Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Move zeek::net namespace to zeek::run_state namespace.

Browse source 
This also moves all of the code from Net.{h,cc} to RunState.{h,cc} and marks Net.h as deprecated
This commit is contained in:
Tim Wojtulewicz 2020-08-19 17:41:24 -07:00
parent d608e7c9a5
commit 0ac3fafe13
64 changed files with 477 additions and 467 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/CMakeLists.txt
View file

@ -253,7 +253,6 @@ set(MAIN_SRCS
List.cc List.cc
Reporter.cc Reporter.cc
NFA.cc NFA.cc
Net.cc
NetVar.cc NetVar.cc
Notifier.cc Notifier.cc
Obj.cc Obj.cc
@ -271,6 +270,7 @@ set(MAIN_SRCS
RuleAction.cc RuleAction.cc
RuleCondition.cc RuleCondition.cc
RuleMatcher.cc RuleMatcher.cc
RunState.cc
ScannedFile.cc ScannedFile.cc
Scope.cc Scope.cc
ScriptCoverageManager.cc ScriptCoverageManager.cc

16
src/Conn.cc
View file

@ -7,7 +7,7 @@
#include <ctype.h> #include <ctype.h>
#include "Desc.h" #include "Desc.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "Event.h" #include "Event.h"
#include "Sessions.h" #include "Sessions.h"
@ -194,8 +194,8 @@ void Connection::NextPacket(double t, bool is_orig,
// arguments for reproducing packets // arguments for reproducing packets
const zeek::Packet *pkt) const zeek::Packet *pkt)
{ {
zeek::net::current_timestamp = t; zeek::run_state::current_timestamp = t;
zeek::net::current_pkt = pkt; zeek::run_state::current_pkt = pkt;
if ( Skipping() ) if ( Skipping() )
return; return;
@ -218,13 +218,13 @@ void Connection::NextPacket(double t, bool is_orig,
else else
last_time = t; last_time = t;
zeek::net::current_timestamp = 0; zeek::run_state::current_timestamp = 0;
zeek::net::current_pkt = nullptr; zeek::run_state::current_pkt = nullptr;
} }
void Connection::SetLifetime(double lifetime) void Connection::SetLifetime(double lifetime)
{ {
ADD_TIMER(&Connection::DeleteTimer, zeek::net::network_time + lifetime, 0, ADD_TIMER(&Connection::DeleteTimer, zeek::run_state::network_time + lifetime, 0,
zeek::detail::TIMER_CONN_DELETE); zeek::detail::TIMER_CONN_DELETE);
} }
@ -329,7 +329,7 @@ void Connection::EnableStatusUpdateTimer()
if ( connection_status_update && zeek::detail::connection_status_update_interval ) if ( connection_status_update && zeek::detail::connection_status_update_interval )
{ {
ADD_TIMER(&Connection::StatusUpdateTimer, ADD_TIMER(&Connection::StatusUpdateTimer,
zeek::net::network_time + zeek::detail::connection_status_update_interval, 0, zeek::run_state::network_time + zeek::detail::connection_status_update_interval, 0,
zeek::detail::TIMER_CONN_STATUS_UPDATE); zeek::detail::TIMER_CONN_STATUS_UPDATE);
installed_status_timer = 1; installed_status_timer = 1;
} }
@ -339,7 +339,7 @@ void Connection::StatusUpdateTimer(double t)
{ {
EnqueueEvent(connection_status_update, nullptr, ConnVal()); EnqueueEvent(connection_status_update, nullptr, ConnVal());
ADD_TIMER(&Connection::StatusUpdateTimer, ADD_TIMER(&Connection::StatusUpdateTimer,
zeek::net::network_time + zeek::detail::connection_status_update_interval, 0, zeek::run_state::network_time + zeek::detail::connection_status_update_interval, 0,
zeek::detail::TIMER_CONN_STATUS_UPDATE); zeek::detail::TIMER_CONN_STATUS_UPDATE);
} }

6
src/DNS_Mgr.cc
View file

@ -34,7 +34,7 @@
#include "ZeekString.h" #include "ZeekString.h"
#include "Expr.h" #include "Expr.h"
#include "Event.h" #include "Event.h"
#include "Net.h" #include "RunState.h"
#include "Val.h" #include "Val.h"
#include "NetVar.h" #include "NetVar.h"
#include "ID.h" #include "ID.h"
@ -1338,7 +1338,7 @@ double DNS_Mgr::GetNextTimeout()
if ( asyncs_timeouts.empty() ) if ( asyncs_timeouts.empty() )
return -1; return -1;
return zeek::net::network_time + DNS_TIMEOUT; return zeek::run_state::network_time + DNS_TIMEOUT;
} }
void DNS_Mgr::Process() void DNS_Mgr::Process()
@ -1350,7 +1350,7 @@ void DNS_Mgr::Process()
{ {
AsyncRequest* req = asyncs_timeouts.top(); AsyncRequest* req = asyncs_timeouts.top();
if ( req->time + DNS_TIMEOUT > zeek::util::current_time() && ! zeek::net::terminating ) if ( req->time + DNS_TIMEOUT > zeek::util::current_time() && ! zeek::run_state::terminating )
break; break;
if ( ! req->processed ) if ( ! req->processed )

2
src/Debug.cc
View file

@ -158,7 +158,7 @@ int TraceState::LogTrace(const char* fmt, ...)
va_start(args, fmt); va_start(args, fmt);
// Prefix includes timestamp and file/line info. // Prefix includes timestamp and file/line info.
fprintf(trace_file, "%.6f ", zeek::net::network_time); fprintf(trace_file, "%.6f ", zeek::run_state::network_time);
const zeek::detail::Stmt* stmt; const zeek::detail::Stmt* stmt;
zeek::detail::Location loc; zeek::detail::Location loc;

6
src/DebugLogger.cc
View file

@ -4,7 +4,7 @@
#include <unistd.h> #include <unistd.h>
#include "DebugLogger.h" #include "DebugLogger.h"
#include "Net.h" #include "RunState.h"
#include "plugin/Plugin.h" #include "plugin/Plugin.h"
zeek::detail::DebugLogger zeek::detail::debug_logger; zeek::detail::DebugLogger zeek::detail::debug_logger;
@ -159,7 +159,7 @@ void DebugLogger::Log(DebugStream stream, const char* fmt, ...)
return; return;
fprintf(file, "%17.06f/%17.06f [%s] ", fprintf(file, "%17.06f/%17.06f [%s] ",
zeek::net::network_time, zeek::util::current_time(true), g->prefix); zeek::run_state::network_time, zeek::util::current_time(true), g->prefix);
for ( int i = g->indent; i > 0; --i ) for ( int i = g->indent; i > 0; --i )
fputs(" ", file); fputs(" ", file);
@ -182,7 +182,7 @@ void DebugLogger::Log(const zeek::plugin::Plugin& plugin, const char* fmt, ...)
return; return;
fprintf(file, "%17.06f/%17.06f [plugin %s] ", fprintf(file, "%17.06f/%17.06f [plugin %s] ",
zeek::net::network_time, zeek::util::current_time(true), plugin.Name().c_str()); zeek::run_state::network_time, zeek::util::current_time(true), plugin.Name().c_str());
va_list ap; va_list ap;
va_start(ap, fmt); va_start(ap, fmt);

2
src/Discard.cc
View file

@ -7,7 +7,7 @@
#include <algorithm> #include <algorithm>
#include "ZeekString.h" #include "ZeekString.h"
#include "Net.h" #include "RunState.h"
#include "Func.h" #include "Func.h"
#include "Var.h" #include "Var.h"
#include "Val.h" #include "Val.h"

6
src/Event.cc
View file

@ -11,7 +11,7 @@
#include "plugin/Manager.h" #include "plugin/Manager.h"
#include "iosource/Manager.h" #include "iosource/Manager.h"
#include "iosource/PktSrc.h" #include "iosource/PktSrc.h"
#include "Net.h" #include "RunState.h"
zeek::EventMgr zeek::event_mgr; zeek::EventMgr zeek::event_mgr;
zeek::EventMgr& mgr = zeek::event_mgr; zeek::EventMgr& mgr = zeek::event_mgr;
@ -226,8 +226,8 @@ void EventMgr::Process()
// reading live (which includes pseudo-realtime), advance the time // reading live (which includes pseudo-realtime), advance the time
// here to the current time since otherwise it won't move forward. // here to the current time since otherwise it won't move forward.
zeek::iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc(); zeek::iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc();
if ( ! pkt_src || ! pkt_src->IsOpen() || zeek::net::reading_live ) if ( ! pkt_src || ! pkt_src->IsOpen() || zeek::run_state::reading_live )
zeek::net::detail::net_update_time(zeek::util::current_time()); zeek::run_state::detail::net_update_time(zeek::util::current_time());
queue_flare.Extinguish(); queue_flare.Extinguish();

6
src/Expr.cc
View file

@ -11,7 +11,7 @@
#include "Scope.h" #include "Scope.h"
#include "Stmt.h" #include "Stmt.h"
#include "EventRegistry.h" #include "EventRegistry.h"
#include "Net.h" #include "RunState.h"
#include "Traverse.h" #include "Traverse.h"
#include "Trigger.h" #include "Trigger.h"
#include "IPAddr.h" #include "IPAddr.h"
@ -3861,7 +3861,7 @@ bool ScheduleExpr::IsPure() const
ValPtr ScheduleExpr::Eval(Frame* f) const ValPtr ScheduleExpr::Eval(Frame* f) const
{ {
if ( zeek::net::terminating ) if ( zeek::run_state::terminating )
return nullptr; return nullptr;
auto when_val = when->Eval(f); auto when_val = when->Eval(f);
@ -3872,7 +3872,7 @@ ValPtr ScheduleExpr::Eval(Frame* f) const
double dt = when_val->InternalDouble(); double dt = when_val->InternalDouble();
if ( when->GetType()->Tag() == zeek::TYPE_INTERVAL ) if ( when->GetType()->Tag() == zeek::TYPE_INTERVAL )
dt += zeek::net::network_time; dt += zeek::run_state::network_time;
auto args = eval_list(f, event->Args()); auto args = eval_list(f, event->Args());

4
src/File.cc
View file

@ -25,7 +25,7 @@
#include "Type.h" #include "Type.h"
#include "Expr.h" #include "Expr.h"
#include "NetVar.h" #include "NetVar.h"
#include "Net.h" #include "RunState.h"
#include "Event.h" #include "Event.h"
#include "Reporter.h" #include "Reporter.h"
#include "Desc.h" #include "Desc.h"
@ -119,7 +119,7 @@ const char* File::Name() const
bool File::Open(FILE* file, const char* mode) bool File::Open(FILE* file, const char* mode)
{ {
static bool fds_maximized = false; static bool fds_maximized = false;
open_time = zeek::net::network_time ? zeek::net::network_time : zeek::util::current_time(); open_time = zeek::run_state::network_time ? zeek::run_state::network_time : zeek::util::current_time();
if ( ! fds_maximized ) if ( ! fds_maximized )
{ {

5
src/Frag.cc
View file

@ -8,6 +8,7 @@
#include "NetVar.h" #include "NetVar.h"
#include "Sessions.h" #include "Sessions.h"
#include "Reporter.h" #include "Reporter.h"
#include "RunState.h"
constexpr uint32_t MIN_ACCEPTABLE_FRAG_SIZE = 64; constexpr uint32_t MIN_ACCEPTABLE_FRAG_SIZE = 64;
constexpr uint32_t MAX_ACCEPTABLE_FRAG_SIZE = 64000; constexpr uint32_t MAX_ACCEPTABLE_FRAG_SIZE = 64000;
@ -154,7 +155,7 @@ void FragReassembler::AddFragment(double t, const zeek::IP_Hdr* ip, const u_char
pkt += hdr_len; pkt += hdr_len;
len -= hdr_len; len -= hdr_len;
NewBlock(zeek::net::network_time, offset, len, pkt); NewBlock(zeek::run_state::network_time, offset, len, pkt);
} }
void FragReassembler::Weird(const char* name) const void FragReassembler::Weird(const char* name) const
@ -278,7 +279,7 @@ void FragReassembler::BlockInserted(DataBlockMap::const_iterator /* it */)
{ {
zeek::reporter->InternalWarning("bad fragment reassembly"); zeek::reporter->InternalWarning("bad fragment reassembly");
DeleteTimer(); DeleteTimer();
Expire(zeek::net::network_time); Expire(zeek::run_state::network_time);
delete [] pkt_start; delete [] pkt_start;
return; return;
} }

2
src/Func.cc
View file

@ -39,7 +39,7 @@
#include "Expr.h" #include "Expr.h"
#include "Stmt.h" #include "Stmt.h"
#include "Scope.h" #include "Scope.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "File.h" #include "File.h"
#include "Frame.h" #include "Frame.h"

124
src/Net.h
View file

@ -1,124 +1,4 @@
// See the file "COPYING" in the main distribution directory for copyright. #warning "Net.h is deprecated and will be removed in v4.1. Use RunState.h and/or ScannedFile.h instead."
#pragma once
#include "zeek-config.h"
#include <sys/stat.h> // for ino_t
#include <list>
#include <vector>
#include <string>
#include <optional>
#include "RunState.h"
#include "ScannedFile.h" #include "ScannedFile.h"
ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
namespace zeek::net {
namespace detail {
extern void net_init(const std::optional<std::string>& interfaces,
const std::optional<std::string>& pcap_input_file,
const std::optional<std::string>& pcap_output_file,
bool do_watchdog);
extern void net_run();
extern void net_get_final_stats();
extern void net_finish(int drain_events);
extern void net_delete(); // Reclaim all memory, etc.
extern void net_update_time(double new_network_time);
extern void net_packet_dispatch(double t, const zeek::Packet* pkt,
zeek::iosource::PktSrc* src_ps);
extern void expire_timers(zeek::iosource::PktSrc* src_ps = nullptr);
extern void zeek_terminate_loop(const char* reason);
extern zeek::iosource::PktSrc* current_pktsrc;
extern zeek::iosource::IOSource* current_iosrc;
extern zeek::iosource::PktDumper* pkt_dumper; // where to save packets
// True if we have timers scheduled for the future on which we need
// to wait. "Need to wait" here means that we're running live (though
// perhaps not reading_live, but just running in real-time) as opposed
// to reading a trace (in which case we don't want to wait in real-time
// on future timers).
extern bool have_pending_timers;
} // namespace detail
// Functions to temporarily suspend processing of live input (network packets
// and remote events/state). Turning this is on is sure to lead to data loss!
extern void net_suspend_processing();
extern void net_continue_processing();
bool net_is_processing_suspended();
// Whether we're reading live traffic.
extern bool reading_live;
// Same but for reading from traces instead. We have two separate
// variables because it's possible that neither is true, and we're
// instead just running timers (per the variable after this one).
extern bool reading_traces;
// If > 0, we are reading from traces but trying to mimic real-time behavior.
// (In this case, both reading_traces and reading_live are true.) The value
// is the speedup (1 = real-time, 0.5 = half real-time, etc.).
extern double pseudo_realtime;
// When we started processing the current packet and corresponding event
// queue.
extern double processing_start_time;
// When the Bro process was started.
extern double zeek_start_time;
// Time at which the Bro process was started with respect to network time,
// i.e. the timestamp of the first packet.
extern double zeek_start_network_time;
// Time according to last packet timestamp (or current time)
extern double network_time;
// True if we're a in the process of cleaning-up just before termination.
extern bool terminating;
// True if Bro is currently parsing scripts.
extern bool is_parsing;
extern const zeek::Packet* current_pkt;
extern int current_dispatched;
extern double current_timestamp;
} // namespace zeek::net
constexpr auto net_init [[deprecated("Remove in v4.1. Use zeek::net::detail::net_init.")]] = zeek::net::detail::net_init;
constexpr auto net_run [[deprecated("Remove in v4.1. Use zeek::net::detail::net_run.")]] = zeek::net::detail::net_run;
constexpr auto net_get_final_stats [[deprecated("Remove in v4.1. Use zeek::net::detail::net_get_final_stats.")]] = zeek::net::detail::net_get_final_stats;
constexpr auto net_finish [[deprecated("Remove in v4.1. Use zeek::net::detail::net_finish.")]] = zeek::net::detail::net_finish;
constexpr auto net_delete [[deprecated("Remove in v4.1. Use zeek::net::detail::net_delete.")]] = zeek::net::detail::net_delete;
constexpr auto net_update_time [[deprecated("Remove in v4.1. Use zeek::net::detail::net_update_time.")]] = zeek::net::detail::net_update_time;
constexpr auto net_packet_dispatch [[deprecated("Remove in v4.1. Use zeek::net::detail::net_packet_dispatch.")]] = zeek::net::detail::net_packet_dispatch;
constexpr auto expire_timers [[deprecated("Remove in v4.1. Use zeek::net::detail::expire_timers.")]] = zeek::net::detail::expire_timers;
constexpr auto zeek_terminate_loop [[deprecated("Remove in v4.1. Use zeek::net::detail::zeek_terminate_loop.")]] = zeek::net::detail::zeek_terminate_loop;
extern zeek::iosource::PktSrc*& current_pktsrc [[deprecated("Remove in v4.1. Use zeek::net::detail::current_pktsrc.")]];
extern zeek::iosource::IOSource*& current_iosrc [[deprecated("Remove in v4.1. Use zeek::net::detail::current_iosrc.")]];
extern zeek::iosource::PktDumper*& pkt_dumper [[deprecated("Remove in v4.1. Use zeek::net::detail::pkt_dumper.")]];
extern bool& have_pending_timers [[deprecated("Remove in v4.1. Use zeek::net::detail::have_pending_timers.")]];
constexpr auto net_suspend_processing [[deprecated("Remove in v4.1. Use zeek::net::net_suspend_processing.")]] = zeek::net::net_suspend_processing;
constexpr auto net_continue_processing [[deprecated("Remove in v4.1. Use zeek::net::net_continue_processing.")]] = zeek::net::net_continue_processing;
constexpr auto net_is_processing_suspended [[deprecated("Remove in v4.1. Use zeek::net::net_is_processing_suspended.")]] = zeek::net::net_is_processing_suspended;
extern bool& reading_live [[deprecated("Remove in v4.1. Use zeek::net::reading_live.")]];
extern bool& reading_traces [[deprecated("Remove in v4.1. Use zeek::net::reading_traces.")]];
extern double& pseudo_realtime [[deprecated("Remove in v4.1. Use zeek::net::pseudo_realtime.")]];
extern double& processing_start_time [[deprecated("Remove in v4.1. Use zeek::net::processing_start_time.")]];
extern double& bro_start_time [[deprecated("Remove in v4.1. Use zeek::net::zeek_start_time.")]];
extern double& bro_start_network_time [[deprecated("Remove in v4.1. Use zeek::net::zeek_start_network_time.")]];
extern bool& terminating [[deprecated("Remove in v4.1. Use zeek::net::terminating.")]];
extern bool& is_parsing [[deprecated("Remove in v4.1. Use zeek::net::is_parsing.")]];
extern const zeek::Packet*& current_pkt [[deprecated("Remove in v4.1. Use zeek::net::current_pkt.")]];
extern int& current_dispatched [[deprecated("Remove in v4.1. Use zeek::net::current_dispatched.")]];
extern double& current_timestamp [[deprecated("Remove in v4.1. Use zeek::net::current_timestamp.")]];

