git: 2fb62f74e6f2 - main - security/zeek: Update to 8.0.9
Date: Mon, 06 Jul 2026 23:05:30 UTC
The branch main has been updated by leres:
URL: https://cgit.FreeBSD.org/ports/commit/?id=2fb62f74e6f276d7eb6bf919940d2557b4cc84e9
commit 2fb62f74e6f276d7eb6bf919940d2557b4cc84e9
Author: Craig Leres <leres@FreeBSD.org>
AuthorDate: 2026-07-06 23:04:40 +0000
Commit: Craig Leres <leres@FreeBSD.org>
CommitDate: 2026-07-06 23:04:40 +0000
security/zeek: Update to 8.0.9
https://github.com/zeek/zeek/releases/tag/v8.0.9
This release fixes the following potential DoS vulnerabilities:
- The NVT, Rlogin, and RSH analyzers have received fixes to avoid
unbounded state growth. Due to the fact that these packets can
be received from remote hosts, these are considered DoS risks.
- A specially crafted WebSocket payload can cause the Spicy WebSocket
analyzer to use excessive memory when processing close, ping,
and pong frames. Due to the fact that these packets can be
received from remote hosts, these are considered a DoS risk.
- A specially crafted series of Finger packets can cause the Spicy
Finger analyzer to use excessive amounts of memory and potentially
crash Zeek. Due to the fact that these packets can be received
from remote hosts, this is considered a DoS risk.
- A specially crafted Kerberos packet can cause the Kerberos
analyzer to enter an invalid state and potentially crash Zeek.
Due to the fact that these packets can be received from remote
hosts, this is considered a DoS risk.
- A specially crafted series of RDP packets can cause the RDP
analyzer to use excessive amounts of memory and potentially crash
Zeek. Due to the fact that these packets can be received from
remote hosts, this is considered a DoS risk.
- A specially crafted IP packet can cause the IP analyzer to read
past the end of the contents of the packet when emitting the
packet_contents event and possibly crash. Due to the fact that
these packets can be received from remote hosts, this is considered
a DoS risk.
- A specially crafted IP packet can cause the packet discarding
code to read off the end of the packet when looking for follow-on
header data. This may potentially lead to a crash of Zeek. Due
to the fact that these packets can be received from remote hosts,
this is considered a DoS risk.
- A specially crafted series of Gnutella packets may cause Zeek
to continue accumulating memory and eventually crash. Due to the
fact that these packets can be received from remote hosts, this
is considered a DoS risk.
- A specially crafted ICMPv6 packet can cause the ICMP analyzer
to skip part of the packet and not report corresponding events
and logs. Due to the fact that these packets can be received
from remote hosts, this is considered an evasion risk.
- A specially crafted SSH packet can cause the SSH analyzer to
throw BinPAC exceptions for extremely large packets and skip
logging them otherwise. Due to the fact that these packets can
be received from remote hosts, this is considered an evasion
risk.
- A number of issues with the HTTP analyzer were found involving
unusual Content-Length, Transfer-Encoding and Expect header
usage. Due to the fact that these packets can be received from
remote hosts, this is considered an evasion risk.
- A series of fixes were applied to the serialization code in Zeek
to avoid buffer overreads with both Broker and ZeroMQ traffic.
On debug builds, these hit various abort() conditions and cause
Zeek to exit. Due to the fact that all of these states require
direct access to the Broker/ZeroMQ ports (meaning access to the
local network to some degree), this isn’t considered a DoS risk.
This release fixes the following bugs:
- Zeek now builds correctly with newer versions of LibreSSL.
- ZeekJS was updated to v0.23.0, which brings compatibility with
Node v26.
- Spicy was updated to v1.14.1.
- The TCP analyzer now clamps the window scale to 14 bytes, which
conforms with RFC7323.
- The Geneve analyzer now properly parses encapsulated IPv6 packets.
- A regression in the management framework's handling of metrics-port
collision avoidance was fixed.
