CHANGES

2.8.0-dev.329 | 2026-07-21 08:44:34 -0700

  * Add GitHub CI setup based on the Cirrus configuration (Tim Wojtulewicz, Corelight)

    Co-Authored-By: Claude <noreply@anthropic.com>

  * internal/json: Do not throw on invalid addresses (Arne Welzel, Corelight)

    A WebSocket client sending `{"@data-type": "address", "data": "123ns"}` can
    trigger a runtime_error, resulting in process termination.

  * Bump CAF for OpenBSD SIGPIPE fix (Dominik Charousset, Corelight)

  * Make broker-node rate calculation more accurate (Dominik Charousset, Corelight)

    Decouple the message processing from the rate calculation by pushing the
    latter to a separate thread. By performing the rate calculation
    separately, we get more accurate results and also keep the code more
    structured.

  * In Python bindings docs, tweak wording regarding alternatives. (Christian Kreibich, Corelight)

  * Remove support for WebSocket clients (Dominik Charousset, Corelight)

  * doc/web-socket: Add us entry to timespan (Arne Welzel, Corelight)

2.8.0-dev.316 | 2026-05-07 16:57:57 -0700

  * CI: drop FreeBSD 13, add FreeBSD 15 (Christian Kreibich, Corelight)

  * CI: add macOS Tahoe (Christian Kreibich, Corelight)

  * CI: drop Ubuntu 24.10, add 26.04, drop 22.04 (Christian Kreibich, Corelight)

    Also reorder Debian jobs for consistency, no other change.

  * CI: drop CentOS Stream 9, add CentOS Stream 10 (Christian Kreibich, Corelight)

  * CI: drop openSUSE Leap 15.6, move to 16.0 (Christian Kreibich, Corelight)

  * CI: Drop Fedora 41/42, add 43/44 (Christian Kreibich, Corelight)

  * Updating submodule(s) [nomail] (Tim Wojtulewicz, Corelight)

  * Updating submodule(s) [nomail] (Tim Wojtulewicz, Corelight)

2.8.0-dev.307 | 2026-04-01 15:40:43 -0700

  * Bump cmake submodule to disable c2y warnings (Tim Wojtulewicz, Corelight)

2.8.0-dev.305 | 2026-02-01 09:06:20 +0100

  * Suppress false positives in clang-tidy (Dominik Charousset, Corelight)

  * Replace Debian 11 with Debian 13 on CI (Dominik Charousset, Corelight)

  * Fix clang-tidy findings and re-enable on CI (Dominik Charousset, Corelight)

2.8.0-dev.301 | 2026-01-21 09:02:48 +0100

  * Use C++20 iterator concepts in our format headers (Dominik Charousset, Corelight)

2.8.0-dev.299 | 2026-01-21 07:31:09 +0100

  * Apply some clang-tidy-19 suggestions (Dominik Charousset, Corelight)

2.8.0-dev.297 | 2026-01-21 06:53:35 +0100

  * Remove stale and obsolete file (Dominik Charousset, Corelight)

2.8.0-dev.294 | 2025-12-08 17:53:07 +0100

  * Use ranges versions of all_of, any_of, etc. (Dominik Charousset, Corelight)

2.8.0-dev.292 | 2025-12-08 17:40:58 +0100

  * Fix btests on newer Python releases (Dominik Charousset, Corelight)

  * Bump FreeBSD cirrus images (Dominik Charousset, Corelight)

2.8.0-dev.288 | 2025-12-01 08:25:13 +0100

  * Prefer `polymorphic_allocator` over a custom class (Dominik Charousset, Corelight)

  * Get rid of `monotonic_buffer_resource` (Dominik Charousset, Corelight)

    Seems like the STL version is now widely available. Hence, we no longer
    need our own backport version.

2.8.0-dev.285 | 2025-09-15 09:00:44 -0700

  * Replace SFINAE traits with concepts (Dominik Charousset, Corelight)

2.8.0-dev.283 | 2025-09-15 08:59:40 -0700

  * Commit sqlite3 files separate from zeek-3rdparty submodule (Tim Wojtulewicz, Corelight)

  * Remove zeek-3rdparty submodule (Tim Wojtulewicz, Corelight)

2.8.0-dev.280 | 2025-07-25 17:46:37 +0200

  * Remove dead code (Dominik Charousset, Corelight)

2.8.0-dev.278 | 2025-07-25 17:45:59 +0200

  * Remove stale files from the repository (Dominik Charousset, Corelight)

    These files have been excluded from CMake for a couple years now. Making
    the code compile again is not trivial and would require restructuring
    anyways. We can always rely on Git if we want to have the old
    implementation as a reference point, so no reason to have dead code
    rotting in the source tree.

2.8.0-dev.276 | 2025-07-25 17:45:20 +0200

  * Remove obsolete macro utilities (Dominik Charousset, Corelight)

    BROKER_TRY is no longer used in Broker. Neither are the macro utilities
    that it relies on.

  * Fix build on Clang 20 (Dominik Charousset, Corelight)

2.8.0-dev.273 | 2025-07-23 16:51:19 +0200

  * Remove building with -flto from python bindings (Tim Wojtulewicz, Corelight)

2.8.0-dev.271 | 2025-07-21 15:47:49 -0700

  * Use the new WebSocket frame API (Dominik Charousset, Corelight)

    CAF 1.0 emits WebSocket frame objects when using the WebSocket API. This
    step prepares Broker for the migration.

2.8.0-dev.269 | 2025-07-21 15:34:34 -0700

  * Fix various clang-tidy findings in C++20 mode (Dominik Charousset, Corelight)

    Major changes:

    - replace `enable_if` with `requires` clauses
    - use designated initializer list for aggregate types
    - use `starts_with` instead of `compare` on string views
    - use new `std::cmp_*` functions when comparing different integer types

    Furthermore, disable the modernize check for range-based iterators. We
    may want to re-visit that at some point but the suggested clang-tidy
    fixes result in broken code. We also disable the exception escape
    warnings for now. Some complaints from this change are legit but there
    are also weird cases where we pass callbacks as lambda expressions and
    clang-tidy insists that they should be `noexcept` for no apparent
    reason. We might want to re-visit that check eventually as well.

    Minor tweaks for silencing clang-tidy complaints:

    - fixed unchecked optional access in `clone_actor.cc`
    - use `remove_if` in `clone_actor.cc` since clang-tidy complains that
      sorting pointers is nondeterministic when using `partition`, which it
      is right to point out but we don't care in this use case
    - fix switch statement with identical branches in `flare_actor.cc`
    - fix 'dead store' in `sqlite_backend.cc` when compiling with
      `BROKER_ASSERT` disabled
    - avoid `std::endl` with `std::cout` (use '\n' instead)
    - change some parameters from value to const reference

2.8.0-dev.267 | 2025-07-21 19:39:59 +0200

  * variant: Allow reference access to shared_envelope (Arne Welzel, Corelight)

    @bbannier pointed out that `shared_envelope()` always increments the
    atomic ref count due to auto declaration. Switch the API to const auto& to
    allow access without incrementing the ref count.

2.8.0-dev.265 | 2025-07-12 14:14:51 +0200

  * Read timestamps as UTC by default (Dominik Charousset, Corelight)

2.8.0-dev.263 | 2025-07-10 14:06:17 -0700

  * Use <version> header instead of deprecated <ciso646> (Tim Wojtulewicz, Corelight)

  * Add flag to disable building extra tools (Tim Wojtulewicz, Corelight)

    The extra tools cause linker errors on the Windows CI builds by causing
    the build processes to run out of memory. They're not necessary for the
    few tests we run for Windows there, so disable them for CI builds.

  * CI: Make Windows environment consistent with how Zeek does it (Tim Wojtulewicz, Corelight)

  * Require C++20 for builds (Tim Wojtulewicz, Corelight)

2.8.0-dev.258 | 2025-06-30 10:18:01 -0700

  * Fix CAF-side warnings in C++20 mode (Dominik Charousset, Corelight)

2.8.0-dev.256 | 2025-06-25 10:29:42 -0700

  * Fix build on Fedora 42 with C++20 enabled (Dominik Charousset, Corelight)

  * Fix build issue in C++20 mode (Dominik Charousset, Corelight)

    (cherry picked from commit 67f7e7da7457a08d3fe0658959da826039c2d0e3)

2.8.0-dev.253 | 2025-06-25 10:29:24 -0700

  * Make some lambda captures more concise in what they're capturing (Tim Wojtulewicz, Corelight)

    This fixes some warnings in C++ 20 builds as well. Lambda captures
    using just [=] are deprecated in that version.

2.8.0-dev.251 | 2025-06-25 16:27:01 +0200

  * Emit chunks from peer connections (Dominik Charousset, Corelight)

    CAF 1.0 emit chunks when running a length-prefix framing protocol. This
    step prepares Broker for the migration.

2.8.0-dev.249 | 2025-06-24 10:30:01 -0700

  * Update baseline for WebSocket test (Dominik Charousset, Corelight)

  * Integrate CAF patch for WS unicode escaping (Dominik Charousset, Corelight)

2.8.0-dev.246 | 2025-06-24 10:22:13 -0700

  * Remove GCC 8 workaround for std::less (Tim Wojtulewicz, Corelight)

2.8.0-dev.244 | 2025-06-24 10:21:46 -0700

  * Add pre-commit for cmake-format, using Zeek config (Tim Wojtulewicz, Corelight)

2.8.0-dev.242 | 2025-05-30 07:20:17 -0700

  * Update pybind11 to v2.13.6 (Tim Wojtulewicz, Corelight)

  * CI: Drop Fedora 40, add Fedora 42 (Arne Welzel, Corelight)

2.8.0-dev.238 | 2025-05-06 15:44:15 +0200

  * Remove stale CI files (Dominik Charousset, Corelight)

2.8.0-dev.234 | 2025-04-23 08:29:32 -0700

  * CI: No more Ubuntu 20.04 [skip ci] (Arne Welzel, Corelight)

2.8.0-dev.232 | 2025-04-23 14:25:31 +0200

  * Add a NEWS entry for hub (Arne Welzel, Corelight)

  * Fix documentation wording (Dominik Charousset, Corelight)

  * Add cleanup code for removing obsolete hub state (Dominik Charousset, Corelight)

  * Simplify filter logic for hubs in the core actor (Dominik Charousset, Corelight)

  * Add missing wait() statement in the subscribers (Dominik Charousset, Corelight)

  * Remove force-closing hubs on shutdown (Dominik Charousset, Corelight)

  * Allow subscribers to receive messages from hubs (Dominik Charousset, Corelight)

  * Fix memory leak when using hubs (Dominik Charousset, Corelight)

  * Fix shutdown delay with the new hubs (Dominik Charousset, Corelight)

  * Integrate review feedback (Dominik Charousset, Corelight)

  * Drop obsolete type alias (Dominik Charousset, Corelight)

  * Allow publishing `data_message` directly on a hub (Dominik Charousset, Corelight)

  * Re-implement publishers and subscribers using hubs (Dominik Charousset, Corelight)

  * Implement new hub API (new pub/sub primitive) (Dominik Charousset, Corelight)

2.8.0-dev.217 | 2025-04-22 11:37:52 -0700

  * Add new store::proxy::valid function (Dominik Charousset, Corelight)

2.8.0-dev.215 | 2025-04-21 16:57:03 -0700

  * Extend the event observer for client connections/buffering (Christian Kreibich, Corelight)

  * Extend the event observer for peering/buffering (Dominik Charousset, Corelight)

  * Remove obsolete metric for buffered messages (Dominik Charousset, Corelight)

    Since we have started using the backpressure operator, the buffered metric
    ("broker_buffered_messages") will always display 0 as buffering takes places
    elsewhere and is per-peering.

2.8.0-dev.211 | 2025-04-19 16:33:45 +0200

  * Remove obsolete CMake/configure options (Dominik Charousset, Corelight)

2.8.0-dev.209 | 2025-04-18 12:34:40 -0700

  * Suppress warnings from CAF on GCC and Clang (Dominik Charousset, Corelight)

  * Promote some info log events to warnings (Dominik Charousset, Corelight)

  * Fix leftover legacy log statements (Dominik Charousset, Corelight)

  * Fix string conversion for internal_command (Dominik Charousset)

  * Avoid throwing exceptions on format string errors (Dominik Charousset)

  * Minor fixes for the new logger plus filter option (Dominik Charousset, Corelight)

  * Merge internal into public logger.hh, add verbose (Dominik Charousset, Corelight)

  * Port remaining log statements, remove log macros (Dominik Charousset, Corelight)

  * Port logging in the store obj to the new API (Dominik Charousset, Corelight)

  * Port more store logging to the new API (Dominik Charousset, Corelight)

  * Merge master and clone store log components (Dominik Charousset, Corelight)

    The distinction between clones and masters at the log level component
    has proven to be too fine-grained and makes it difficult to log events
    outside of the master and clone actors, e.g., the store (base) actor or
    the channels.

  * Remove BROKER_TRACE from the code base (Dominik Charousset, Corelight)

    The new logging backend no longer offers trace logging. Since it is more
    geared towards high-level description of events rather than leaving a
    paper trail what lines of code ran.

  * Convert logging for core and endpoint components (Dominik Charousset, Corelight)

  * Use the new logging functions (Dominik Charousset, Corelight)

  * Add new API for tapping into Broker logs (Dominik Charousset, Corelight)

    The new event API in Broker enables users to install custom event
    observers (loggers) in order to embed Broker logs into a wider context.

2.8.0-dev.185 | 2025-03-31 14:38:05 +0200

  * Drop caf dependencies from example (Benjamin Bannier, Corelight)

    We do not expose caf as a Broker dependency anymore so this is not
    required.

  * Require C++17 when compiling example (Benjamin Bannier, Corelight)

    We have required C++17 since some time now, and this would have not
    compiled since then.