16
src/Reporter.cc
View file

@ -12,7 +12,7 @@
#include "Event.h" #include "Event.h"
#include "Expr.h" #include "Expr.h"
#include "NetVar.h" #include "NetVar.h"
#include "Net.h" #include "RunState.h"
#include "Conn.h" #include "Conn.h"
#include "Timer.h" #include "Timer.h"
#include "ID.h" #include "ID.h"
@ -226,7 +226,7 @@ void Reporter::InternalWarning(const char* fmt, ...)
void Reporter::Syslog(const char* fmt, ...) void Reporter::Syslog(const char* fmt, ...)
{ {
if ( zeek::net::reading_traces ) if ( zeek::run_state::reading_traces )
return; return;
va_list ap; va_list ap;
@ -313,7 +313,7 @@ bool Reporter::PermitNetWeird(const char* name)
++count; ++count;
if ( count == 1 ) if ( count == 1 )
zeek::detail::timer_mgr->Add(new NetWeirdTimer(zeek::net::network_time, name, zeek::detail::timer_mgr->Add(new NetWeirdTimer(zeek::run_state::network_time, name,
weird_sampling_duration)); weird_sampling_duration));
if ( count <= weird_sampling_threshold ) if ( count <= weird_sampling_threshold )
@ -333,7 +333,7 @@ bool Reporter::PermitFlowWeird(const char* name,
auto& map = flow_weird_state[endpoints]; auto& map = flow_weird_state[endpoints];
if ( map.empty() ) if ( map.empty() )
zeek::detail::timer_mgr->Add(new FlowWeirdTimer(zeek::net::network_time, endpoints, zeek::detail::timer_mgr->Add(new FlowWeirdTimer(zeek::run_state::network_time, endpoints,
weird_sampling_duration)); weird_sampling_duration));
auto& count = map[name]; auto& count = map[name];
@ -360,7 +360,7 @@ bool Reporter::PermitExpiredConnWeird(const char* name, const zeek::RecordVal& c
auto& map = expired_conn_weird_state[conn_tuple]; auto& map = expired_conn_weird_state[conn_tuple];
if ( map.empty() ) if ( map.empty() )
zeek::detail::timer_mgr->Add(new ConnTupleWeirdTimer(zeek::net::network_time, zeek::detail::timer_mgr->Add(new ConnTupleWeirdTimer(zeek::run_state::network_time,
std::move(conn_tuple), std::move(conn_tuple),
weird_sampling_duration)); weird_sampling_duration));
@ -563,7 +563,7 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
if ( time ) if ( time )
vl.emplace_back(zeek::make_intrusive<zeek::TimeVal>( vl.emplace_back(zeek::make_intrusive<zeek::TimeVal>(
zeek::net::network_time ? zeek::net::network_time : zeek::util::current_time())); zeek::run_state::network_time ? zeek::run_state::network_time : zeek::util::current_time()));
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(buffer)); vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(buffer));
@ -595,10 +595,10 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
{ {
std::string s = ""; std::string s = "";
if ( zeek::net::zeek_start_network_time != 0.0 ) if ( zeek::run_state::zeek_start_network_time != 0.0 )
{ {
char tmp[32]; char tmp[32];
snprintf(tmp, 32, "%.6f", zeek::net::network_time); snprintf(tmp, 32, "%.6f", zeek::run_state::network_time);
s += std::string(tmp) + " "; s += std::string(tmp) + " ";
} }

8
src/RuleMatcher.cc
View file

@ -22,6 +22,7 @@
#include "module_util.h" #include "module_util.h"
#include "Var.h" #include "Var.h"
#include "IPAddr.h" #include "IPAddr.h"
#include "RunState.h"
using namespace std; using namespace std;
@ -1236,9 +1237,9 @@ void RuleMatcher::DumpStats(zeek::File* f)
f->Write(zeek::util::fmt("%.6f computed dfa states = %d; classes = ??; " f->Write(zeek::util::fmt("%.6f computed dfa states = %d; classes = ??; "
"computed trans. = %d; matchers = %d; mem = %d\n", "computed trans. = %d; matchers = %d; mem = %d\n",
zeek::net::network_time, stats.dfa_states, stats.computed, zeek::run_state::network_time, stats.dfa_states, stats.computed,
stats.matchers, stats.mem)); stats.matchers, stats.mem));
f->Write(zeek::util::fmt("%.6f DFA cache hits = %d; misses = %d\n", zeek::net::network_time, f->Write(zeek::util::fmt("%.6f DFA cache hits = %d; misses = %d\n", zeek::run_state::network_time,
stats.hits, stats.misses)); stats.hits, stats.misses));
DumpStateStats(f, root); DumpStateStats(f, root);
@ -1256,7 +1257,8 @@ void RuleMatcher::DumpStateStats(zeek::File* f, RuleHdrTest* hdr_test)
RuleHdrTest::PatternSet* set = hdr_test->psets[i][j]; RuleHdrTest::PatternSet* set = hdr_test->psets[i][j];
assert(set->re); assert(set->re);
f->Write(zeek::util::fmt("%.6f %d DFA states in %s group %d from sigs ", zeek::net::network_time, f->Write(zeek::util::fmt("%.6f %d DFA states in %s group %d from sigs ",
zeek::run_state::network_time,
set->re->DFA()->NumStates(), set->re->DFA()->NumStates(),
Rule::TypeToString((Rule::PatternType)i), j)); Rule::TypeToString((Rule::PatternType)i), j));

36
src/Net.cc → src/RunState.cc
View file

@ -1,7 +1,7 @@
// See the file "COPYING" in the main distribution directory for copyright. // See the file "COPYING" in the main distribution directory for copyright.
#include "zeek-config.h" #include "zeek-config.h"
#include "Net.h" #include "RunState.h"
#include <sys/types.h> #include <sys/types.h>
#ifdef TIME_WITH_SYS_TIME #ifdef TIME_WITH_SYS_TIME
@ -45,7 +45,7 @@ extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
static double last_watchdog_proc_time = 0.0; // value of above during last watchdog static double last_watchdog_proc_time = 0.0; // value of above during last watchdog
extern int signal_val; extern int signal_val;
namespace zeek::net { namespace zeek::run_state {
namespace detail { namespace detail {
zeek::iosource::PktDumper* pkt_dumper = nullptr; zeek::iosource::PktDumper* pkt_dumper = nullptr;
@ -438,23 +438,23 @@ void net_continue_processing()
bool net_is_processing_suspended() { return _processing_suspended; } bool net_is_processing_suspended() { return _processing_suspended; }
} // namespace zeek::net } // namespace zeek::run_state
// Remove all of these in v4.1. // Remove all of these in v4.1.
zeek::iosource::PktSrc*& current_pktsrc = zeek::net::detail::current_pktsrc; zeek::iosource::PktSrc*& current_pktsrc = zeek::run_state::detail::current_pktsrc;
zeek::iosource::IOSource*& current_iosrc = zeek::net::detail::current_iosrc; zeek::iosource::IOSource*& current_iosrc = zeek::run_state::detail::current_iosrc;
zeek::iosource::PktDumper*& pkt_dumper = zeek::net::detail::pkt_dumper; zeek::iosource::PktDumper*& pkt_dumper = zeek::run_state::detail::pkt_dumper;
bool& have_pending_timers = zeek::net::detail::have_pending_timers; bool& have_pending_timers = zeek::run_state::detail::have_pending_timers;
bool& reading_live = zeek::net::reading_live; bool& reading_live = zeek::run_state::reading_live;
bool& reading_traces = zeek::net::reading_traces; bool& reading_traces = zeek::run_state::reading_traces;
double& pseudo_realtime = zeek::net::pseudo_realtime; double& pseudo_realtime = zeek::run_state::pseudo_realtime;
double& processing_start_time = zeek::net::processing_start_time; double& processing_start_time = zeek::run_state::processing_start_time;
double& bro_start_time = zeek::net::zeek_start_time; double& bro_start_time = zeek::run_state::zeek_start_time;
double& bro_start_network_time = zeek::net::zeek_start_network_time; double& bro_start_network_time = zeek::run_state::zeek_start_network_time;
bool& terminating = zeek::net::terminating; bool& terminating = zeek::run_state::terminating;
bool& is_parsing = zeek::net::is_parsing; bool& is_parsing = zeek::run_state::is_parsing;
const zeek::Packet*& current_pkt = zeek::net::current_pkt; const zeek::Packet*& current_pkt = zeek::run_state::current_pkt;
int& current_dispatched = zeek::net::current_dispatched; int& current_dispatched = zeek::run_state::current_dispatched;
double& current_timestamp = zeek::net::current_timestamp; double& current_timestamp = zeek::run_state::current_timestamp;

118
src/RunState.h Normal file
View file

@ -0,0 +1,118 @@
// See the file "COPYING" in the main distribution directory for copyright.
#pragma once
#include "zeek-config.h"
#include <string>
#include <optional>
ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
namespace zeek::run_state {
namespace detail {
extern void net_init(const std::optional<std::string>& interfaces,
const std::optional<std::string>& pcap_input_file,
const std::optional<std::string>& pcap_output_file,
bool do_watchdog);
extern void net_run();
extern void net_get_final_stats();
extern void net_finish(int drain_events);
extern void net_delete(); // Reclaim all memory, etc.
extern void net_update_time(double new_network_time);
extern void net_packet_dispatch(double t, const zeek::Packet* pkt,
zeek::iosource::PktSrc* src_ps);
extern void expire_timers(zeek::iosource::PktSrc* src_ps = nullptr);
extern void zeek_terminate_loop(const char* reason);
extern zeek::iosource::PktSrc* current_pktsrc;
extern zeek::iosource::IOSource* current_iosrc;
extern zeek::iosource::PktDumper* pkt_dumper; // where to save packets
// True if we have timers scheduled for the future on which we need
// to wait. "Need to wait" here means that we're running live (though
// perhaps not reading_live, but just running in real-time) as opposed
// to reading a trace (in which case we don't want to wait in real-time
// on future timers).
extern bool have_pending_timers;
} // namespace detail
// Functions to temporarily suspend processing of live input (network packets
// and remote events/state). Turning this is on is sure to lead to data loss!
extern void net_suspend_processing();
extern void net_continue_processing();
bool net_is_processing_suspended();
// Whether we're reading live traffic.
extern bool reading_live;
// Same but for reading from traces instead. We have two separate
// variables because it's possible that neither is true, and we're
// instead just running timers (per the variable after this one).
extern bool reading_traces;
// If > 0, we are reading from traces but trying to mimic real-time behavior.
// (In this case, both reading_traces and reading_live are true.) The value
// is the speedup (1 = real-time, 0.5 = half real-time, etc.).
extern double pseudo_realtime;
// When we started processing the current packet and corresponding event
// queue.
extern double processing_start_time;
// When the Bro process was started.
extern double zeek_start_time;
// Time at which the Bro process was started with respect to network time,
// i.e. the timestamp of the first packet.
extern double zeek_start_network_time;
// Time according to last packet timestamp (or current time)
extern double network_time;
// True if we're a in the process of cleaning-up just before termination.
extern bool terminating;
// True if Bro is currently parsing scripts.
extern bool is_parsing;
extern const zeek::Packet* current_pkt;
extern int current_dispatched;
extern double current_timestamp;
} // namespace zeek::run_state
constexpr auto net_init [[deprecated("Remove in v4.1. Use zeek::run_state::detail::net_init.")]] = zeek::run_state::detail::net_init;
constexpr auto net_run [[deprecated("Remove in v4.1. Use zeek::run_state::detail::net_run.")]] = zeek::run_state::detail::net_run;
constexpr auto net_get_final_stats [[deprecated("Remove in v4.1. Use zeek::run_state::detail::net_get_final_stats.")]] = zeek::run_state::detail::net_get_final_stats;
constexpr auto net_finish [[deprecated("Remove in v4.1. Use zeek::run_state::detail::net_finish.")]] = zeek::run_state::detail::net_finish;
constexpr auto net_delete [[deprecated("Remove in v4.1. Use zeek::run_state::detail::net_delete.")]] = zeek::run_state::detail::net_delete;
constexpr auto net_update_time [[deprecated("Remove in v4.1. Use zeek::run_state::detail::net_update_time.")]] = zeek::run_state::detail::net_update_time;
constexpr auto net_packet_dispatch [[deprecated("Remove in v4.1. Use zeek::run_state::detail::net_packet_dispatch.")]] = zeek::run_state::detail::net_packet_dispatch;
constexpr auto expire_timers [[deprecated("Remove in v4.1. Use zeek::run_state::detail::expire_timers.")]] = zeek::run_state::detail::expire_timers;
constexpr auto zeek_terminate_loop [[deprecated("Remove in v4.1. Use zeek::run_state::detail::zeek_terminate_loop.")]] = zeek::run_state::detail::zeek_terminate_loop;
extern zeek::iosource::PktSrc*& current_pktsrc [[deprecated("Remove in v4.1. Use zeek::run_state::detail::current_pktsrc.")]];
extern zeek::iosource::IOSource*& current_iosrc [[deprecated("Remove in v4.1. Use zeek::run_state::detail::current_iosrc.")]];
extern zeek::iosource::PktDumper*& pkt_dumper [[deprecated("Remove in v4.1. Use zeek::run_state::detail::pkt_dumper.")]];
extern bool& have_pending_timers [[deprecated("Remove in v4.1. Use zeek::run_state::detail::have_pending_timers.")]];
constexpr auto net_suspend_processing [[deprecated("Remove in v4.1. Use zeek::run_state::net_suspend_processing.")]] = zeek::run_state::net_suspend_processing;
constexpr auto net_continue_processing [[deprecated("Remove in v4.1. Use zeek::run_state::net_continue_processing.")]] = zeek::run_state::net_continue_processing;
constexpr auto net_is_processing_suspended [[deprecated("Remove in v4.1. Use zeek::run_state::net_is_processing_suspended.")]] = zeek::run_state::net_is_processing_suspended;
extern bool& reading_live [[deprecated("Remove in v4.1. Use zeek::run_state::reading_live.")]];
extern bool& reading_traces [[deprecated("Remove in v4.1. Use zeek::run_state::reading_traces.")]];
extern double& pseudo_realtime [[deprecated("Remove in v4.1. Use zeek::run_state::pseudo_realtime.")]];
extern double& processing_start_time [[deprecated("Remove in v4.1. Use zeek::run_state::processing_start_time.")]];
extern double& bro_start_time [[deprecated("Remove in v4.1. Use zeek::run_state::zeek_start_time.")]];
extern double& bro_start_network_time [[deprecated("Remove in v4.1. Use zeek::run_state::zeek_start_network_time.")]];
extern bool& terminating [[deprecated("Remove in v4.1. Use zeek::run_state::terminating.")]];
extern bool& is_parsing [[deprecated("Remove in v4.1. Use zeek::run_state::is_parsing.")]];
extern const zeek::Packet*& current_pkt [[deprecated("Remove in v4.1. Use zeek::run_state::current_pkt.")]];
extern int& current_dispatched [[deprecated("Remove in v4.1. Use zeek::run_state::current_dispatched.")]];
extern double& current_timestamp [[deprecated("Remove in v4.1. Use zeek::run_state::current_timestamp.")]];

1
src/ScannedFile.h
View file

@ -31,7 +31,6 @@ public:
std::string canonical_path; // normalized, absolute path via realpath() std::string canonical_path; // normalized, absolute path via realpath()
static auto constexpr canonical_stdin_path = "<stdin>"; static auto constexpr canonical_stdin_path = "<stdin>";
}; };
extern std::list<ScannedFile> files_scanned; extern std::list<ScannedFile> files_scanned;

26
src/Sessions.cc
View file

@ -11,7 +11,7 @@
#include <unistd.h> #include <unistd.h>
#include "Desc.h" #include "Desc.h"
#include "Net.h" #include "RunState.h"
#include "Event.h" #include "Event.h"
#include "Timer.h" #include "Timer.h"
#include "NetVar.h" #include "NetVar.h"
@ -633,11 +633,11 @@ void NetSessions::DoNextPacket(double t, const zeek::Packet* pkt, const zeek::IP
{ {
EncapsulatingConn ec(ip_hdr->SrcAddr(), ip_hdr->DstAddr(), EncapsulatingConn ec(ip_hdr->SrcAddr(), ip_hdr->DstAddr(),
tunnel_type); tunnel_type);
ip_tunnels[tunnel_idx] = TunnelActivity(ec, zeek::net::network_time); ip_tunnels[tunnel_idx] = TunnelActivity(ec, zeek::run_state::network_time);
zeek::detail::timer_mgr->Add(new detail::IPTunnelTimer(zeek::net::network_time, tunnel_idx)); zeek::detail::timer_mgr->Add(new detail::IPTunnelTimer(zeek::run_state::network_time, tunnel_idx));
} }
else else
it->second.second = zeek::net::network_time; it->second.second = zeek::run_state::network_time;
if ( gre_version == 0 ) if ( gre_version == 0 )
DoNextInnerPacket(t, pkt, caplen, len, data, gre_link_type, DoNextInnerPacket(t, pkt, caplen, len, data, gre_link_type,
@ -759,9 +759,9 @@ void NetSessions::DoNextInnerPacket(double t, const zeek::Packet* pkt,
ts = pkt->ts; ts = pkt->ts;
else else
{ {
ts.tv_sec = (time_t) zeek::net::network_time; ts.tv_sec = (time_t) zeek::run_state::network_time;
ts.tv_usec = (suseconds_t) ts.tv_usec = (suseconds_t)
((zeek::net::network_time - (double)ts.tv_sec) * 1000000); ((zeek::run_state::network_time - (double)ts.tv_sec) * 1000000);
} }
const u_char* data = nullptr; const u_char* data = nullptr;
@ -797,9 +797,9 @@ void NetSessions::DoNextInnerPacket(double t, const zeek::Packet* pkt,
ts = pkt->ts; ts = pkt->ts;
else else
{ {
ts.tv_sec = (time_t) zeek::net::network_time; ts.tv_sec = (time_t) zeek::run_state::network_time;
ts.tv_usec = (suseconds_t) ts.tv_usec = (suseconds_t)
((zeek::net::network_time - (double)ts.tv_sec) * 1000000); ((zeek::run_state::network_time - (double)ts.tv_sec) * 1000000);
} }
EncapsulationStack* outer = prev ? EncapsulationStack* outer = prev ?
@ -1311,7 +1311,7 @@ bool NetSessions::WantConnection(uint16_t src_port, uint16_t dst_port,
void NetSessions::DumpPacket(const zeek::Packet *pkt, int len) void NetSessions::DumpPacket(const zeek::Packet *pkt, int len)
{ {
if ( ! zeek::net::detail::pkt_dumper ) if ( ! zeek::run_state::detail::pkt_dumper )
return; return;
if ( len != 0 ) if ( len != 0 )
@ -1322,7 +1322,7 @@ void NetSessions::DumpPacket(const zeek::Packet *pkt, int len)
const_cast<zeek::Packet *>(pkt)->cap_len = len; const_cast<zeek::Packet *>(pkt)->cap_len = len;
} }
zeek::net::detail::pkt_dumper->Dump(pkt); zeek::run_state::detail::pkt_dumper->Dump(pkt);
} }
void NetSessions::Weird(const char* name, const zeek::Packet* pkt, void NetSessions::Weird(const char* name, const zeek::Packet* pkt,
@ -1351,7 +1351,7 @@ unsigned int NetSessions::ConnectionMemoryUsage()
{ {
unsigned int mem = 0; unsigned int mem = 0;
if ( zeek::net::terminating ) if ( zeek::run_state::terminating )
// Connections have been flushed already. // Connections have been flushed already.
return 0; return 0;
@ -1371,7 +1371,7 @@ unsigned int NetSessions::ConnectionMemoryUsageConnVals()
{ {
unsigned int mem = 0; unsigned int mem = 0;
if ( zeek::net::terminating ) if ( zeek::run_state::terminating )
// Connections have been flushed already. // Connections have been flushed already.
return 0; return 0;
@ -1389,7 +1389,7 @@ unsigned int NetSessions::ConnectionMemoryUsageConnVals()
unsigned int NetSessions::MemoryAllocation() unsigned int NetSessions::MemoryAllocation()
{ {
if ( zeek::net::terminating ) if ( zeek::run_state::terminating )
// Connections have been flushed already. // Connections have been flushed already.
return 0; return 0;