- A number of out-of-bounds reads where fixed in the following
analyzers: BitTorrent, DCE-RPC, GSS-API, GTPv1, IRC, KRB, Login,
NetBIOS, NFLog, and SSL.
- A number of signed bit-shifting issues were fixed in the following
analyzers: ASN.1, DNS, DTLS, FTP, Geneve, IP, NetBIOS, Null,
RFB, SNAP, SMB, and VXLAN.
- The Ident analyzer fixed a potential signed overflow when parsing
port information.
- A bug was fixed in the pcapng packet source with handling empty
options blocks.
- A potential segfault was fixed with the global_ids BIF if it was
called during startup before all of the script-level type data
was fully parsed.
- The NTP analyzer gained some additional length checking when
parsing extension fields to avoid potential integer overflows.
- Certain protocol fields in the RDP parser are capped to maximum
values to prevent unbounded buffering.
- A few fixes were applied to the handling of HTTP Content-Range
values to avoid integer overflows.
- The GENEVE and VXLAN analyzers now use the correct packet object
when parsing the inner packet, avoiding a possible null pointer
dereference.
Reported by: Tim Wojtulewicz
---
security/zeek/Makefile | 3 +-
security/zeek/distinfo | 6 +-
...xil_spicy_hilti_runtime_include_configuration.h | 11 ---
...uxil_spicy_hilti_runtime_include_types_stream.h | 20 ------
...picy_hilti_toolchain_include_compiler_printer.h | 11 ---
...il_spicy_hilti_toolchain_src_ast_ast-context.cc | 11 ---
...il_spicy_hilti_toolchain_src_compiler_driver.cc | 20 ------
...xil_spicy_spicy_runtime_include_configuration.h | 11 ---
.../patch-auxil_spicy_spicy_runtime_src_sink.cc | 11 ---
...ude_compiler_detail_codegen_productions_while.h | 11 ---
...olchain_src_compiler_codegen_grammar-builder.cc | 11 ---
security/zeek/files/patch-src_OpaqueVal.cc | 12 ----
security/zeek/files/patch-src_digest.cc | 12 ----
.../patch-src_file__analysis_analyzer_x509_OCSP.cc | 84 ----------------------
.../patch-src_file__analysis_analyzer_x509_X509.cc | 12 ----
.../patch-src_file__analysis_analyzer_x509_X509.h | 20 ------
...-src_file__analysis_analyzer_x509_functions.bif | 38 ----------
security/zeek/pkg-plist | 6 ++
18 files changed, 10 insertions(+), 300 deletions(-)
diff --git a/security/zeek/Makefile b/security/zeek/Makefile
index 9c8b4784a852..177ca3225572 100644
--- a/security/zeek/Makefile
+++ b/security/zeek/Makefile
@@ -1,6 +1,5 @@
PORTNAME= zeek
-DISTVERSION= 8.0.8
-PORTREVISION= 1
+DISTVERSION= 8.0.9
CATEGORIES= security
MASTER_SITES= https://download.zeek.org/
diff --git a/security/zeek/distinfo b/security/zeek/distinfo
index 95e2615ed0e3..d2114f44a524 100644
--- a/security/zeek/distinfo
+++ b/security/zeek/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1778626523
-SHA256 (zeek-8.0.8.tar.gz) = 4fe714238cdecb72234c287e9e18178ff40a95fe195bd513471e4ef79ff42e7c
-SIZE (zeek-8.0.8.tar.gz) = 100080362
+TIMESTAMP = 1783377056
+SHA256 (zeek-8.0.9.tar.gz) = ad63d497bc626ffff6c882e572e33c4799464505c12711b79587b4d7ebcfcf99
+SIZE (zeek-8.0.9.tar.gz) = 100663310
diff --git a/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_configuration.h b/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_configuration.h
deleted file mode 100644
index 89b1d7cf051a..000000000000
--- a/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_configuration.h
+++ /dev/null
@@ -1,11 +0,0 @@
---- auxil/spicy/hilti/runtime/include/configuration.h.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/hilti/runtime/include/configuration.h
-@@ -76,7 +76,7 @@ inline const Configuration& unsafeGet() {
- * matters.