2.8.0-dev.182 | 2025-03-31 14:37:48 +0200

  * Bump pre-commit hooks (Benjamin Bannier, Corelight)

  * Populate data_envelope with topic in json::decode() (Arne Welzel, Corelight)

    This allows users access to the topic via variant::shared_envelope()

2.8.0-dev.178 | 2025-02-20 13:17:43 +0100

  * Remove space in UDL definition (Tim Wojtulewicz, Corelight)

2.8.0-dev.176 | 2025-02-15 10:14:39 +0100

  * Fix typo in configuration option name (Dominik Charousset, Corelight)

2.8.0-dev.174 | 2025-02-07 17:45:35 -0800

  * CI: bump FreeBSD 14 to 14.2, which came out in Dec'24 (Christian Kreibich, Corelight)

  * CI: remove OpenSuSE Leap 15.5, EOL. (Christian Kreibich, Corelight)

2.8.0-dev.171 | 2025-01-27 07:37:10 -0700

  * Add sphinx configuration key for readthedocs (Tim Wojtulewicz, Corelight)

2.8.0-dev.169 | 2024-12-13 12:02:08 -0700

  * CI: Add '=' to ENV commands to silence 'docker build' warnings (Tim Wojtulewicz, Corelight)

  * CI: Add python3-distuils to ubuntu 20 image (Tim Wojtulewicz)

  * CI: Require newer gcc and python on opensuse-leap builds (Tim Wojtulewicz, Corelight)

2.8.0-dev.163 | 2024-12-10 17:27:21 -0700

  * Fix ruff F findings (Tim Wojtulewicz, Corelight)

  * Fix ruff UP findings (Tim Wojtulewicz, Corelight)

  * Fix ruff C4 findings (Tim Wojtulewicz, Corelight)

  * Add ruff linting for python, fix I/ISC issues (Tim Wojtulewicz, Corelight)

  * Add pre-commit run ruff-format, fix findings (Tim Wojtulewicz, Corelight)

  * Remove long-obsolete travis.yml file (Tim Wojtulewicz, Corelight)

  * CI: Install python3.9-dev on ubuntu 20 (Tim Wojtulewicz, Corelight)

  * Require Python 3.9 in CMakeLists.txt (Tim Wojtulewicz, Corelight)

2.8.0-dev.154 | 2024-12-06 15:14:02 -0800

  * Fix potential connector infinite loop in read_result::stop scenarios (Christian Kreibich, Corelight)

  * Add reason strings to a peering's force_disconnect() (Christian Kreibich, Corelight)

  * Revert part of 4d9aa3bd that currently breaks Zeek build (Christian Kreibich, Corelight)

2.8.0-dev.150 | 2024-12-06 00:02:47 -0800

  * CI: add Ubuntu 24.10 (Christian Kreibich, Corelight)

  * CI: bump FreeBSD to 14.1 and 13.4, respectively (Christian Kreibich, Corelight)

  * CI: drop Fedora 39, add 41 (Christian Kreibich, Corelight)

2.8.0-dev.146 | 2024-12-04 14:36:30 -0700

  * CI: Require python 3.9 on ubuntu 20 (Tim Wojtulewicz, Corelight)

2.8.0-dev.144 | 2024-12-02 23:59:25 -0800

  * Fix log statement when disconnecting stalled peers (Dominik Charousset)

  * Disconnect slow peers and WS clients by default (Dominik Charousset)

  * Pick up backport for on_backpressure_buffer (Dominik Charousset)

2.8.0-dev.140 | 2024-11-25 19:00:28 +0100

  * Fix invalid range clang-tidy findings (Dominik Charousset, Corelight)

    Fix occurrences of "The value '0' provided to the cast expression is not
    in the valid range of values for 'p2p_message_type'."

  * Fix clang-tidy performance warnings (Dominik Charousset, Corelight)

    Addressed warnings:

    - parameter is copied for each invocation but only used as a const
      reference
    - do not use 'std::endl' with streams; use '\\n' instead

    Furthermore, `performance-enum-size` warnings have been disabled. Broker
    uses several enum types in types that are exchanged over the network.
    Changing the enum types would be a breaking change on the wire format.

2.8.0-dev.137 | 2024-11-07 19:06:35 +0100

  * Update `clang-format` on CI (Dominik Charousset)

2.8.0-dev.135 | 2024-11-07 16:48:29 +0100

  * Bump dockerfiles for Fedora 39 and 40 (Dominik Charousset)

2.8.0-dev.133 | 2024-10-18 17:42:01 -0700

  * Remove obsolete operators.hh utility (Dominik Charousset)

2.8.0-dev.131 | 2024-10-18 16:57:55 -0700

  * Integrate review feedback (Dominik Charousset)

  * Fix regression in the new decoding logic (Dominik Charousset)

  * Fix build on FreeBSD (Dominik Charousset, Corelight)

  * Replace CAF deserializers with Broker decoders (Dominik Charousset, Corelight)

  * Implement a decoder with inspect API support (Dominik Charousset, Corelight)

  * Use Broker's own serialization over CAF serializer (Dominik Charousset, Corelight)

  * Use the new binary decoder for Broker's variant (Dominik Charousset, Corelight)

  * Iterate on the new decoding API (Dominik Charousset, Corelight)

  * Implement new decoding logic for the binary format (Dominik Charousset, Corelight)

2.8.0-dev.121 | 2024-10-18 10:12:55 -0700

  * Fix bugprone and modernize clang-tidy findings (Dominik Charousset)

  * Pin prometheus to 1.2.4 (Arne Welzel, Corelight)

2.8.0-dev.117 | 2024-09-14 15:58:08 +0200

  * Fix type 3 messages in broker-throughput (Dominik Charousset)

    Tables and set must have unique keys. When using a builder, the calling
    code must make sure to not violate that assumption.

2.8.0-dev.115 | 2024-07-22 14:57:32 -0700

  * Pick up an upstream CAF fix (Dominik Charousset, Corelight)

2.8.0-dev.113 | 2024-07-16 16:45:13 +0200

  * Remove obsolete test scaffolding (Dominik Charousset, Corelight)

2.8.0-dev.111 | 2024-07-16 16:38:44 +0200

  * Switch to clang-format 18 in CI (Dominik Charousset, Corelight)

2.8.0-dev.109 | 2024-07-14 11:04:26 +0200

  * Enforce TLS version 1.2 as minimum when using SSL (Dominik Charousset, Corelight)

2.8.0-dev.107 | 2024-07-14 08:39:15 +0200

  * Add more btests to replace "unit" tests (Dominik Charousset, Corelight)

2.8.0-dev.97 | 2024-07-12 15:04:40 -0700

  * CI: Only use Sonoma for macOS (Tim Wojtulewicz, Corelight)

  * CI: Set FETCH_CONTENT_FULLY_DISCONNECTED flag for configure (Tim Wojtulewicz, Corelight)

2.8.0-dev.93 | 2024-07-11 12:11:26 -0700

  * Add safety checks for accessing registry pointers (Dominik Charousset, Corelight)

  * Fix build on Windows (Dominik Charousset, Corelight)

  * Remove obsolete tests (Dominik Charousset, Corelight)

  * Use bundling approach for building prometheus-cpp (Dominik Charousset and Christian Kreibich, Corelight)

  * Drop legacy telemetry API (Dominik Charousset, Corelight)

2.8.0-dev.84 | 2024-06-24 15:38:31 +0200

  * Remove unused master_resolver from the code base (Dominik Charousset, Corelight)

  * Fix/suppress clang-tidy findings (Dominik Charousset, Corelight)

2.8.0-dev.80 | 2024-05-31 09:10:03 +0200

  * Add JSON schema for the WebSocket output format (Dominik Charousset, Corelight)

2.8.0-dev.78 | 2024-05-31 09:09:10 +0200

  * Remove workaround for unsupported CMake versions (Dominik Charousset, Corelight)

    Since we have bumped the minimum CMake version to 3.15, we no longer
    need to worry about older CMake version.

2.8.0-dev.76 | 2024-05-31 09:08:22 +0200

  * Add missing dependency to serialization benchmark (Dominik Charousset, Corelight)

2.8.0-dev.74 | 2024-05-25 14:51:52 +0200

  * Add missing include (Dominik Charousset, Corelight)

  * CI: bump FreeBSD 13 to 13.3 (Christian Kreibich, Corelight)

  * CI: add Opensuse Leap 15.6 (Christian Kreibich, Corelight)

  * CI: remove CentOS Stream 8 (Christian Kreibich, Corelight)

  * CI: add Fedora 40, drop 38 (Christian Kreibich, Corelight)

2.8.0-dev.68 | 2024-05-16 20:51:52 +0200

  * Restore the serialization benchmark program (Dominik Charousset, Corelight)

2.8.0-dev.66 | 2024-05-12 13:49:48 +0200

  * CI: Replace Ubuntu 23.10 with Ubuntu 24.04 (Tim Wojtulewicz, Corelight)

2.8.0-dev.64 | 2024-05-09 14:11:32 +0200

  * Implement new decode functions for the JSON format (Dominik Charousset, Corelight)

2.8.0-dev.61 | 2024-05-06 14:26:27 -0700

  * Properly install config.hh header (again) (Dominik Charousset, Corelight)

  * Disable tools when building Broker as sub-project (Dominik Charousset, Corelight)

    Projects that build Broker only as a dependency (like Zeek) have no use
    for the benchmark tools. Hence, those targets should be excluded from
    the build to avoid building superfluous binaries but also since they
    might cause build issues in some scenarios.

2.8.0-dev.56 | 2024-03-19 15:54:34 -0700

  * Fix update-changes config due to version.hh moving (Tim Wojtulewicz, Corelight)

2.8.0-dev.55 | 2024-03-19 15:30:46 -0700

  * Restore the routing-table benchmark program (Dominik Charousset, Corelight)

2.8.0-dev.53 | 2024-03-19 15:30:10 -0700

  * Restore python-ssl test (Dominik Charousset, Corelight)

2.8.0-dev.51 | 2024-03-19 15:28:32 -0700

  * docs/python: Point users at WebSocket (Arne Welzel, Corelight)

    Users on Slack somewhat regularly ask questions around how to use the Python
    bindings and finding quirks with it. Just for us to tell them they
    should be using WebSockets instead. These might not be perfect, but at
    least we're open to hear feedback and improve them, which isn't
    necessarily our stance for the Python bindings.

    Put up a big banner to redirect users into the future. Seems "warning" is
    warranted given our reluctance and future ideas around deprecation for
    the bindings.

2.8.0-dev.49 | 2024-03-15 22:18:06 +0100

  * CI: Remove CentOS 7 and Debian 10 builds (Christian Kreibich, Corelight)

2.8.0-dev.47 | 2024-03-14 20:56:38 +0100

  * Fix CTest setup for the unit tests (Dominik Charousset, Corelight)

2.8.0-dev.45 | 2024-03-14 19:23:38 +0100

  * Use the Canonical Project Structure for Broker (Dominik Charousset, Corelight)

    For the Canonical Project Structure, see
    https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p1204r0.html.

2.8.0-dev.41 | 2024-02-20 09:15:14 -0700

  * Remove obsolete code (Dominik Charousset, Corelight)

  * CI: Use a python venv in test.sh to avoid pip errors on newer platforms (Tim Wojtulewicz, Corelight)

  * CI: Pin Windows openssl to 3.1.1 (Tim Wojtulewicz, Corelight)

  * CI: Fix building of alpine image with regards to python packages (Tim Wojtulewicz, Corelight)

  * Implement new variant type and builder API (Dominik Charousset, Corelight)

    - The new `broker::variant` is similar to `broker::data` in so far that
      it can represent similar types. However, once constructed, the new
      `broker::variant` is a read-only type. Internally, the variant stores
      the binary representation of the represented value. This makes
      serializing into the binary format essentially a no-op. When
      deserializing a value from the wire, we also keep the original byte
      representation around. For the actual data structure on top of the
      buffer, `broker::variant` uses a monotonic buffer resource in order to
      efficiently allocate the data structure representing the value.
    - For building a `broker::variant`, Broker now ships a new builder API.
      A builder must be filled with the entire data set for a
      `broker::variant` before constructing the final object.
    - The new `broker::variant` also comes with a matching "envelope" type.
      An envelope is basically the raw data plus meta data (such as topic).
      The envelopes represent the old message types such as `data_message`.

2.8.0-dev.35 | 2024-01-30 18:31:39 +0100

  * Implement JSON encoding for broker::data (Dominik Charousset, Corelight)

    The new header `broker/format/json.hh` implements the `encode`-API for
    `broker::variant`, akin to `broker/format/txt.hh`. The generated JSON
    format is tailored to the WebSocket interface.

    The format itself is documented in `web-socket.rst`.

2.8.0-dev.24 | 2024-01-30 17:28:02 +0100

  * Fix build with Python >= 3.12 (Dominik Charousset, Corelight)

    The distutils package has been removed in Python 3.12. Hence, we need a
    different approach for finding the site-packages directory.

    Since the FindPython module already sets appropriate variables for this
    purpose (https://cmake.org/cmake/help/latest/module/FindPython.html), we
    simply switch to using `Python_SITEARCH`.

2.8.0-dev.22 | 2024-01-08 09:24:07 -0700

  * Bump CAF to fix runtime error on Windows (Dominik Charousset, Corelight)

    Fixes an issue on Windows where the pipe to the connector would shut
    down after 2 minutes, essentially taking Broker with it.

2.8.0-dev.20 | 2023-12-15 20:59:14 +0100

  * Implement encoding for text and binary formats (Dominik Charousset, Corelight)

    - implement new encoding functions for both text and binary
    - start versioning the Broker data formats in the API
    - integrate the new encoding functions into text rendering and serialization

2.8.0-dev.18 | 2023-12-14 19:56:46 -0800

  * CI updates (Christian Kreibich, Corelight)

    - remove openSUSE Leap 15.4, about to EOL
    - drop macOS Monterey, add Sonoma
    - add Ubuntu 23.10
    - FreeBSD 14 is out now, 13 is at 13.2, and 12 is about to EOL.
    - distro EOL comment tweaks
    - drop Fedora 37, add Fedora 39

2.8.0-dev.11 | 2023-12-04 16:36:02 +0100

  * Pick up upstream CAF patch for flow::from_steps (Dominik Charousset, Corelight)

    This fixes a potential segfault (dereferencing a null pointer) in Broker.

2.8.0-dev.9 | 2023-12-04 16:02:54 +0100

  * Fix MBR allocations for >= 1024 bytes (Dominik Charousset, Corelight)

    When trying to allocate a single object with size >= 1024, the current
    implementation crashes with a stack overflow. This patch allows blocks
    to exceed the hard-coded size limit to accommodate larger objects.