60
src/Stats.cc
View file

@ -3,7 +3,7 @@
#include "Conn.h" #include "Conn.h"
#include "File.h" #include "File.h"
#include "Event.h" #include "Event.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "ID.h" #include "ID.h"
#include "Sessions.h" #include "Sessions.h"
@ -51,7 +51,7 @@ void ProfileTimer::Dispatch(double t, bool is_expire)
// Reinstall timer. // Reinstall timer.
if ( ! is_expire ) if ( ! is_expire )
zeek::detail::timer_mgr->Add(new ProfileTimer(zeek::net::network_time + interval, zeek::detail::timer_mgr->Add(new ProfileTimer(zeek::run_state::network_time + interval,
logger, interval)); logger, interval));
} }
@ -71,11 +71,11 @@ ProfileLogger::~ProfileLogger()
void ProfileLogger::Log() void ProfileLogger::Log()
{ {
if ( zeek::net::terminating ) if ( zeek::run_state::terminating )
// Connections have been flushed already. // Connections have been flushed already.
return; return;
file->Write(zeek::util::fmt("%.06f ------------------------\n", zeek::net::network_time)); file->Write(zeek::util::fmt("%.06f ------------------------\n", zeek::run_state::network_time));
// Do expensive profiling only occasionally. // Do expensive profiling only occasionally.
bool expensive = false; bool expensive = false;
@ -108,27 +108,27 @@ void ProfileLogger::Log()
first_utime = utime; first_utime = utime;
first_stime = stime; first_stime = stime;
file->Write(zeek::util::fmt("%.06f Command line: ", zeek::net::network_time )); file->Write(zeek::util::fmt("%.06f Command line: ", zeek::run_state::network_time ));
for ( int i = 0; i < zeek_argc; i++ ) for ( int i = 0; i < zeek_argc; i++ )
{ {
file->Write(zeek_argv[i]); file->Write(zeek_argv[i]);
file->Write(" "); file->Write(" ");
} }
file->Write(zeek::util::fmt("\n%.06f ------------------------\n", zeek::net::network_time)); file->Write(zeek::util::fmt("\n%.06f ------------------------\n", zeek::run_state::network_time));
} }
file->Write(zeek::util::fmt("%.06f Memory: total=%" PRId64 "K total_adj=%" PRId64 "K malloced: %" PRId64 "K\n", file->Write(zeek::util::fmt("%.06f Memory: total=%" PRId64 "K total_adj=%" PRId64 "K malloced: %" PRId64 "K\n",
zeek::net::network_time, total / 1024, (total - first_total) / 1024, zeek::run_state::network_time, total / 1024, (total - first_total) / 1024,
malloced / 1024)); malloced / 1024));
file->Write(zeek::util::fmt("%.06f Run-time: user+sys=%.1f user=%.1f sys=%.1f real=%.1f\n", file->Write(zeek::util::fmt("%.06f Run-time: user+sys=%.1f user=%.1f sys=%.1f real=%.1f\n",
zeek::net::network_time, (utime + stime) - (first_utime + first_stime), zeek::run_state::network_time, (utime + stime) - (first_utime + first_stime),
utime - first_utime, stime - first_stime, rtime - first_rtime)); utime - first_utime, stime - first_stime, rtime - first_rtime));
int conn_mem_use = expensive ? sessions->ConnectionMemoryUsage() : 0; int conn_mem_use = expensive ? sessions->ConnectionMemoryUsage() : 0;
file->Write(zeek::util::fmt("%.06f Conns: total=%" PRIu64 " current=%" PRIu64 "/%" PRIi32 " mem=%" PRIi32 "K avg=%.1f table=%" PRIu32 "K connvals=%" PRIu32 "K\n", file->Write(zeek::util::fmt("%.06f Conns: total=%" PRIu64 " current=%" PRIu64 "/%" PRIi32 " mem=%" PRIi32 "K avg=%.1f table=%" PRIu32 "K connvals=%" PRIu32 "K\n",
zeek::net::network_time, zeek::run_state::network_time,
Connection::TotalConnections(), Connection::TotalConnections(),
Connection::CurrentConnections(), Connection::CurrentConnections(),
sessions->CurrentConnections(), sessions->CurrentConnections(),
@ -142,19 +142,19 @@ void ProfileLogger::Log()
sessions->GetStats(s); sessions->GetStats(s);
file->Write(zeek::util::fmt("%.06f Conns: tcp=%zu/%zu udp=%zu/%zu icmp=%zu/%zu\n", file->Write(zeek::util::fmt("%.06f Conns: tcp=%zu/%zu udp=%zu/%zu icmp=%zu/%zu\n",
zeek::net::network_time, zeek::run_state::network_time,
s.num_TCP_conns, s.max_TCP_conns, s.num_TCP_conns, s.max_TCP_conns,
s.num_UDP_conns, s.max_UDP_conns, s.num_UDP_conns, s.max_UDP_conns,
s.num_ICMP_conns, s.max_ICMP_conns s.num_ICMP_conns, s.max_ICMP_conns
)); ));
sessions->tcp_stats.PrintStats(file, sessions->tcp_stats.PrintStats(file,
zeek::util::fmt("%.06f TCP-States:", zeek::net::network_time)); zeek::util::fmt("%.06f TCP-States:", zeek::run_state::network_time));
// Alternatively, if you prefer more compact output... // Alternatively, if you prefer more compact output...
/* /*
file->Write(zeek::util::fmt("%.8f TCP-States: I=%d S=%d SA=%d SR=%d E=%d EF=%d ER=%d F=%d P=%d\n", file->Write(zeek::util::fmt("%.8f TCP-States: I=%d S=%d SA=%d SR=%d E=%d EF=%d ER=%d F=%d P=%d\n",
zeek::net::network_time, zeek::run_state::network_time,
sessions->tcp_stats.StateInactive(), sessions->tcp_stats.StateInactive(),
sessions->tcp_stats.StateRequest(), sessions->tcp_stats.StateRequest(),
sessions->tcp_stats.StateSuccRequest(), sessions->tcp_stats.StateSuccRequest(),
@ -168,9 +168,9 @@ void ProfileLogger::Log()
*/ */
file->Write(zeek::util::fmt("%.06f Connections expired due to inactivity: %" PRIu64 "\n", file->Write(zeek::util::fmt("%.06f Connections expired due to inactivity: %" PRIu64 "\n",
zeek::net::network_time, killed_by_inactivity)); zeek::run_state::network_time, killed_by_inactivity));
file->Write(zeek::util::fmt("%.06f Total reassembler data: %" PRIu64 "K\n", zeek::net::network_time, file->Write(zeek::util::fmt("%.06f Total reassembler data: %" PRIu64 "K\n", zeek::run_state::network_time,
Reassembler::TotalMemoryAllocation() / 1024)); Reassembler::TotalMemoryAllocation() / 1024));
// Signature engine. // Signature engine.
@ -180,38 +180,38 @@ void ProfileLogger::Log()
zeek::detail::rule_matcher->GetStats(&stats); zeek::detail::rule_matcher->GetStats(&stats);
file->Write(zeek::util::fmt("%06f RuleMatcher: matchers=%d nfa_states=%d dfa_states=%d " file->Write(zeek::util::fmt("%06f RuleMatcher: matchers=%d nfa_states=%d dfa_states=%d "
"ncomputed=%d mem=%dK\n", zeek::net::network_time, stats.matchers, "ncomputed=%d mem=%dK\n", zeek::run_state::network_time, stats.matchers,
stats.nfa_states, stats.dfa_states, stats.computed, stats.mem / 1024)); stats.nfa_states, stats.dfa_states, stats.computed, stats.mem / 1024));
} }
file->Write(zeek::util::fmt("%.06f Timers: current=%d max=%d lag=%.2fs\n", file->Write(zeek::util::fmt("%.06f Timers: current=%d max=%d lag=%.2fs\n",
zeek::net::network_time, zeek::run_state::network_time,
zeek::detail::timer_mgr->Size(), zeek::detail::timer_mgr->PeakSize(), zeek::detail::timer_mgr->Size(), zeek::detail::timer_mgr->PeakSize(),
zeek::net::network_time - zeek::detail::timer_mgr->LastTimestamp())); zeek::run_state::network_time - zeek::detail::timer_mgr->LastTimestamp()));
zeek::detail::DNS_Mgr::Stats dstats; zeek::detail::DNS_Mgr::Stats dstats;
zeek::detail::dns_mgr->GetStats(&dstats); zeek::detail::dns_mgr->GetStats(&dstats);
file->Write(zeek::util::fmt("%.06f DNS_Mgr: requests=%lu succesful=%lu failed=%lu pending=%lu cached_hosts=%lu cached_addrs=%lu\n", file->Write(zeek::util::fmt("%.06f DNS_Mgr: requests=%lu succesful=%lu failed=%lu pending=%lu cached_hosts=%lu cached_addrs=%lu\n",
zeek::net::network_time, zeek::run_state::network_time,
dstats.requests, dstats.successful, dstats.failed, dstats.pending, dstats.requests, dstats.successful, dstats.failed, dstats.pending,
dstats.cached_hosts, dstats.cached_addresses)); dstats.cached_hosts, dstats.cached_addresses));
zeek::detail::trigger::Manager::Stats tstats; zeek::detail::trigger::Manager::Stats tstats;
zeek::detail::trigger_mgr->GetStats(&tstats); zeek::detail::trigger_mgr->GetStats(&tstats);
file->Write(zeek::util::fmt("%.06f Triggers: total=%lu pending=%lu\n", zeek::net::network_time, tstats.total, tstats.pending)); file->Write(zeek::util::fmt("%.06f Triggers: total=%lu pending=%lu\n", zeek::run_state::network_time, tstats.total, tstats.pending));
unsigned int* current_timers = zeek::detail::TimerMgr::CurrentTimers(); unsigned int* current_timers = zeek::detail::TimerMgr::CurrentTimers();
for ( int i = 0; i < zeek::detail::NUM_TIMER_TYPES; ++i ) for ( int i = 0; i < zeek::detail::NUM_TIMER_TYPES; ++i )
{ {
if ( current_timers[i] ) if ( current_timers[i] )
file->Write(zeek::util::fmt("%.06f %s = %d\n", zeek::net::network_time, file->Write(zeek::util::fmt("%.06f %s = %d\n", zeek::run_state::network_time,
zeek::detail::timer_type_to_string(static_cast<zeek::detail::TimerType>(i)), zeek::detail::timer_type_to_string(static_cast<zeek::detail::TimerType>(i)),
current_timers[i])); current_timers[i]));
} }
file->Write(zeek::util::fmt("%0.6f Threads: current=%d\n", zeek::net::network_time, zeek::thread_mgr->NumThreads())); file->Write(zeek::util::fmt("%0.6f Threads: current=%d\n", zeek::run_state::network_time, zeek::thread_mgr->NumThreads()));
const threading::Manager::msg_stats_list& thread_stats = zeek::thread_mgr->GetMsgThreadStats(); const threading::Manager::msg_stats_list& thread_stats = zeek::thread_mgr->GetMsgThreadStats();
for ( threading::Manager::msg_stats_list::const_iterator i = thread_stats.begin(); for ( threading::Manager::msg_stats_list::const_iterator i = thread_stats.begin();
@ -221,7 +221,7 @@ void ProfileLogger::Log()
file->Write(zeek::util::fmt("%0.6f %-25s in=%" PRIu64 " out=%" PRIu64 " pending=%" PRIu64 "/%" PRIu64 file->Write(zeek::util::fmt("%0.6f %-25s in=%" PRIu64 " out=%" PRIu64 " pending=%" PRIu64 "/%" PRIu64
" (#queue r/w: in=%" PRIu64 "/%" PRIu64 " out=%" PRIu64 "/%" PRIu64 ")" " (#queue r/w: in=%" PRIu64 "/%" PRIu64 " out=%" PRIu64 "/%" PRIu64 ")"
"\n", "\n",
zeek::net::network_time, zeek::run_state::network_time,
i->first.c_str(), i->first.c_str(),
s.sent_in, s.sent_out, s.sent_in, s.sent_out,
s.pending_in, s.pending_out, s.pending_in, s.pending_out,
@ -237,7 +237,7 @@ void ProfileLogger::Log()
"events_in=%zu events_out=%zu " "events_in=%zu events_out=%zu "
"logs_in=%zu logs_out=%zu " "logs_in=%zu logs_out=%zu "
"ids_in=%zu ids_out=%zu ", "ids_in=%zu ids_out=%zu ",
zeek::net::network_time, cs.num_peers, cs.num_stores, zeek::run_state::network_time, cs.num_peers, cs.num_stores,
cs.num_pending_queries, cs.num_pending_queries,
cs.num_events_incoming, cs.num_events_outgoing, cs.num_events_incoming, cs.num_events_outgoing,
cs.num_logs_incoming, cs.num_logs_outgoing, cs.num_logs_incoming, cs.num_logs_outgoing,
@ -254,7 +254,7 @@ void ProfileLogger::Log()
int total_table_rentries = 0; int total_table_rentries = 0;
file->Write(zeek::util::fmt("%.06f Global_sizes > 100k: %dK\n", file->Write(zeek::util::fmt("%.06f Global_sizes > 100k: %dK\n",
zeek::net::network_time, mem / 1024)); zeek::run_state::network_time, mem / 1024));
for ( const auto& global : globals ) for ( const auto& global : globals )
{ {
@ -295,7 +295,7 @@ void ProfileLogger::Log()
if ( print ) if ( print )
{ {
file->Write(zeek::util::fmt("%.06f %s = %dK", file->Write(zeek::util::fmt("%.06f %s = %dK",
zeek::net::network_time, id->Name(), zeek::run_state::network_time, id->Name(),
size / 1024)); size / 1024));
if ( entries >= 0 ) if ( entries >= 0 )
@ -308,9 +308,9 @@ void ProfileLogger::Log()
} }
file->Write(zeek::util::fmt("%.06f Global_sizes total: %dK\n", file->Write(zeek::util::fmt("%.06f Global_sizes total: %dK\n",
zeek::net::network_time, mem / 1024)); zeek::run_state::network_time, mem / 1024));
file->Write(zeek::util::fmt("%.06f Total number of table entries: %d/%d\n", file->Write(zeek::util::fmt("%.06f Total number of table entries: %d/%d\n",
zeek::net::network_time, zeek::run_state::network_time,
total_table_entries, total_table_rentries)); total_table_entries, total_table_rentries));
} }
@ -330,16 +330,16 @@ void ProfileLogger::SegmentProfile(const char* name, const zeek::detail::Locatio
{ {
if ( name ) if ( name )
file->Write(zeek::util::fmt("%.06f segment-%s dt=%.06f dmem=%d\n", file->Write(zeek::util::fmt("%.06f segment-%s dt=%.06f dmem=%d\n",
zeek::net::network_time, name, dtime, dmem)); zeek::run_state::network_time, name, dtime, dmem));
else if ( loc ) else if ( loc )
file->Write(zeek::util::fmt("%.06f segment-%s:%d dt=%.06f dmem=%d\n", file->Write(zeek::util::fmt("%.06f segment-%s:%d dt=%.06f dmem=%d\n",
zeek::net::network_time, zeek::run_state::network_time,
loc->filename ? loc->filename : "nofile", loc->filename ? loc->filename : "nofile",
loc->first_line, loc->first_line,
dtime, dmem)); dtime, dmem));
else else
file->Write(zeek::util::fmt("%.06f segment-XXX dt=%.06f dmem=%d\n", file->Write(zeek::util::fmt("%.06f segment-XXX dt=%.06f dmem=%d\n",
zeek::net::network_time, dtime, dmem)); zeek::run_state::network_time, dtime, dmem));
} }

4
src/Stmt.cc
View file

@ -169,7 +169,7 @@ ExprListStmt::~ExprListStmt() = default;
ValPtr ExprListStmt::Exec(Frame* f, StmtFlowType& flow) const ValPtr ExprListStmt::Exec(Frame* f, StmtFlowType& flow) const
{ {
last_access = zeek::net::network_time; last_access = zeek::run_state::network_time;
flow = FLOW_NEXT; flow = FLOW_NEXT;
auto vals = eval_list(f, l.get()); auto vals = eval_list(f, l.get());
@ -233,7 +233,7 @@ static void print_log(const std::vector<ValPtr>& vals)
vec->Assign(vec->Size(), zeek::make_intrusive<zeek::StringVal>(d.Description())); vec->Assign(vec->Size(), zeek::make_intrusive<zeek::StringVal>(d.Description()));
} }
record->Assign(0, zeek::make_intrusive<zeek::TimeVal>(zeek::net::network_time)); record->Assign(0, zeek::make_intrusive<zeek::TimeVal>(zeek::run_state::network_time));
record->Assign(1, std::move(vec)); record->Assign(1, std::move(vec));
zeek::log_mgr->Write(plval.get(), record.get()); zeek::log_mgr->Write(plval.get(), record.get());
} }

4
src/Stmt.h
View file

@ -16,7 +16,7 @@
ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
namespace zeek::net { extern double network_time; } namespace zeek::run_state { extern double network_time; }
namespace zeek::detail { namespace zeek::detail {
@ -53,7 +53,7 @@ public:
ForStmt* AsForStmt(); ForStmt* AsForStmt();
void RegisterAccess() const { last_access = zeek::net::network_time; access_count++; } void RegisterAccess() const { last_access = zeek::run_state::network_time; access_count++; }
void AccessStats(ODesc* d) const; void AccessStats(ODesc* d) const;
uint32_t GetAccessCount() const { return access_count; } uint32_t GetAccessCount() const { return access_count; }

12
src/Timer.cc
View file

@ -5,7 +5,7 @@
#include "util.h" #include "util.h"
#include "Timer.h" #include "Timer.h"
#include "Desc.h" #include "Desc.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "broker/Manager.h" #include "broker/Manager.h"
#include "iosource/Manager.h" #include "iosource/Manager.h"
@ -96,13 +96,13 @@ void TimerMgr::Process()
// pseudo-realtime), advance the timer here to the current time since otherwise it won't // pseudo-realtime), advance the timer here to the current time since otherwise it won't
// move forward and the timers won't fire correctly. // move forward and the timers won't fire correctly.
iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc(); iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc();
if ( ! pkt_src || ! pkt_src->IsOpen() || zeek::net::reading_live || zeek::net::net_is_processing_suspended() ) if ( ! pkt_src || ! pkt_src->IsOpen() || zeek::run_state::reading_live || zeek::run_state::net_is_processing_suspended() )
zeek::net::detail::net_update_time(zeek::util::current_time()); zeek::run_state::detail::net_update_time(zeek::util::current_time());
// Just advance the timer manager based on the current network time. This won't actually // Just advance the timer manager based on the current network time. This won't actually
// change the time, but will dispatch any timers that need dispatching. // change the time, but will dispatch any timers that need dispatching.
zeek::net::current_dispatched += Advance(zeek::net::network_time, zeek::run_state::current_dispatched += Advance(zeek::run_state::network_time,
max_timer_expires - zeek::net::current_dispatched); max_timer_expires - zeek::run_state::current_dispatched);
} }
void TimerMgr::InitPostScript() void TimerMgr::InitPostScript()
@ -186,7 +186,7 @@ double PQ_TimerMgr::GetNextTimeout()
{ {
Timer* top = Top(); Timer* top = Top();
if ( top ) if ( top )
return std::max(0.0, top->Time() - zeek::net::network_time); return std::max(0.0, top->Time() - zeek::run_state::network_time);
return -1; return -1;
} }

6
src/Trigger.cc
View file

@ -85,12 +85,12 @@ TraversalCode zeek::detail::trigger::TriggerTraversalCallback::PreExpr(const zee
class TriggerTimer final : public Timer { class TriggerTimer final : public Timer {
public: public:
TriggerTimer(double arg_timeout, Trigger* arg_trigger) TriggerTimer(double arg_timeout, Trigger* arg_trigger)
: Timer(zeek::net::network_time + arg_timeout, TIMER_TRIGGER) : Timer(zeek::run_state::network_time + arg_timeout, TIMER_TRIGGER)
{ {
Ref(arg_trigger); Ref(arg_trigger);
trigger = arg_trigger; trigger = arg_trigger;
timeout = arg_timeout; timeout = arg_timeout;
time = zeek::net::network_time; time = zeek::run_state::network_time;
} }
~TriggerTimer() ~TriggerTimer()
@ -505,7 +505,7 @@ Manager::~Manager()
double Manager::GetNextTimeout() double Manager::GetNextTimeout()
{ {
return pending->empty() ? -1 : zeek::net::network_time + 0.100; return pending->empty() ? -1 : zeek::run_state::network_time + 0.100;
} }
void Manager::Process() void Manager::Process()