- */
- inline const Configuration& unsafeGet() {
-- assert(detail::__configuration);
-+ assert(detail::__configuration.get());
- return *detail::__configuration;
- }
-
diff --git a/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_types_stream.h b/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_types_stream.h
deleted file mode 100644
index 1aa2ea7c0a33..000000000000
--- a/security/zeek/files/patch-auxil_spicy_hilti_runtime_include_types_stream.h
+++ /dev/null
@@ -1,20 +0,0 @@
---- auxil/spicy/hilti/runtime/include/types/stream.h.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/hilti/runtime/include/types/stream.h
-@@ -691,7 +691,7 @@ class SafeConstIterator { (private)
-
- void _ensureValidChain() const {
- // This must have been checked at this point already.
-- assert(_chain);
-+ assert(_chain.get());
-
- if ( ! _chain->isValid() )
- throw InvalidIterator("stream object no longer available");
-@@ -1752,7 +1752,7 @@ class Stream { (public)
-
- /** Destructor. */
- ~Stream() {
-- assert(_chain);
-+ assert(_chain.get());
- _chain->invalidate();
- }
-
diff --git a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_include_compiler_printer.h b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_include_compiler_printer.h
deleted file mode 100644
index b66c0a9c7765..000000000000
--- a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_include_compiler_printer.h
+++ /dev/null
@@ -1,11 +0,0 @@
---- auxil/spicy/hilti/toolchain/include/compiler/printer.h.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/hilti/toolchain/include/compiler/printer.h
-@@ -59,7 +59,7 @@ class Stream { (public)
- Stream(std::ostream& s) : _stream(s) {}
-
- auto& state() const {
-- assert(detail::State::current);
-+ assert(detail::State::current.get());
- return *detail::State::current;
- }
-
diff --git a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_ast_ast-context.cc b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_ast_ast-context.cc
deleted file mode 100644
index be8f3ff70565..000000000000
--- a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_ast_ast-context.cc
+++ /dev/null
@@ -1,11 +0,0 @@
---- auxil/spicy/hilti/toolchain/src/ast/ast-context.cc.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/hilti/toolchain/src/ast/ast-context.cc
-@@ -328,7 +328,7 @@ void ASTContext::garbageCollect() {
- changed = false;
-
- for ( auto& n : _nodes ) {
-- assert(n);
-+ assert(n.get());
-
- if ( n->isRetained() ) {
- ++retained;
diff --git a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_compiler_driver.cc b/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_compiler_driver.cc
deleted file mode 100644
index 15ef25453916..000000000000
--- a/security/zeek/files/patch-auxil_spicy_hilti_toolchain_src_compiler_driver.cc
+++ /dev/null
@@ -1,20 +0,0 @@
---- auxil/spicy/hilti/toolchain/src/compiler/driver.cc.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/hilti/toolchain/src/compiler/driver.cc
-@@ -683,7 +683,7 @@ Result<Nothing> Driver::compileUnits() {
- }
-
- Result<Nothing> Driver::compileUnits() {
-- assert(_builder);
-+ assert(_builder.get());
-
- if ( auto rc = context()->astContext()->processAST(_builder.get(), this); ! rc ) {
- // hilti::detail::printer::print(std::cerr, context()->astContext()->root());
-@@ -723,7 +723,7 @@ Result<Nothing> Driver::run() {
- Result<Nothing> Driver::run() {
- assert(! _builder);
- initialize();
-- assert(_builder);
-+ assert(_builder.get());
-
- for ( const auto& i : _driver_options.inputs ) {
- if ( auto rc = addInput(i); ! rc )
diff --git a/security/zeek/files/patch-auxil_spicy_spicy_runtime_include_configuration.h b/security/zeek/files/patch-auxil_spicy_spicy_runtime_include_configuration.h
deleted file mode 100644
index 500d7bce576a..000000000000
--- a/security/zeek/files/patch-auxil_spicy_spicy_runtime_include_configuration.h
+++ /dev/null
@@ -1,11 +0,0 @@
---- auxil/spicy/spicy/runtime/include/configuration.h.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/spicy/runtime/include/configuration.h
-@@ -43,7 +43,7 @@ inline const Configuration& unsafeGet() {
- * matters.
