DoS risk.

This release fixes the following bugs:

 - Zeek now builds correctly with newer versions of LibreSSL.

 - ZeekJS was updated to v0.23.0, which brings compatibility with
   Node v26.

 - Spicy was updated to v1.14.1.

 - The TCP analyzer now clamps the window scale to 14 bytes, which
   conforms with RFC7323.

 - The Geneve analyzer now properly parses encapsulated IPv6 packets.

 - A regression in the management framework's handling of metrics-port
   collision avoidance was fixed.

 - A number of out-of-bounds reads where fixed in the following
   analyzers: BitTorrent, DCE-RPC, GSS-API, GTPv1, IRC, KRB, Login,
   NetBIOS, NFLog, and SSL.

 - A number of signed bit-shifting issues were fixed in the following
   analyzers: ASN.1, DNS, DTLS, FTP, Geneve, IP, NetBIOS, Null,
   RFB, SNAP, SMB, and VXLAN.

 - The Ident analyzer fixed a potential signed overflow when parsing
   port information.

 - A bug was fixed in the pcapng packet source with handling empty
   options blocks.

 - A potential segfault was fixed with the global_ids BIF if it was
   called during startup before all of the script-level type data
   was fully parsed.

 - The NTP analyzer gained some additional length checking when
   parsing extension fields to avoid potential integer overflows.

 - Certain protocol fields in the RDP parser are capped to maximum
   values to prevent unbounded buffering.

 - A few fixes were applied to the handling of HTTP Content-Range
   values to avoid integer overflows.

 - The GENEVE and VXLAN analyzers now use the correct packet object
   when parsing the inner packet, avoiding a possible null pointer
   dereference.

Reported by:	Tim Wojtulewicz

security/zeek: Unbreak build with libressl

Apply upstream fixes for building with libressl:

    https://github.com/zeek/zeek/pull/5578

Which includes:

    https://github.com/zeek/zeek/commit/8e05b01
    https://github.com/zeek/zeek/commit/f38fa4d

Obtained from:	Kevin Harrington
Reported by:	Kevin Harrington

security/zeek: Clean up USES=python

Python 3.10 is the minimal supported Python 3.

Approved by:	portmgr (blanket)
With hat:	python

security/zeek: Unbreak build for current after 86326398b73b

Upstream issue:

    https://github.com/zeek/zeek/issues/5557

Upstream analysis:

    In C++20 which we use assert is still a mess since it is so
    underspecified, but many implementations already perform
    conversion of its arguments to bool; this is likely the reason
    we missed this. According to your logs the implementation of
    assert in your particular build configuration does not do that

Upstream fixes:

    https://github.com/zeek/spicy/pull/2399
    Do not assume assert performs C++26 contextual conversions

    (plus two additional changes)

While here switch to USES=compiler:c++20-lang

Obtained from:	Benjamin Bannier
Reported by:	pkg-fallout

security/zeek: Update to 8.0.8

https://github.com/zeek/zeek/releases/tag/v8.0.8

This release fixes the following potential DoS vulnerability:

 - A specially-crafted series of MIME headers sent via SMTP or HTTP
   could cause Zeek to use large amounts of memory and potentially
   crash.

This release fixes the following potential DoS vulnerability:

 - Sqlite storage backends no longer potentially write data into a
   single database file across multiple unrelated backend handles.

 - A crash in the table code was fixed if reallocation failed while
   resizing.

Reported by:	Tim Wojtulewicz

security/zeek: Update to 8.0.7

https://github.com/zeek/zeek/releases/tag/v8.0.7

This release fixes the following potential DoS vulnerabilities:

 - A series of DNS messages containing long DNS compression chains
   can cause Zeek to spend a long time processing packets and
   potentially crash. Due to the fact that these packets can be
   received from remote hosts, this is a DoS risk.

 - A specially-crafted LDAP search request can cause Zeek to spend
   a long time processing the packet, resulting in Zeek silently
   dropping the LDAP analyzer for the connection. Due to the fact
   that these packets can be received from remote hosts, this is
   an evasion risk.