2.8.0-dev.7 | 2023-11-16 16:54:09 +0100

  * Fix error::context (Dominik Charousset, Corelight)

2.8.0-dev.5 | 2023-11-13 19:52:09 -0800

  * Fix Github edit links in top-right of HTML pages (Christian Kreibich, Corelight)

2.8.0-dev.3 | 2023-10-13 13:25:04 -0700

  * Replace magic numbers with named indexes (Dominik Charousset, Corelight)

  * Avoid implicit conversions in Zeek utility classes (Dominik Charousset)

2.7.0-dev.32 | 2023-08-28 09:41:33 -0700

  * CI: Remove EOL ubuntu 22.10 build (Tim Wojtulewicz, Corelight)

  * CI: Fix a spelling error in (almost) every Dockerfile (Tim Wojtulewicz, Corelight)

  * CI: Force alpine image to rebuild (Tim Wojtulewicz, Corelight)

  * CI: Install newer version of python on older distros (Tim Wojtulewicz, Corelight)

  * Merge branch 'topic/awelzel/fix-rtd-doc-build' (Arne Welzel, Corelight)

    * topic/awelzel/fix-rtd-doc-build:
      doc/conf: Fix html_theme not defined

  * doc/conf: Fix html_theme not defined (Arne Welzel, Corelight)

    Zeek side reference: zeek/zeek-docs#206

2.7.0-dev.25 | 2023-08-24 15:32:31 -0700

  * Bump dockerfile images (Dominik Charousset, Corelight)

  * Fix endless recursion in do_print (Dominik Charousset, Corelight)

  * Make println utility reusable (Dominik Charousset, Corelight)

2.7.0-dev.21 | 2023-08-15 17:39:57 +0100

  * Build broker bindings for older versions of Python (Johanna Amann, Corelight)

    Recently (GH-370), the version of Python required to build the bindings
    was upped to 3.7. This is problematic, as we have older versions of
    Python in distributions that we still support; this lowers this version
    again.

2.7.0-dev.19 | 2023-07-31 10:35:39 -0700

  * Force rebuilds of alpine, debian-11, ubuntu-2210, and Windows CI images (Tim Wojtulewicz, Corelight)

  * Replace usage of deprecated CMake FindPythonInterp and FindPythonDev (Tim Wojtulewicz, Corelight)

    These were both replaced by components to the FindPython module, and
    were marked as deprecated in CMake 3.12. This removes their usage
    since CMake 3.27 and above now report a warning for CMP0148. This also
    replaces the naming of some variables to match the CMake documentation.

  * Update pybind11 to v2.11.1 (Tim Wojtulewicz, Corelight)

2.7.0-dev.15 | 2023-07-02 14:55:22 -0700

  * Add /J flag on Windows to force unsigned char (Tim Wojtulewicz, Corelight)

  * Pass -funsigned-char flag during compilation (Tim Wojtulewicz, Corelight)

2.7.0-dev.12 | 2023-06-21 09:26:05 -0700

  * Use a set for caching metric instances (Dominik Charousset, Corelight)

  * Optimize metric_collector::insert_or_update lookup (Dominik Charousset, Corelight)

2.7.0-dev.9 | 2023-06-15 14:46:55 -0700

  * CI: a round of updates to align with Zeek (Christian Kreibich, Corelight)

2.7.0-dev.7 | 2023-06-12 14:08:19 -0700

  * ci/windows: choco --localonly is gone (Tim Wojtulewicz, Corelight)

2.7.0-dev.5 | 2023-06-12 12:26:32 -0700

  * Fix handling of fragmented WebSocket frames (Dominik Charousset, Corelight)

2.7.0-dev.2 | 2023-05-26 11:03:44 -0700

  * Bump CAF submodule to fix a crash on disposables (Dominik Charousset, Corelight)

2.6.0-dev.66 | 2023-05-23 11:33:10 -0700

  * Bump CAF submodule to fix sprintf warning (Dominik Charousset, Corelight)

2.5.0-dev.120 | 2023-05-18 09:59:21 +0200

  * Cover more types with the WebSocket btest (Dominik Charousset, Corelight)

2.5.0-dev.118 | 2023-05-12 12:39:11 -0700

  * Update CAF submodule to remove leftover debug message (Tim Wojtulewicz, Corelight)

2.5.0-dev.116 | 2023-05-12 11:18:43 -0700

  * Pick up CAF backport of uint64_t support in JSON (Dominik Charousset, Corelight)

2.5.0-dev.114 | 2023-05-12 11:18:26 -0700

  * Allow reading port parameters as integers (Dominik Charousset, Corelight)

    Restore backwards compatibility (in particular with Zeek) that expect
    the port parameters to be accessible as 16-bit integers.

  * Fix metadata vector location in websocket docs (Arne Welzel, Corelight)

    As documented, they are one level further down, following args
    directly.

2.5.0-dev.110 | 2023-05-11 12:42:51 +0200

  * Add metadata section to websocket docs (Arne Welzel, Corelight)

  * zeek-unsafe-types: assertEquals() is deprecated (Arne Welzel, Corelight)

  * bindings: Rework Python for extensible metadata format (Arne Welzel, Corelight)

  * Implement extensible metadata format for events (Arne Welzel, Corelight)

  * Update tests to consider event timestamps. (Jan Grashoefer, Corelight)

  * Add event timestamp to python bindings. (Jan Grashoefer, Corelight)

  * Add optional timestamp to event message. (Jan Grashoefer, Corelight)

  * Pin Sphinx/sphinx_rtd_theme in requirements.txt (Arne Welzel, Corelight)

  * Fix urllib/openssl 1.0.2 error in readthedocs build (Arne Welzel, Corelight)

    Fix as per: readthedocs/readthedocs.org#10290 (comment)

2.5.0-dev.95 | 2023-04-14 19:41:45 +0200

  * Fix trailing semicolon (Arne Welzel, Corelight)

2.5.0-dev.93 | 2023-04-14 10:15:00 +0200

  * Fix CMake package file for Broker (Dominik Charousset, Corelight)

2.5.0-dev.91 | 2023-04-11 20:21:34 +0200

  * Force static builds for the bundled CAF (Dominik Charousset, Corelight)

2.5.0-dev.89 | 2023-04-08 10:05:14 +0200

  * Fix heap-use-after free with flow scopes (Dominik Charousset, Corelight)

2.5.0-dev.86 | 2023-04-08 10:03:18 +0200

  * Bump CAF for fixing clang warnings (Dominik Charousset, Corelight)

2.5.0-dev.84 | 2023-04-06 11:06:09 -0700

  * Explicitly use std namespace when calling std::move (Tim Wojtulewicz, Corelight)

2.5.0-dev.82 | 2023-03-30 11:58:10 -0700

  * CI: Force rebuild of opensuse-tumbleweed VM to pick up gcc 13 (Tim Wojtulewicz, Corelight)

  * Update CAF for GCC 13 build (Dominik Charousset, Corelight)

2.5.0-dev.79 | 2023-03-23 21:00:02 +0100

  * Fix tick_interval usage in send_later (Arne Welzel, Corelight)

2.5.0-dev.77 | 2023-03-19 15:01:44 +0100

  * Add new btest for the status reporting over HTTP (Dominik Charousset, Corelight)

  * Support Zeek-style port notation as arguments (Dominik Charousset, Corelight)

    Our `btest`-suites pass Zeek-style port notation such as "1024/tcp" as
    arguments to Broker. By dealing with them at the endpoint level, we can
    avoid the overhead of stripping the protocol suffixes when adding more
    `btest` suites that interact with Broker tools.

  * Add instrumentation and status collection logic (Dominik Charousset, Corelight)

2.5.0-dev.69 | 2023-03-18 17:05:15 -0700

  * Pick up CAF patch for Prometheus (Dominik Charousset, Corelight)

2.5.0-dev.67 | 2023-03-17 09:25:55 +0100

  * Use IPv6 mode for accept sockets by default (Dominik Charousset, Corelight)

2.5.0-dev.64 | 2023-03-12 12:51:02 -0700

  * Update benchmarker Cirrus secrets to use org-level values (Tim Wojtulewicz, Corelight)

2.5.0-dev.62 | 2023-03-04 11:07:48 +0100

  * Fix regression in endpoint::peers (Dominik Charousset, Corelight)

2.5.0-dev.59 | 2023-02-01 15:33:14 -0700

  * Bump pybind11 to version 2.10.3 (Tim Wojtulewicz, Corelight)

2.5.0-dev.55 | 2023-01-28 10:08:31 +0100

  * sqlite_backend: Add a few more backend_options (Arne Welzel, Corelight)

    * synchronous to run 'PRAGMA synchronous=<value>' during initialization.
    * journal_mode to run 'PRAGMA journal_mode=<value>' during initialization.
    * failure_mode to delete the database and reopen it when
      an error occurs during initialization.
    * integrity_check to run PRAGMA integrity_check during initialization to
      reliably detect corrupted databases.

2.5.0-dev.46 | 2023-01-10 17:28:37 -0800

  * CI: switch action/checkout to v3 (Christian Kreibich, Corelight)

  * CI: remove Fedora 35, now EOL (Christian Kreibich, Corelight)

2.5.0-dev.44 | 2023-01-10 16:49:10 +0100

  * Implement graceful disconnect handshake (Dominik Charousset, Corelight)

2.5.0-dev.36 | 2023-01-05 12:08:33 -0700

  * CI: macOS platform updates (Tim Wojtulewicz, Corelight)

    - Add Ventura build
    - Switch all macOS builds to use M1 images. x86_64 builds are no longer supported
      by Cirrus for macOS as of 2023/1/1.
    - Drop Big Sur build

2.5.0-dev.34 | 2022-11-29 14:46:24 +0100

  * Add formatting helper for consistent pre/post Python 3.11 enum stringification (Christian Kreibich, Corelight)

  * CI: add Fedora 37 (Christian Kreibich, Corelight)

2.5.0-dev.31 | 2022-11-22 13:13:43 -0700

  * Zeek 5.0.x compatibility (Dominik Charousset, Corelight)

2.5.0-dev.29 | 2022-11-22 13:13:09 -0700

  * Fix formatting (Dominik Charousset, Corelight)

  * Fix clang-tidy warnings (Dominik Charousset, Corelight)

  * Fix handling of peer/client errors (Dominik Charousset, Corelight)

  * Set missing flag during unpeering process (Dominik Charousset, Corelight)

  * Migrate to CAF 0.19 backport of the flow API (Dominik Charousset, Corelight)

2.5.0-dev.22 | 2022-11-21 09:54:18 -0700

  * Windows CI: make Dockerfile a little more like one in Zeek (Tim Wojtulewicz, Corelight)

    - Install choco in a much less-verbose way
    - Use choco to install VS build tools and git

2.5.0-dev.20 | 2022-11-15 11:49:21 -0700

  * Update CAF submodule for SPCP buffer fix (Dominik Charousset, Corelight)

2.5.0-dev.18 | 2022-11-14 12:21:07 -0700

  * Minimize messaging in sim_clock::advance_time (Dominik Charousset, Corelight)

2.5.0-dev.16 | 2022-11-14 12:17:17 -0700

  * Tweak documentation for --with-log-level (Dominik Charousset, Corelight)

  * Configure script: drop --with-caf, add -D option (Dominik Charousset, Corelight)

2.5.0-dev.12 | 2022-11-14 12:16:44 -0700

  * Add interface include dirs to broker lib targets (Dominik Charousset, Corelight)

2.5.0-dev.10 | 2022-11-14 12:16:23 -0700

  * Drop CAF incubator: caf-net moved to the main repo (Dominik Charousset, Corelight)

2.5.0-dev.8 | 2022-11-14 12:15:19 -0700

  * Remove LGTM config file (Dominik Charousset, Corelight)

  * Apply LGTM recommendations for some minor findings (Dominik Charousset, Corelight)

2.5.0-dev.4 | 2022-11-09 18:27:33 -0700

  * Add the branch whitelist to the Windows/Clang-Tidy Cirrus tasks (Tim Wojtulewicz, Corelight)

2.5.0-dev.2 | 2022-11-09 10:45:06 -0700

  * Merge commit 'd9db9ce515f576dc8a4113b1accc489a645bd43c' (Tim Wojtulewicz, Corelight)

    * commit 'd9db9ce515f576dc8a4113b1accc489a645bd43c':
      Enable modernize-* checks and apply auto-fixes

  * Enable modernize-* checks and apply auto-fixes (Dominik Charousset, Corelight)

  * Update submodules [nomail] [skip ci] (Tim Wojtulewicz)

2.4.0-dev.86 | 2022-10-20 16:49:49 -0700

  * Fix CMake package file when bundling CAF (Dominik Charousset, Corelight)

  * Fix messaging between clone and proxy (Dominik Charousset, Corelight)

2.4.0-dev.82 | 2022-10-19 19:37:01 -0700

  * Update cmake submodule [nomail] (Tim Wojtulewicz, Corelight)

  * Moved include CXX17 directive as per CR instruction (Tomer Lev)

  * Bumped cmake submodule commit (Tomer Lev)

  * Adding suuport to MSVC under windows platform (Tomer Lev)

2.4.0-dev.77 | 2022-10-02 10:22:23 +0200

  * Performance improvements (Dominik Charousset, Corelight)

    - Fix performance bottleneck in Broker-internal caching (see #277)
    - Improve performance with the `stealing` scheduler policy
      (see https://github.com/zeek/zeek/issues/2332)

2.4.0-dev.75 | 2022-09-21 09:56:19 -0700

  * Fix a clang-tidy failure from a recent merge (Tim Wojtulewicz, Corelight)

  * Fix minor formatting issue (Tim Wojtulewicz, Corelight)

2.4.0-dev.72 | 2022-09-20 08:49:22 -0700

  * Get initial number of entries from the backend (Dominik Charousset, Corelight)

  * Add additional health and performance metrics (Dominik Charousset, Corelight)

2.4.0-dev.69 | 2022-09-20 08:20:48 -0700

  * Enable performance-* checks and fix findings (Dominik Charousset, Corelight)

2.4.0-dev.66 | 2022-09-19 09:21:27 -0700

  * Fix error handling with OpenSSL calls (Dominik Charousset, Corelight)