- */
- inline const Configuration& unsafeGet() {
-- assert(rt::detail::globalState()->configuration);
-+ assert(rt::detail::globalState()->configuration.get());
- return *rt::detail::globalState()->configuration;
- }
-
diff --git a/security/zeek/files/patch-auxil_spicy_spicy_runtime_src_sink.cc b/security/zeek/files/patch-auxil_spicy_spicy_runtime_src_sink.cc
deleted file mode 100644
index b41dff63a260..000000000000
--- a/security/zeek/files/patch-auxil_spicy_spicy_runtime_src_sink.cc
+++ /dev/null
@@ -1,11 +0,0 @@
---- auxil/spicy/spicy/runtime/src/sink.cc.orig 2026-06-10 16:58:45 UTC
-+++ auxil/spicy/spicy/runtime/src/sink.cc
-@@ -431,7 +431,7 @@ void Sink::_close(bool orderly) {
- fmt("error in connected unit %s during close (%s)", s->parser->name, err.what()));
- }
-
-- assert(s->resumable); // must have conluded after freezing/aborting
-+ assert(static_cast<bool>(s->resumable)); // must have conluded after freezing/aborting
- }
- }
-
diff --git a/security/zeek/files/patch-auxil_spicy_spicy_toolchain_include_compiler_detail_codegen_productions_while.h b/security/zeek/files/patch-auxil_spicy_spicy_toolchain_include_compiler_detail_codegen_productions_while.h
deleted file mode 100644
index d6834009e69c..000000000000
--- a/security/zeek/files/patch-auxil_spicy_spicy_toolchain_include_compiler_detail_codegen_productions_while.h
+++ /dev/null
@@ -1,11 +0,0 @@
---- auxil/spicy/spicy/toolchain/include/compiler/detail/codegen/productions/while.h.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/spicy/toolchain/include/compiler/detail/codegen/productions/while.h
-@@ -55,7 +55,7 @@ class While : public Production { (public)
- * loop body. This method must be called only after `preprocessLookAhead()`.
- */
- const production::LookAhead* lookAheadProduction() const {
-- assert(_body_for_grammar); // set by preprocessLookAhead() return
-+ assert(_body_for_grammar.get()); // set by preprocessLookAhead() return
- return _body_for_grammar->as<production::LookAhead>();
- }
-
diff --git a/security/zeek/files/patch-auxil_spicy_spicy_toolchain_src_compiler_codegen_grammar-builder.cc b/security/zeek/files/patch-auxil_spicy_spicy_toolchain_src_compiler_codegen_grammar-builder.cc
deleted file mode 100644
index 8685ba0688c7..000000000000
--- a/security/zeek/files/patch-auxil_spicy_spicy_toolchain_src_compiler_codegen_grammar-builder.cc
+++ /dev/null
@@ -1,11 +0,0 @@
---- auxil/spicy/spicy/toolchain/src/compiler/codegen/grammar-builder.cc.orig 2026-05-12 18:14:47 UTC
-+++ auxil/spicy/spicy/toolchain/src/compiler/codegen/grammar-builder.cc
-@@ -354,7 +354,7 @@ hilti::Result<hilti::Nothing> GrammarBuilder::run(type
- Grammar g(id.str(), unit->location());
- auto pf = ProductionFactory(cg(), this, &g);
- auto root = pf.createProduction(unit);
-- assert(root);
-+ assert(root.get());
-
- if ( auto rc = g.setRoot(std::move(root)); ! rc )
- return rc.error();
diff --git a/security/zeek/files/patch-src_OpaqueVal.cc b/security/zeek/files/patch-src_OpaqueVal.cc
deleted file mode 100644
index 7ca84c8c482c..000000000000
--- a/security/zeek/files/patch-src_OpaqueVal.cc
+++ /dev/null
@@ -1,12 +0,0 @@
---- src/OpaqueVal.cc.orig 2026-05-12 18:14:44 UTC