 - A specially-crafted series of ASN.1 messages in LDAP packets can
   cause Zeek to spend a long time processing the packets, resulting
   in Zeek silently dropping the LDAP analyzer for the connection.
   Due to the fact that these packets can be received from remote
   hosts, this is an evasion risk.

This release fixes the following bugs:

 - Support for non-Broker cluster backends was added to the
   cluster/experimental set of scripts.

 - The SQLite storage backend now uses quick_check instead of
   integrity_check in the default set of pragmas.

 - The events ssl_extension_pre_shared_key_server_hello and
   ssl_extension_pre_shared_key_client_hello can now be used
   independently.

 - The SSH analyzer now supports the ML-KEM family of key exchange
   algorithms.

 - A memory leak in the telemetry framework's process handling on
   FreeBSD was fixed.

 - ZeekJS was updated to v0.22.1.

Reported by:	Tim Wojtulewicz

security/zeek: Do not remove state.db on pkg remove

Klemens Nanni reported that "pkg upgrade zeek" was breaking zeekctl
in a cluster installation. Testing showed this was also true for
standalone.

The pkg-message already advises the user that they may need to
manually remove state.db.

Reported by:	Klemens Nanni

security/zeek: security/zeek: Update to 8.0.6

https://github.com/zeek/zeek/releases/tag/v8.0.6

This release fixes the following potential DoS vulnerability:

 - Zeek's HTTP analyzer can be tricked into interpreting Transfer-Encoding
   or Content-Length headers set in MIME entities within HTTP bodies
   and change the analyzer behavior.

This release fixes the following bugs:

 - A missing state check was added to the finalize_redis hook in
   the Redis analyzer

 - A bug was fixed when attempting to append a vector to itself
   that would cause an infinite loop.

 - A memory leak was fixed that occurred when looping over tables
   while running Zeek with ZAM enabled.

Reported by:	Tim Wojtulewicz

security/zeek: security/zeek: Update to 8.0.5

https://github.com/zeek/zeek/releases/tag/v8.0.5

This release fixes the following bugs:

 - The to_subnet() built-in function's parsing of IPv6 subnets was
   changed to align with how IPv6 subnet literals are parsed in
   Zeek scripts.

 - Zeek now reports a better error message when a table constructor
   is called without square brackets around the keys.

 - ssl.log will now correctly report certificate fingerprints when
   a protocol error is encountered after certificates are passed,
   but before the connection is logged.

 - An unbounded growth issue was fixed with Zeek's internal regex
   engine, which caused excessive memory usage when constructing
   large numbers of patterns.

 - An attribute error related to metrics ports reported by zeekctl
   when using standalone mode was fixed.

 - Zeek now correctly handles blocks being used when defining Spicy
   units.

 - A potential crash around evaluating invalid expressions during
   Zeek initialization was fixed.

 - Zeek now properly accounts for originator and responder packets
   and byte counts when a connection flip happens on the second
   packet.

Reported by:	Tim Wojtulewicz

security/libsodium: Update to 1.0.21

The API remains compatible but bumping all dependent ports as SHLIB
has changed.

Changelog: https://github.com/jedisct1/libsodium/releases/tag/1.0.21-RELEASE
Security: https://00f.net/2025/12/30/libsodium-vulnerability/
PR: 279347

security/zeek: Update PATH the crash-diag so it can locate gdb

Previously the script was not finding gdb.

security/zeek: Update to 8.0.4

https://github.com/zeek/zeek/releases/tag/v8.0.4

This release fixes the following bugs:

 - Reverts an inadvertent change to Zeekctl's pysubnettree submodule
   that was causing Zeekctl to require Python 3.10.

 - A potential crash involving deleting items from tables with the
   &ordered attribute was fixed.

 - zeek-client was updated to the newly-released v1.5.0.

Reported by:    Tim Wojtulewicz

security/zeek: Update to 8.0.3

https://github.com/zeek/zeek/releases/tag/v8.0.3

This release fixes the following bugs:

 - zeekctl stats should no longer report a Python error.