20
src/Val.cc
View file

@ -20,7 +20,7 @@
#include "ZeekString.h" #include "ZeekString.h"
#include "CompHash.h" #include "CompHash.h"
#include "Dict.h" #include "Dict.h"
#include "Net.h" #include "RunState.h"
#include "File.h" #include "File.h"
#include "Func.h" #include "Func.h"
#include "Desc.h" #include "Desc.h"
@ -1412,7 +1412,7 @@ TableVal::TableVal(TableTypePtr t, detail::AttributesPtr a) : Val(t)
Init(std::move(t)); Init(std::move(t));
SetAttrs(std::move(a)); SetAttrs(std::move(a));
if ( ! zeek::net::is_parsing ) if ( ! zeek::run_state::is_parsing )
return; return;
for ( const auto& t : table_type->GetIndexTypes() ) for ( const auto& t : table_type->GetIndexTypes() )
@ -1946,7 +1946,7 @@ const ValPtr& TableVal::Find(const ValPtr& index)
if ( v ) if ( v )
{ {
if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) ) if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) )
v->SetExpireAccess(net::network_time); v->SetExpireAccess(run_state::network_time);
if ( v->GetVal() ) if ( v->GetVal() )
return v->GetVal(); return v->GetVal();
@ -1970,7 +1970,7 @@ const ValPtr& TableVal::Find(const ValPtr& index)
if ( v ) if ( v )
{ {
if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) ) if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) )
v->SetExpireAccess(net::network_time); v->SetExpireAccess(run_state::network_time);
if ( v->GetVal() ) if ( v->GetVal() )
return v->GetVal(); return v->GetVal();
@ -2042,7 +2042,7 @@ TableValPtr TableVal::LookupSubnetValues(const SubNetVal* search)
if ( entry ) if ( entry )
{ {
if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) ) if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) )
entry->SetExpireAccess(net::network_time); entry->SetExpireAccess(run_state::network_time);
} }
} }
@ -2068,7 +2068,7 @@ bool TableVal::UpdateTimestamp(Val* index)
if ( ! v ) if ( ! v )
return false; return false;
v->SetExpireAccess(net::network_time); v->SetExpireAccess(run_state::network_time);
return true; return true;
} }
@ -2204,7 +2204,7 @@ void TableVal::SendToStore(const Val* index, const TableEntryVal* new_entry_val,
if ( attrs->Find(zeek::detail::ATTR_EXPIRE_CREATE) ) if ( attrs->Find(zeek::detail::ATTR_EXPIRE_CREATE) )
{ {
// for create expiry, we have to substract the already elapsed time from the expiry. // for create expiry, we have to substract the already elapsed time from the expiry.
auto e = expire_time - (net::network_time - new_entry_val->ExpireAccessTime()); auto e = expire_time - (run_state::network_time - new_entry_val->ExpireAccessTime());
if ( e <= 0 ) if ( e <= 0 )
// element already expired? Let's not insert it. // element already expired? Let's not insert it.
break; break;
@ -2528,7 +2528,7 @@ void TableVal::InitDefaultFunc(zeek::detail::Frame* f)
void TableVal::InitTimer(double delay) void TableVal::InitTimer(double delay)
{ {
timer = new TableValTimer(this, net::network_time + delay); timer = new TableValTimer(this, run_state::network_time + delay);
zeek::detail::timer_mgr->Add(timer); zeek::detail::timer_mgr->Add(timer);
} }
@ -2595,7 +2595,7 @@ void TableVal::DoExpire(double t)
{ {
// User doesn't want us to expire // User doesn't want us to expire
// this now. // this now.
v->SetExpireAccess(net::network_time - timeout + secs); v->SetExpireAccess(run_state::network_time - timeout + secs);
delete k; delete k;
continue; continue;
} }
@ -2874,7 +2874,7 @@ RecordVal::RecordVal(RecordTypePtr t, bool init_fields) : Val(std::move(t))
auto vl = val.record_val = new std::vector<ValPtr>; auto vl = val.record_val = new std::vector<ValPtr>;
vl->reserve(n); vl->reserve(n);
if ( zeek::net::is_parsing ) if ( zeek::run_state::is_parsing )
parse_time_records[rt].emplace_back(NewRef{}, this); parse_time_records[rt].emplace_back(NewRef{}, this);
if ( ! init_fields ) if ( ! init_fields )

14
src/Val.h
View file

@ -54,9 +54,11 @@ ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
namespace zeek { namespace zeek {
namespace net { namespace run_state {
extern double network_time;
extern double zeek_start_network_time; extern double network_time;
extern double zeek_start_network_time;
} }
using FuncPtr = zeek::IntrusivePtr<Func>; using FuncPtr = zeek::IntrusivePtr<Func>;
@ -731,7 +733,7 @@ public:
: val(std::move(v)) : val(std::move(v))
{ {
expire_access_time = expire_access_time =
int(net::network_time - net::zeek_start_network_time); int(run_state::network_time - run_state::zeek_start_network_time);
} }
TableEntryVal* Clone(Val::CloneState* state); TableEntryVal* Clone(Val::CloneState* state);
@ -744,9 +746,9 @@ public:
// Returns/sets time of last expiration relevant access to this value. // Returns/sets time of last expiration relevant access to this value.
double ExpireAccessTime() const double ExpireAccessTime() const
{ return net::zeek_start_network_time + expire_access_time; } { return run_state::zeek_start_network_time + expire_access_time; }
void SetExpireAccess(double time) void SetExpireAccess(double time)
{ expire_access_time = int(time - net::zeek_start_network_time); } { expire_access_time = int(time - run_state::zeek_start_network_time); }
protected: protected:
friend class TableVal; friend class TableVal;

6
src/WeirdState.cc
View file

@ -1,5 +1,5 @@
#include "WeirdState.h" #include "WeirdState.h"
#include "Net.h" #include "RunState.h"
#include "util.h" #include "util.h"
namespace zeek::detail { namespace zeek::detail {
@ -14,10 +14,10 @@ bool PermitWeird(WeirdStateMap& wsm, const char* name, uint64_t threshold,
return true; return true;
if ( state.count == threshold + 1) if ( state.count == threshold + 1)
state.sampling_start_time = zeek::net::network_time; state.sampling_start_time = zeek::run_state::network_time;
else else
{ {
if ( zeek::net::network_time > state.sampling_start_time + duration ) if ( zeek::run_state::network_time > state.sampling_start_time + duration )
{ {
state.sampling_start_time = 0; state.sampling_start_time = 0;
state.count = 1; state.count = 1;

11
src/analyzer/Manager.cc
View file

@ -5,6 +5,7 @@
#include "Hash.h" #include "Hash.h"
#include "Val.h" #include "Val.h"
#include "IntrusivePtr.h" #include "IntrusivePtr.h"
#include "RunState.h"
#include "protocol/conn-size/ConnSize.h" #include "protocol/conn-size/ConnSize.h"
#include "protocol/icmp/ICMP.h" #include "protocol/icmp/ICMP.h"
@ -499,14 +500,14 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
void Manager::ExpireScheduledAnalyzers() void Manager::ExpireScheduledAnalyzers()
{ {
if ( ! zeek::net::network_time ) if ( ! zeek::run_state::network_time )
return; return;
while ( conns_by_timeout.size() ) while ( conns_by_timeout.size() )
{ {
ScheduledAnalyzer* a = conns_by_timeout.top(); ScheduledAnalyzer* a = conns_by_timeout.top();
if ( a->timeout > zeek::net::network_time ) if ( a->timeout > zeek::run_state::network_time )
return; return;
conns_by_timeout.pop(); conns_by_timeout.pop();
@ -540,7 +541,7 @@ void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp,
TransportProto proto, const Tag& analyzer, TransportProto proto, const Tag& analyzer,
double timeout) double timeout)
{ {
if ( ! zeek::net::network_time ) if ( ! zeek::run_state::network_time )
{ {
reporter->Warning("cannot schedule analyzers before processing begins; ignored"); reporter->Warning("cannot schedule analyzers before processing begins; ignored");
return; return;
@ -554,7 +555,7 @@ void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp,
ScheduledAnalyzer* a = new ScheduledAnalyzer; ScheduledAnalyzer* a = new ScheduledAnalyzer;
a->conn = ConnIndex(orig, resp, resp_p, proto); a->conn = ConnIndex(orig, resp, resp_p, proto);
a->analyzer = analyzer; a->analyzer = analyzer;
a->timeout = zeek::net::network_time + timeout; a->timeout = zeek::run_state::network_time + timeout;
conns.insert(std::make_pair(a->conn, a)); conns.insert(std::make_pair(a->conn, a));
conns_by_timeout.push(a); conns_by_timeout.push(a);
@ -597,7 +598,7 @@ Manager::tag_set Manager::GetScheduled(const Connection* conn)
for ( conns_map::iterator i = all.first; i != all.second; i++ ) for ( conns_map::iterator i = all.first; i != all.second; i++ )
{ {
if ( i->second->timeout > zeek::net::network_time ) if ( i->second->timeout > zeek::run_state::network_time )
result.insert(i->second->analyzer); result.insert(i->second->analyzer);
} }

3
src/analyzer/protocol/conn-size/ConnSize.cc
View file

@ -7,6 +7,7 @@
#include "analyzer/protocol/tcp/TCP.h" #include "analyzer/protocol/tcp/TCP.h"
#include "IP.h" #include "IP.h"
#include "Reporter.h" #include "Reporter.h"
#include "RunState.h"
#include "events.bif.h" #include "events.bif.h"
@ -90,7 +91,7 @@ void ConnSize_Analyzer::CheckThresholds(bool is_orig)
if ( duration_thresh != 0 ) if ( duration_thresh != 0 )
{ {
if ( ( zeek::net::network_time - start_time ) > duration_thresh && conn_duration_threshold_crossed ) if ( ( zeek::run_state::network_time - start_time ) > duration_thresh && conn_duration_threshold_crossed )
{ {
EnqueueConnEvent(conn_duration_threshold_crossed, EnqueueConnEvent(conn_duration_threshold_crossed,
ConnVal(), ConnVal(),

6
src/analyzer/protocol/dns/DNS.cc
View file

@ -13,7 +13,7 @@
#include "NetVar.h" #include "NetVar.h"
#include "Sessions.h" #include "Sessions.h"
#include "Event.h" #include "Event.h"
#include "Net.h" #include "RunState.h"
#include "events.bif.h" #include "events.bif.h"
@ -1908,7 +1908,7 @@ DNS_Analyzer::DNS_Analyzer(zeek::Connection* conn)
else else
{ {
ADD_ANALYZER_TIMER(&DNS_Analyzer::ExpireTimer, ADD_ANALYZER_TIMER(&DNS_Analyzer::ExpireTimer,
zeek::net::network_time + zeek::detail::dns_session_timeout, true, zeek::run_state::network_time + zeek::detail::dns_session_timeout, true,
zeek::detail::TIMER_DNS_EXPIRE); zeek::detail::TIMER_DNS_EXPIRE);
} }
} }
@ -1956,7 +1956,7 @@ void DNS_Analyzer::ExpireTimer(double t)
// The - 1.0 in the following is to allow 1 second for the // The - 1.0 in the following is to allow 1 second for the
// common case of a single request followed by a single reply, // common case of a single request followed by a single reply,
// so we don't needlessly set the timer twice in that case. // so we don't needlessly set the timer twice in that case.
if ( t - Conn()->LastTime() >= zeek::detail::dns_session_timeout - 1.0 || zeek::net::terminating ) if ( t - Conn()->LastTime() >= zeek::detail::dns_session_timeout - 1.0 || zeek::run_state::terminating )
{ {
Event(connection_timeout); Event(connection_timeout);
zeek::sessions->Remove(Conn()); zeek::sessions->Remove(Conn());

32
src/analyzer/protocol/http/HTTP.cc
View file

@ -62,7 +62,7 @@ HTTP_Entity::HTTP_Entity(HTTP_Message* arg_message, zeek::analyzer::mime::MIME_E
void HTTP_Entity::EndOfData() void HTTP_Entity::EndOfData()
{ {
if ( DEBUG_http ) if ( DEBUG_http )
DEBUG_MSG("%.6f: end of data\n", zeek::net::network_time); DEBUG_MSG("%.6f: end of data\n", zeek::run_state::network_time);
if ( zip ) if ( zip )
{ {
@ -84,7 +84,7 @@ void HTTP_Entity::Deliver(int len, const char* data, bool trailing_CRLF)
if ( DEBUG_http ) if ( DEBUG_http )
{ {
DEBUG_MSG("%.6f HTTP_Entity::Deliver len=%d, in_header=%d\n", DEBUG_MSG("%.6f HTTP_Entity::Deliver len=%d, in_header=%d\n",
zeek::net::network_time, len, in_header); zeek::run_state::network_time, len, in_header);
} }
if ( end_of_data ) if ( end_of_data )
@ -511,7 +511,7 @@ void HTTP_Entity::SubmitAllHeaders()
ASSERT(! in_header); ASSERT(! in_header);
if ( DEBUG_http ) if ( DEBUG_http )
DEBUG_MSG("%.6f end of headers\n", zeek::net::network_time); DEBUG_MSG("%.6f end of headers\n", zeek::run_state::network_time);
if ( Parent() && if ( Parent() &&
Parent()->MIMEContentType() == zeek::analyzer::mime::CONTENT_TYPE_MULTIPART ) Parent()->MIMEContentType() == zeek::analyzer::mime::CONTENT_TYPE_MULTIPART )
@ -609,7 +609,7 @@ HTTP_Message::HTTP_Message(HTTP_Analyzer* arg_analyzer,
entity_data_buffer = nullptr; entity_data_buffer = nullptr;
BeginEntity(top_level); BeginEntity(top_level);
start_time = zeek::net::network_time; start_time = zeek::run_state::network_time;
body_length = 0; body_length = 0;
content_gap_length = 0; content_gap_length = 0;
header_length = init_header_length; header_length = init_header_length;
@ -642,7 +642,7 @@ void HTTP_Message::Done(bool interrupted, const char* detail)
zeek::analyzer::mime::MIME_Message::Done(); zeek::analyzer::mime::MIME_Message::Done();
// DEBUG_MSG("%.6f HTTP message done.\n", zeek::net::network_time); // DEBUG_MSG("%.6f HTTP message done.\n", zeek::run_state::network_time);
top_level->EndOfData(); top_level->EndOfData();
if ( is_orig || MyHTTP_Analyzer()->HTTP_ReplyCode() != 206 ) if ( is_orig || MyHTTP_Analyzer()->HTTP_ReplyCode() != 206 )
@ -684,7 +684,7 @@ bool HTTP_Message::Undelivered(int64_t len)
void HTTP_Message::BeginEntity(zeek::analyzer::mime::MIME_Entity* entity) void HTTP_Message::BeginEntity(zeek::analyzer::mime::MIME_Entity* entity)
{ {
if ( DEBUG_http ) if ( DEBUG_http )
DEBUG_MSG("%.6f: begin entity (%d)\n", zeek::net::network_time, is_orig); DEBUG_MSG("%.6f: begin entity (%d)\n", zeek::run_state::network_time, is_orig);
current_entity = (HTTP_Entity*) entity; current_entity = (HTTP_Entity*) entity;
@ -698,7 +698,7 @@ void HTTP_Message::BeginEntity(zeek::analyzer::mime::MIME_Entity* entity)
void HTTP_Message::EndEntity(zeek::analyzer::mime::MIME_Entity* entity) void HTTP_Message::EndEntity(zeek::analyzer::mime::MIME_Entity* entity)
{ {
if ( DEBUG_http ) if ( DEBUG_http )
DEBUG_MSG("%.6f: end entity (%d)\n", zeek::net::network_time, is_orig); DEBUG_MSG("%.6f: end entity (%d)\n", zeek::run_state::network_time, is_orig);
if ( entity == top_level ) if ( entity == top_level )
{ {
@ -1126,7 +1126,7 @@ void HTTP_Analyzer::EndpointEOF(bool is_orig)
{ {
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::EndpointEOF(is_orig); zeek::analyzer::tcp::TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
// DEBUG_MSG("%.6f eof\n", zeek::net::network_time); // DEBUG_MSG("%.6f eof\n", zeek::run_state::network_time);
if ( is_orig ) if ( is_orig )
RequestMade(false, "message ends as connection contents are completely delivered"); RequestMade(false, "message ends as connection contents are completely delivered");
@ -1138,7 +1138,7 @@ void HTTP_Analyzer::ConnectionFinished(bool half_finished)
{ {
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::ConnectionFinished(half_finished); zeek::analyzer::tcp::TCP_ApplicationAnalyzer::ConnectionFinished(half_finished);
// DEBUG_MSG("%.6f connection finished\n", zeek::net::network_time); // DEBUG_MSG("%.6f connection finished\n", zeek::run_state::network_time);
RequestMade(true, "message ends as connection is finished"); RequestMade(true, "message ends as connection is finished");
ReplyMade(true, "message ends as connection is finished"); ReplyMade(true, "message ends as connection is finished");
} }
@ -1170,7 +1170,7 @@ void HTTP_Analyzer::GenStats()
r->Assign(2, zeek::make_intrusive<zeek::DoubleVal>(request_version.ToDouble())); r->Assign(2, zeek::make_intrusive<zeek::DoubleVal>(request_version.ToDouble()));
r->Assign(3, zeek::make_intrusive<zeek::DoubleVal>(reply_version.ToDouble())); r->Assign(3, zeek::make_intrusive<zeek::DoubleVal>(reply_version.ToDouble()));
// DEBUG_MSG("%.6f http_stats\n", zeek::net::network_time); // DEBUG_MSG("%.6f http_stats\n", zeek::run_state::network_time);
EnqueueConnEvent(http_stats, ConnVal(), std::move(r)); EnqueueConnEvent(http_stats, ConnVal(), std::move(r));
} }
} }
@ -1369,7 +1369,7 @@ void HTTP_Analyzer::HTTP_Event(const char* category, const char* detail)
void HTTP_Analyzer::HTTP_Event(const char* category, zeek::StringValPtr detail) void HTTP_Analyzer::HTTP_Event(const char* category, zeek::StringValPtr detail)
{ {
if ( http_event ) if ( http_event )
// DEBUG_MSG("%.6f http_event\n", zeek::net::network_time); // DEBUG_MSG("%.6f http_event\n", zeek::run_state::network_time);
EnqueueConnEvent(http_event, EnqueueConnEvent(http_event,
ConnVal(), ConnVal(),
zeek::make_intrusive<zeek::StringVal>(category), zeek::make_intrusive<zeek::StringVal>(category),
@ -1403,7 +1403,7 @@ void HTTP_Analyzer::HTTP_Request()
connect_request = true; connect_request = true;
if ( http_request ) if ( http_request )
// DEBUG_MSG("%.6f http_request\n", zeek::net::network_time); // DEBUG_MSG("%.6f http_request\n", zeek::run_state::network_time);
EnqueueConnEvent(http_request, EnqueueConnEvent(http_request,
ConnVal(), ConnVal(),
request_method, request_method,
@ -1438,7 +1438,7 @@ void HTTP_Analyzer::RequestMade(bool interrupted, const char* msg)
if ( request_message ) if ( request_message )
request_message->Done(interrupted, msg); request_message->Done(interrupted, msg);
// DEBUG_MSG("%.6f request made\n", zeek::net::network_time); // DEBUG_MSG("%.6f request made\n", zeek::run_state::network_time);
request_method = nullptr; request_method = nullptr;
unescaped_URI = nullptr; unescaped_URI = nullptr;
@ -1459,7 +1459,7 @@ void HTTP_Analyzer::ReplyMade(bool interrupted, const char* msg)
reply_ongoing = 0; reply_ongoing = 0;
// DEBUG_MSG("%.6f reply made\n", zeek::net::network_time); // DEBUG_MSG("%.6f reply made\n", zeek::run_state::network_time);
if ( reply_message ) if ( reply_message )
reply_message->Done(interrupted, msg); reply_message->Done(interrupted, msg);
@ -1644,7 +1644,7 @@ void HTTP_Analyzer::HTTP_Header(bool is_orig, zeek::analyzer::mime::MIME_Header*
is_orig, false, true, false); is_orig, false, true, false);
if ( DEBUG_http ) if ( DEBUG_http )
DEBUG_MSG("%.6f http_header\n", zeek::net::network_time); DEBUG_MSG("%.6f http_header\n", zeek::run_state::network_time);
auto upper_hn = zeek::analyzer::mime::to_string_val(h->get_name()); auto upper_hn = zeek::analyzer::mime::to_string_val(h->get_name());
upper_hn->ToUpper(); upper_hn->ToUpper();
@ -1692,7 +1692,7 @@ void HTTP_Analyzer::InitHTTPMessage(zeek::analyzer::tcp::ContentLine_Analyzer* c
delete message; delete message;
} }
// DEBUG_MSG("%.6f init http message\n", zeek::net::network_time); // DEBUG_MSG("%.6f init http message\n", zeek::run_state::network_time);
message = new HTTP_Message(this, cl, is_orig, expect_body, message = new HTTP_Message(this, cl, is_orig, expect_body,
init_header_length); init_header_length);
} }

10
src/analyzer/protocol/icmp/ICMP.cc
View file

@ -7,7 +7,7 @@
#include "zeek-config.h" #include "zeek-config.h"
#include "IP.h" #include "IP.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "Event.h" #include "Event.h"
#include "Conn.h" #include "Conn.h"
@ -76,7 +76,7 @@ void ICMP_Analyzer::DeliverPacket(int len, const u_char* data,
} }
} }
Conn()->SetLastTime(zeek::net::current_timestamp); Conn()->SetLastTime(zeek::run_state::current_timestamp);
if ( zeek::detail::rule_matcher ) if ( zeek::detail::rule_matcher )
{ {
@ -99,9 +99,9 @@ void ICMP_Analyzer::DeliverPacket(int len, const u_char* data,
len_stat += len; len_stat += len;
if ( ip->NextProto() == IPPROTO_ICMP ) if ( ip->NextProto() == IPPROTO_ICMP )
NextICMP4(zeek::net::current_timestamp, icmpp, len, caplen, data, ip); NextICMP4(zeek::run_state::current_timestamp, icmpp, len, caplen, data, ip);
else if ( ip->NextProto() == IPPROTO_ICMPV6 ) else if ( ip->NextProto() == IPPROTO_ICMPV6 )
NextICMP6(zeek::net::current_timestamp, icmpp, len, caplen, data, ip); NextICMP6(zeek::run_state::current_timestamp, icmpp, len, caplen, data, ip);
else else
{ {
zeek::reporter->AnalyzerError( zeek::reporter->AnalyzerError(
@ -345,7 +345,7 @@ zeek::RecordValPtr ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& da
{ {
bad_hdr_len = 0; bad_hdr_len = 0;
ip_len = ip_hdr->TotalLen(); ip_len = ip_hdr->TotalLen();
bad_checksum = ! zeek::net::current_pkt->l3_checksummed && bad_checksum = ! zeek::run_state::current_pkt->l3_checksummed &&
(ones_complement_checksum((void*) ip_hdr->IP4_Hdr(), ip_hdr_len, 0) != 0xffff); (ones_complement_checksum((void*) ip_hdr->IP4_Hdr(), ip_hdr_len, 0) != 0xffff);
src_addr = ip_hdr->SrcAddr(); src_addr = ip_hdr->SrcAddr();