-+++ src/OpaqueVal.cc
-@@ -27,7 +27,8 @@
- #include "zeek/probabilistic/BloomFilter.h"
- #include "zeek/probabilistic/CardinalityCounter.h"
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- inline void* EVP_MD_CTX_md_data(const EVP_MD_CTX* ctx) { return ctx->md_data; }
- #endif
-
diff --git a/security/zeek/files/patch-src_digest.cc b/security/zeek/files/patch-src_digest.cc
deleted file mode 100644
index f0d7aabeb29d..000000000000
--- a/security/zeek/files/patch-src_digest.cc
+++ /dev/null
@@ -1,12 +0,0 @@
---- src/digest.cc.orig 2026-05-12 18:14:44 UTC
-+++ src/digest.cc
-@@ -12,7 +12,8 @@
-
- #include "zeek/Reporter.h"
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- #define EVP_MD_CTX_new EVP_MD_CTX_create
- #define EVP_MD_CTX_free EVP_MD_CTX_destroy
- #endif
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_OCSP.cc b/security/zeek/files/patch-src_file__analysis_analyzer_x509_OCSP.cc
deleted file mode 100644
index 1614a4676cf6..000000000000
--- a/security/zeek/files/patch-src_file__analysis_analyzer_x509_OCSP.cc
+++ /dev/null
@@ -1,84 +0,0 @@
---- src/file_analysis/analyzer/x509/OCSP.cc.orig 2026-05-12 18:14:44 UTC
-+++ src/file_analysis/analyzer/x509/OCSP.cc
-@@ -26,7 +26,8 @@ static bool OCSP_RESPID_bio(OCSP_BASICRESP* basic_resp
- static constexpr size_t OCSP_STRING_BUF_SIZE = 2048;
-
- static bool OCSP_RESPID_bio(OCSP_BASICRESP* basic_resp, BIO* bio) {
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- ASN1_OCTET_STRING* key = nullptr;
- X509_NAME* name = nullptr;
-
-@@ -353,7 +354,8 @@ void OCSP::ParseRequest(OCSP_REQUEST* req) {
-
- uint64_t version = 0;
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- if ( req->tbsRequest->version )
- version = (uint64_t)ASN1_INTEGER_get(req->tbsRequest->version);
- #else
-@@ -425,7 +427,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
- if ( ! basic_resp )
- goto clean_up;
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- resp_data = basic_resp->tbsResponseData;
- if ( ! resp_data )
- goto clean_up;
-@@ -434,7 +437,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
- vl.emplace_back(GetFile()->ToVal());
- vl.emplace_back(std::move(status_val));
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- vl.emplace_back(val_mgr->Count((uint64_t)ASN1_INTEGER_get(resp_data->version)));
- #else
- vl.emplace_back(parse_basic_resp_data_version(basic_resp));
-@@ -451,8 +455,9 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
- vl.emplace_back(val_mgr->EmptyString());
- }
-
-- // producedAt
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+// producedAt
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- produced_at = resp_data->producedAt;
- #else
- produced_at = OCSP_resp_get0_produced_at(basic_resp);
-@@ -477,7 +482,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
- // cert id
- const OCSP_CERTID* cert_id = nullptr;
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- cert_id = single_resp->certId;
- #else
- cert_id = OCSP_SINGLERESP_get0_id(single_resp);
-@@ -550,7 +556,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
- }
- }
