Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Pre-allocate and re-use Vals for bool, int, count, enum and empty string

Browse source
This commit is contained in:
Jon Siwek 2019-01-09 14:47:58 -06:00
parent dcbef9cbe3
commit 2982765128
136 changed files with 1859 additions and 1811 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/file_analysis/File.cc
View file

@ -34,9 +34,9 @@ static RecordVal* get_conn_id_val(const Connection* conn)
{
RecordVal* v = new RecordVal(conn_id);
v->Assign(0, new AddrVal(conn->OrigAddr()));
v->Assign(1, port_mgr->Get(ntohs(conn->OrigPort()), conn->ConnTransport()));
v->Assign(1, val_mgr->GetPort(ntohs(conn->OrigPort()), conn->ConnTransport()));
v->Assign(2, new AddrVal(conn->RespAddr()));
v->Assign(3, port_mgr->Get(ntohs(conn->RespPort()), conn->ConnTransport()));
v->Assign(3, val_mgr->GetPort(ntohs(conn->RespPort()), conn->ConnTransport()));
return v;
}
@ -97,7 +97,7 @@ File::File(const string& file_id, const string& source_name, Connection* conn,
if ( conn )
{
val->Assign(is_orig_idx, new Val(is_orig, TYPE_BOOL));
val->Assign(is_orig_idx, val_mgr->GetBool(is_orig));
UpdateConnectionFields(conn, is_orig);
}
@ -157,7 +157,7 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig)
val_list* vl = new val_list();
vl->append(val->Ref());
vl->append(conn->BuildConnVal());
vl->append(new Val(is_orig, TYPE_BOOL));
vl->append(val_mgr->GetBool(is_orig));
FileEvent(file_over_new_connection, vl);
}
}
@ -230,13 +230,13 @@ bool File::SetExtractionLimit(RecordVal* args, uint64 bytes)
void File::IncrementByteCount(uint64 size, int field_idx)
{
uint64 old = LookupFieldDefaultCount(field_idx);
val->Assign(field_idx, new Val(old + size, TYPE_COUNT));
val->Assign(field_idx, val_mgr->GetCount(old + size));
}
void File::SetTotalBytes(uint64 size)
{
DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Total bytes %" PRIu64, id.c_str(), size);
val->Assign(total_bytes_idx, new Val(size, TYPE_COUNT));
val->Assign(total_bytes_idx, val_mgr->GetCount(size));
}
bool File::IsComplete() const
@ -308,7 +308,7 @@ bool File::SetMime(const string& mime_type)
RecordVal* meta = new RecordVal(fa_metadata_type);
vl->append(meta);
meta->Assign(meta_mime_type_idx, new StringVal(mime_type));
meta->Assign(meta_inferred_idx, new Val(0, TYPE_BOOL));
meta->Assign(meta_inferred_idx, val_mgr->GetBool(0));
FileEvent(file_sniff, vl);
return true;
}
@ -465,8 +465,8 @@ void File::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
{
val_list* vl = new val_list();
vl->append(val->Ref());
vl->append(new Val(current_offset, TYPE_COUNT));
vl->append(new Val(gap_bytes, TYPE_COUNT));
vl->append(val_mgr->GetCount(current_offset));
vl->append(val_mgr->GetCount(gap_bytes));
FileEvent(file_reassembly_overflow, vl);
}
}
@ -610,8 +610,8 @@ void File::Gap(uint64 offset, uint64 len)
{
val_list* vl = new val_list();
vl->append(val->Ref());
vl->append(new Val(offset, TYPE_COUNT));
vl->append(new Val(len, TYPE_COUNT));
vl->append(val_mgr->GetCount(offset));
vl->append(val_mgr->GetCount(len));
FileEvent(file_gap, vl);
}

6
src/file_analysis/Manager.cc
View file

@ -445,7 +445,7 @@ string Manager::GetFileID(analyzer::Tag tag, Connection* c, bool is_orig)
val_list* vl = new val_list();
vl->append(tagval);
vl->append(c->BuildConnVal());
vl->append(new Val(is_orig, TYPE_BOOL));
vl->append(val_mgr->GetBool(is_orig));
mgr.QueueEvent(get_file_handle, vl);
mgr.Drain(); // need file handle immediately so we don't have to buffer data
@ -457,7 +457,7 @@ bool Manager::IsDisabled(analyzer::Tag tag)
if ( ! disabled )
disabled = internal_const_val("Files::disable")->AsTableVal();
Val* index = new Val(bool(tag), TYPE_COUNT);
Val* index = val_mgr->GetCount(bool(tag));
Val* yield = disabled->Lookup(index);
Unref(index);
@ -536,7 +536,7 @@ VectorVal* file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
for ( set<string>::const_iterator it2 = it->second.begin();
it2 != it->second.end(); ++it2 )
{
element->Assign(0, new Val(it->first, TYPE_INT));
element->Assign(0, val_mgr->GetInt(it->first));
element->Assign(1, new StringVal(*it2));
}

2
src/file_analysis/analyzer/data_event/DataEvent.cc
View file

@ -44,7 +44,7 @@ bool DataEvent::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
val_list* args = new val_list;
args->append(GetFile()->GetVal()->Ref());
args->append(new StringVal(new BroString(data, len, 0)));
args->append(new Val(offset, TYPE_COUNT));
args->append(val_mgr->GetCount(offset));
mgr.QueueEvent(chunk_event, args);

4
src/file_analysis/analyzer/extract/Extract.cc
View file

@ -93,8 +93,8 @@ bool Extract::DeliverStream(const u_char* data, uint64 len)
val_list* vl = new val_list();
vl->append(f->GetVal()->Ref());
vl->append(Args()->Ref());
vl->append(new Val(limit, TYPE_COUNT));
vl->append(new Val(len, TYPE_COUNT));
vl->append(val_mgr->GetCount(limit));
vl->append(val_mgr->GetCount(len));
f->FileEvent(file_extraction_limit, vl);
// Limit may have been modified by a BIF, re-check it.