8
src/analyzer/protocol/netbios/NetbiosSSN.cc
View file

@ -9,7 +9,7 @@
#include "NetVar.h" #include "NetVar.h"
#include "Sessions.h" #include "Sessions.h"
#include "Event.h" #include "Event.h"
#include "Net.h" #include "RunState.h"
#include "events.bif.h" #include "events.bif.h"
@ -471,7 +471,7 @@ NetbiosSSN_Analyzer::NetbiosSSN_Analyzer(zeek::Connection* conn)
else else
{ {
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer,
zeek::net::network_time + netbios_ssn_session_timeout, true, zeek::run_state::network_time + netbios_ssn_session_timeout, true,
zeek::detail::TIMER_NB_EXPIRE); zeek::detail::TIMER_NB_EXPIRE);
} }
} }
@ -526,8 +526,8 @@ void NetbiosSSN_Analyzer::ExpireTimer(double t)
// The - 1.0 in the following is to allow 1 second for the // The - 1.0 in the following is to allow 1 second for the
// common case of a single request followed by a single reply, // common case of a single request followed by a single reply,
// so we don't needlessly set the timer twice in that case. // so we don't needlessly set the timer twice in that case.
if ( zeek::net::terminating || if ( zeek::run_state::terminating ||
zeek::net::network_time - Conn()->LastTime() >= zeek::run_state::network_time - Conn()->LastTime() >=
netbios_ssn_session_timeout - 1.0 ) netbios_ssn_session_timeout - 1.0 )
{ {
Event(connection_timeout); Event(connection_timeout);

13
src/analyzer/protocol/pia/PIA.cc
View file

@ -5,6 +5,7 @@
#include "IP.h" #include "IP.h"
#include "DebugLogger.h" #include "DebugLogger.h"
#include "Reporter.h" #include "Reporter.h"
#include "RunState.h"
#include "analyzer/protocol/tcp/TCP_Flags.h" #include "analyzer/protocol/tcp/TCP_Flags.h"
#include "analyzer/protocol/tcp/TCP_Reassembler.h" #include "analyzer/protocol/tcp/TCP_Reassembler.h"
@ -385,11 +386,11 @@ void PIA_TCP::ActivateAnalyzer(zeek::analyzer::Tag tag, const zeek::detail::Rule
// worth the effort. // worth the effort.
if ( b->is_orig ) if ( b->is_orig )
reass_orig->DataSent(zeek::net::network_time, orig_seq = b->seq, reass_orig->DataSent(zeek::run_state::network_time, orig_seq = b->seq,
b->len, b->data, tcp::TCP_Flags(), true); b->len, b->data, tcp::TCP_Flags(), true);
else else
reass_resp->DataSent(zeek::net::network_time, resp_seq = b->seq, reass_resp->DataSent(zeek::run_state::network_time, resp_seq = b->seq,
b->len, b->data, tcp::TCP_Flags(), true); b->len, b->data, tcp::TCP_Flags(), true);
} }
// We also need to pass the current packet on. // We also need to pass the current packet on.
@ -397,11 +398,11 @@ void PIA_TCP::ActivateAnalyzer(zeek::analyzer::Tag tag, const zeek::detail::Rule
if ( current->data ) if ( current->data )
{ {
if ( current->is_orig ) if ( current->is_orig )
reass_orig->DataSent(zeek::net::network_time, reass_orig->DataSent(zeek::run_state::network_time,
orig_seq = current->seq, orig_seq = current->seq,
current->len, current->data, analyzer::tcp::TCP_Flags(), true); current->len, current->data, analyzer::tcp::TCP_Flags(), true);
else else
reass_resp->DataSent(zeek::net::network_time, reass_resp->DataSent(zeek::run_state::network_time,
resp_seq = current->seq, resp_seq = current->seq,
current->len, current->data, analyzer::tcp::TCP_Flags(), true); current->len, current->data, analyzer::tcp::TCP_Flags(), true);
} }

20
src/analyzer/protocol/rpc/RPC.cc
View file

@ -3,17 +3,17 @@
#include "zeek-config.h" #include "zeek-config.h"
#include "RPC.h" #include "RPC.h"
#include <stdlib.h>
#include <string> #include <string>
#include "NetVar.h" #include "NetVar.h"
#include "XDR.h" #include "XDR.h"
#include "Reporter.h" #include "Reporter.h"
#include "Sessions.h" #include "Sessions.h"
#include "RunState.h"
#include "events.bif.h" #include "events.bif.h"
#include <stdlib.h>
namespace { // local namespace namespace { // local namespace
const bool DEBUG_rpc_resync = false; const bool DEBUG_rpc_resync = false;
} }
@ -327,7 +327,7 @@ void RPC_Interpreter::Timeout()
const u_char* buf = nullptr; const u_char* buf = nullptr;
int n = 0; int n = 0;
if ( ! RPC_BuildReply(c, BifEnum::RPC_TIMEOUT, buf, n, zeek::net::network_time, zeek::net::network_time, 0) ) if ( ! RPC_BuildReply(c, BifEnum::RPC_TIMEOUT, buf, n, zeek::run_state::network_time, zeek::run_state::network_time, 0) )
Weird("bad_RPC"); Weird("bad_RPC");
} }
} }
@ -534,7 +534,7 @@ bool Contents_RPC::CheckResync(int& len, const u_char*& data, bool orig)
// TCP keep-alive retransmissions. // TCP keep-alive retransmissions.
DEBUG_MSG("%.6f RPC resync: " DEBUG_MSG("%.6f RPC resync: "
"discard small pieces: %d\n", "discard small pieces: %d\n",
zeek::net::network_time, len); zeek::run_state::network_time, len);
Conn()->Weird("RPC_resync", zeek::util::fmt("discard %d bytes\n", len)); Conn()->Weird("RPC_resync", zeek::util::fmt("discard %d bytes\n", len));
} }
@ -634,7 +634,7 @@ void Contents_RPC::DeliverStream(int len, const u_char* data, bool orig)
while (len > 0) while (len > 0)
{ {
last_time = zeek::net::network_time; last_time = zeek::run_state::network_time;
switch (state) { switch (state) {
case WAIT_FOR_MESSAGE: case WAIT_FOR_MESSAGE:
@ -649,7 +649,7 @@ void Contents_RPC::DeliverStream(int len, const u_char* data, bool orig)
msg_buf.Init(MAX_RPC_LEN, 0); msg_buf.Init(MAX_RPC_LEN, 0);
last_frag = false; last_frag = false;
state = WAIT_FOR_MARKER; state = WAIT_FOR_MARKER;
start_time = zeek::net::network_time; start_time = zeek::run_state::network_time;
// no break. fall through // no break. fall through
case WAIT_FOR_MARKER: case WAIT_FOR_MARKER:
@ -675,7 +675,7 @@ void Contents_RPC::DeliverStream(int len, const u_char* data, bool orig)
last_frag = (marker & 0x80000000) != 0; last_frag = (marker & 0x80000000) != 0;
marker &= 0x7fffffff; marker &= 0x7fffffff;
//printf("%.6f %d marker= %u <> last_frag= %d <> expected=%llu <> processed= %llu <> len = %d\n", //printf("%.6f %d marker= %u <> last_frag= %d <> expected=%llu <> processed= %llu <> len = %d\n",
// zeek::net::network_time, IsOrig(), marker, last_frag, msg_buf.GetExpected(), msg_buf.GetProcessed(), len); // zeek::run_state::network_time, IsOrig(), marker, last_frag, msg_buf.GetExpected(), msg_buf.GetProcessed(), len);
if ( ! msg_buf.AddToExpected(marker) ) if ( ! msg_buf.AddToExpected(marker) )
Conn()->Weird("RPC_message_too_long", zeek::util::fmt("%" PRId64, msg_buf.GetExpected())); Conn()->Weird("RPC_message_too_long", zeek::util::fmt("%" PRId64, msg_buf.GetExpected()));
@ -729,7 +729,7 @@ RPC_Analyzer::RPC_Analyzer(const char* name, zeek::Connection* conn,
{ {
if ( Conn()->ConnTransport() == TRANSPORT_UDP ) if ( Conn()->ConnTransport() == TRANSPORT_UDP )
ADD_ANALYZER_TIMER(&RPC_Analyzer::ExpireTimer, ADD_ANALYZER_TIMER(&RPC_Analyzer::ExpireTimer,
zeek::net::network_time + zeek::detail::rpc_timeout, true, zeek::run_state::network_time + zeek::detail::rpc_timeout, true,
zeek::detail::TIMER_RPC_EXPIRE); zeek::detail::TIMER_RPC_EXPIRE);
} }
@ -746,12 +746,12 @@ void RPC_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
if ( orig ) if ( orig )
{ {
if ( ! interp->DeliverRPC(data, len, len, true, zeek::net::network_time, zeek::net::network_time) ) if ( ! interp->DeliverRPC(data, len, len, true, zeek::run_state::network_time, zeek::run_state::network_time) )
Weird("bad_RPC"); Weird("bad_RPC");
} }
else else
{ {
if ( ! interp->DeliverRPC(data, len, len, false, zeek::net::network_time, zeek::net::network_time) ) if ( ! interp->DeliverRPC(data, len, len, false, zeek::run_state::network_time, zeek::run_state::network_time) )
Weird("bad_RPC"); Weird("bad_RPC");
} }
} }

10
src/analyzer/protocol/stepping-stone/SteppingStone.cc
View file

@ -6,7 +6,7 @@
#include <stdlib.h> #include <stdlib.h>
#include "Event.h" #include "Event.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "analyzer/protocol/tcp/TCP.h" #include "analyzer/protocol/tcp/TCP.h"
#include "Sessions.h" #include "Sessions.h"
@ -178,9 +178,9 @@ void SteppingStone_Analyzer::DeliverPacket(int len, const u_char* data,
ip, caplen); ip, caplen);
if ( is_orig ) if ( is_orig )
orig_endp->DataSent(zeek::net::network_time, seq, len, caplen, data, nullptr, nullptr); orig_endp->DataSent(zeek::run_state::network_time, seq, len, caplen, data, nullptr, nullptr);
else else
resp_endp->DataSent(zeek::net::network_time, seq, len, caplen, data, nullptr, nullptr); resp_endp->DataSent(zeek::run_state::network_time, seq, len, caplen, data, nullptr, nullptr);
} }
void SteppingStone_Analyzer::DeliverStream(int len, const u_char* data, void SteppingStone_Analyzer::DeliverStream(int len, const u_char* data,
@ -190,14 +190,14 @@ void SteppingStone_Analyzer::DeliverStream(int len, const u_char* data,
if ( is_orig ) if ( is_orig )
{ {
orig_endp->DataSent(zeek::net::network_time, orig_stream_pos, len, len, orig_endp->DataSent(zeek::run_state::network_time, orig_stream_pos, len, len,
data, nullptr, nullptr); data, nullptr, nullptr);
orig_stream_pos += len; orig_stream_pos += len;
} }
else else
{ {
resp_endp->DataSent(zeek::net::network_time, resp_stream_pos, len, len, resp_endp->DataSent(zeek::run_state::network_time, resp_stream_pos, len, len,
data, nullptr, nullptr); data, nullptr, nullptr);
resp_stream_pos += len; resp_stream_pos += len;
} }

32
src/analyzer/protocol/tcp/TCP.cc
View file

@ -8,7 +8,7 @@
#include "analyzer/protocol/pia/PIA.h" #include "analyzer/protocol/pia/PIA.h"
#include "IP.h" #include "IP.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "File.h" #include "File.h"
#include "Event.h" #include "Event.h"
@ -127,7 +127,7 @@ TCP_Analyzer::TCP_Analyzer(zeek::Connection* conn)
{ {
// Set a timer to eventually time out this connection. // Set a timer to eventually time out this connection.
ADD_ANALYZER_TIMER(&TCP_Analyzer::ExpireTimer, ADD_ANALYZER_TIMER(&TCP_Analyzer::ExpireTimer,
zeek::net::network_time + zeek::detail::tcp_SYN_timeout, false, zeek::run_state::network_time + zeek::detail::tcp_SYN_timeout, false,
zeek::detail::TIMER_TCP_EXPIRE); zeek::detail::TIMER_TCP_EXPIRE);
deferred_gen_event = close_deferred = 0; deferred_gen_event = close_deferred = 0;
@ -166,7 +166,7 @@ void TCP_Analyzer::Done()
{ {
Analyzer::Done(); Analyzer::Done();
if ( zeek::net::terminating && connection_pending && is_active && ! BothClosed() ) if ( zeek::run_state::terminating && connection_pending && is_active && ! BothClosed() )
Event(connection_pending); Event(connection_pending);
LOOP_OVER_GIVEN_CHILDREN(i, packet_children) LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
@ -275,7 +275,7 @@ const struct tcphdr* TCP_Analyzer::ExtractTCP_Header(const u_char*& data,
bool TCP_Analyzer::ValidateChecksum(const struct tcphdr* tp, bool TCP_Analyzer::ValidateChecksum(const struct tcphdr* tp,
TCP_Endpoint* endpoint, int len, int caplen) TCP_Endpoint* endpoint, int len, int caplen)
{ {
if ( ! zeek::net::current_pkt->l3_checksummed && ! zeek::detail::ignore_checksums && caplen >= len && if ( ! zeek::run_state::current_pkt->l3_checksummed && ! zeek::detail::ignore_checksums && caplen >= len &&
! endpoint->ValidChecksum(tp, len) ) ! endpoint->ValidChecksum(tp, len) )
{ {
Weird("bad_TCP_checksum"); Weird("bad_TCP_checksum");
@ -1074,7 +1074,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
uint32_t seq_one_past_segment = base_seq + seg_len; uint32_t seq_one_past_segment = base_seq + seg_len;
init_endpoint(endpoint, flags, base_seq, seq_one_past_segment, init_endpoint(endpoint, flags, base_seq, seq_one_past_segment,
zeek::net::current_timestamp); zeek::run_state::current_timestamp);
bool seq_underflow = false; bool seq_underflow = false;
uint64_t rel_seq = get_relative_seq(endpoint, base_seq, endpoint->LastSeq(), uint64_t rel_seq = get_relative_seq(endpoint, base_seq, endpoint->LastSeq(),
@ -1091,7 +1091,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
update_window(endpoint, ntohs(tp->th_win), base_seq, ack_seq, flags); update_window(endpoint, ntohs(tp->th_win), base_seq, ack_seq, flags);
if ( ! orig->did_close || ! resp->did_close ) if ( ! orig->did_close || ! resp->did_close )
Conn()->SetLastTime(zeek::net::current_timestamp); Conn()->SetLastTime(zeek::run_state::current_timestamp);
if ( flags.SYN() ) if ( flags.SYN() )
{ {
@ -1113,7 +1113,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
{ {
++endpoint->FIN_cnt; ++endpoint->FIN_cnt;
if ( endpoint->FIN_cnt >= zeek::detail::tcp_storm_thresh && zeek::net::current_timestamp < if ( endpoint->FIN_cnt >= zeek::detail::tcp_storm_thresh && zeek::run_state::current_timestamp <
endpoint->last_time + zeek::detail::tcp_storm_interarrival_thresh ) endpoint->last_time + zeek::detail::tcp_storm_interarrival_thresh )
Weird("FIN_storm"); Weird("FIN_storm");
@ -1124,7 +1124,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
{ {
++endpoint->RST_cnt; ++endpoint->RST_cnt;
if ( endpoint->RST_cnt >= zeek::detail::tcp_storm_thresh && zeek::net::current_timestamp < if ( endpoint->RST_cnt >= zeek::detail::tcp_storm_thresh && zeek::run_state::current_timestamp <
endpoint->last_time + zeek::detail::tcp_storm_interarrival_thresh ) endpoint->last_time + zeek::detail::tcp_storm_interarrival_thresh )
Weird("RST_storm"); Weird("RST_storm");
@ -1171,11 +1171,11 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
} }
int32_t delta_last = update_last_seq(endpoint, seq_one_past_segment, flags, len); int32_t delta_last = update_last_seq(endpoint, seq_one_past_segment, flags, len);
endpoint->last_time = zeek::net::current_timestamp; endpoint->last_time = zeek::run_state::current_timestamp;
bool do_close; bool do_close;
bool gen_event; bool gen_event;
UpdateStateMachine(zeek::net::current_timestamp, endpoint, peer, base_seq, ack_seq, UpdateStateMachine(zeek::run_state::current_timestamp, endpoint, peer, base_seq, ack_seq,
len, delta_last, is_orig, flags, do_close, gen_event); len, delta_last, is_orig, flags, do_close, gen_event);
if ( flags.ACK() ) if ( flags.ACK() )
@ -1210,7 +1210,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
if ( DEBUG_tcp_data_sent ) if ( DEBUG_tcp_data_sent )
{ {
DEBUG_MSG("%.6f before DataSent: len=%d caplen=%d skip=%d\n", DEBUG_MSG("%.6f before DataSent: len=%d caplen=%d skip=%d\n",
zeek::net::network_time, len, caplen, Skipping()); zeek::run_state::network_time, len, caplen, Skipping());
} }
uint64_t rel_data_seq = flags.SYN() ? rel_seq + 1 : rel_seq; uint64_t rel_data_seq = flags.SYN() ? rel_seq + 1 : rel_seq;
@ -1218,7 +1218,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
int need_contents = 0; int need_contents = 0;
if ( len > 0 && (caplen >= len || packet_children.size()) && if ( len > 0 && (caplen >= len || packet_children.size()) &&
! flags.RST() && ! Skipping() && ! seq_underflow ) ! flags.RST() && ! Skipping() && ! seq_underflow )
need_contents = DeliverData(zeek::net::current_timestamp, data, len, caplen, ip, need_contents = DeliverData(zeek::run_state::current_timestamp, data, len, caplen, ip,
tp, endpoint, rel_data_seq, is_orig, flags); tp, endpoint, rel_data_seq, is_orig, flags);
endpoint->CheckEOF(); endpoint->CheckEOF();
@ -1664,7 +1664,7 @@ void TCP_Analyzer::ConnectionClosed(TCP_Endpoint* endpoint, TCP_Endpoint* peer,
if ( DEBUG_tcp_connection_close ) if ( DEBUG_tcp_connection_close )
{ {
DEBUG_MSG("%.6f close_complete=%d tcp_close_delay=%f\n", DEBUG_MSG("%.6f close_complete=%d tcp_close_delay=%f\n",
zeek::net::network_time, close_complete, zeek::run_state::network_time, close_complete,
zeek::detail::tcp_close_delay); zeek::detail::tcp_close_delay);
} }
@ -2058,7 +2058,7 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl
} }
DEBUG_MSG("%.6f rexmit %" PRIu64" + %d <= %" PRIu64" data_in_flight = %d\n", DEBUG_MSG("%.6f rexmit %" PRIu64" + %d <= %" PRIu64" data_in_flight = %d\n",
zeek::net::network_time, seq, len, max_top_seq, data_in_flight); zeek::run_state::network_time, seq, len, max_top_seq, data_in_flight);
if ( tcp_rexmit ) if ( tcp_rexmit )
endp->TCP()->EnqueueConnEvent(tcp_rexmit, endp->TCP()->EnqueueConnEvent(tcp_rexmit,
@ -2129,9 +2129,9 @@ void TCPStats_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
TCP_ApplicationAnalyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen); TCP_ApplicationAnalyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
if ( is_orig ) if ( is_orig )
orig_stats->DataSent(zeek::net::network_time, seq, len, caplen, data, ip, nullptr); orig_stats->DataSent(zeek::run_state::network_time, seq, len, caplen, data, ip, nullptr);
else else
resp_stats->DataSent(zeek::net::network_time, seq, len, caplen, data, ip, nullptr); resp_stats->DataSent(zeek::run_state::network_time, seq, len, caplen, data, ip, nullptr);
} }
} // namespace zeek::analyzer::tcp } // namespace zeek::analyzer::tcp

2
src/analyzer/protocol/tcp/TCP_Endpoint.cc
View file

@ -2,7 +2,7 @@
#include <errno.h> #include <errno.h>
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "analyzer/protocol/tcp/TCP.h" #include "analyzer/protocol/tcp/TCP.h"
#include "TCP_Reassembler.h" #include "TCP_Reassembler.h"