 - The management framework controller configuration has a new
   tls_options_websocket variable for setting TLS options for the
   controller's Websocket server.

 - Fixed Broker errors being visible/sent to WebSocket clients
   unrelated to their own connection.

Reported by:    Tim Wojtulewicz

security/zeek: Update to 8.0.2

https://github.com/zeek/zeek/releases/tag/v8.0.2

This release fixes the following vulnerability:

 - The KRB analyzer can leak information about hosts in analyzed
   traffic via external DNS lookups.

This release fixes the following bugs:

 - The get_current_packet_header() BIF now populates the returned
   record also for fragmented IP datagrams.

 - The decompose_uri() script function now correctly handles URIs
   containing IPv6 addresses.

 - The QUIC parser now discards packets with the fixed_bit field
   set to 0, rather than continuing to parse and potentially running
   into analyzer violations.

While here, conform to hier(7) by moving default log and spool
directories to /var (thanks to Klemens Nanni for reporting this).
This change only affects new installs of zeek since zeekctl.cfg is
not modified.

Reported by:    Tim Wojtulewicz, Klemens Nanni

security/zeek: Update to 8.0.1

https://github.com/zeek/zeek/releases/tag/v8.0.1

Reported by:    Tim Wojtulewicz

security/zeek: Update to 8.0.0

This is the latest major version number Long-Term Support (LTS)
release of Zeek.

    https://github.com/zeek/zeek/releases/tag/v8.0.0

Reported by:    Tim Wojtulewicz

security/zeek: Update to 7.0.9

This release fixes the following potential DoS vulnerability:

 - Very large log records can cause Zeek to overflow memory and
   potentially crash.

This release fixes the following bugs:

 - The response to BDAT LAST was never recognized by the SMTP
   analyzer, resulting in the BDAT LAST commands not being logged
   in a timely fashion and receiving the wrong status.

 - The ZeekJS submodule was updated to v0.18.0.

Reported by:    Tim Wojtulewicz

security/zeek: Fix PERFTOOLS_RUN_DEPENDS

Build depends should be executables or shared libraries, not include
files.

Reported by:    Gleb Popov

security/zeek: Unbreak PERFTOOLS

Apparently the pprof has been provided by the devel/pprof port for
quite awhile. Since PERFTOOLS is off by default this wasn't noticed
until reported by Andrea Venturoli.

Reported by:    Andrea Venturoli

security/zeek: Update to 7.0.8

https://github.com/zeek/zeek/releases/tag/v7.0.8

This release fixes the following bugs:

 - GCC 15.1 failed to build both Zeek and the integrated Paraglob
   library.

 - The requirement for the BIND library to be present for the build
   was removed.

 - The Spicy submodule was updated to v1.11.5. This version brings
   a fix for a compilation failure when iterating over a byte value.

Reported by:    Tim Wojtulewicz

security/zeek: Update to 7.0.7

https://github.com/zeek/zeek/releases/tag/v7.0.7

This release fixes the following bugs:

 - The LDAP analyzer now handles GSSAPI-signed traffic correctly
   if the response token is missing.

The QUIC analyzer gained the following fixes:

 - Traffic where ClientHello/ServerHello messages are fragmented
   over multiple packets should now be parsed correctly.

 - The wrong connection ID could be used for decryption if the
   client started using a different one later in the INITIAL packet.

 - ACK ranges should now be parsed correctly.

 - Parsing of INITIAL packets could consume the remainder of a UDP
   datagram, even if there were possibly other PACKET types in that
   datagram.

Reported by:    Tim Wojtulewicz

security/zeek: Update to 7.0.6

https://github.com/zeek/zeek/releases/tag/v7.0.6

This release fixes the following bugs:

 - ZAM now handles assignment of record fields correctly when
   assigning to the result of an in operation.

 - The QUIC analyzer was not handling all of the packets in a
   multi-packet UDP datagram, which lead it to miss data and have
   incomplete logging.

 - The QUIC analyzer was not confirming the protocol early enough,
   which caused the service field for a connection to possible have
   a strange ordering (possibly confirmingg ssl before quic, for
   example).