2.4.0-dev.64 | 2022-09-13 08:14:22 -0400

  * Avoid unnecessary copies (Dominik Charousset, Corelight)

  * Add clang-tidy to CI with an initial set of checks (Dominik Charousset, Corelight)

2.4.0-dev.61 | 2022-09-07 16:43:16 +0200

  * Update CAF submodule to fix stalling Broker pipelines (Dominik Charousset, Corelight)

2.4.0-dev.59 | 2022-08-26 09:02:43 -0700

  * Add missing error signaling (Dominik Charousset, Corelight)

2.4.0-dev.57 | 2022-08-24 12:57:52 +0100

  * Fix formatting (Dominik Charousset, Corelight)

  * Allow clients to change the import metric topics (Dominik Charousset, Corelight)

2.4.0-dev.54 | 2022-08-22 16:41:54 +0200

  * Remove the retry limit on peerings (Dominik Charousset, Corelight)

2.4.0-dev.52 | 2022-08-22 16:40:48 +0200

  * Set SO_REUSEADDR for the Prometheus HTTP server (Dominik Charousset, Corelight)

2.4.0-dev.50 | 2022-08-22 16:39:58 +0200

  * Revert accidental change to CMake file from #255 (Dominik Charousset, Corelight)

2.4.0-dev.48 | 2022-08-18 08:03:54 +0200

  * Fix AUTO_CAUSES_COPY coverity reportings (Arne Welzel, Corelight)

2.4.0-dev.46 | 2022-08-09 10:54:42 +0200

  * Add getters for bucket settings on family handles (Dominik Charousset, Corelight)

2.4.0-dev.42 | 2022-08-08 10:48:37 +0200

  * Remove dead code and obsolete files (Dominik Charousset, Corelight)

2.4.0-dev.39 | 2022-08-03 20:44:57 +0200

  * Apply clang-format to the code base, add CI check (Dominik Charousset, Corelight)

2.4.0-dev.37 | 2022-08-03 19:01:24 +0200

  * Upgrade pybind11 to version 2.10.0 (Dominik Charousset, Corelight)

2.4.0-dev.35 | 2022-08-03 07:52:15 +0200

  * Fix warnings on GCC by dropping [[nodiscard]] on convert functions (Dominik Charousset, Corelight)

2.4.0-dev.33 | 2022-08-02 20:06:17 +0200

  * telemetry: Introduce a broker::metrics_collector. (Arne Welzel, Corelight)

    - Add collect() on the registry and implement proxying between
      broker::telemetry and caf::telemetry via metrics_collector
    - Add new upcast() and value() overloads for const-pointers to handles

2.4.0-dev.26 | 2022-07-07 14:17:50 -0700

  * CI updates (Christian Kreibich, Corelight)

    - add FreeBSD 13.1 and fix broken link
    - add Opensuse Tumbleweed
    - drop Ubuntu 21.10, EOL 2022-07-14
    - remove Debian 9, EOL 2022-06-30

  * Make more and better use of C++17 features (Dominik Charousset, Corelight)

    - Use `if constexpr` over `enable_if` in more places
    - Consequently use `foo_v<...>` over `foo<...>::value`
    - Drop legacy C++14 and C++17 backports in `type_traits.hh`
    - Use better type introspection to allow `convert` to return `void`
    - Make more consistent use of the `convert` API

2.4.0-dev.19 | 2022-06-27 15:48:47 -0700

  * Fix double-close on pipe handles (Dominik Charousset, Corelight)

2.4.0-dev.17 | 2022-06-27 10:10:35 -0700

  * CI distribution updates (Johanna Amann, Corelight)

    Update distribution list to the same list we use for Zeek

2.4.0-dev.15 | 2022-06-24 12:53:34 -0700

  * Fix recently introduced warnings on GCC (Dominik Charousset, Corelight)

2.4.0-dev.13 | 2022-06-24 12:53:18 -0700

  * Point out that --with-caf is for-development-only (Dominik Charousset, Corelight)

  * Keep make dist from deleting all paths containing 'build' [skip ci] (Tim Wojtulewicz, Corelight)

2.4.0-dev.10 | 2022-06-21 10:55:43 -0700

  * Add new btest for put_unique (Dominik Charousset, Corelight)

  * Streamline clone actor logic (Dominik Charousset, Corelight)

  * Protect against clones receiving wrong inputs (Dominik Charousset, Corelight)

  * Use multiple proxies per node for put_unique test (Dominik Charousset, Corelight)

  * Remove unused message type (Dominik Charousset, Corelight)

2.4.0-dev.2 | 2022-06-14 09:19:25 -0700

  * Dockerfile updates for consistency with recent Zeek changes (Tim Wojtulewicz, Corelight)

2.3.0 | 2022-06-03 11:39:10 -0700

  * Release 2.3.0

2.2.0-323 | 2022-06-02 11:40:39 -0700

  * Require newer cmake, and bump cmake installed in CI images (Tim Wojtulewicz, Corelight)

2.2.0-320 | 2022-06-01 21:09:40 +0200

  * Fix leak in WebSockets. (Dominik Charousset, Corelight)

  * Fix warning on GCC. (Dominik Charousset, Corelight)

  * Run btests with ASAN/LeakSanitizer on CI. (Dominik Charousset, Corelight)

2.2.0-316 | 2022-06-01 12:24:56 +0200

  * Add version negotiation to the handshake process. (Dominik
    Charousset, Corelight)

  * Fix double-close on sockets. (Dominik Charousset, Corelight)

  * Enable new handshake tests in `btest.cfg`. (Dominik Charousset,
    Corelight)

2.2.0-311 | 2022-05-30 11:08:11 +0200

  * Implement new fan-out benchmark (Dominik Charousset, Corelight)

2.2.0-309 | 2022-05-30 11:07:09 +0200

  * Remove deprecated std::iterator usage (Tim Wojtulewicz, Corelight)

2.2.0-307 | 2022-05-30 11:06:19 +0200

  * Set SO_REUSEADDR by default. (Dominik Charousset, Corelight)

2.2.0-305 | 2022-05-30 11:00:52 +0200

  * Fix minor Coverity findings. (Dominik Charousset, Corelight)

2.2.0-303 | 2022-05-30 10:31:23 +0200

  * Add WebSocket support. (Dominik Charousset, Corelight)

    Broker now offers access to the publish/subscribe layer via
    WebSocket in order to make its data model accessible to third
    parties. WebSocket clients are treated as lightweight peers. Each
    Broker endpoint can be configured to act as a WebSocket server by
    either setting the environment variable
    ``BROKER_WEB_SOCKET_PORT``; by setting ``broker.web-socket.port``
    on the command line or in the configuration file; or
    programmatically by calling ``endpoint::web_socket_listen``. See
    ``docs/web-socket.rst`` for more information.

2.2.0-277 | 2022-05-23 10:26:53 -0700

  * Fix warning when building on macOS (Dominik Charousset, Corelight)

2.2.0-275 | 2022-05-23 10:24:52 -0700

  * Drop broken FreeBSD 11 build from pipeline (Dominik Charousset, Corelight)

2.2.0-272 | 2022-05-04 11:14:41 -0700

  * Expand tests to verify handling of Python-unsafe types sent by Zeek (Christian Kreibich, Corelight)

  * Add broker.zeek.SafeEvent to work around data rendering problems (Christian Kreibich, Corelight)

  * Expand HashableDict in favor of types.MappingProxyType (Christian Kreibich, Corelight)

2.2.0-268 | 2022-05-04 10:42:37 -0700

  * Remove missed usage of previously-removed bro.py (Tim Wojtulewicz, Corelight)

2.2.0-267 | 2022-05-04 09:44:46 -0700

  * Remove long-deprecated bro.py (Tim Wojtulewicz)

2.2.0-265 | 2022-05-04 09:42:30 -0700

  * Remove accidentally included .tmp folder for broker-cluster-benchmark (Christian Kreibich, Corelight)

2.2.0-263 | 2022-04-28 19:46:01 +0000

  * Implement new ALM transport (Dominik Charousset, Corelight)

    This is too long of a change to list all of the commits in this file, but
    the full list can be seen in https://github.com/zeek/broker/pull/201.

2.2.0-35 | 2022-03-18 13:39:43 -0700

  * Disable LeakSanitizer on Windows (Tim Wojtulewicz, Corelight)

  * Disable python bindings in Windows CI builds (Tim Wojtulewicz)

  * Fix _MSC_VER macro usage that was breaking macro expansion (Tim Wojtulewicz)

  * Output more information when CTest fails (Tim Wojtulewicz)

  * Wrap GCC pragmas to avoid warnings on Windows (Tim Wojtulewicz)

  * Normalize paths when installing python bindings (Tim Wojtulewicz)

  * Set proper environment in test.cmd (Tim Wojtulewicz)

  * Fix address::convert_from (Dominik Charousset, Corelight)

  * Fix build on MSVC (Dominik Charousset)

  * Rework CI scripts for Windows (Tim Wojtulewicz, Corelight)

2.2.0-22 | 2022-02-09 12:56:35 -0800

  * CI support refresh (Christian Kreibich, Corelight)

    - add FreeBSD 14
    - add Ubuntu 21.10
    - remove OpenSUSE Leap 15.2 (EOL)
    - add CentOS Stream 9
    - remove Fedora 33 (EOL)

2.2.0-16 | 2022-02-07 16:21:18 +0100

  * Avoid exposing CAF internals. (Dominik Charousset, Corelight)

    Remove all CAF dependencies from public headers and build the
    bundled CAF version as static, private utility. Consumers of
    Broker no longer need to locate CAF headers and we do not install
    any CAF content alongside Broker, i.e., Broker becomes fully
    standalone.

    Where possible, Broker uses recent C++ additions like `std::variant` to
    replace CAF types. For types that have no equivalent, Broker deploys
    fully opaque handle types. For example, `broker::worker` internally
    wraps a `caf::actor` handle.

    All components in Broker that require access to CAF were grouped into
    the new namespace `broker::internal`. We omit all internal headers from
    an installation, since they would be worthless without the matching CAF
    headers anyways. This also gives us a clean separation between API
    artifacts users may interact with and API parts that are reserved for
    internal use.

2.2.0-4 | 2022-01-27 14:49:00 -0700

  * Have `make dist` cleanup a few more wayward files before tarring (Tim Wojtulewicz, Corelight)

  * Remove CentOS 8 from CI. (Tim Wojtulewicz, Corelight)

    EOL was 2021-12-31

2.2.0 | 2021-12-20 19:32:33 -0800

  * Merge branch 'topic/christian/fix-python-unhashables' (Christian Kreibich, Corelight)

    * topic/christian/fix-python-unhashables:
      Add testcases for new Python SafeSubscriber class
      Provide a SafeSubscriber class in Python to accommodate non-hashable types
      Add immutable values to Python data type testsuite
      Python cleanup: remove unneeded semicolons and trailing whitespace

  * Add testcases for new Python SafeSubscriber class (Christian Kreibich, Corelight)

  * Provide a SafeSubscriber class in Python to accommodate non-hashable types (Christian Kreibich, Corelight)

    Broker's data model supports nested complex types, such as a set with table
    members. When rendering such structures into Python, this could trigger
    TypeError exceptions due to unhashable types.

    The SafeSubscriber class and the corresponding Endpoint.make_safe_subscriber()
    method ensure that immutable (hashable) Python types get used and that the
    returned values are read-only. For sets the frozenset type achieves this, for
    mapping types it's types.MappingProxyType. The API now also supports the latter
    two types as inputs.

  * Add immutable values to Python data type testsuite (Christian Kreibich, Corelight)

  * Python cleanup: remove unneeded semicolons and trailing whitespace (Christian Kreibich, Corelight)

2.2.0-dev.17 | 2021-11-05 13:38:17 -0700

  * Request at least Sphinx 2.0 to avoid a dependency problem in RTD (Christian Kreibich, Corelight)

  * Introduce .readthedocs.yaml to avoid docs directory (Christian Kreibich, Corelight)

2.2.0-dev.14 | 2021-11-05 12:47:15 -0700

  * Add macOS Monterey and drop Catalina in CI (Christian Kreibich, Corelight)

  * Add Fedora 35 in CI (Christian Kreibich, Corelight)

2.2.0-dev.10 | 2021-08-26 14:30:39 -0700

  * CI support refresh (Christian Kreibich, Corelight)

    - Add Debian 11 (Bullseye)
    - Drop Ubuntu 16.04

2.2.0-dev.8 | 2021-08-03 11:55:22 -0700

  * Fix publisher deadlock when passing large batches (Dominik Charousset, Corelight)

2.2.0-dev.6 | 2021-07-28 19:08:17 -0700

  * Fix output of build-type CFLAGS during configure (Tim Wojtulewicz, Corelight)

  * Update HMAC key for benchmarking service (Tim Wojtulewicz, Corelight)

2.2.0-dev.3 | 2021-07-16 19:02:24 -0700

  * Raise CAF dependency to 0.18.5 and update embedded version (Tim Wojtulewicz, Corelight)

2.1.0 | 2021-07-08 09:49:23 -0700

  * Release 2.1.0.

2.1.0-dev.90 | 2021-07-08 09:49:16 -0700

  * Raise CAF dependency to 0.18.4 and update embedded version (Tim Wojtulewicz, Corelight)

  * Bring back process metrics (Dominik Charousset, Corelight)

2.1.0-dev.87 | 2021-07-02 10:02:22 -0700

  * Fix is_prefix logic (Dominik Charousset, Corelight)

  * Remove global topic variables (Dominik Charousset, Corelight)

    Fix a potential memory corruption during static initialization by
    avoiding global variables with non-trivial constructors.