10
src/analyzer/protocol/tcp/TCP_Reassembler.cc
View file

@ -195,7 +195,7 @@ void TCP_Reassembler::Undelivered(uint64_t up_to_seq)
DEBUG_MSG("%.6f Undelivered: IsOrig()=%d up_to_seq=%" PRIu64", last_reassm=%" PRIu64", " DEBUG_MSG("%.6f Undelivered: IsOrig()=%d up_to_seq=%" PRIu64", last_reassm=%" PRIu64", "
"endp: FIN_cnt=%d, RST_cnt=%d, " "endp: FIN_cnt=%d, RST_cnt=%d, "
"peer: FIN_cnt=%d, RST_cnt=%d\n", "peer: FIN_cnt=%d, RST_cnt=%d\n",
zeek::net::network_time, IsOrig(), up_to_seq, last_reassem_seq, zeek::run_state::network_time, IsOrig(), up_to_seq, last_reassem_seq,
endpoint->FIN_cnt, endpoint->RST_cnt, endpoint->FIN_cnt, endpoint->RST_cnt,
peer->FIN_cnt, peer->RST_cnt); peer->FIN_cnt, peer->RST_cnt);
} }
@ -225,7 +225,7 @@ void TCP_Reassembler::Undelivered(uint64_t up_to_seq)
{ {
DEBUG_MSG("%.6f Undelivered: IsOrig()=%d, seq=%" PRIu64", len=%" PRIu64", " DEBUG_MSG("%.6f Undelivered: IsOrig()=%d, seq=%" PRIu64", len=%" PRIu64", "
"skip_deliveries=%d\n", "skip_deliveries=%d\n",
zeek::net::network_time, IsOrig(), last_reassem_seq, zeek::run_state::network_time, IsOrig(), last_reassem_seq,
up_to_seq - last_reassem_seq, up_to_seq - last_reassem_seq,
skip_deliveries); skip_deliveries);
} }
@ -440,7 +440,7 @@ void TCP_Reassembler::BlockInserted(zeek::DataBlockMap::const_iterator it)
void TCP_Reassembler::Overlap(const u_char* b1, const u_char* b2, uint64_t n) void TCP_Reassembler::Overlap(const u_char* b1, const u_char* b2, uint64_t n)
{ {
if ( DEBUG_tcp_contents ) if ( DEBUG_tcp_contents )
DEBUG_MSG("%.6f TCP contents overlap: %" PRIu64" IsOrig()=%d\n", zeek::net::network_time, n, IsOrig()); DEBUG_MSG("%.6f TCP contents overlap: %" PRIu64" IsOrig()=%d\n", zeek::run_state::network_time, n, IsOrig());
if ( rexmit_inconsistency && if ( rexmit_inconsistency &&
memcmp((const void*) b1, (const void*) b2, n) && memcmp((const void*) b1, (const void*) b2, n) &&
@ -477,7 +477,7 @@ bool TCP_Reassembler::DataSent(double t, uint64_t seq, int len,
if ( DEBUG_tcp_contents ) if ( DEBUG_tcp_contents )
{ {
DEBUG_MSG("%.6f DataSent: IsOrig()=%d seq=%" PRIu64" upper=%" PRIu64" ack=%" PRIu64"\n", DEBUG_MSG("%.6f DataSent: IsOrig()=%d seq=%" PRIu64" upper=%" PRIu64" ack=%" PRIu64"\n",
zeek::net::network_time, IsOrig(), seq, upper_seq, ack); zeek::run_state::network_time, IsOrig(), seq, upper_seq, ack);
} }
if ( skip_deliveries ) if ( skip_deliveries )
@ -581,7 +581,7 @@ void TCP_Reassembler::CheckEOF()
if ( DEBUG_tcp_connection_close ) if ( DEBUG_tcp_connection_close )
{ {
DEBUG_MSG("%.6f EOF for %d\n", DEBUG_MSG("%.6f EOF for %d\n",
zeek::net::network_time, endp->IsOrig()); zeek::run_state::network_time, endp->IsOrig());
} }
did_EOF = true; did_EOF = true;

3
src/analyzer/protocol/teredo/Teredo.cc
View file

@ -6,6 +6,7 @@
#include "Reporter.h" #include "Reporter.h"
#include "Sessions.h" #include "Sessions.h"
#include "ZeekString.h" #include "ZeekString.h"
#include "RunState.h"
#include "events.bif.h" #include "events.bif.h"
@ -232,7 +233,7 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::TEREDO); zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::TEREDO);
zeek::sessions->DoNextInnerPacket(zeek::net::network_time, nullptr, inner, e, ec); zeek::sessions->DoNextInnerPacket(zeek::run_state::network_time, nullptr, inner, e, ec);
} }
} // namespace zeek::analyzer::teredo } // namespace zeek::analyzer::teredo

6
src/analyzer/protocol/udp/UDP.cc
View file

@ -4,7 +4,7 @@
#include "zeek-config.h" #include "zeek-config.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "analyzer/protocol/udp/UDP.h" #include "analyzer/protocol/udp/UDP.h"
#include "analyzer/Manager.h" #include "analyzer/Manager.h"
@ -62,7 +62,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
int chksum = up->uh_sum; int chksum = up->uh_sum;
auto validate_checksum = ! zeek::net::current_pkt->l3_checksummed && ! zeek::detail::ignore_checksums && caplen >=len; auto validate_checksum = ! zeek::run_state::current_pkt->l3_checksummed && ! zeek::detail::ignore_checksums && caplen >=len;
constexpr auto vxlan_len = 8; constexpr auto vxlan_len = 8;
constexpr auto eth_len = 14; constexpr auto eth_len = 14;
@ -130,7 +130,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
ulen -= sizeof(struct udphdr); ulen -= sizeof(struct udphdr);
caplen -= sizeof(struct udphdr); caplen -= sizeof(struct udphdr);
Conn()->SetLastTime(zeek::net::current_timestamp); Conn()->SetLastTime(zeek::run_state::current_timestamp);
if ( udp_contents ) if ( udp_contents )
{ {

8
src/analyzer/protocol/vxlan/VXLAN.cc
View file

@ -6,7 +6,7 @@
#include "TunnelEncapsulation.h" #include "TunnelEncapsulation.h"
#include "Conn.h" #include "Conn.h"
#include "IP.h" #include "IP.h"
#include "Net.h" #include "RunState.h"
#include "Sessions.h" #include "Sessions.h"
#include "Reporter.h" #include "Reporter.h"
@ -61,8 +61,8 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
len -= vxlan_len; len -= vxlan_len;
pkt_timeval ts; pkt_timeval ts;
ts.tv_sec = (time_t) zeek::net::current_timestamp; ts.tv_sec = (time_t) zeek::run_state::current_timestamp;
ts.tv_usec = (suseconds_t) ((zeek::net::current_timestamp - (double)ts.tv_sec) * 1000000); ts.tv_usec = (suseconds_t) ((zeek::run_state::current_timestamp - (double)ts.tv_sec) * 1000000);
zeek::Packet pkt(DLT_EN10MB, &ts, caplen, len, data); zeek::Packet pkt(DLT_EN10MB, &ts, caplen, len, data);
if ( ! pkt.Layer2Valid() ) if ( ! pkt.Layer2Valid() )
@ -105,7 +105,7 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
inner->ToPktHdrVal(), zeek::val_mgr->Count(vni)); inner->ToPktHdrVal(), zeek::val_mgr->Count(vni));
zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN); zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN);
zeek::sessions->DoNextInnerPacket(zeek::net::network_time, &pkt, inner, estack, ec); zeek::sessions->DoNextInnerPacket(zeek::run_state::network_time, &pkt, inner, estack, ec);
} }
} // namespace zeek::analyzer::vxlan } // namespace zeek::analyzer::vxlan

3
src/binpac_bro-lib.pac
View file

@ -4,6 +4,7 @@
#include "Reporter.h" #include "Reporter.h"
#include "Val.h" #include "Val.h"
#include "ConvertUTF.h" #include "ConvertUTF.h"
#include "RunState.h"
%} %}
%code{ %code{
@ -63,5 +64,5 @@ zeek::StringVal* utf16_bytestring_to_utf8_val(zeek::Connection* conn, const byte
function network_time(): double function network_time(): double
%{ %{
return zeek::net::network_time; return zeek::run_state::network_time;
%} %}

10
src/broker/Manager.cc
View file

@ -22,7 +22,7 @@
#include "DebugLogger.h" #include "DebugLogger.h"
#include "iosource/Manager.h" #include "iosource/Manager.h"
#include "SerializationFormat.h" #include "SerializationFormat.h"
#include "Net.h" #include "RunState.h"
using namespace std; using namespace std;
@ -923,7 +923,7 @@ void Manager::Process()
// Ensure that time gets update before processing broker messages, or events // Ensure that time gets update before processing broker messages, or events
// based on them might get scheduled wrong. // based on them might get scheduled wrong.
if ( use_real_time ) if ( use_real_time )
zeek::net::detail::net_update_time(zeek::util::current_time()); zeek::run_state::detail::net_update_time(zeek::util::current_time());
bool had_input = false; bool had_input = false;
@ -995,11 +995,11 @@ void Manager::Process()
if ( had_input ) if ( had_input )
{ {
if ( zeek::net::network_time == 0 ) if ( zeek::run_state::network_time == 0 )
// If we're getting Broker messages, but still haven't initialized // If we're getting Broker messages, but still haven't initialized
// zeek::net::network_time, may as well do so now because otherwise the // zeek::run_state::network_time, may as well do so now because otherwise the
// broker/cluster logs will end up using timestamp 0. // broker/cluster logs will end up using timestamp 0.
zeek::net::detail::net_update_time(zeek::util::current_time()); zeek::run_state::detail::net_update_time(zeek::util::current_time());
} }
} }

8
src/file_analysis/File.cc
View file

@ -115,7 +115,7 @@ File::~File()
void File::UpdateLastActivityTime() void File::UpdateLastActivityTime()
{ {
val->Assign(last_active_idx, zeek::make_intrusive<zeek::TimeVal>(zeek::net::network_time)); val->Assign(last_active_idx, zeek::make_intrusive<zeek::TimeVal>(zeek::run_state::network_time));
} }
double File::GetLastActivityTime() const double File::GetLastActivityTime() const
@ -250,7 +250,7 @@ bool File::IsComplete() const
void File::ScheduleInactivityTimer() const void File::ScheduleInactivityTimer() const
{ {
zeek::detail::timer_mgr->Add(new detail::FileTimer(zeek::net::network_time, id, GetTimeoutInterval())); zeek::detail::timer_mgr->Add(new detail::FileTimer(zeek::run_state::network_time, id, GetTimeoutInterval()));
} }
bool File::AddAnalyzer(file_analysis::Tag tag, zeek::RecordVal* args) bool File::AddAnalyzer(file_analysis::Tag tag, zeek::RecordVal* args)
@ -469,7 +469,7 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
} }
// Forward data to the reassembler. // Forward data to the reassembler.
file_reassembler->NewBlock(zeek::net::network_time, offset, len, data); file_reassembler->NewBlock(zeek::run_state::network_time, offset, len, data);
} }
else if ( stream_offset == offset ) else if ( stream_offset == offset )
{ {
@ -482,7 +482,7 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
// This is data that doesn't match the offset and the reassembler // This is data that doesn't match the offset and the reassembler
// needs to be enabled. // needs to be enabled.
file_reassembler = new FileReassembler(this, stream_offset); file_reassembler = new FileReassembler(this, stream_offset);
file_reassembler->NewBlock(zeek::net::network_time, offset, len, data); file_reassembler->NewBlock(zeek::run_state::network_time, offset, len, data);
} }
else else
{ {

4
src/file_analysis/Manager.h
View file

@ -7,7 +7,7 @@
#include <map> #include <map>
#include "Component.h" #include "Component.h"
#include "Net.h" #include "RunState.h"
#include "RuleMatcher.h" #include "RuleMatcher.h"
#include "plugin/ComponentManager.h" #include "plugin/ComponentManager.h"
@ -381,7 +381,7 @@ protected:
* @param is_termination whether the Manager (and probably Bro) is in a * @param is_termination whether the Manager (and probably Bro) is in a
* terminating state. If true, then the timeout cannot be postponed. * terminating state. If true, then the timeout cannot be postponed.
*/ */
void Timeout(const std::string& file_id, bool is_terminating = zeek::net::terminating); void Timeout(const std::string& file_id, bool is_terminating = zeek::run_state::terminating);
/** /**
* Immediately remove file_analysis::File object associated with \a file_id. * Immediately remove file_analysis::File object associated with \a file_id.

4
src/fuzzers/fuzzer-setup.h
View file

@ -49,7 +49,7 @@ namespace zeek { namespace detail {
void fuzzer_cleanup_one_input() void fuzzer_cleanup_one_input()
{ {
terminating = true; run_state::terminating = true;
broker_mgr->ClearStores(); broker_mgr->ClearStores();
file_mgr->Terminate(); file_mgr->Terminate();
timer_mgr->Expire(); timer_mgr->Expire();
@ -58,7 +58,7 @@ void fuzzer_cleanup_one_input()
sessions->Drain(); sessions->Drain();
zeek::event_mgr.Drain(); zeek::event_mgr.Drain();
sessions->Clear(); sessions->Clear();
terminating = false; run_state::terminating = false;
} }
}} // namespace zeek::detail }} // namespace zeek::detail

2
src/fuzzers/pop3-fuzzer.cc
View file

@ -1,6 +1,6 @@
#include "binpac.h" #include "binpac.h"
#include "Net.h" #include "RunState.h"
#include "Conn.h" #include "Conn.h"
#include "Sessions.h" #include "Sessions.h"
#include "analyzer/Analyzer.h" #include "analyzer/Analyzer.h"

2
src/input/Manager.cc
View file

@ -15,7 +15,7 @@
#include "Event.h" #include "Event.h"
#include "EventHandler.h" #include "EventHandler.h"
#include "NetVar.h" #include "NetVar.h"
#include "Net.h" #include "RunState.h"
#include "CompHash.h" #include "CompHash.h"
#include "Func.h" #include "Func.h"

8
src/iosource/Manager.cc
View file

@ -9,7 +9,7 @@
#include "Manager.h" #include "Manager.h"
#include "Component.h" #include "Component.h"
#include "IOSource.h" #include "IOSource.h"
#include "Net.h" #include "RunState.h"
#include "PktSrc.h" #include "PktSrc.h"
#include "PktDumper.h" #include "PktDumper.h"
#include "plugin/Manager.h" #include "plugin/Manager.h"
@ -115,7 +115,7 @@ void Manager::FindReadySources(std::vector<IOSource*>* ready)
// If there aren't any sources and exit_only_after_terminate is false, just // If there aren't any sources and exit_only_after_terminate is false, just
// return an empty set of sources. We want the main loop to end. // return an empty set of sources. We want the main loop to end.
if ( Size() == 0 && ( ! zeek::BifConst::exit_only_after_terminate || zeek::net::terminating ) ) if ( Size() == 0 && ( ! zeek::BifConst::exit_only_after_terminate || zeek::run_state::terminating ) )
return; return;
double timeout = -1; double timeout = -1;
@ -166,7 +166,7 @@ void Manager::FindReadySources(std::vector<IOSource*>* ready)
} }
else else
{ {
if ( ! zeek::net::pseudo_realtime ) if ( ! zeek::run_state::pseudo_realtime )
// A pcap file is always ready to process unless it's suspended // A pcap file is always ready to process unless it's suspended
ready->push_back(pkt_src); ready->push_back(pkt_src);
} }
@ -315,7 +315,7 @@ void Manager::Register(PktSrc* src)
// little bit for those sources. // little bit for those sources.
if ( src->IsLive() ) if ( src->IsLive() )
poll_interval = 10; poll_interval = 10;
else if ( zeek::net::pseudo_realtime ) else if ( zeek::run_state::pseudo_realtime )
poll_interval = 1; poll_interval = 1;
Register(src, false); Register(src, false);

26
src/iosource/PktSrc.cc
View file

@ -7,7 +7,7 @@
#include "util.h" #include "util.h"
#include "Hash.h" #include "Hash.h"
#include "Net.h" #include "RunState.h"
#include "Sessions.h" #include "Sessions.h"
#include "broker/Manager.h" #include "broker/Manager.h"
#include "iosource/Manager.h" #include "iosource/Manager.h"
@ -82,7 +82,7 @@ double PktSrc::CurrentPacketTimestamp()
double PktSrc::CurrentPacketWallClock() double PktSrc::CurrentPacketWallClock()
{ {
// We stop time when we are suspended. // We stop time when we are suspended.
if ( zeek::net::net_is_processing_suspended() ) if ( zeek::run_state::net_is_processing_suspended() )
current_wallclock = zeek::util::current_time(true); current_wallclock = zeek::util::current_time(true);
return current_wallclock; return current_wallclock;
@ -175,9 +175,9 @@ double PktSrc::CheckPseudoTime()
return 0; return 0;
double pseudo_time = current_packet.time - first_timestamp; double pseudo_time = current_packet.time - first_timestamp;
double ct = (zeek::util::current_time(true) - first_wallclock) * zeek::net::pseudo_realtime; double ct = (zeek::util::current_time(true) - first_wallclock) * zeek::run_state::pseudo_realtime;
return pseudo_time <= ct ? zeek::net::zeek_start_time + pseudo_time : 0; return pseudo_time <= ct ? zeek::run_state::zeek_start_time + pseudo_time : 0;
} }
void PktSrc::InitSource() void PktSrc::InitSource()
@ -201,16 +201,16 @@ void PktSrc::Process()
if ( current_packet.Layer2Valid() ) if ( current_packet.Layer2Valid() )
{ {
if ( zeek::net::pseudo_realtime ) if ( zeek::run_state::pseudo_realtime )
{ {
current_pseudo = CheckPseudoTime(); current_pseudo = CheckPseudoTime();
zeek::net::detail::net_packet_dispatch(current_pseudo, &current_packet, this); zeek::run_state::detail::net_packet_dispatch(current_pseudo, &current_packet, this);
if ( ! first_wallclock ) if ( ! first_wallclock )
first_wallclock = zeek::util::current_time(true); first_wallclock = zeek::util::current_time(true);
} }
else else
zeek::net::detail::net_packet_dispatch(current_packet.time, &current_packet, this); zeek::run_state::detail::net_packet_dispatch(current_packet.time, &current_packet, this);
} }
have_packet = false; have_packet = false;
@ -231,10 +231,10 @@ bool PktSrc::ExtractNextPacketInternal()
// Don't return any packets if processing is suspended (except for the // Don't return any packets if processing is suspended (except for the
// very first packet which we need to set up times). // very first packet which we need to set up times).
if ( zeek::net::net_is_processing_suspended() && first_timestamp ) if ( zeek::run_state::net_is_processing_suspended() && first_timestamp )
return false; return false;
if ( zeek::net::pseudo_realtime ) if ( zeek::run_state::pseudo_realtime )
current_wallclock = zeek::util::current_time(true); current_wallclock = zeek::util::current_time(true);
if ( ExtractNextPacket(&current_packet) ) if ( ExtractNextPacket(&current_packet) )
@ -252,7 +252,7 @@ bool PktSrc::ExtractNextPacketInternal()
return true; return true;
} }
if ( zeek::net::pseudo_realtime && ! IsOpen() ) if ( zeek::run_state::pseudo_realtime && ! IsOpen() )
{ {
if ( broker_mgr->Active() ) if ( broker_mgr->Active() )
iosource_mgr->Terminate(); iosource_mgr->Terminate();
@ -344,16 +344,16 @@ double PktSrc::GetNextTimeout()
// but we're not in pseudo-realtime mode, let the loop just spin as fast as it can. If we're // but we're not in pseudo-realtime mode, let the loop just spin as fast as it can. If we're
// in pseudo-realtime mode, find the next time that a packet is ready and have poll block until // in pseudo-realtime mode, find the next time that a packet is ready and have poll block until
// then. // then.
if ( IsLive() || zeek::net::net_is_processing_suspended() ) if ( IsLive() || zeek::run_state::net_is_processing_suspended() )
return -1; return -1;
else if ( ! zeek::net::pseudo_realtime ) else if ( ! zeek::run_state::pseudo_realtime )
return 0; return 0;
if ( ! have_packet ) if ( ! have_packet )
ExtractNextPacketInternal(); ExtractNextPacketInternal();
double pseudo_time = current_packet.time - first_timestamp; double pseudo_time = current_packet.time - first_timestamp;
double ct = (zeek::util::current_time(true) - first_wallclock) * zeek::net::pseudo_realtime; double ct = (zeek::util::current_time(true) - first_wallclock) * zeek::run_state::pseudo_realtime;
return std::max(0.0, pseudo_time - ct); return std::max(0.0, pseudo_time - ct);
} }