 - The @load-plugin script directive had some deficiencies when it
   came to loading scripts generated by BIF code, which could
   potentially lead to errors with plugins using those directives.

 - VLAN packets containing VNTAG headers were not being handled
   correctly.

 - ZeekJS keeps now properly keeps the Node.js IO loop alive until
   Zeek terminates.

 - The ZeekJS Javascript execution is now offloaded to a dedicated
   thread to allow for interoperability with Spicy fibers.

 - The mozilla-ca-list.zeek and ct-list.zeek files were updated to
   be based on NSS 3.109.

Reported by:    Tim Wojtulewicz

security/zeek: Update to 7.0.5

https://github.com/zeek/zeek/releases/tag/v7.0.5

This release fixes the following potential DoS vulnerability:

 - Large QUIC packets can cause Zeek to overflow memory and potentially
   crash. Due to the possibility of receiving these packets from
   remote hosts, this is a DoS risk.

This release fixes the following bugs:

 - The ZAM script optimization feature gained some fixes for some
   minor memory leaks.

 - The ZeekJS submodule was updated to v0.14.0. In certain environment,
   ZeekJS would fail to start a debugging thread due to limited
   stack size, producing spurious log messages

Reported by:    Tim Wojtulewicz

security/zeek: Update to 7.0.4

https://github.com/zeek/zeek/releases/tag/v7.0.4

This release fixes the following bugs:

 - The community-id-logging.zeek policy script was used to set
   c$conn$community_id during new_connection() rather than
   connection_state_remove(), allowing other scripts to reuse its
   value early.

 - The input framework will no longer get stuck and use 100% of the
   CPU when encountering lines not immediately terminated by a new
   line.

 - The Modbus analyzer added some additional protocol checks and
   should no longer over-match on traffic that's not specifically
   on port 502.

 - ZeekJS was updated to version v0.13.2, which brings support for
   newer versions of Node.js and a fix for a segfault when running
   under Alpine.

 - A minor bug was fixed in the detect-sqli policy script to handle
   spaces being encoded as plus signs.

Reported by:    Tim Wojtulewicz

security/zeek: Fix build with clang 19

https://github.com/zeek/zeek/issues/3994
    https://github.com/zeek/zeek/pull/3997

    Clang 19 with libc++ started failing to compile because the
    default implementation of std::char_traits was removed, making
    uses of std::char_traits<unsigned char> invalid (by consequence,
    also std::basic_string<unsigned char>).

security/zeek: Update to 7.0.3

https://github.com/zeek/zeek/releases/tag/v7.0.3

This release fixes the following potential DoS vulnerability:

 - Adding to the POP3 hardening in 7.0.2, the parser now simply
   discards too many pending commands, rather than any attempting
   to process them. Further, invalid server responses do not result
   in command completion anymore. Processing out-of-order commands
   or finishing commands based on invalid server responses could
   result in inconsistent analyzer state, potentially triggering
   null pointer references for crafted traffic.

Reported by:	Tim Wojtulewicz

security/zeek: Update to 7.0.2

https://github.com/zeek/zeek/releases/tag/v7.0.2

This release fixes the following potential DoS vulnerability:

 - The POP3 parser has been hardened to avoid unbounded state growth
   in the face of one-sided traffic capture or when enabled for
   non-POP3 traffic.

This release fixes the following bugs:

 - Support for SASL+SPNEGO+NTLMSSP was added to the LDAP analyzer.

 - Telemetry callbacks are now handled via Zeek instead of depending
   on the prometehus-cpp library to handle them.

Reported by:	Tim Wojtulewicz

security/zeek: Update to 7.0.1

https://github.com/zeek/zeek/releases/tag/v7.0.1

This release fixes the following bugs:

 - HTTP passwords with colon characters in them are now correctly
   logged.

 - The LDAP analyzer now supports handling of non-sealed GSS-API
   WRAP tokens.

 - Heuristics for parsing SASL encrypted and signed LDAP traffic
   have been made more strict and predictable.