2.1.0-dev.83 | 2021-06-28 08:44:56 -0700

  * Fix heap-use-after-free during shutdown (Dominik Charousset, Corelight)

2.1.0-dev.81 | 2021-06-21 15:56:14 -0700

  * CI support refresh to bring in line with Zeek (Christian Kreibich, Corelight)

  * Update port used by benchmark host (Tim Wojtulewicz, Corelight)

2.1.0-dev.78 | 2021-06-07 09:22:35 -0700

  * Remove noexcept from functions that may throw

    Functions that access a `variant` of a `metric_view` may throw
    `broker::bad_variant_access`. (Dominik Charousset, Corelight)

  * Fix uninitialized field warnings (Dominik Charousset, Corelight)

2.1.0-dev.75 | 2021-06-01 10:18:00 -0700

  * Make telemetry exporter configurable at runtime (Dominik Charousset, Corelight)

  * Raise CAF dependency to 0.18.3 (Dominik Charousset, Corelight)

  * Update CAF submodule (Dominik Charousset, Corelight)

  * Enable Broker to collect cluster metrics (Dominik Charousset, Corelight)

  * Add remaining meta data to scrape output (Dominik Charousset, Corelight)

  * Add support for histograms to the scraper (Dominik Charousset, Corelight)

  * Implement new publishing mode for local metrics (Dominik Charousset, Corelight)

2.1.0-dev.67 | 2021-05-24 15:22:34 -0700

  * Change how actor_system_config::config_file_path is set (Jon Siwek, Corelight)

    Mainly avoid conflict with an upcoming change

2.1.0-dev.66 | 2021-05-24 15:01:34 -0700

  * Update embedded CAF to 0.18.3 (Jon Siwek, Corelight)

    And migrate a now-deprecated actor_system_config::parse() usage.

2.1.0-dev.65 | 2021-04-19 16:14:38 -0700

  * Fix broker-pipe crash with static CAF builds (Dominik Charousset, Corelight)

2.1.0-dev.63 | 2021-04-19 16:01:51 -0700

  * Remove redundant code in "integration" test (Dominik Charousset, Corelight)

2.1.0-dev.61 | 2021-03-27 14:15:37 -0700

  * Bump libbroker soversion to 4 (Jon Siwek, Corelight)

  * Update bundled CAF to 0.18.2 (Jon Siwek, Corelight)

2.1.0-dev.58 | 2021-03-17 13:45:33 -0700

  * Prevent use of LeakSanitizer on FreeBSD (Jon Siwek, Corelight)

2.1.0-dev.56 | 2021-03-08 12:27:52 -0800

  * Improve error handling for data store backend creation failures (Jon Siwek, Corelight)

    * Change broker::filesystem::detail functions that rely on
      std::filesystem to use non-throwing calls

    * Add error messages to some broker::filesystem::detail functions:
      mkdirs(), remove(), and remove_all()

    * Use sqlite3_errmsg() to emit reason for sqlite3_open() failures

    * Change sqlite backend initialization failures to be non-fatal

    Related to https://github.com/zeek/zeek/issues/1426

2.1.0-dev.54 | 2021-03-02 19:59:06 -0700

  * Add lgtm configuration (Tim Wojtulewicz, Corelight)

2.1.0-dev.52 | 2021-02-26 17:57:58 -0800

  * Fix to allow hashing of Python binding's broker.Count type (Jon Siwek, Corelight)

2.1.0-dev.50 | 2021-02-22 15:45:38 -0800

  * Enable metrics exposition via BROKER_METRICS_PORT (Dominik Charousset, Corelight)

2.1.0-dev.48 | 2021-02-16 13:58:19 -0800

  * Increase CPUs used for macOS CI builds (Jon Siwek, Corelight)

2.1.0-dev.47 | 2021-02-16 12:30:36 -0800

  * broker-benchmark: Fix heap-buffer overflow when receiving stats (Dominik Charousset, Corelight)

  * Fix metrics and TTL of locally published data (Dominik Charousset, Corelight)

  * Implement more lightweight origin credit tracking (Dominik Charousset, Corelight)

    The item-based tracking of message origins keeps all context for input
    messages. However, benchmarking reveled that this nice-to-have property
    comes at an expensive price.

    The new approach for tracking how many inputs for each origin are
    currently in the system leverages the reference count of Broker messages
    that we need in any case rather than introducing additional state.

  * Disable background deserialization (Dominik Charousset, Corelight)

    Zeek configures only a few threads to the CAF thread pool. This may
    introduce some heavy delays for the deserialization that takes place in
    the background. Disabling this feature altogether makes sure that
    messages will not end up in some queues even though it puts more
    pressure on the multiplexer's thread.

2.1.0-dev.42 | 2021-02-11 12:10:05 -0800

  * Disable syntax highlighting for some overview documentation (Jon Siwek, Corelight)

  * Add Python bindings example docs for representing Zeek records (Jon Siwek, Corelight)

  * Fix typo in data model documentation (Jon Siwek, Corelight)

2.1.0-dev.39 | 2021-01-25 21:17:05 -0800

  * Add missing comments to example Windows Dockerfile (Jon Siwek, Corelight)

  * Add Travis CI config for Windows OS (Jon Siwek, Corelight)

2.1.0-dev.36 | 2021-01-25 12:27:58 -0800

  * Update embedded CAF to 0.18 (Jon Siwek, Corelight)

  * Add CI support for running cluster benchmarks (Tim Wojtulewicz, Corelight)

2.1.0-dev.33 | 2021-01-21 16:15:32 -0800

  * Fix deprecation warnings with latest CAF (Dominik Charousset, Corelight)

  * Clean up remaining caf::hash::fnv TODO (Dominik Charousset, Corelight)

    CAF 0.18 introduced an FNV hashing visitor that we can use instead of
    rolling custom hash algorithms and hash combinators.

  * Replace unsafe (to|from)_blob functions (Dominik Charousset, Corelight)

    The utility functions `to_blob` and `from_blob` in
    `broker/detail/blob.hh` silently ignored any error during serialization
    and deserialization. Since the functions were only used by the SQLite
    backend, the new implementations with proper error propagation (and
    cleaned up interface) moved to `sqlite_backend.cc`.

2.1.0-dev.27 | 2021-01-19 21:07:18 -0800

  * Update Cirrus CI naming for MacOS images (Christian Kreibich, Corelight)

    The docs on https://cirrus-ci.org/guide/macOS/ changed from
    "osx_instance" to "macos_instance", so let's reflect that.

2.1.0-dev.25 | 2021-01-12 20:19:56 -0800

  * GH-165: Fix possible deadlock by implementing new origin-based credit strategy (Dominik Charousset, Corelight)

2.1.0-dev.16 | 2021-01-11 11:05:53 -0800

  * Remove deprecated broker::memory/broker::sqlite enums (Jon Siwek, Corelight)

  * Remove unused and broken rocksdb backend (Dominik Charousset, Corelight)

2.1.0-dev.12 | 2021-01-04 15:40:56 -0800

  * broker-cluster-benchmark: Fix type mismatch and potential cleanup issue (Dominik Charousset, Corelight)

2.1.0-dev.10 | 2020-12-23 10:13:37 -0800

  * Call `ctest` instead of `make test` in CI builds (Dominik Charousset, Corelight)

    Setting `CTEST_OUTPUT_ON_FAILURE` and then calling `make test` seems to
    lose the flag at some point. Calling `ctest` directly and passing
    `--output-on-failure` makes sure that we actually get the test output in
    case of an error.

2.1.0-dev.8 | 2020-12-21 10:53:48 -0800

  * Add macOS Big Sur to CI (Jon Siwek, Corelight)

2.1.0-dev.6 | 2020-12-17 16:04:25 -0800

  * Remove explicit use of config mode for finding CAF (Dominik Charousset, Corelight)

2.1.0-dev.4 | 2020-12-17 10:36:12 -0700

  * Fix CAF configuration parameter names (Dominik Charousset, Corelight)

2.1.0-dev.2 | 2020-12-16 15:04:30 -0800

  * Make sure status updates are visible before data (Dominik Charousset, Corelight)

2.1.0-dev | 2020-12-14 20:16:02 -0800

  * Update NEWS for start of v2.1.0 development (Jon Siwek, Corelight)

1.5.0-dev.63 | 2020-12-14 10:38:14 -0800

  * Update CAF submodule to fix handling of --libdir (Jon Siwek, Corelight)

1.5.0-dev.62 | 2020-12-12 18:28:25 -0800

  * Change `configure --prefix` to not set CMAKE_INSTALL_LIBDIR (Jon Siwek, Corelight)

    In places where that libdir option is used and not explicitly set
    before, it will already correctly prepend CMAKE_INSTALL_PREFIX.  Having
    the configure script use the hardcoded 'lib' also prevented the
    automatic use of 'lib64' on platforms that prefer it.

1.5.0-dev.61 | 2020-12-10 14:07:51 -0800

  * Add Jenkinsfile for re-enabling Windows builds (Dominik Charousset, Corelight)

  * Add Python context manager support (Dominik Charousset, Corelight)

    For proper resource management/cleanup, the Python API now requires
    using Endpoint, Subscriber, StatusSubscriber, and Store objects within a
    `with` statement or alternatively doing an explicit call to the
    ``reset()`` method of subscriber/store objects before the associated
    Endpoint's ``shutdown()`` method.

    Co-authored-by: Jon Siwek <jsiwek@corelight.com>

  * Disable Windows builds via Travis CI (Dominik Charousset, Corelight)

    Remove the YAML file for Travis CI due to issues with getting Visual
    Studio 2019 with support for `std::filesystem` working on Travis. This
    is supposed to be a temporary measure until either finding a fix for the
    setup or re-enabling Windows build through some other means.

  * Fix handling of initial subscription set (Dominik Charousset, Corelight)

  * Add missing to_string overloads (Dominik Charousset, Corelight)

  * Make CMake scaffold more robust against re-runs (Dominik Charousset, Corelight)

  * Clean up deprecation warnings for CAF 0.18 (Dominik Charousset, Corelight)

  * Fix CAF paths for bundled CAF version (Dominik Charousset, Corelight)

  * Migrate to CAF 0.18, update CAF submodule (Dominik Charousset, Corelight)

1.5.0-dev.43 | 2020-12-09 17:27:31 -0800

  * Update SQLite to 3.34.0 (Jon Siwek, Corelight)

1.5.0-dev.42 | 2020-12-04 13:05:41 -0800

  * Add FreeBSD 11.4 and 12.2 to CI (Jon Siwek, Corelight)

1.5.0-dev.40 | 2020-12-04 11:32:19 -0800

  * Suppress interactive tzdata setup on Ubuntu (Dominik Charousset)

  * Call update on Debian-based distros before install (Dominik Charousset)

  * Update CI build matrix (Dominik Charousset)

  * Update and streamline Docker files (Dominik Charousset)

1.5.0-dev.34 | 2020-12-02 11:05:55 -0800

  * Update minimum required CMake to 3.5 (Jon Siwek, Corelight)

1.5.0-dev.32 | 2020-12-02 10:57:29 -0800

  * Upgrade pybind11 to v2.6.1 and fix compatibility issues (Jon Siwek, Corelight)

1.5.0-dev.30 | 2020-11-26 18:12:38 +0000

  * Update macOS CI to use system default Python 3 (Jon Siwek, Corelight)

  * Remove Python 2 compatibility logic (Jon Siwek, Corelight)

  * Update CMake logic to enforce Python >= 3.5 for Python Bindings (Jon Siwek, Corelight)

  * Update Python Bindings docs for new Python >= 3.5 requirements (Jon Siwek, Corelight)

  * Update cmake submodules with changes related to Python 2 EOL (Jon Siwek, Corelight)

1.5.0-dev.22 | 2020-10-21 15:37:57 -0700

  * Move CI from Fedora 30 (EOL) to Fedora 32 (Jon Siwek, Corelight)

1.5.0-dev.20 | 2020-10-21 15:14:55 -0700

  * Update Windows CI config (Jon Siwek, Corelight)

    * Disable Cirrus Windows task: an updated Docker image on Cirrus-side
      has unknown issues and trying to create one for ourselves also ended
      with similar, unsuccessful results

    * Provide an example Dockerfile that uses Visual Studio 2019, which may
      help as a starting point for manual testing/development purposes

    * Enable Travis for testing just Windows

1.5.0-dev.16 | 2020-08-21 11:41:06 -0700

  * Respect --config-file= CLI parameters (Dominik Charousset, Corelight)

1.5.0-dev.14 | 2020-07-30 16:08:56 -0700

  * Fix build with CAF 0.18 (Dominik Charousset)

1.5.0-dev.12 | 2020-07-27 18:17:13 -0700

  * Use 127.0.0.1 instead of ::1 for cluster configs (Dominik Charousset)

  * Call abort() on errors during cluster benchmarks (Dominik Charousset)

    Orderly shutdowns seem to fail for some categories of errors. Calling
    `abort` ensures that the program at least always terminates, even though
    this means skipping cleanup of system resources such as open ports.

  * Make cluster-benchmark tool modular, add new mode (Dominik Charousset)

    Rather than using flags to change the behavior, the configuration of the
    tool now asks for a mode. This makes the tool easier to extend and use.
    Previously the behavior of mutualy exclusive flags (for example, setting
    both `--generate-config` and `--dump-stats`) was not well defined.

    Furthermore, this commits adds another mode: `shrink-generator-file`.
    This enables users to reduce the size of recordings retrospectively.

  * Add factory function for creating generator file headers (Dominik Charousset)

  * Add new read_raw method to expose generator file input bytes (Dominik Charousset)

  * Make broker-cluster-benchmark config file output independent of argv order (Dominik Charousset)

  * Add integration test for broker-cluster-benchmark (Dominik Charousset)

  * Support reading the cluster benchmark config from STDIN (Dominik Charousset)

1.5.0-dev | 2020-07-27 10:45:17 -0700

  * Update NEWS for v1.5.0-dev placeholder (Jon Siwek, Corelight)

1.4.0 | 2020-07-27 10:28:25 -0700

  * Release 1.4.0

1.4.0-dev.171 | 2020-07-24 15:28:49 -0700

  * Update embedded CAF 0.17.6 (Jon Siwek, Corelight)

1.4.0-dev.170 | 2020-07-24 13:53:33 -0700

  * Use std::move in some broker::store methods (Jon Siwek, Corelight)

1.4.0-dev.169 | 2020-07-24 11:28:34 -0700

  * Silence self-assign-overloaded warning on Clang (Dominik Charousset)

1.4.0-dev.165 | 2020-07-16 18:30:03 -0700

  * Update CAF to release/0.17 branch (Jon Siwek, Corelight)

1.4.0-dev.164 | 2020-07-14 14:56:23 -0700

  * Properly initialize stack buffers in the flare (Dominik Charousset)

1.4.0-dev.162 | 2020-07-13 09:19:40 -0700

  * GH-129: improve logging for stale store expiry reminders (Jon Siwek, Corelight)

1.4.0-dev.160 | 2020-07-10 16:51:18 -0700

  * broker-cluster-benchmark: Avoid extra peerings on startup (Dominik Charousset)

  * broker-cluster-benchmark: Fix loop detection and tree printing (Dominik Charousset)

1.4.0-dev.157 | 2020-07-08 08:33:03 -0700

  * Change default console logging verbosity to "error" (Jon Siwek, Corelight)

1.4.0-dev.155 | 2020-07-07 12:40:20 -0700

  * Improve error messages emitted from SQLite backend (Jon Siwek, Corelight)

  * Fix typos in docs (Jon Siwek, Corelight)

  * Add Python SQLite-backed data store examples (Jon Siwek, Corelight)

  * Fix syntax highlighting for Python examples (Jon Siwek, Corelight)

  * Fix docs to include snippets from correct header path (Jon Siwek, Corelight)

1.4.0-dev.150 | 2020-06-30 10:58:03 -0700

  * Include store IDs in the topic (Dominik Charousset)

    As discussed in #121, adding the store ID to the topic enables better
    control over the amount of data a subscriber receives by selecting only
    stores of interest.