6
src/iosource/pcap/Dumper.cc
View file

@ -5,7 +5,7 @@
#include "Dumper.h" #include "Dumper.h"
#include "../PktSrc.h" #include "../PktSrc.h"
#include "../../Net.h" #include "../../RunState.h"
#include "pcap.bif.h" #include "pcap.bif.h"
@ -47,7 +47,7 @@ void PcapDumper::Open()
if ( append ) if ( append )
{ {
// See if output file already exists (and is non-empty). // See if output file already exists (and is non-empty).
exists = stat(props.path.c_str(), &s); ; exists = stat(props.path.c_str(), &s);
if ( exists < 0 && errno != ENOENT ) if ( exists < 0 && errno != ENOENT )
{ {
@ -81,7 +81,7 @@ void PcapDumper::Open()
} }
} }
props.open_time = zeek::net::network_time; props.open_time = zeek::run_state::network_time;
props.hdr_size = zeek::Packet::GetLinkHeaderSize(pcap_datalink(pd)); props.hdr_size = zeek::Packet::GetLinkHeaderSize(pcap_datalink(pd));
Opened(props); Opened(props);
} }

34
src/logging/Manager.cc
View file

@ -7,7 +7,7 @@
#include "Event.h" #include "Event.h"
#include "EventHandler.h" #include "EventHandler.h"
#include "NetVar.h" #include "NetVar.h"
#include "Net.h" #include "RunState.h"
#include "Type.h" #include "Type.h"
#include "File.h" #include "File.h"
#include "input.h" #include "input.h"
@ -863,7 +863,7 @@ bool Manager::Write(zeek::EnumVal* id, zeek::RecordVal* columns_arg)
info = new WriterBackend::WriterInfo; info = new WriterBackend::WriterInfo;
info->path = zeek::util::copy_string(path.c_str()); info->path = zeek::util::copy_string(path.c_str());
info->network_time = zeek::net::network_time; info->network_time = zeek::run_state::network_time;
zeek::detail::HashKey* k; zeek::detail::HashKey* k;
zeek::IterCookie* c = filter->config->AsTable()->InitForIteration(); zeek::IterCookie* c = filter->config->AsTable()->InitForIteration();
@ -1151,7 +1151,7 @@ WriterFrontend* Manager::CreateWriter(zeek::EnumVal* id, zeek::EnumVal* writer,
WriterInfo* winfo = new WriterInfo; WriterInfo* winfo = new WriterInfo;
winfo->type = writer->Ref()->AsEnumVal(); winfo->type = writer->Ref()->AsEnumVal();
winfo->writer = nullptr; winfo->writer = nullptr;
winfo->open_time = zeek::net::network_time; winfo->open_time = zeek::run_state::network_time;
winfo->rotation_timer = nullptr; winfo->rotation_timer = nullptr;
winfo->interval = 0; winfo->interval = 0;
winfo->postprocessor = nullptr; winfo->postprocessor = nullptr;
@ -1345,7 +1345,7 @@ bool Manager::Flush(zeek::EnumVal* id)
for ( Stream::WriterMap::iterator i = stream->writers.begin(); for ( Stream::WriterMap::iterator i = stream->writers.begin();
i != stream->writers.end(); i++ ) i != stream->writers.end(); i++ )
i->second->writer->Flush(zeek::net::network_time); i->second->writer->Flush(zeek::run_state::network_time);
RemoveDisabledWriters(stream); RemoveDisabledWriters(stream);
@ -1441,14 +1441,14 @@ void RotationTimer::Dispatch(double t, bool is_expire)
if ( ! is_expire ) if ( ! is_expire )
{ {
winfo->open_time = zeek::net::network_time; winfo->open_time = zeek::run_state::network_time;
log_mgr->InstallRotationTimer(winfo); log_mgr->InstallRotationTimer(winfo);
} }
} }
void Manager::InstallRotationTimer(WriterInfo* winfo) void Manager::InstallRotationTimer(WriterInfo* winfo)
{ {
if ( zeek::net::terminating ) if ( zeek::run_state::terminating )
return; return;
if ( winfo->rotation_timer ) if ( winfo->rotation_timer )
@ -1461,25 +1461,25 @@ void Manager::InstallRotationTimer(WriterInfo* winfo)
if ( rotation_interval ) if ( rotation_interval )
{ {
// When this is called for the first time, zeek::net::network_time can still be // When this is called for the first time, zeek::run_state::network_time can still be
// zero. If so, we set a timer which fires immediately but doesn't // zero. If so, we set a timer which fires immediately but doesn't
// rotate when it expires. // rotate when it expires.
if ( ! zeek::net::network_time ) if ( ! zeek::run_state::network_time )
winfo->rotation_timer = new RotationTimer(1, winfo, false); winfo->rotation_timer = new RotationTimer(1, winfo, false);
else else
{ {
if ( ! winfo->open_time ) if ( ! winfo->open_time )
winfo->open_time = zeek::net::network_time; winfo->open_time = zeek::run_state::network_time;
static auto log_rotate_base_time = zeek::id::find_val<zeek::StringVal>("log_rotate_base_time"); static auto log_rotate_base_time = zeek::id::find_val<zeek::StringVal>("log_rotate_base_time");
static auto base_time = log_rotate_base_time->AsString()->CheckString(); static auto base_time = log_rotate_base_time->AsString()->CheckString();
double base = zeek::util::detail::parse_rotate_base_time(base_time); double base = zeek::util::detail::parse_rotate_base_time(base_time);
double delta_t = double delta_t =
zeek::util::detail::calc_next_rotate(zeek::net::network_time, rotation_interval, base); zeek::util::detail::calc_next_rotate(zeek::run_state::network_time, rotation_interval, base);
winfo->rotation_timer = winfo->rotation_timer =
new RotationTimer(zeek::net::network_time + delta_t, winfo, true); new RotationTimer(zeek::run_state::network_time + delta_t, winfo, true);
} }
zeek::detail::timer_mgr->Add(winfo->rotation_timer); zeek::detail::timer_mgr->Add(winfo->rotation_timer);
@ -1553,7 +1553,7 @@ std::string Manager::FormatRotationPath(zeek::EnumValPtr writer,
void Manager::Rotate(WriterInfo* winfo) void Manager::Rotate(WriterInfo* winfo)
{ {
DBG_LOG(zeek::DBG_LOGGING, "Rotating %s at %.6f", DBG_LOG(zeek::DBG_LOGGING, "Rotating %s at %.6f",
winfo->writer->Name(), zeek::net::network_time); winfo->writer->Name(), zeek::run_state::network_time);
static auto default_ppf = zeek::id::find_func("Log::__default_rotation_postprocessor"); static auto default_ppf = zeek::id::find_func("Log::__default_rotation_postprocessor");
@ -1566,11 +1566,11 @@ void Manager::Rotate(WriterInfo* winfo)
auto rotation_path = FormatRotationPath({zeek::NewRef{}, winfo->type}, auto rotation_path = FormatRotationPath({zeek::NewRef{}, winfo->type},
winfo->writer->Info().path, winfo->writer->Info().path,
winfo->open_time, zeek::net::network_time, winfo->open_time, zeek::run_state::network_time,
zeek::net::terminating, zeek::run_state::terminating,
std::move(ppf)); std::move(ppf));
winfo->writer->Rotate(rotation_path.data(), winfo->open_time, zeek::net::network_time, zeek::net::terminating); winfo->writer->Rotate(rotation_path.data(), winfo->open_time, zeek::run_state::network_time, zeek::run_state::terminating);
++rotations_pending; ++rotations_pending;
} }
@ -1585,12 +1585,12 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
if ( ! success ) if ( ! success )
{ {
DBG_LOG(zeek::DBG_LOGGING, "Non-successful rotating writer '%s', file '%s' at %.6f,", DBG_LOG(zeek::DBG_LOGGING, "Non-successful rotating writer '%s', file '%s' at %.6f,",
writer->Name(), filename, zeek::net::network_time); writer->Name(), filename, zeek::run_state::network_time);
return true; return true;
} }
DBG_LOG(zeek::DBG_LOGGING, "Finished rotating %s at %.6f, new name %s", DBG_LOG(zeek::DBG_LOGGING, "Finished rotating %s at %.6f, new name %s",
writer->Name(), zeek::net::network_time, new_name); writer->Name(), zeek::run_state::network_time, new_name);
WriterInfo* winfo = FindWriter(writer); WriterInfo* winfo = FindWriter(writer);
if ( ! winfo ) if ( ! winfo )

4
src/logging/WriterFrontend.cc
View file

@ -1,5 +1,5 @@
#include "Net.h" #include "RunState.h"
#include "threading/SerialTypes.h" #include "threading/SerialTypes.h"
#include "broker/Manager.h" #include "broker/Manager.h"
@ -226,7 +226,7 @@ void WriterFrontend::Write(int arg_num_fields, Value** vals)
write_buffer[write_buffer_pos++] = vals; write_buffer[write_buffer_pos++] = vals;
if ( write_buffer_pos >= WRITER_BUFFER_SIZE || ! buf || zeek::net::terminating ) if ( write_buffer_pos >= WRITER_BUFFER_SIZE || ! buf || zeek::run_state::terminating )
// Buffer full (or no bufferin desired or termiating). // Buffer full (or no bufferin desired or termiating).
FlushWriteBuffer(); FlushWriteBuffer();

3
src/logging/writers/ascii/Ascii.cc
View file

@ -15,6 +15,7 @@
#include <dirent.h> #include <dirent.h>
#include "Func.h" #include "Func.h"
#include "RunState.h"
#include "supervisor/Supervisor.h" #include "supervisor/Supervisor.h"
#include "logging/Manager.h" #include "logging/Manager.h"
#include "threading/SerialTypes.h" #include "threading/SerialTypes.h"
@ -398,7 +399,7 @@ Ascii::~Ascii()
if ( ! ascii_done ) if ( ! ascii_done )
// In case of errors aborting the logging altogether, // In case of errors aborting the logging altogether,
// DoFinish() may not have been called. // DoFinish() may not have been called.
CloseFile(zeek::net::network_time); CloseFile(zeek::run_state::network_time);
delete formatter; delete formatter;
} }

6
src/main.cc
View file

@ -5,7 +5,7 @@
#include "iosource/Manager.h" #include "iosource/Manager.h"
#include "supervisor/Supervisor.h" #include "supervisor/Supervisor.h"
#include "Net.h" #include "RunState.h"
int main(int argc, char** argv) int main(int argc, char** argv)
{ {
@ -17,7 +17,7 @@ int main(int argc, char** argv)
auto& options = setup_result.options; auto& options = setup_result.options;
auto do_net_run = zeek::iosource_mgr->Size() > 0 || auto do_net_run = zeek::iosource_mgr->Size() > 0 ||
zeek::net::detail::have_pending_timers || zeek::run_state::detail::have_pending_timers ||
zeek::BifConst::exit_only_after_terminate; zeek::BifConst::exit_only_after_terminate;
if ( do_net_run ) if ( do_net_run )
@ -56,7 +56,7 @@ int main(int argc, char** argv)
mem_net_start_malloced / 1024 / 1024); mem_net_start_malloced / 1024 / 1024);
} }
zeek::net::detail::net_run(); zeek::run_state::detail::net_run();
double time_net_done = zeek::util::current_time(true); double time_net_done = zeek::util::current_time(true);

2
src/scan.l
View file

@ -31,7 +31,7 @@
#include "broparse.h" #include "broparse.h"
#include "Reporter.h" #include "Reporter.h"
#include "RE.h" #include "RE.h"
#include "Net.h" #include "RunState.h"
#include "Traverse.h" #include "Traverse.h"
#include "module_util.h" #include "module_util.h"
#include "ScannedFile.h" #include "ScannedFile.h"

4
src/stats.bif
View file

@ -140,7 +140,7 @@ function get_proc_stats%(%): ProcStats
auto r = zeek::make_intrusive<zeek::RecordVal>(ProcStats); auto r = zeek::make_intrusive<zeek::RecordVal>(ProcStats);
int n = 0; int n = 0;
double elapsed_time = zeek::util::current_time() - zeek::net::zeek_start_time; double elapsed_time = zeek::util::current_time() - zeek::run_state::zeek_start_time;
double user_time = double user_time =
double(ru.ru_utime.tv_sec) + double(ru.ru_utime.tv_usec) / 1e6; double(ru.ru_utime.tv_sec) + double(ru.ru_utime.tv_usec) / 1e6;
double system_time = double system_time =
@ -152,7 +152,7 @@ function get_proc_stats%(%): ProcStats
r->Assign(n++, zeek::val_mgr->Count(0)); r->Assign(n++, zeek::val_mgr->Count(0));
#endif #endif
r->Assign(n++, zeek::make_intrusive<zeek::TimeVal>(zeek::net::zeek_start_time)); r->Assign(n++, zeek::make_intrusive<zeek::TimeVal>(zeek::run_state::zeek_start_time));
r->Assign(n++, zeek::make_intrusive<zeek::IntervalVal>(elapsed_time, Seconds)); r->Assign(n++, zeek::make_intrusive<zeek::IntervalVal>(elapsed_time, Seconds));
r->Assign(n++, zeek::make_intrusive<zeek::IntervalVal>(user_time, Seconds)); r->Assign(n++, zeek::make_intrusive<zeek::IntervalVal>(user_time, Seconds));

6
src/supervisor/Supervisor.cc
View file

@ -24,7 +24,7 @@
#include "DebugLogger.h" #include "DebugLogger.h"
#include "ID.h" #include "ID.h"
#include "Val.h" #include "Val.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "zeek-config.h" #include "zeek-config.h"
#include "util.h" #include "util.h"
@ -200,10 +200,10 @@ void zeek::detail::ParentProcessCheckTimer::Dispatch(double t, bool is_expire)
// FreeBSD: procctl(PROC_PDEATHSIG_CTL) // FreeBSD: procctl(PROC_PDEATHSIG_CTL)
// Also note the Stem process has its own polling loop with similar logic. // Also note the Stem process has its own polling loop with similar logic.
if ( zeek::Supervisor::ThisNode()->parent_pid != getppid() ) if ( zeek::Supervisor::ThisNode()->parent_pid != getppid() )
zeek::net::detail::zeek_terminate_loop("supervised node was orphaned"); zeek::run_state::detail::zeek_terminate_loop("supervised node was orphaned");
if ( ! is_expire ) if ( ! is_expire )
timer_mgr->Add(new ParentProcessCheckTimer(zeek::net::network_time + interval, timer_mgr->Add(new ParentProcessCheckTimer(zeek::run_state::network_time + interval,
interval)); interval));
} }

11
src/threading/Manager.cc
View file

@ -7,6 +7,7 @@
#include "iosource/Manager.h" #include "iosource/Manager.h"
#include "Event.h" #include "Event.h"
#include "IPAddr.h" #include "IPAddr.h"
#include "RunState.h"
namespace zeek::threading { namespace zeek::threading {
namespace detail { namespace detail {
@ -130,7 +131,7 @@ void Manager::SendHeartbeats()
void Manager::StartHeartbeatTimer() void Manager::StartHeartbeatTimer()
{ {
heartbeat_timer_running = true; heartbeat_timer_running = true;
zeek::detail::timer_mgr->Add(new detail::HeartbeatTimer(zeek::net::network_time + zeek::BifConst::Threading::heartbeat_interval)); zeek::detail::timer_mgr->Add(new detail::HeartbeatTimer(zeek::run_state::network_time + zeek::BifConst::Threading::heartbeat_interval));
} }
// Raise everything in here as warnings so it is passed to scriptland without // Raise everything in here as warnings so it is passed to scriptland without
@ -191,10 +192,10 @@ void Manager::Flush()
{ {
bool do_beat = false; bool do_beat = false;
if ( zeek::net::network_time && (zeek::net::network_time > next_beat || ! next_beat) ) if ( zeek::run_state::network_time && (zeek::run_state::network_time > next_beat || ! next_beat) )
{ {
do_beat = true; do_beat = true;
next_beat = ::zeek::net::network_time + zeek::BifConst::Threading::heartbeat_interval; next_beat = ::zeek::run_state::network_time + zeek::BifConst::Threading::heartbeat_interval;
} }
did_process = false; did_process = false;
@ -213,7 +214,7 @@ void Manager::Flush()
if ( msg->Process() ) if ( msg->Process() )
{ {
if ( zeek::net::network_time ) if ( zeek::run_state::network_time )
did_process = true; did_process = true;
} }
@ -253,7 +254,7 @@ void Manager::Flush()
delete t; delete t;
} }
// fprintf(stderr, "P %.6f %.6f do_beat=%d did_process=%d next_next=%.6f\n", zeek::net::network_time, // fprintf(stderr, "P %.6f %.6f do_beat=%d did_process=%d next_next=%.6f\n", zeek::run_state::network_time,
// zeek::detail::timer_mgr->Time(), do_beat, (int)did_process, next_beat); // zeek::detail::timer_mgr->Time(), do_beat, (int)did_process, next_beat);
} }

8
src/threading/MsgThread.cc
View file

@ -7,7 +7,7 @@
#include "MsgThread.h" #include "MsgThread.h"
#include "Manager.h" #include "Manager.h"
#include "iosource/Manager.h" #include "iosource/Manager.h"
#include "Net.h" #include "RunState.h"
// Set by Zeek's main signal handler. // Set by Zeek's main signal handler.
extern int signal_val; extern int signal_val;
@ -229,7 +229,7 @@ void MsgThread::OnSignalStop()
child_sent_finish = true; child_sent_finish = true;
// Signal thread to terminate. // Signal thread to terminate.
SendIn(new detail::FinishMessage(this, zeek::net::network_time), true); SendIn(new detail::FinishMessage(this, zeek::run_state::network_time), true);
} }
void MsgThread::OnWaitForStop() void MsgThread::OnWaitForStop()
@ -303,7 +303,7 @@ void MsgThread::Heartbeat()
if ( child_sent_finish ) if ( child_sent_finish )
return; return;
SendIn(new detail::HeartbeatMessage(this, zeek::net::network_time, zeek::util::current_time())); SendIn(new detail::HeartbeatMessage(this, zeek::run_state::network_time, zeek::util::current_time()));
} }
void MsgThread::Finished() void MsgThread::Finished()
@ -450,7 +450,7 @@ void MsgThread::Run()
// anymore. // anymore.
if ( ! child_finished && ! Killed() ) if ( ! child_finished && ! Killed() )
{ {
OnFinish(zeek::net::network_time); OnFinish(zeek::run_state::network_time);
Finished(); Finished();
} }
} }