 - StartTLS support was added to the LDAP analyzer.

 - Specify less-strict permissions for directories and files created
   by zeek-archiver to play more nicely with user's umask setting.

Reported by:	Tim Wojtulewicz

security/zeek: Clean up some stage nits

- Change the legacy lib/broctl symlink from an absolute to a
   relative path.

 - Remove unnecessary USES=gettext-runtime

 - Add @dir pkg-plist entries for empty directories.

Reported by:	Daniel Engberg

security/zeek: Update to 7.0.0

https://github.com/zeek/zeek/releases/tag/v7.0.0

This is the latest major version number Long-Term Support (LTS)
release of Zeek.

 - The Telemetry framework has had a major rework, and includes a
   number of breaking changes. The biggest change is a move towards
   a Prometheus-first model.

 - All of the metrics-related script-level options, type, and methods
   have been
   moved to the Telemetry framework.

 - The following options have been removed:

       Broker::metrics_export_interval
       Broker::metrics_export_topic
       Broker::metrics_import_topics
       Broker::metrics_export_prefixes

 - The unit field has been removed from the telemetry log.

 - All of the BROKER_METRICS_* environment variables have been
   removed.

 - The instruments that previously supported count in scripts and
   int64_t in C++ were removed in favor of only providing double
   versions.

 - The is_sum argument has been removed from the constructors/creation
   methods for all of the instruments.

 - Zeekctl now sets FileExtract::prefix to spool/extract_files/<node>
   to avoid deletion of extracted files when stopping worker nodes.

 - Support delete on tables, sets and vectors to clear their contents.

 - A new helper function can_load() backed by a new bif find_in_zeekpath()
   was added to determine if a non-relative @load directive might
   work.

 - Zeek packagers can now include a "local" addition into Zeek's
   version string.

 - SMB2 packets containing multiple PDUs now correctly parse all
   of the headers, instead of just the first one and ignoring the
   rest.

 - The new built-in function lookup_connection_analyzer_id() retrieves
   the numeric identifier of an analyzer associated with a connection.

 - The from_json() function now supports ingesting JSON representations
   of tables as produced by the to_json() function.

 - The analyzer.log now optionally supports logging of disabled
   analyzers through the new option Analyzer::logging::include_disabling.

 - The ftp.log fuid field is now cleared after handling a command
   with a fuid associated with it.

 - The type_name field populated by global_ids() now aligns with
   the value returned by type_name() for each identifier. E.g,
   Site::local_nets has a type_name of set[subnet] rather than table.

 - The ISO 9660 file signature has been moved into the policy
   directory.

 - The val_footprint() BiF now factors in the size of strings when
   reporting footprints, roughly equating a string's size with the
   number of elements comparable to that length.

 - The tuning/defaults policy has been deprecated and will be removed
   in v7.1.

 - If a Spicy protocol analyzers feeds data into file analysis, it
   now needs to call Zeek's Files::register_protocol() and provide
   a callback for computing file handles.

 - The Supervisor's API now returns NodeConfig records with a cluster
   table whose ClusterEndpoints have a port value of 0/unknown,
   rather than 0/tcp, to indicate that the node in question has no
   listening port.

 - The --disable-archiver configure flag no longer does anything
   and will be removed in 7.1. zeek-archiver has moved into the
   zeek-aux repository.

Reported by:	Tim Wojtulewicz

security/zeek: Fix intermittent crash

Also fix trace-summary python backtrace.

Intermittent crash:

    https://github.com/zeek/zeek/commit/8c337bd7693a2002dcfe8a15b35dc92eb9e78de9

    threading/MsgThread: Decouple IO source and thread

    A MsgThread acting as an IO source itself can result in the
    scenario where the threading manager's heartbeat timer deletes
    a terminated MsgThread instance, but at the same time this
    instance is in the list of ready IO sources as determined by
    the IO loop in the current iteration.

trace-summary backtrace:

    https://github.com/zeek/pysubnettree/pull/38

    Fix extension for stricter unicode validation

    This fixes our extension module for python/cpython#105375 which
    made unicode validation stricter.