1.4.0-dev.148 | 2020-06-23 16:10:07 -0700

  * Use the right variable when opening peers.txt for recording data (Tim Wojtulewicz, Corelight)

1.4.0-dev.146 | 2020-06-12 18:01:03 -0700

  * Differentiate between data store remove and expire events (Dominik Charousset)

  * Remove the multimap for data store clones (Dominik Charousset)

1.4.0-dev.141 | 2020-06-02 10:53:09 -0700

  * Change CI script to compile from build/Makefile (Jon Siwek, Corelight)

1.4.0-dev.140 | 2020-06-01 12:16:17 -0700

  * Add store ID to insert, update and erase events (Dominik Charousset)

1.4.0-dev.138 | 2020-05-29 17:33:07 -0700

  * Add benchmark targets to installed files (Tim Wojtulewicz, Corelight)

1.4.0-dev.136 | 2020-05-28 14:08:26 -0700

  * Move recording logic to mixin (Dominik Charousset)

  * Move data store management to mixin (Dominik Charousset)

  * Move connection and notification logic to mixins (Dominik Charousset)

1.4.0-dev.131 | 2020-05-19 10:48:28 -0700

  * Fix definition of broker::infinite (Dominik Charousset)

  * Bump required CAF version to >= 0.17.5 (Dominik Charousset)

  * Update CAF submodule (Dominik Charousset)

  * Port Broker to CAF 0.18 (Dominik Charousset)

    With the new forward compatibility macros in CAF 0.17.5, we can support
    both CAF releases with a few select #ifdef blocks until switching fully
    to CAF 0.18.

  * Switch to _v suffix notation for atoms (Dominik Charousset)

  * Use CAF's new type ID API (Dominik Charousset)

1.4.0-dev.121 | 2020-05-15 10:37:27 -0700

  * Use BROKER_WINDOWS in conditionals for MinGW (Noah Treuhaft)

1.4.0-dev.118 | 2020-05-13 11:12:51 -0700

  * Add CMake variable to disable doc examples (Tim Wojtulewicz, Corelight)

1.4.0-dev.116 | 2020-04-30 18:29:35 -0700

  * Use inheritance for composing the core manager (Dominik Charousset)

  * Refactor streaming scaffold (Dominik Charousset)

    - Bundle streaming logic in new alm::stream_transport class
    - Inherit from `caf::stream_manager` directly
    - Remove the obsolete `stream_distribution_tree`

  * Templatize the core policy (Dominik Charousset)

  * Generalize node_message (Dominik Charousset, Corelight)

  * Fix subscription management with filter_extend (Dominik Charousset, Corelight)

1.4.0-dev.105 | 2020-04-30 16:37:21 -0700

* Allow users to subscribe to data store "update events" (Dominik Charousset)

  By subscribing to the new (reserved) topic topics::store_events, users can
  now get insert, update, and erase events whenever values in the store are
  added, changed, or removed::

    auto x = subscriber.get();
    if (auto insert = store_event::insert::make(x)) {
      // ...
    }
    // ... same for store_event::update and store_event::erase ...

1.4.0-dev.85 | 2020-04-29 15:17:53 -0700

  * Add new status codes for node discovery (Dominik Charousset)

    The new status codes are currently unused, but become relevant when
    switching to the ALM-based communication backend.

1.4.0-dev.81 | 2020-04-15 15:10:37 -0700

  * GH-109: fix unusable subscriber.poll() method in Python bindings (Jon Siwek, Corelight)

1.4.0-dev.79 | 2020-04-15 15:08:12 -0700

  * GH-106: Fix Python tests to work with Python 3.8 (Jon Siwek, Corelight)

  * Change topic strings to not automatically alter slashes (Jon Siwek, Corelight)

    Automatically removing trailing or consecutive slashes in topic strings
    prevents uniquely targeting topic names to a node.

    For example, publishing to "node-10/" should not match a subscription
    for "node-1/", but that's what happens with prefix-based matching if the
    trailing slash is automatically removed.

1.4.0-dev.77 | 2020-04-09 22:57:15 -0700

  * Fix concurrency setup for the Cirrus/MSVC build (Dominik Charousset)

1.4.0-dev.75 | 2020-03-30 13:21:09 -0700

  * Make RocksDB usage opt-in and add --enable-rocksdb configure flag
    (Jon Siwek, Corelight)

1.4.0-dev.73 | 2020-03-27 11:11:51 -0700

  * Add missing binding for broker_options member (Dominik Charousset)

  * Update CAF submodule to fix MSVC/Windows build (Dominik Charousset)

1.4.0-dev.69 | 2020-03-26 12:00:05 -0700

  * Update CAF submodule to fix GCC 7.2 build (Dominik Charousset)

1.4.0-dev.67 | 2020-03-23 10:22:10 -0700

  * Increase template backtrace limit (Dominik Charousset)

1.4.0-dev.65 | 2020-03-13 22:21:28 -0700

  * Add Windows task to Cirrus CI config (Jon Siwek, Corelight)

    This also moves the CAF submodule from aux/caf/ to caf/ since
    Windows does not allow naming a directory "aux".

1.4.0-dev.63 | 2020-03-13 13:38:40 -0700

  * Add branch whitelist for CI notifications (Jon Siwek, Corelight)

1.4.0-dev.62 | 2020-03-09 19:21:47 -0700

  * Add Cirrus CI config and remove Travis CI config (Jon Siwek, Corelight)

    The CMake configuration also now prefers choosing a Python3 installation
    over Python2 (since that's end-of-life) for building the Broker Python
    bindings.

    Some timeout values in unit tests were also fiddled to work better in
    the CI environment.

1.4.0-dev.60 | 2020-03-09 12:54:05 -0700

  * Fix a race condition in data store flare operations (Jon Siwek, Corelight)

    The race (as seen via Zeek usage) goes like:

    Thread A: enqueue item, get suspended
    Thread B: sees mailbox has items
    Thread B: dequeue item
    Thread B: extinguish flare
    Thread A: resume, fire flare

    That ordering can leave the flare in an active state without any actual
    items remaining in the mailbox.

    This patch adds a mutex/lock such that extinguishing of the flare cannot
    be interleaved between the enqueue and firing of the flare.

    This likely relates to https://github.com/zeek/zeek/issues/838,
    https://github.com/zeek/zeek/issues/716, as well as this thread
    http://mailman.icsi.berkeley.edu/pipermail/zeek/2020-February/015062.html

1.4.0-dev.58 | 2020-03-06 11:53:58 -0800

  * Send statuses and errors via regular topics (Dominik Charousset)

    With this set of changes, status and error messages no longer bypass the
    regular topic-based distribution. There are two new reserved topics:
    topics::statuses and topics::errors. Messages to these two topics are never
    forwarded to peers.

    When emitting status or error messages, they get converted to data, which
    is a vector.  The new conversions between status <-> data and error <->
    data actually accounts for the most code changes. However, this means
    scripts can now easily access these messages as well. Subscribing to the
    reserved topics grants easy access to statuses and errors now, allowing to
    multiplex them with regular events.

    The status_subscriber was rewritten to dispatch to a regular subscriber
    internally.

  * Implement conversion between error and data (Dominik Charousset)

  * Implement can_convert_to for endpoint_info (Dominik Charousset)

  * Add declarative inspection of data via contains<> (Dominik Charousset)

  * Make ec convertible to and from string (Dominik Charousset)

  * Add status_view type for operating on raw data (Dominik Charousset)

  * Implement conversion between data and status (Dominik Charousset)

  * Add from-string conversion to sc enum (Dominik Charousset)

1.4.0-dev.38 | 2020-03-06 10:39:42 -0800

  * Fix cross compilation build (Dominik Charousset)

1.4.0-dev.35 | 2020-03-02 11:40:53 -0800

  * Add missing unistd.h include (Jon Siwek, Corelight)

1.4.0-dev.34 | 2020-03-02 10:56:59 -0800

  * Include CAF directly as submodule (Dominik Charousset)

1.4.0-dev.32 | 2020-03-02 10:30:03 -0800

  * Check in CMake whether the <filesystem> code links (Dominik Charousset)

  * Add instructions for MSVC builds (Dominik Charousset)

  * Improve error logging in the SQLite backend (Dominik Charousset)

  * Port the flare to Windows/MSVC (Dominik Charousset)

    The `pipe` system call only exists on POSIX. On Windows, we need to
    create a pair of connected sockets. Also, file descriptors and sockets
    are different things on Windows.

    Fortunately, CAF already offers a set of abstractions we can use to
    adjust for the platform differences. We still have to make sure to use
    recv/send on Windows instead of read/write as well as calling WSAStartup
    and WSACleanup.

  * Port recording utilities to Windows (Dominik Charousset)

  * Port filesystem wrapper to Windows/MSVC (Dominik Charousset)

  * Reimplement address with caf::ip_address for MSVC (Dominik Charousset)

    The implementation of `broker::address` used many  UNIX-specific
    functions as well as functions marked as deprecated/unsafe on MSVC (e.g.
    `sprintf`). Basing the implementation on `caf::ip_address` instead of
    rolling a custom implementation avoids dealing with most issues in the
    first place.

  * Add MSVC to the CMake build harness (Dominik Charousset)

1.4.0-dev.18 | 2020-02-28 13:22:09 -0800

  * Fix handling of OS-specific threading flags (Dominik Charousset)

1.4.0-dev.15 | 2020-02-25 17:56:28 -0800

  * Support building Broker as CMake subdirectory (Dominik Charousset)

    When building Broker as a subdirectory, we disable all compiler checks
    and flag management and leave it to the parent project to provide valid
    settings. In order to achieve "perfect forwarding" of all settings, we
    include CAF as subdirectory rather than bundling it as an external
    project.

1.4.0-dev.4 | 2020-02-22 11:54:14 -0800

  * Fix various "maybe uninitialized" warnings (Jon Siwek, Corelight)

  * Switch to using [[deprecated]] attribute (Jon Siwek, Corelight)

1.4.0-dev | 2020-02-08 11:47:27 -0800

  * Update NEWS/VERSION for v1.4.0-dev (Jon Siwek, Corelight)

1.3.0 | 2020-02-08 11:02:01 -0800

  * Release 1.3.0.

1.2.0-161 | 2020-02-08 11:01:43 -0800

  * Update RTD version labeling for LTS (Jon Siwek, Corelight)

1.2.0-160 | 2020-02-08 10:41:13 -0800

  * Fix RTD version number/label template (Jon Siwek, Corelight)

1.2.0-159 | 2020-02-08 10:38:58 -0800

  * Fix RTD version number/label template (Jon Siwek, Corelight)

1.2.0-158 | 2020-02-08 10:34:43 -0800

  * Display version number for more RTD version labels (Jon Siwek, Corelight)

1.2.0-157 | 2020-02-08 09:39:45 -0800

  * Update embedded CAF to 0.17.4 (Jon Siwek, Corelight)

1.2.0-156 | 2020-02-07 21:05:22 -0800

  * Update NEWS (Jon Siwek, Corelight)

1.2.0-155 | 2020-02-05 21:46:17 -0800

  * Update CAF to current 0.17.4 release branch (Jon Siwek, Corelight)

1.2.0-154 | 2020-02-04 11:33:03 +0000

  * GH-85: Improve Python bindings Event validity checks. (Jon Siwek,
    Corelight)

    This adds a valid() method to broker.zeek.Event objects that may be
    called after creating them to check if the data it parsed was valid
    event data.

    Also extended the name() and args() methods of broker.zeek.Event to
    first check for validity to avoid segfaulting.  If the validity check
    fails, a ValueError exception is now thrown.

1.2.0-151 | 2020-01-24 12:04:26 -0800

  * Fix accidential error/log output (Dominik Charousset, Corelight)

  * Extend log output format on the console (Dominik Charousset, Corelight)

1.2.0-147 | 2020-01-23 13:33:04 +0000

  * Redesign Broker's configuration setup. (Dominik Charousset, Corelight)

    The environment variables BROKER_DEBUG_VERBOSE and
    BROKER_DEBUG_LEVEL overlapped and provided fuzzy semantics for a
    user. This commit replaces the previous variables with
    BROKER_CONSOLE_VERBOSITY and BROKER_FILE_VERBOSITY:

    - set `BROKER_CONSOLE_VERBOSITY=info` for seeing high-level events such
      as new connections, incoming peerings, etc.
    - set `BROKER_CONSOLE_VERBOSITY=debug` for tapping into exchanged
      messages and other low-level events (slow)

    When debugging a distributed Broker setup, users can instead use
    BROKER_FILE_VERBOSITY to record a test run and then collect the files
    from all endpoints.

    In all cases, Broker now omits CAF output. Advanced features are only
    accessible from the (new) `broker.conf`. Here, experienced users can
    remove the component files, tweak format strings, and so on.