30
src/util.cc
View file

@ -52,7 +52,7 @@
#include "Obj.h" #include "Obj.h"
#include "Val.h" #include "Val.h"
#include "NetVar.h" #include "NetVar.h"
#include "Net.h" #include "RunState.h"
#include "Reporter.h" #include "Reporter.h"
#include "iosource/Manager.h" #include "iosource/Manager.h"
#include "iosource/PktSrc.h" #include "iosource/PktSrc.h"
@ -854,7 +854,7 @@ FILE* rotate_file(const char* name, zeek::RecordVal* rotate_info)
auto tmpname = tmpname_buf.get(); auto tmpname = tmpname_buf.get();
snprintf(newname, buflen, "%s.%d.%.06f.tmp", snprintf(newname, buflen, "%s.%d.%.06f.tmp",
name, getpid(), zeek::net::network_time); name, getpid(), zeek::run_state::network_time);
newname[buflen-1] = '\0'; newname[buflen-1] = '\0';
strcpy(tmpname, newname); strcpy(tmpname, newname);
strcat(tmpname, ".tmp"); strcat(tmpname, ".tmp");
@ -891,8 +891,8 @@ FILE* rotate_file(const char* name, zeek::RecordVal* rotate_info)
{ {
rotate_info->Assign<zeek::StringVal>(0, name); rotate_info->Assign<zeek::StringVal>(0, name);
rotate_info->Assign<zeek::StringVal>(1, newname); rotate_info->Assign<zeek::StringVal>(1, newname);
rotate_info->Assign<zeek::TimeVal>(2, zeek::net::network_time); rotate_info->Assign<zeek::TimeVal>(2, zeek::run_state::network_time);
rotate_info->Assign<zeek::TimeVal>(3, zeek::net::network_time); rotate_info->Assign<zeek::TimeVal>(3, zeek::run_state::network_time);
} }
return newf; return newf;
@ -957,7 +957,7 @@ double calc_next_rotate(double current, double interval, double base)
void terminate_processing() void terminate_processing()
{ {
if ( ! zeek::net::terminating ) if ( ! zeek::run_state::terminating )
raise(SIGTERM); raise(SIGTERM);
} }
@ -2031,13 +2031,13 @@ double current_time(bool real)
double t = double(tv.tv_sec) + double(tv.tv_usec) / 1e6; double t = double(tv.tv_sec) + double(tv.tv_usec) / 1e6;
if ( ! zeek::net::pseudo_realtime || real || ! zeek::iosource_mgr || ! zeek::iosource_mgr->GetPktSrc() ) if ( ! zeek::run_state::pseudo_realtime || real || ! zeek::iosource_mgr || ! zeek::iosource_mgr->GetPktSrc() )
return t; return t;
// This obviously only works for a single source ... // This obviously only works for a single source ...
zeek::iosource::PktSrc* src = zeek::iosource_mgr->GetPktSrc(); zeek::iosource::PktSrc* src = zeek::iosource_mgr->GetPktSrc();
if ( zeek::net::net_is_processing_suspended() ) if ( zeek::run_state::net_is_processing_suspended() )
return src->CurrentPacketTimestamp(); return src->CurrentPacketTimestamp();
// We don't scale with pseudo_realtime here as that would give us a // We don't scale with pseudo_realtime here as that would give us a
@ -2269,7 +2269,7 @@ void* debug_malloc(size_t t)
{ {
void* v = malloc(t); void* v = malloc(t);
if ( malloc_debug ) if ( malloc_debug )
printf("%.6f malloc %x %d\n", zeek::net::network_time, v, t); printf("%.6f malloc %x %d\n", zeek::run_state::network_time, v, t);
return v; return v;
} }
@ -2277,14 +2277,14 @@ void* debug_realloc(void* v, size_t t)
{ {
v = realloc(v, t); v = realloc(v, t);
if ( malloc_debug ) if ( malloc_debug )
printf("%.6f realloc %x %d\n", zeek::net::network_time, v, t); printf("%.6f realloc %x %d\n", zeek::run_state::network_time, v, t);
return v; return v;
} }
void debug_free(void* v) void debug_free(void* v)
{ {
if ( malloc_debug ) if ( malloc_debug )
printf("%.6f free %x\n", zeek::net::network_time, v); printf("%.6f free %x\n", zeek::run_state::network_time, v);
free(v); free(v);
} }
@ -2292,7 +2292,7 @@ void* operator new(size_t t)
{ {
void* v = malloc(t); void* v = malloc(t);
if ( malloc_debug ) if ( malloc_debug )
printf("%.6f new %x %d\n", zeek::net::network_time, v, t); printf("%.6f new %x %d\n", zeek::run_state::network_time, v, t);
return v; return v;
} }
@ -2300,21 +2300,21 @@ void* operator new[](size_t t)
{ {
void* v = malloc(t); void* v = malloc(t);
if ( malloc_debug ) if ( malloc_debug )
printf("%.6f new[] %x %d\n", zeek::net::network_time, v, t); printf("%.6f new[] %x %d\n", zeek::run_state::network_time, v, t);
return v; return v;
} }
void operator delete(void* v) void operator delete(void* v)
{ {
if ( malloc_debug ) if ( malloc_debug )
printf("%.6f delete %x\n", zeek::net::network_time, v); printf("%.6f delete %x\n", zeek::run_state::network_time, v);
free(v); free(v);
} }
void operator delete[](void* v) void operator delete[](void* v)
{ {
if ( malloc_debug ) if ( malloc_debug )
printf("%.6f delete %x\n", zeek::net::network_time, v); printf("%.6f delete %x\n", zeek::run_state::network_time, v);
free(v); free(v);
} }
@ -2530,7 +2530,7 @@ string json_escape_utf8(const string& val)
} // namespace zeek::util } // namespace zeek::util
// Remove in v4.1. // Remove in v4.1.
double& network_time = zeek::net::network_time; double& network_time = zeek::run_state::network_time;
unsigned int bro_prng(unsigned int state) unsigned int bro_prng(unsigned int state)
{ return zeek::util::detail::prng(state); } { return zeek::util::detail::prng(state); }

2
src/util.h
View file

@ -111,7 +111,7 @@ extern char* strcasestr(const char* s, const char* find);
// perspective. In particular, if we're reading from a savefile this // perspective. In particular, if we're reading from a savefile this
// is the time of the most recent packet, not the time returned by // is the time of the most recent packet, not the time returned by
// gettimeofday(). // gettimeofday().
extern double& network_time [[deprecated("Remove in v4.1. Use zeek::net::network_time.")]]; extern double& network_time [[deprecated("Remove in v4.1. Use zeek::run_state::network_time.")]];
[[deprecated("Remove in v4.1: Use system snprintf instead")]] [[deprecated("Remove in v4.1: Use system snprintf instead")]]
inline int safe_snprintf(char* str, size_t size, const char* format, ...) inline int safe_snprintf(char* str, size_t size, const char* format, ...)

32
src/zeek-setup.cc
View file

@ -29,7 +29,7 @@ extern "C" {
#include "Event.h" #include "Event.h"
#include "File.h" #include "File.h"
#include "Reporter.h" #include "Reporter.h"
#include "Net.h" #include "RunState.h"
#include "NetVar.h" #include "NetVar.h"
#include "Var.h" #include "Var.h"
#include "Timer.h" #include "Timer.h"
@ -261,7 +261,7 @@ static void done_with_network()
if ( zeek::detail::profiling_logger ) if ( zeek::detail::profiling_logger )
zeek::detail::profiling_logger->Log(); zeek::detail::profiling_logger->Log();
zeek::net::terminating = true; zeek::run_state::terminating = true;
zeek::analyzer_mgr->Done(); zeek::analyzer_mgr->Done();
zeek::detail::timer_mgr->Expire(); zeek::detail::timer_mgr->Expire();
@ -269,7 +269,7 @@ static void done_with_network()
zeek::event_mgr.Drain(); zeek::event_mgr.Drain();
zeek::event_mgr.Drain(); zeek::event_mgr.Drain();
zeek::net::detail::net_finish(1); zeek::run_state::detail::net_finish(1);
#ifdef USE_PERFTOOLS_DEBUG #ifdef USE_PERFTOOLS_DEBUG
@ -293,7 +293,7 @@ static void terminate_bro()
{ {
zeek::util::detail::set_processing_status("TERMINATING", "terminate_bro"); zeek::util::detail::set_processing_status("TERMINATING", "terminate_bro");
zeek::net::terminating = true; zeek::run_state::terminating = true;
zeek::iosource_mgr->Wakeup("terminate_bro"); zeek::iosource_mgr->Wakeup("terminate_bro");
@ -354,7 +354,7 @@ RETSIGTYPE sig_handler(int signo)
zeek::util::detail::set_processing_status("TERMINATING", "sig_handler"); zeek::util::detail::set_processing_status("TERMINATING", "sig_handler");
signal_val = signo; signal_val = signo;
if ( ! zeek::net::terminating ) if ( ! zeek::run_state::terminating )
zeek::iosource_mgr->Wakeup("sig_handler"); zeek::iosource_mgr->Wakeup("sig_handler");
return RETSIGVAL; return RETSIGVAL;
@ -448,7 +448,7 @@ zeek::detail::SetupResult setup(int argc, char** argv,
if ( zeek_prefixes ) if ( zeek_prefixes )
zeek::util::tokenize_string(zeek_prefixes, ":", &zeek_script_prefixes); zeek::util::tokenize_string(zeek_prefixes, ":", &zeek_script_prefixes);
zeek::net::pseudo_realtime = options.pseudo_realtime; zeek::run_state::pseudo_realtime = options.pseudo_realtime;
#ifdef USE_PERFTOOLS_DEBUG #ifdef USE_PERFTOOLS_DEBUG
perftools_leaks = options.perftools_check_leaks; perftools_leaks = options.perftools_check_leaks;
@ -476,7 +476,7 @@ zeek::detail::SetupResult setup(int argc, char** argv,
atexit(atexit_handler); atexit(atexit_handler);
zeek::util::detail::set_processing_status("INITIALIZING", "main"); zeek::util::detail::set_processing_status("INITIALIZING", "main");
zeek::net::zeek_start_time = zeek::util::current_time(true); zeek::run_state::zeek_start_time = zeek::util::current_time(true);
zeek::val_mgr = new ValManager(); zeek::val_mgr = new ValManager();
reporter = new Reporter(options.abort_on_scripting_errors); reporter = new Reporter(options.abort_on_scripting_errors);
@ -628,9 +628,9 @@ zeek::detail::SetupResult setup(int argc, char** argv,
HeapLeakChecker::Disabler disabler; HeapLeakChecker::Disabler disabler;
#endif #endif
zeek::net::is_parsing = true; zeek::run_state::is_parsing = true;
yyparse(); yyparse();
zeek::net::is_parsing = false; zeek::run_state::is_parsing = false;
RecordVal::DoneParsing(); RecordVal::DoneParsing();
TableVal::DoneParsing(); TableVal::DoneParsing();
@ -751,7 +751,7 @@ zeek::detail::SetupResult setup(int argc, char** argv,
} }
if ( dns_type != DNS_PRIME ) if ( dns_type != DNS_PRIME )
zeek::net::detail::net_init(options.interface, options.pcap_file, options.pcap_output_file, options.use_watchdog); zeek::run_state::detail::net_init(options.interface, options.pcap_file, options.pcap_output_file, options.use_watchdog);
if ( ! g_policy_debug ) if ( ! g_policy_debug )
{ {
@ -803,10 +803,10 @@ zeek::detail::SetupResult setup(int argc, char** argv,
zeek::detail::segment_logger = zeek::detail::profiling_logger; zeek::detail::segment_logger = zeek::detail::profiling_logger;
} }
if ( ! zeek::net::reading_live && ! zeek::net::reading_traces ) if ( ! zeek::run_state::reading_live && ! zeek::run_state::reading_traces )
// Set up network_time to track real-time, since // Set up network_time to track real-time, since
// we don't have any other source for it. // we don't have any other source for it.
zeek::net::detail::net_update_time(zeek::util::current_time()); zeek::run_state::detail::net_update_time(zeek::util::current_time());
if ( zeek_init ) if ( zeek_init )
zeek::event_mgr.Enqueue(zeek_init, zeek::Args{}); zeek::event_mgr.Enqueue(zeek_init, zeek::Args{});
@ -874,7 +874,7 @@ zeek::detail::SetupResult setup(int argc, char** argv,
zeek::reporter->ZeekInitDone(); zeek::reporter->ZeekInitDone();
zeek::analyzer_mgr->DumpDebug(); zeek::analyzer_mgr->DumpDebug();
zeek::net::detail::have_pending_timers = ! zeek::net::reading_traces && zeek::detail::timer_mgr->Size() > 0; zeek::run_state::detail::have_pending_timers = ! zeek::run_state::reading_traces && zeek::detail::timer_mgr->Size() > 0;
return {0, std::move(options)}; return {0, std::move(options)};
} }
@ -884,7 +884,7 @@ int cleanup(bool did_net_run)
if ( did_net_run ) if ( did_net_run )
done_with_network(); done_with_network();
zeek::net::detail::net_delete(); zeek::run_state::detail::net_delete();
terminate_bro(); terminate_bro();
sqlite3_shutdown(); sqlite3_shutdown();
@ -904,7 +904,7 @@ int cleanup(bool did_net_run)
} // namespace detail } // namespace detail
namespace net::detail { namespace run_state::detail {
void zeek_terminate_loop(const char* reason) void zeek_terminate_loop(const char* reason)
{ {
@ -926,5 +926,5 @@ void zeek_terminate_loop(const char* reason)
exit(0); exit(0);
} }
} // namespace net::detail } // namespace run_state::detail
} // namespace zeek } // namespace zeek

43
src/zeek.bif
View file

@ -331,7 +331,7 @@ function current_time%(%): time
## .. zeek:see:: current_time ## .. zeek:see:: current_time
function network_time%(%): time function network_time%(%): time
%{ %{
return zeek::make_intrusive<zeek::TimeVal>(zeek::net::network_time); return zeek::make_intrusive<zeek::TimeVal>(zeek::run_state::network_time);
%} %}
## Returns a system environment variable. ## Returns a system environment variable.
@ -388,7 +388,7 @@ function exit%(code: int%): any
## .. zeek:see:: exit zeek_is_terminating ## .. zeek:see:: exit zeek_is_terminating
function terminate%(%): bool function terminate%(%): bool
%{ %{
if ( zeek::net::terminating ) if ( zeek::run_state::terminating )
return zeek::val_mgr->False(); return zeek::val_mgr->False();
zeek::util::detail::terminate_processing(); zeek::util::detail::terminate_processing();
@ -1875,7 +1875,7 @@ function zeek_args%(%): string_vec
## .. zeek:see:: reading_traces packet_source ## .. zeek:see:: reading_traces packet_source
function reading_live_traffic%(%): bool function reading_live_traffic%(%): bool
%{ %{
return zeek::val_mgr->Bool(zeek::net::reading_live); return zeek::val_mgr->Bool(zeek::run_state::reading_live);
%} %}
## Checks whether Zeek reads traffic from a trace file (as opposed to from a ## Checks whether Zeek reads traffic from a trace file (as opposed to from a
@ -1886,7 +1886,7 @@ function reading_live_traffic%(%): bool
## .. zeek:see:: reading_live_traffic packet_source ## .. zeek:see:: reading_live_traffic packet_source
function reading_traces%(%): bool function reading_traces%(%): bool
%{ %{
return zeek::val_mgr->Bool(zeek::net::reading_traces); return zeek::val_mgr->Bool(zeek::run_state::reading_traces);
%} %}
## Returns: the packet source being read by Zeek. ## Returns: the packet source being read by Zeek.
@ -2109,7 +2109,7 @@ function dump_rule_stats%(f: file%): bool
## .. zeek:see:: terminate ## .. zeek:see:: terminate
function zeek_is_terminating%(%): bool function zeek_is_terminating%(%): bool
%{ %{
return zeek::val_mgr->Bool(zeek::net::terminating); return zeek::val_mgr->Bool(zeek::run_state::terminating);
%} %}
## Returns the hostname of the machine Zeek runs on. ## Returns the hostname of the machine Zeek runs on.
@ -3365,7 +3365,7 @@ function lookup_connection%(cid: conn_id%): connection
c->Assign(1, std::move(orig_endp)); c->Assign(1, std::move(orig_endp));
c->Assign(2, std::move(resp_endp)); c->Assign(2, std::move(resp_endp));
c->Assign(3, zeek::make_intrusive<zeek::TimeVal>(zeek::net::network_time)); c->Assign(3, zeek::make_intrusive<zeek::TimeVal>(zeek::run_state::network_time));
c->Assign(4, zeek::make_intrusive<zeek::IntervalVal>(0.0)); c->Assign(4, zeek::make_intrusive<zeek::IntervalVal>(0.0));
c->Assign(5, zeek::make_intrusive<zeek::TableVal>(zeek::id::string_set)); // service c->Assign(5, zeek::make_intrusive<zeek::TableVal>(zeek::id::string_set)); // service
c->Assign(6, zeek::val_mgr->EmptyString()); // history c->Assign(6, zeek::val_mgr->EmptyString()); // history
@ -3400,8 +3400,8 @@ function dump_current_packet%(file_name: string%) : bool
%{ %{
const Packet* pkt; const Packet* pkt;
if ( ! zeek::net::detail::current_pktsrc || if ( ! zeek::run_state::detail::current_pktsrc ||
! zeek::net::detail::current_pktsrc->GetCurrentPacket(&pkt) ) ! zeek::run_state::detail::current_pktsrc->GetCurrentPacket(&pkt) )
return zeek::val_mgr->False(); return zeek::val_mgr->False();
if ( addl_pkt_dumper && addl_pkt_dumper->Path() != file_name->CheckString()) if ( addl_pkt_dumper && addl_pkt_dumper->Path() != file_name->CheckString())
@ -3433,8 +3433,8 @@ function get_current_packet%(%) : pcap_packet
const Packet* p; const Packet* p;
auto pkt = zeek::make_intrusive<zeek::RecordVal>(pcap_packet); auto pkt = zeek::make_intrusive<zeek::RecordVal>(pcap_packet);
if ( ! zeek::net::detail::current_pktsrc || if ( ! zeek::run_state::detail::current_pktsrc ||
! zeek::net::detail::current_pktsrc->GetCurrentPacket(&p) ) ! zeek::run_state::detail::current_pktsrc->GetCurrentPacket(&p) )
{ {
pkt->Assign(0, zeek::val_mgr->Count(0)); pkt->Assign(0, zeek::val_mgr->Count(0));
pkt->Assign(1, zeek::val_mgr->Count(0)); pkt->Assign(1, zeek::val_mgr->Count(0));
@ -3465,8 +3465,8 @@ function get_current_packet_header%(%) : raw_pkt_hdr
%{ %{
const Packet* p; const Packet* p;
if ( zeek::net::detail::current_pktsrc && if ( zeek::run_state::detail::current_pktsrc &&
zeek::net::detail::current_pktsrc->GetCurrentPacket(&p) ) zeek::run_state::detail::current_pktsrc->GetCurrentPacket(&p) )
{ {
return p->ToRawPktHdrVal(); return p->ToRawPktHdrVal();
} }
@ -3688,10 +3688,10 @@ static constexpr double mmdb_msg_suppression_duration = 300;
static void report_mmdb_msg(const char* format, ...) static void report_mmdb_msg(const char* format, ...)
{ {
if ( zeek::net::network_time > mmdb_msg_suppression_time + mmdb_msg_suppression_duration ) if ( zeek::run_state::network_time > mmdb_msg_suppression_time + mmdb_msg_suppression_duration )
{ {
mmdb_msg_count = 0; mmdb_msg_count = 0;
mmdb_msg_suppression_time = zeek::net::network_time; mmdb_msg_suppression_time = zeek::run_state::network_time;
} }
if ( mmdb_msg_count >= mmdb_msg_limit ) if ( mmdb_msg_count >= mmdb_msg_limit )
@ -4701,10 +4701,11 @@ function rotate_file_by_name%(f: string%): rotate_info
bool is_addl_pkt_dumper = false; bool is_addl_pkt_dumper = false;
// Special case: one of current dump files. // Special case: one of current dump files.
if ( zeek::net::detail::pkt_dumper && zeek::util::streq(zeek::net::detail::pkt_dumper->Path().c_str(), f->CheckString()) ) if ( zeek::run_state::detail::pkt_dumper &&
zeek::util::streq(zeek::run_state::detail::pkt_dumper->Path().c_str(), f->CheckString()) )
{ {
is_pkt_dumper = true; is_pkt_dumper = true;
zeek::net::detail::pkt_dumper->Close(); zeek::run_state::detail::pkt_dumper->Close();
} }
if ( addl_pkt_dumper && if ( addl_pkt_dumper &&
@ -4729,8 +4730,8 @@ function rotate_file_by_name%(f: string%): rotate_info
if ( is_pkt_dumper ) if ( is_pkt_dumper )
{ {
info->Assign(2, zeek::make_intrusive<zeek::TimeVal>(zeek::net::detail::pkt_dumper->OpenTime())); info->Assign(2, zeek::make_intrusive<zeek::TimeVal>(zeek::run_state::detail::pkt_dumper->OpenTime()));
zeek::net::detail::pkt_dumper->Open(); zeek::run_state::detail::pkt_dumper->Open();
} }
if ( is_addl_pkt_dumper ) if ( is_addl_pkt_dumper )
@ -4753,7 +4754,7 @@ function calc_next_rotate%(i: interval%) : interval
static auto base_time = log_rotate_base_time->AsString()->CheckString(); static auto base_time = log_rotate_base_time->AsString()->CheckString();
double base = zeek::util::detail::parse_rotate_base_time(base_time); double base = zeek::util::detail::parse_rotate_base_time(base_time);
return zeek::make_intrusive<zeek::IntervalVal>(zeek::util::detail::calc_next_rotate(zeek::net::network_time, i, base)); return zeek::make_intrusive<zeek::IntervalVal>(zeek::util::detail::calc_next_rotate(zeek::run_state::network_time, i, base));
%} %}
## Returns the size of a given file. ## Returns the size of a given file.
@ -5011,7 +5012,7 @@ function is_remote_event%(%) : bool
## .. zeek:see:: continue_processing ## .. zeek:see:: continue_processing
function suspend_processing%(%) : any function suspend_processing%(%) : any
%{ %{
zeek::net::net_suspend_processing(); zeek::run_state::net_suspend_processing();
return nullptr; return nullptr;
%} %}
@ -5020,7 +5021,7 @@ function suspend_processing%(%) : any
## .. zeek:see:: suspend_processing ## .. zeek:see:: suspend_processing
function continue_processing%(%) : any function continue_processing%(%) : any
%{ %{
zeek::net::net_continue_processing(); zeek::run_state::net_continue_processing();
return nullptr; return nullptr;
%} %}