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- i2a_ASN1_OBJECT(bio, basic_resp->signatureAlgorithm->algorithm);
- len = BIO_read(bio, buf, sizeof(buf));
- vl.emplace_back(make_intrusive<StringVal>(len, buf));
-@@ -567,7 +574,8 @@ void OCSP::ParseResponse(OCSP_RESPONSE* resp) {
- certs_vector = new VectorVal(id::find_type<VectorType>("x509_opaque_vector"));
- vl.emplace_back(AdoptRef{}, certs_vector);
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- certs = basic_resp->certs;
- #else
- certs = OCSP_resp_get0_certs(basic_resp);
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.cc b/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.cc
deleted file mode 100644
index 60a12b4a5441..000000000000
--- a/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.cc
+++ /dev/null
@@ -1,12 +0,0 @@
---- src/file_analysis/analyzer/x509/X509.cc.orig 2026-05-12 18:14:44 UTC
-+++ src/file_analysis/analyzer/x509/X509.cc
-@@ -349,7 +349,8 @@ void X509::ParseSAN(X509_EXTENSION* ext) {
- }
-
- auto len = ASN1_STRING_length(gen->d.ia5);
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
- const char* name = (const char*)ASN1_STRING_data(gen->d.ia5);
- #else
- const char* name = (const char*)ASN1_STRING_get0_data(gen->d.ia5);
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.h b/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.h
deleted file mode 100644
index 31fd9a917cdf..000000000000
--- a/security/zeek/files/patch-src_file__analysis_analyzer_x509_X509.h
+++ /dev/null
@@ -1,20 +0,0 @@
---- src/file_analysis/analyzer/x509/X509.h.orig 2026-05-12 18:14:44 UTC
-+++ src/file_analysis/analyzer/x509/X509.h
-@@ -9,13 +9,15 @@
- #include "zeek/OpaqueVal.h"
- #include "zeek/file_analysis/analyzer/x509/X509Common.h"
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
-
- #define X509_get_signature_nid(x) OBJ_obj2nid((x)->sig_alg->algorithm)
-
- #endif
-
--#if ( OPENSSL_VERSION_NUMBER < 0x1010000fL ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x1010000fL ) || \
-+ (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x30900000L))
-
- #define X509_OBJECT_new() (X509_OBJECT*)malloc(sizeof(X509_OBJECT))
- #define X509_OBJECT_free(a) free(a)
diff --git a/security/zeek/files/patch-src_file__analysis_analyzer_x509_functions.bif b/security/zeek/files/patch-src_file__analysis_analyzer_x509_functions.bif
deleted file mode 100644
index aa673887b14b..000000000000
--- a/security/zeek/files/patch-src_file__analysis_analyzer_x509_functions.bif
+++ /dev/null
@@ -1,38 +0,0 @@
---- src/file_analysis/analyzer/x509/functions.bif.orig 2026-05-12 18:14:44 UTC
-+++ src/file_analysis/analyzer/x509/functions.bif
-@@ -65,7 +65,7 @@ X509* x509_get_ocsp_signer(const STACK_OF(X509)* certs
- const ASN1_OCTET_STRING* key = nullptr;
- const X509_NAME* name = nullptr;
-
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
- OCSP_RESPID* resp_id = basic_resp->tbsResponseData->responderId;
-
- if ( resp_id->type == V_OCSP_RESPID_NAME )
-@@ -359,7 +359,7 @@ function x509_ocsp_verify%(certs: x509_opaque_vector,
-
- // Because we actually want to be able to give nice error messages that show why we were
- // not able to verify the OCSP response - do our own verification logic first.