    The initialization process now also fixes ordering of the various
    configuration parameters:

    - `broker.conf` overrides hard-coded defaults
    - environment variables override `broker.conf` entires
    - command line arguments override environment variables

    Finally, Broker now throws exceptions on invalid configuration entries
    rather than silently dropping them. Also, the `endpoint` checks whether
    the user asked for a help text and stops immediately instead of carrying
    on normally.

1.2.0-141 | 2020-01-07 20:45:15 -0800

  * Preserve optimization setting for sanitizer build (Jon Siwek, Corelight)

1.2.0-140 | 2020-01-03 10:45:38 -0700

  * Add LeakSanitizer instrumentation macros

    And disable checking LSAN leaks of sqlite3_open which seems to be a
    false positive. (Jon Siwek, Corelight)

  * Improve convenience options for enabling sanitizers

    * Removes --enable-asan configure flag
    * Removes ENABLE_ADDRESS_SANITIZER CMake variable
    * Adds --sanitizers configure flag
    * Adds BROKER_SANITIZERS CMake variable
    * Sets C++ compiler flags according to the new options and also passes
      them to the embedded CAF project

    These new options would typically be used with the Debug build type and
    also automatically sets -O1 unless NO_OPTIMIZATIONS environment variable
    exists.

    Related to https://github.com/zeek/broker/pull/77 (Jon Siwek, Corelight)


1.2.0-137 | 2019-12-02 16:29:47 -0800

  * Add infinite-send-rate feature to broker-benchmark (Dominik Charousset, Corelight)

1.2.0-135 | 2019-11-24 10:13:37 -0800

  * Use binary serializers, prepare for CAF changes (Dominik Charousset, Corelight)

    - The stream serializers perform poorly and probably disappear in the
      next CAF release. Consequently, always using the binary serializers
      improves performance and also makes sure Broker is "future proof".
    - Legacy support for serialize() functions probably fades away and
      mixing `inspect` and `serialize` functions in Broker only has historic
      reasons anyway. Sicking to one abstraction (`inspect`) is overdue.
    - The binary_serializer might use any buffer type in future releases.
      Instead of hardcoding `vector<char>`, we now ask the serializer for
      its container type.

  * Avoid using soon-to-be-removed message::take (Dominik Charousset, Corelight)

1.2.0-131 | 2019-11-15 17:49:37 -0800

  * Add workaround to enable parallel Unix make for external project_caf (Simon Hardy-Francis, Corelight)

  * Fix build for multi-config CMake generators (e.g. Xcode) (Jon Siwek, Corelight)

1.2.0-126 | 2019-11-11 13:47:17 -0800

  * Make broker-cluster-benchmark log output configurable (Dominik Charousset, Corelight)

    Also makes "quiet" log level the default.

1.2.0-123 | 2019-11-11 13:36:46 -0800

  * Update embedded CAF to 0.17.3 (Jon Siwek, Corelight)

1.2.0-120 | 2019-10-30 13:22:30 -0700

  * Set CMAKE_INSTALL_LIBDIR in CAF if set in broker/zeek (Johanna Amann, Corelight)

    The INSTALL_LIB_DIR CMake variable was also removed in favor of
    CMAKE_INSTALL_LIBDIR.

1.2.0-117 | 2019-10-28 18:06:57 -0700

  * Update README to reflect CMake 3.0+ requirement (Jon Siwek, Corelight)

1.2.0-115 | 2019-10-28 16:53:41 -0700

  * Require CMake 3 (Dominik Charousset, Corelight)

  * Fix position of CMake project() (Dominik Charousset, Corelight)

    The call to `project` must come after `cmake_minimum_required` in CMake
    in order to get the correct policy settings.

  * Fix conditions where broker-cluster-benchmark may hang (Dominik Charousset, Corelight)

1.2.0-108 | 2019-10-28 16:08:14 -0700

  * Use Ubuntu 18.04 (Bionic) for Travis CI (Jon Siwek, Corelight)

    Mostly as a simple way to get a C++17-capable compiler in the default
    build environment.

  * Require C++17 (Jon Siwek, Corelight)

1.2.0-102 | 2019-10-23 09:16:09 -0700

  * Add -DNO_AUTO_LIBCPP when building CAF. (Robin Sommer, Corelight)

    When setting the C++ compiler to clang, CAF by default switches to
    compiling with -stdlib=libc++. As Broker doesn't do that, the two end
    up linking against different libaries. Setting NO_AUTO_LIBCPP lets CAF
    use the same library settings as Broker.

1.2.0-100 | 2019-10-21 17:35:16 -0700

  * Add broker-cluster-benchmark tool (Dominik Charousset, Corelight)

    Allows benchmarking arbitrary Broker networks based on previously
    recorded data.  e.g. can record all Broker messages in a Zeek cluster
    and then replay them later in a simulated network for benchmarking
    purposes.  See tests/benchmark/README.md for details.

  * Add new is_file utility function (Dominik Charousset, Corelight)

  * Remove obsolete benchmark (Dominik Charousset, Corelight)

    The old broker-stream-benchmark is very low level and no longer provides
    any value with broker-cluster-benchmark in the mix.

  * Give recognizable names to custom actor types (Dominik Charousset, Corelight)

  * Streamline announcement of types (Dominik Charousset, Corelight)

1.2.0-60 | 2019-10-21 09:33:35 -0700

  * Update embedded CAF to 0.17.2 (Jon Siwek, Corelight)

1.2.0-59 | 2019-10-21 11:41:35 +0200

  * Fix check for cmake commands on POSIX shells (Dominik Charousset, Corelight)

  * Prefer cmake3 command, add --cmake=PATH option (Dominik Charousset, Corelight)

1.2.0-56 | 2019-10-16 10:01:19 -0700

  * Update to pybind11 v2.4.3 (Jon Siwek, Corelight)

1.2.0-54 | 2019-10-02 10:44:57 -0700

  * Extend visibility of imported CAF library targets (Dominik Charousset, Corelight)

1.2.0-49 | 2019-09-30 10:09:24 -0700

  * Let CAF parse the CLI of broker-benchmark instead of using getopt (Dominik Charousset)

  * Remove YCM file (Dominik Charousset)

  * Move config.hh.in out of the include directory (Dominik Charousset)

1.2.0-42 | 2019-09-27 08:30:53 -0700

  * Fix Xcode warnings about subscriber move-assignment (Jon Siwek, Corelight)

1.2.0-40 | 2019-09-19 16:38:30 -0700

  * Update header include guard in broker/config.hh (Jon Siwek, Corelight)

1.2.0-39 | 2019-09-17 10:07:15 -0700

  * Update contribution guide (Dominik Charousset)

  * Switch from header guards to pragma once (Dominik Charousset)

1.2.0-36 | 2019-09-06 12:56:49 -0700

  * Ensure default logging level of "quiet" (Jon Siwek, Corelight)

1.2.0-34 | 2019-09-04 19:04:06 -0700

  * Fix update-changes config due to version.hh moving (Jon Siwek, Corelight)

  * Fix ambiguous overload compile error in ssl test (Jon Siwek, Corelight)

  * GH-51: move Broker header files into include/ subdir (Jon Siwek, Corelight)

    So that project root directory doesn't need to be in search path
    (which potentially has non-header files whose name may collide with
    the intended header file from standard).

1.2.0-31 | 2019-09-04 15:30:51 -0700

  * Allow subscribers to use absolute timeouts (Dominik Charousset)

  * Add option to record metadata for published messages (Dominik Charousset)

1.2.0-12 | 2019-09-04 13:38:42 -0700

  * Always disable OpenSSL in test fixture (Dominik Charousset)

  * Make logging code more robust (Dominik Charousset)

    Setting CAF_LOG_COMPONENT is very brittle and CAF is moving away from
    this design for that reason. Instead, we now dispatch directly to
    CAF_LOG_IMPL with the proper log component and level.

    Also, we no longer use CAF_LOG_* macros directly and instead always use
    the Broker macros in order to make sure log entries are properly
    attributed to either CAF or Broker code.

  * Rename test.[hc]pp according to naming convention (Dominik Charousset)

  * Let CAF set proper config option in base_fixture (Dominik Charousset)

  * Revert 90a7ab3 and adjust base_fixture to CAF 0.17 (Dominik Charousset)

1.2.0-6 | 2019-09-03 11:32:35 -0700

  * Review broker-benchmark, remove dead/unsafe code (Dominik Charousset)

    - Remove 'use-non-blocking' mode, since it is unsafe. Once the queue gets
      exhausted, CAF will halt the nonblocking producer. However, there is no logic
      to trigger it again (see `publisher_worker` in `publisher.cc`). On a bigger
      picture, this nonblocking mode mimics what the publisher does internally, so
      it serves no purpose from a benchmarking perspective.

    - Remove 'use-zeek-batches' mode. This mode caused the benchmark to use the
      function `sendZeekBatch` for generating events. However, the implementation
      was identical to sendBrokerBatch (the default). Consequently, this mode was a
      fancy no-op.

1.2.0-4 | 2019-08-14 09:54:48 -0700

  * Properly announce message types in core unit test (Dominik Charousset)

1.2.0 | 2019-08-02 18:24:15 -0700

  * Release 1.2.0.

1.1.2-58 | 2019-08-02 18:23:46 -0700

  * Adjust unit tests to work with CAF 0.17.0 (Jon Siwek, Corelight)

1.1.2-57 | 2019-07-26 16:03:53 -0700

  * Link libatomic when necessary (Jon Siwek, Corelight)

1.1.2-55 | 2019-06-17 20:18:29 -0700

  * Update Travis config for bro to zeek renaming (Daniel Thayer)

1.1.2-51 | 2019-06-07 09:13:22 -0700

  * Add enum_value documentation (synnick)

1.1.2-49 | 2019-05-30 21:32:58 -0700

  * Improve shutdown behavior (Jon Siwek, Corelight)

    Sending the "kill" exit reason to CAF actors seems to more reliably
    avoid deadlock/hang issues on shutting down, likely due to it having
    more explicit logic to shut down streams.

1.1.2-48 | 2019-05-28 17:39:41 -0700

  * Fix subscriber_base::get(n, timeout) congestion tracking (Jon Siwek, Corelight)

    This could call became_not_full() in cases where the underlying queue
    size did not actually transition to below the congestion limit.

  * Fix race in subscriber_base::poll() leading to vector realloc (Jon Siwek, Corelight)

    The value used to reserve the initial vector capacity may
    be underestimated due to unlocking a mutex between the call
    to buffer_size() and consume(), leading to unnecessary vector
    re-allocation.

  * Improve broker::bro::Message API to help avoid copies (Jon Siwek, Corelight)

  * Fix flare_actor always reporting readiness (Jon Siwek, Corelight)

    Since mailbox elements get taken via receive(), not dequeue(),
    the flare which signalled readiness never got extinguished.

  * Add broker::store::proxy::receive(n) (Jon Siwek, Corelight)

    For receiving N data store responses at a time.

1.1.2-40 | 2019-05-23 17:57:57 -0700

  * GH-43: use Python tuples to represent Broker vectors (Jon Siwek, Corelight)

    Opposed to previously mapping vectors to Python lists.

    This is needed in order to represent tables indexed by vectors: tables
    are mapped to dictionaries, dictionaries require immutable indices,
    and a tuple is immutable whereas a list is mutable.

1.1.2-38 | 2019-05-15 15:52:42 -0700

  * Fix for Python2 compatibility (Jon Siwek, Corelight)

1.1.2-37 | 2019-05-15 14:36:24 -0700

  * Add bro.py compatibility module with deprecation warnings (Jon Siwek, Corelight)

  * Add bro.hh compatibility header with deprecation warnings (Jon Siwek, Corelight)

  * Replace "bro" with "zeek" in tests, docs, and src code (Daniel Thayer)

  * Rename files from "bro" to "zeek" (Daniel Thayer)

1.1.2-32 | 2019-05-14 12:21:59 -0700

  * Update unit test to use zeek executable, not bro (Jon Siwek, Corelight)

1.1.2-30 | 2019-04-19 11:08:52 -0700

  * Replace bro_init/bro_done usages with zeek_init/zeek_done (Seth Hall, Corelight)

1.1.2-27 | 2019-04-16 12:42:43 -0700

  * Update usage of a deprecated Sphinx API (Jon Siwek, Corelight)

  * Add missing copyright to sphinx extension code (Jon Siwek, Corelight)

1.1.2-24 | 2019-04-12 13:19:59 -0700

  * Add repr/str methods to python bindings Count type (Jon Siwek, Corelight)

1.1.2-23 | 2019-03-27 10:40:00 -0700

  * Deploy copy-on-write for more efficient messaging (Dominik Charousset)

    This contains a breaking API change (for C++ code, not Python),
    see NEWS for code migration details.

1.1.2-18 | 2019-03-22 12:48:04 -0700

  * GH-40: use TZ-aware (UTC) datetimes in python bindings (Jon Siwek, Corelight)

1.1.2-15 | 2019-03-07 18:39:46 -0800

    - Add --with-python-config configure option (Jarry Shaw)

1.1.2-13 | 2019-02-15 13:53:38 -0600

  * zeek/GH-273: Fix file descriptor leak in subscribers (Jon Siwek, Corelight)

    Specifically, endpoint::make_status_subscriber() and
    endpoint::make_subscriber() methods because the "flare" class was
    missing a dtor to close its FDs.