Reported by:	Arne Welzel (crash), ogogon (backtrace)

security/zeek: Update to 6.0.4

https://github.com/zeek/zeek/releases/tag/v6.0.4

This release fixes the following bugs:

 - The Mozilla CA and Google CT lists were updated to their latest
   versions.

 - A crash with ICMP packets involving errant length checking was
   fixed.

 - When a shadow file is empty/missing during rotation, Zeek aborts
   with an error message, but if the shadow file was empty, it will
   still be there after the restart.

 - A new function remove_exclude was added to the PacketFilter
   framework which can be used to remove a previously added exclude
   filter by name.

 - A new option --localversion was added to the configure script.

 - The highwayhash submodule was updated to fix a build issue for
   FreeBSD.

Reported by:	Tim Wojtulewicz

security/zeek: Convert post-extract to EXTRACT_AFTER_ARGS

"Saves I/O by not extracting unused dependency"

PR:		278766
Reported by:	diizzy

security/zeek: Fix package when BUILD_TYPE is not "release"

This is a simple pkg-plist change.

security/zeek: Update to 6.0.3

https://github.com/zeek/zeek/releases/tag/v6.0.3

This release fixes the following potential DoS vulnerability:

 - A specially-crafted series of packets containing nested MIME
   entities can cause Zeek to spend large amounts of time parsing
   the entities.

This release fixes the following bugs:

 - CMake correctly passes along third-party package information
   when building plugins.

 - Fix a problem with the HTTP analyzer where a signature regex
   ending in '$' used to match against 'http-request-body' or
   'http-reply-bdoy' will never succeed.

 - The DNS analyzer now understands the Ed25519 and Ed448 signature
   algorithms.

 - The SMB::State$recent_files field was not correctly expiring
   entries, leading to unbounded state growth.

 - The &create_expire attribute is now kept valid after clearing a
   table.

Reported by:	Tim Wojtulewicz
Security:	fedf7e71-61bd-49ec-aaf0-6da14bdbb319

security/zeek: Remove reference to MANPREFIX

Remove ZEEK_MAN_INSTALL_PATH and let cmake default to share/man.

Reported by:	bofh

security/zeek: Install man pages in share/man

*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree

- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
  ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
  Also move conditional flags for non sparc64/arm ARCH to fixed flags.

Reviewed by:	brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068

security/zeek: Update to 6.0.2

https://github.com/zeek/zeek/releases/tag/v6.0.2

This release fixes the following potential DoS vulnerabilities:

 - A specially-crafted SSL packet could cause Zeek to leak memory
   and potentially crash.

 - A specially-crafted series of FTP packets could cause Zeek to
   log entries for requests that have already been completed, using
   resources unnecessarily and potentially causing Zeek to lose
   other traffic.

 - A specially-crafted series of SSL packets could cause Zeek to
   output a very large number of unnecessary alerts for the same
   record.

 - A specially-crafted series of SSL packets could cause Zeek to
   generate very long ssl_history fields in the ssl.log, potentially
   using a large amount of memory due to unbounded state growth

 - A specially-crafted IEEE802.11 packet could cause Zeek to overflow
   memory and potentially crash

This release fixes the following bugs:

 - Fixed Spicy type names from causing collisions with existing
   Zeek types.

 - On some systems with low values for the maximum number of file
   descriptors, it was possible to run into crashes when doing DNS
   lookups if all of the file descriptors were used.

 - Tables backed by a Broker backend now correctly support deletion
   if they have complex index types.

 - A significant performance issue with Zeek's supervisor code was
   fixed, revolving around the re-initialization of the Event Manager
   object used to track events.

 - The MaxMind DB code now cleans up after itself, resolving a
   memory leak with the loaded database files.

 - The ZeekJS submodule was updated to version 0.9.6, bringing fixes
   for zeek.invoke and zeek.event crashes, garbage collection, and
   an issue where Zeek may stop executing events from ZeekJS.