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
- signer = x509_get_ocsp_signer(basic->certs, basic);
- #else
- signer = x509_get_ocsp_signer(OCSP_resp_get0_certs(basic), basic);
-@@ -730,7 +730,7 @@ function sct_verify%(cert: opaque of x509, logid: stri
- uint32_t cert_length;
- if ( precert )
- {
--#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10002000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
- x->cert_info->enc.modified = 1;
- cert_length = i2d_X509_CINF(x->cert_info, &cert_out);
- #else
-@@ -1058,7 +1058,7 @@ function x509_check_cert_hostname%(cert_opaque: opaque
- continue;
-
- std::size_t len = ASN1_STRING_length(gen->d.ia5);
--#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
-+#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || ( defined(LIBRESSL_VERSION_NUMBER) && ( LIBRESSL_VERSION_NUMBER < 0x30900000L ) )
- auto* name = reinterpret_cast<const char*>(ASN1_STRING_data(gen->d.ia5));
- #else
- auto* name = reinterpret_cast<const char*>(ASN1_STRING_get0_data(gen->d.ia5));
diff --git a/security/zeek/pkg-plist b/security/zeek/pkg-plist
index 9b0d47318b2c..446c2fbbfaa7 100644
--- a/security/zeek/pkg-plist
+++ b/security/zeek/pkg-plist
@@ -686,6 +686,7 @@ include/zeek/analyzer/protocol/ftp/FTP.h
include/zeek/analyzer/protocol/ftp/events.bif.h
include/zeek/analyzer/protocol/ftp/functions.bif.h
include/zeek/analyzer/protocol/gnutella/Gnutella.h
+include/zeek/analyzer/protocol/gnutella/consts.bif.h
include/zeek/analyzer/protocol/gnutella/events.bif.h
include/zeek/analyzer/protocol/gssapi/GSSAPI.h
include/zeek/analyzer/protocol/gssapi/events.bif.h
@@ -804,6 +805,7 @@ include/zeek/analyzer/protocol/rpc/NFS.h
include/zeek/analyzer/protocol/rpc/Portmap.h
include/zeek/analyzer/protocol/rpc/RPC.h
include/zeek/analyzer/protocol/rpc/XDR.h
+include/zeek/analyzer/protocol/rpc/consts.bif.h
include/zeek/analyzer/protocol/rpc/events.bif.h
include/zeek/analyzer/protocol/sip/SIP.h
include/zeek/analyzer/protocol/sip/SIP_TCP.h
@@ -904,6 +906,7 @@ include/zeek/analyzer/protocol/socks/socks-analyzer.pac
include/zeek/analyzer/protocol/socks/socks-protocol.pac
include/zeek/analyzer/protocol/socks/socks.pac
include/zeek/analyzer/protocol/ssh/SSH.h
+include/zeek/analyzer/protocol/ssh/consts.bif.h
include/zeek/analyzer/protocol/ssh/consts.pac
include/zeek/analyzer/protocol/ssh/events.bif.h
include/zeek/analyzer/protocol/ssh/ssh-analyzer.pac
@@ -1519,6 +1522,7 @@ share/man/man8/zeek.8.gz
%%DATADIR%%/base/bif/plugins/Zeek_GTPv1.functions.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_Geneve.events.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_Geneve.functions.bif.zeek
+%%DATADIR%%/base/bif/plugins/Zeek_Gnutella.consts.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_Gnutella.events.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_HTTP.events.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_HTTP.functions.bif.zeek
@@ -1553,6 +1557,7 @@ share/man/man8/zeek.8.gz
%%DATADIR%%/base/bif/plugins/Zeek_RDP.events.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_RDP.types.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_RFB.events.bif.zeek
+%%DATADIR%%/base/bif/plugins/Zeek_RPC.consts.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_RPC.events.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_RawReader.raw.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_SIP.events.bif.zeek
@@ -1597,6 +1602,7 @@ share/man/man8/zeek.8.gz
%%DATADIR%%/base/bif/plugins/Zeek_SOCKS.events.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_SQLiteReader.sqlite.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_SQLiteWriter.sqlite.bif.zeek
+%%DATADIR%%/base/bif/plugins/Zeek_SSH.consts.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_SSH.events.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_SSH.types.bif.zeek
%%DATADIR%%/base/bif/plugins/Zeek_SSL.consts.bif.zeek