1.1.2-12 | 2019-02-06 13:15:57 -0600

  * Add validity-checking functions for Bro-specific messages (Jon Siwek, Corelight)

1.1.2-11 | 2019-01-23 13:57:51 -0600

  * Add --with-log-level configure option (Jon Siwek, Corelight)

1.1.2-10 | 2019-01-22 15:05:55 -0600

  * Update embedded CAF to 0.16.3 (Jon Siwek, Corelight)

1.1.2-8 | 2019-01-16 09:02:18 -0600

  * Fix python bindings unicode decode exceptions (Jon Siwek, Corelight)

1.1.2-7 | 2019-01-14 17:52:21 -0600

  * Fix README title formatting (Jon Siwek, Corelight)

1.1.2-5 | 2019-01-10 18:00:11 -0600

  * Fix RTD URL (Jon Siwek, Corelight)

1.1.2-4 | 2019-01-10 17:06:06 -0600

  * Update manual URL and some simple s/Bro/Zeek (Jon Siwek, Corelight)

1.1.2-3 | 2019-01-02 11:22:02 -0600

  * Add --rate option to broker-pipe

    Calling broker-pipe in subscriber mode with the rate option
    suppresses the normal output and prints the number of received
    messages to stdout every second instead. (Tobias Mayer)

1.1.2-1 | 2018-12-19 15:11:27 -0600

  * Fix broker shared library build version (Jon Siwek, Corelight)

1.1.2 | 2018-12-19 09:47:51 -0600

  * Release 1.1.2

  * Update embedded SQLite to 3.26.0 (Jon Siwek, Corelight)

1.1.1-10 | 2018-12-13 10:42:53 -0600

  * GH-31: fix python binding broker.Store.keys() method (Jon Siwek, Corelight)

1.1.1-9 | 2018-12-12 16:14:55 -0600

  * Add benchmark for no-network, core-to-core setup (Dominik Charousset)

  * Add stream benchmark mode for running sink + source in one process (Dominik Charousset)

1.1.1-4 | 2018-12-10 11:11:48 -0600

  * Propagate --build-static and --build-static-only to CAF (Johanna Amann)

  * Make --enable-static-only work when CAF is static (Johanna Amann)

    Changes the ordering of the CAF libraries in the link command and
    adds fPIC to python bindings.

  * Update submodules to use github.com/zeek (Jon Siwek, Corelight)

1.1.1 | 2018-11-29 09:52:01 -0600

  * Release 1.1.1.

1.1.0-483 | 2018-11-29 09:50:54 -0600

  * Add `broker.Port.Unknown` to python binding docs (hosom)

1.1.0-481 | 2018-11-22 06:55:13 -0600

  * Fix build with CAF_NO_EXCEPTION defined (Dominik Charousset)

1.1.0-479 | 2018-11-21 09:15:51 -0600

  * Improve python bindings virtualenv installation docs (hosom)

1.1.0-477 | 2018-11-13 19:43:51 -0600

  * Adjust an attribution (Jon Siwek, Corelight)

1.1.0-476 | 2018-11-13 10:58:03 -0600

  * Fix ping.py example (reported by Jeff Atkinson, Salesforce)

1.1.0-475 | 2018-11-06 18:41:53 -0600

  * Prevent rare hangs on shutdown with CAF 0.16.1+ (Jon Siwek, Corelight)

1.1.0-474 | 2018-11-05 14:52:46 -0600

  * Remove a broker-node TODO (Jon Siwek, Corelight)

1.1.0-473 | 2018-11-05 14:47:24 -0600

  * Fix broker-node shutdown in verbose mode (Jon Siwek, Corelight)

1.1.0-471 | 2018-11-02 07:59:56 -0500

  * Fix endpoint shutdown behavior (Jon Siwek, Corelight)

1.1.0-470 | 2018-11-01 16:53:12 -0500

  * Disable clang test for Travis Trusty (Jon Siwek, Corelight)

1.1.0-469 | 2018-10-31 18:39:30 -0500

  * Fix shutdown issue with CAF 0.16.1 (Dominik Charousset)

  * Implement broker-node tool for latency measurement (Dominik Charousset)

  * Support more idiomatic build-dir syntax (Dominik Charousset)

1.1.0-461 | 2018-10-31 18:35:10 -0500

  * Fix CMake script and a unit test to work with CAF 0.16.1,
    which is now the default/embedded version (Jon Siwek, Corelight)

1.1.0-459 | 2018-10-25 13:34:42 -0500

  * GH-20: Buffer received batches until peer_added status is available
    (Jon Siwek, Corelight)

1.1.0-456 | 2018-10-24 15:50:15 -0500

  * Add max_threads property to broker.Configuration python binding (Jon Siwek, Corelight)

  * Add default broker.Configuration() ctor to python bindings (Jon Siwek, Corelight)

1.1.0-454 | 2018-10-05 11:41:01 -0500

  * GH-19: add endpoint::unpeer_nosync python binding (Jon Siwek, Corelight)

1.1.0-453 | 2018-10-05 09:30:16 -0500

  * Remove README acknowledgements as missing commits are now in master
    (Jon Siwek, Corelight)

1.1.0-8 | 2018-10-04 11:08:07 -0500

  * Update actor-system branch link in README (Jon Siwek, Corelight)

1.1.0-7 | 2018-10-04 11:05:26 -0500

  * Add acknowledgements to README (Jon Siwek, Corelight)

1.1.0-6 | 2018-10-03 19:15:44 -0500

  * Initialize clone_state members in ctor (Jon Siwek, Corelight)

1.1.0-5 | 2018-10-03 19:10:57 -0500

  * Fix uninitialized status member (Jon Siwek, Corelight)

1.1.0-4 | 2018-10-03 18:11:05 -0500

  * Use move() in to avoid a few copies (Jon Siwek, Corelight)

1.1.0-3 | 2018-10-03 17:15:33 -0500

  * Check results of flare fcntl calls (Jon Siwek, Corelight)

1.1.0-2 | 2018-10-03 16:58:55 -0500

  * Fix uninitialized master_actor member (Jon Siwek, Corelight)

1.1.0-1 | 2018-09-27 14:02:12 -0500

  * Fix unitialized subscriber_base::max_qsize_ member (Jon Siwek, Corelight)

1.1.0 | 2018-09-17 10:55:56 -0500

  * Release 1.1.0.

1.0.1-62 | 2018-09-17 10:54:29 -0500

  * GH-15: change broker.Error type in python bindings (Jon Siwek, Corelight)

    This was only used as an exception type for Data conversions, which
    are now TypeError, and broker.Error is now bound to broker::error
    as is expected since broker.Status is bound to broker::status.

1.0.1-61 | 2018-09-12 10:54:38 -0500

  * Remove unused warnings and variables (Matthias Vallentin)

1.0.1-59 | 2018-09-11 16:11:10 -0500

  * Update pybind11 to v2.2.4 release (Jon Siwek, Corelight)

1.0.1-58 | 2018-09-11 14:24:03 -0500

  * GH-12: fix Endpoint.peers() python binding (Jon Siwek, Corelight)

  * GH-12: add python method "node_id" for Endpoint and EndpointInfo
    This returns a unique node ID string. (Jon Siwek, Corelight)

1.0.1-56 | 2018-09-11 13:17:25 -0500

  * GH-13: fix incorrect "unpeer" python binding (Jon Siwek, Corelight)

1.0.1-55 | 2018-09-10 14:43:15 -0500

  * GH-11: fix ambiguous broker.Event constructor (Jon Siwek, Corelight)

1.0.1-54 | 2018-09-06 18:19:34 -0500

  * Prevent data store clone messages from being forwarded
    (Jon Siwek, Corelight)

1.0.1-53 | 2018-09-05 09:57:44 -0500

  * Make blocking flags available to Python wrapper (Matthias Vallentin)

  * Improve `make dist` (Jon Siwek, Corelight)

1.0.1-49 | 2018-08-29 23:43:32 +0000

  * Add Python __repr__ binding for broker::endpoint_info. It
    translates to a unique node ID string. (Jon Siwek, Corelight)

  * Remove Bro-specific "relay" messages. (Jon Siwek, Corelight)

1.0.1-44 | 2018-08-22 10:55:34 -0500

  * Bring back a minor advance_time optimization (Jon Siwek, Corelight)

1.0.1-42 | 2018-08-21 09:59:54 -0500

  * Move core actor to public namespace (Dominik Charousset)

  * Decouple clock component of the endpoint (Dominik Charousset)

1.0.1-38 | 2018-08-10 16:47:53 -0500

  * Add ability to do blocking subscription modifications
    (Jon Siwek, Corelight)

  * Fix an issue that could cause message loss (Jon Siwek, Corelight)

  * Fix two debug logging macros (Jon Siwek, Corelight)

1.0.1-33 | 2018-08-08 12:43:52 -0500

  * Update pybind11 to latest master (Jon Siwek, Corelight)

  * Fix CAF deprecation warnings (Jon Siwek, Corelight)

1.0.1-31 | 2018-08-08 09:41:49 -0500

  * Fix pedantic compiler warnings (Jon Siwek, Corelight)

  * Fix deprecated warnings, cleanup test fixtures (Dominik Charousset)

1.0.1-25 | 2018-07-25 15:07:54 -0500

  * Fix enabling use of ccache in embedded CAF (Jon Siwek, Corelight)

1.0.1-21 | 2018-07-17 14:12:22 -0500

  * Add compatibility/wrapper functions which call the equivalent within
    the "caf" namespace (Jon Siwek, Corelight)

      - broker::is
      - broker::get
      - broker::get_if
      - broker::visit

  * Use caf::variant, remove broker::detail::variant (Dominik Charousset)

1.0.1-18 | 2018-06-27 20:01:47 -0500

  * Fix some typos in the Broker User Manual (Daniel Thayer)

1.0.1-16 | 2018-06-26 15:04:07 -0500

  * Fix deprecated actor_system_config field usages (Corelight)

1.0.1-15 | 2018-06-25 15:43:42 -0500

  * Clean up broker headers / includes (Corelight)

  * Improve python-store test reliability (Corelight)

1.0.1-12 | 2018-06-15 15:15:22 -0500

  * Add --disable-tests configure flag (Corelight)

1.0.1-9 | 2018-06-14 16:27:12 -0500

  * Remove timeout in endpoint::peers() and endpoint::peer_subscriptions()
    (Corelight)

1.0.1-8 | 2018-06-13 14:47:48 -0500

  * Use atomics in endpoint::advance_time implementation (Corelight)

1.0.1-5 | 2018-06-11 10:36:48 -0500

  * Fix "peer_lost" status notification sometimes getting lost (Corelight)

1.0.1-4 | 2018-06-07 16:55:23 -0500

  * Optimize endpoint::advance_time() (Corelight)

1.0.1-3 | 2018-06-04 09:18:47 -0700

  * Add Bro message type for handling + relaying events (Corelight)

1.0.1 | 2018-05-25 12:10:24 -0500

  * Release 1.0.1.

1.0.0-15 | 2018-05-25 12:08:51 -0500

  * Improve version number automation of version.hh (Corelight)

  * Fix compiling a test on older GCCs (Corelight)

1.0.0-13 | 2018-05-25 08:53:10 -0500

  * Fix external CAF arguments: build byproducts / compiler launcher
    (Corelight)

1.0.0-12 | 2018-05-24 12:03:06 -0500

  * Update documentation/diagrams (Corelight)

1.0.0-11 | 2018-05-24 09:38:31 -0500

  * Enable Travis CI email notifications (Corelight)

  * Add --ccache configure option (Corelight)

1.0.0-8 | 2018-05-24 08:39:11 -0500

  * Simplify CAF's external CMake project arguments (Corelight)

1.0.0-7 | 2018-05-23 16:12:09 -0500

  * Update user manual link in README (Corelight)

1.0.0-6 | 2018-05-23 15:44:59 -0500

  * Workaround bug in RtD requirements.txt location (Corelight)

1.0.0-3 | 2018-05-23 12:58:11 -0500

  * Update documentation build targets (Corelight)

1.0.0-2 | 2018-05-22 13:27:37 -0500

  * Add OpenSSL requirement check and pass results to external CAF
    (Corelight)

1.0.0-1 | 2018-05-22 09:47:07 -0500

  * Pass OpenSSL root dir hint through to CAF external project (Corelight)

1.0.0 | 2018-05-21 19:47:19 +0000

  * New Broker version incorporating a completely reworked API, along
    with major implementation changes. Please see the new Broker user
    manual for more information about this version. (Jon Siwek,
    Matthias Vallentin, Robin Sommer, Dominik Charousset. Integration
    supported by Corelight.)

0.7 | 2017-05-26 08:28:56 -0500

  * Release 0.7.

0.6 | 2016-10-27 14:44:50 -0700

  * Release 0.6.

0.5 | 2016-08-12 13:16:46 -0700

  * Release 0.5.

  * Change broker version check so that it only accepts version 0.14.X. (Johanna Amann)

0.4-31 | 2016-08-05 15:39:07 -0700

  * Respect -DINSTALL_LIB_DIR in multilib environments. Addresses
    BIT-1555. (M.B., Matthias Vallentin).

  * Fix compile and testing issues with Python 3. Addresses BIT-1554.
    (Matthias Vallentin)

0.4-24 | 2016-03-11 15:35:55 -0800

  * Fix broken link to manual (Matthias Vallentin)

0.4-23 | 2016-03-11 10:28:41 -0800

  * Show more details in build summary (Matthias Vallentin)

  * Deprecate --with-libcaf in favor of --with-caf (Matthias Vallentin)

  * Add README.rst symlink (Johanna Amann)

  * Fix warning about potentially signed literal. (Matthias Vallentin)

0.4-14 | 2015-11-11 09:19:15 -0600

  * Another fix for a unit test's vector-in-vector confusion.
    (Jon Siwek)

0.4-13 | 2015-11-10 13:20:01 -0800

  * Add checks for SSE2 intrinsic availability. (Jon Siwek)

  * Fix unit test ambiguity: vector copy/move ctor vs list
    initialization. (Jon Siwek)

0.4-9 | 2015-09-29 09:45:08 -0700

  * Add configure option to not build python bindings. (Daniel Thayer)

  * Fixed the configure summary output to always show true or false
    for the python bindings. (Daniel Thayer)

0.4-5 | 2015-08-20 14:11:30 -0700

  * Fix bug that prevented peers from being disconnected. (Mathias
    Fischer)

0.4-2 | 2015-07-14 21:52:47 -0700

  * Require CAF 0.14. (Matthias Vallentin)

  * Remove use of deprecated sb_actor. (Matthias Vallentin)

  * Minor compile fixes on Mac OSX. (Matthias Vallentin)

0.4-1 | 2015-06-11 12:12:12 -0500

  * Fix data store clone (re)synchronization bugs. (Jon Siwek)

0.4 | 2015-05-20 12:58:23 -0500

  * Release 0.4.

0.3-1 | 2015-05-20 12:55:33 -0500

  * pybroker: change record's fields() method to return by value
    (Jon Siwek)

0.3 | 2015-05-07 20:28:31 -0700

  * Release 0.3.

  * Include dist target in Makefile (Johanna Amann)

0.2 | 2015-04-24 09:57:28 -0500

  * Start version/change tracking like other Bro repos. (Jon Siwek)