Reported by:	Tim Wojtulewicz
Security:	386a14bb-1a21-41c6-a2cf-08d79213379b

security/zeek: revert f85e384: inadvertent update

I accidently commited changes to security/vuxml and security/zeek.

security/vuxml: Mark zeek < 6.0.2 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v6.0.2

This release fixes the following potential DoS vulnerabilities:

 - A specially-crafted SSL packet could cause Zeek to leak memory
   and potentially crash.

 - A specially-crafted series of FTP packets could cause Zeek to
   log entries for requests that have already been completed, using
   resources unnecessarily and potentially causing Zeek to lose
   other traffic.

 - A specially-crafted series of SSL packets could cause Zeek to
   output a very large number of unnecessary alerts for the same
   record.

 - A specially-crafted series of SSL packets could cause Zeek to
   generate very long ssl_history fields in the ssl.log, potentially
   using a large amount of memory due to unbounded state growth

 - A specially-crafted IEEE802.11 packet could cause Zeek to overflow
   memory and potentially crash

Reported by:	Tim Wojtulewicz

security/zeek: Remove duplicated and incorrect build dependency of CMake

CMake binary is provided by devel/cmake-core not devel/cmake which
is a metaport and we don't need to safeguard for a version that's
over 3 years old

Approved by:	portmgr (blanket)

security/zeek: Update to 6.0.0

https://github.com/zeek/zeek/releases/tag/v6.0.1

This release fixes the following potential DoS vulnerabilities:

 - File extraction limits were not correctly enforced for files
   containing large amounts of missing bytes.

 - Sessions are sometimes not cleaned up completely within Zeek
   during shutdown,
   potentially causing a crash when using the -B dpd flag for debug logging.

 - A specially-crafted HTTP packet can cause Zeek's filename
   extraction code to take a long time to process the data.

 - A specially-crafted series of FTP packets made up of a CWD request
   followed by a large amount of ERPT requests may cause Zeek to
   spend a long time logging the commands.

 - A specially-crafted VLAN packet can cause Zeek to overflow memory
   and potentially crash.

This release fixes the following bugs:

 - Fixed a base64 decoding issue with the authorization field of
   HTTP request headers that was sometimes causing Zeek to output
   error messages.

 - Ensure that Zeek builds use the internal version of Spicy instead
   of external installations, unless specifically configured for
   that mode.

 - Support was added for switch fields when exporting Spicy types
   to Zeek.

 - A number of fixes were added to protect against potential unbounded
   state growth with the SMB and DCE-RPC analyzers. SMB close
   requests will properly tear down an related DCE-RPC analyzers.

 - Fixed a regression in the UDP and TCP analyzers that was causing
   more data than necessary to be forwarded to the next analyzer
   in the chain.

 - A connection's value is now updated in-place when its directionality
   is flipped due to Zeek's heuristics (for example, SYN/SYN-ACK
   reversal or protocol specific approaches).

 - Fixed undefined symbols being reported from Spicy when building
   some of the binary packages for Zeek.

 - Loading policy/frameworks/notice/community-id.zeek now also
   automatically community ID logging.

 - Spicy no longer registers an extra port for every port registered
   in a plugin's .evt file.

 - Timeouts in DNS resolution no longer cause uncontrolled memory
   growth.

 - Fix check to skip DNS hostname lookups for notices that are not
   delivered via email in policy/frameworks/notice/extend-email/hostnames.

Reported by:	Tim Wojtulewicz
Security:	8eefa87f-31f1-496d-bf8e-2b465b6e4e8a

security/zeek: Clean up USES=python

- While I'm here, fix PLIST

====> Checking for pkg-plist issues (check-plist)
===> Parsing plist
===> Checking for items in STAGEDIR missing from pkg-plist
Error: Orphaned: @dir lib/%%ZEEKUSER%%/plugins
Error: Orphaned: @dir lib/%%ZEEKUSER%%/spicy
===> Checking for items in pkg-plist which are not in STAGEDIR
===> Error: Plist issues found.
*** Error code 1

Approved by:	portmgr (blanket)
With hat:	python