2
src/file_analysis/analyzer/extract/functions.bif
View file

@ -13,7 +13,7 @@ function FileExtract::__set_limit%(file_id: string, args: any, n: count%): bool
RecordVal* rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
bool result = file_mgr->SetExtractionLimit(file_id->CheckString(), rv, n);
Unref(rv);
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
module GLOBAL;

104
src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

@ -13,7 +13,7 @@ VectorVal* process_rvas(const RVAS* rva_table)
{
VectorVal* rvas = new VectorVal(internal_type("index_vec")->AsVectorType());
for ( uint16 i=0; i < rva_table->rvas()->size(); ++i )
rvas->Assign(i, new Val((*rva_table->rvas())[i]->size(), TYPE_COUNT));
rvas->Assign(i, val_mgr->GetCount((*rva_table->rvas())[i]->size()));
return rvas;
}
@ -30,7 +30,7 @@ refine flow File += {
{
if ( ((c >> i) & 0x1) == 1 )
{
Val *ch = new Val((1<<i)&mask, TYPE_COUNT);
Val *ch = val_mgr->GetCount((1<<i)&mask);
char_set->Assign(ch, 0);
Unref(ch);
}
@ -44,22 +44,22 @@ refine flow File += {
{
RecordVal* dh = new RecordVal(BifType::Record::PE::DOSHeader);
dh->Assign(0, new StringVal(${h.signature}.length(), (const char*) ${h.signature}.data()));
dh->Assign(1, new Val(${h.UsedBytesInTheLastPage}, TYPE_COUNT));
dh->Assign(2, new Val(${h.FileSizeInPages}, TYPE_COUNT));
dh->Assign(3, new Val(${h.NumberOfRelocationItems}, TYPE_COUNT));
dh->Assign(4, new Val(${h.HeaderSizeInParagraphs}, TYPE_COUNT));
dh->Assign(5, new Val(${h.MinimumExtraParagraphs}, TYPE_COUNT));
dh->Assign(6, new Val(${h.MaximumExtraParagraphs}, TYPE_COUNT));
dh->Assign(7, new Val(${h.InitialRelativeSS}, TYPE_COUNT));
dh->Assign(8, new Val(${h.InitialSP}, TYPE_COUNT));
dh->Assign(9, new Val(${h.Checksum}, TYPE_COUNT));
dh->Assign(10, new Val(${h.InitialIP}, TYPE_COUNT));
dh->Assign(11, new Val(${h.InitialRelativeCS}, TYPE_COUNT));
dh->Assign(12, new Val(${h.AddressOfRelocationTable}, TYPE_COUNT));
dh->Assign(13, new Val(${h.OverlayNumber}, TYPE_COUNT));
dh->Assign(14, new Val(${h.OEMid}, TYPE_COUNT));
dh->Assign(15, new Val(${h.OEMinfo}, TYPE_COUNT));
dh->Assign(16, new Val(${h.AddressOfNewExeHeader}, TYPE_COUNT));
dh->Assign(1, val_mgr->GetCount(${h.UsedBytesInTheLastPage}));
dh->Assign(2, val_mgr->GetCount(${h.FileSizeInPages}));
dh->Assign(3, val_mgr->GetCount(${h.NumberOfRelocationItems}));
dh->Assign(4, val_mgr->GetCount(${h.HeaderSizeInParagraphs}));
dh->Assign(5, val_mgr->GetCount(${h.MinimumExtraParagraphs}));
dh->Assign(6, val_mgr->GetCount(${h.MaximumExtraParagraphs}));
dh->Assign(7, val_mgr->GetCount(${h.InitialRelativeSS}));
dh->Assign(8, val_mgr->GetCount(${h.InitialSP}));
dh->Assign(9, val_mgr->GetCount(${h.Checksum}));
dh->Assign(10, val_mgr->GetCount(${h.InitialIP}));
dh->Assign(11, val_mgr->GetCount(${h.InitialRelativeCS}));
dh->Assign(12, val_mgr->GetCount(${h.AddressOfRelocationTable}));
dh->Assign(13, val_mgr->GetCount(${h.OverlayNumber}));
dh->Assign(14, val_mgr->GetCount(${h.OEMid}));
dh->Assign(15, val_mgr->GetCount(${h.OEMinfo}));
dh->Assign(16, val_mgr->GetCount(${h.AddressOfNewExeHeader}));
BifEvent::generate_pe_dos_header((analyzer::Analyzer *) connection()->bro_analyzer(),
connection()->bro_analyzer()->GetFile()->GetVal()->Ref(),
@ -94,11 +94,11 @@ refine flow File += {
if ( pe_file_header )
{
RecordVal* fh = new RecordVal(BifType::Record::PE::FileHeader);
fh->Assign(0, new Val(${h.Machine}, TYPE_COUNT));
fh->Assign(0, val_mgr->GetCount(${h.Machine}));
fh->Assign(1, new Val(static_cast<double>(${h.TimeDateStamp}), TYPE_TIME));
fh->Assign(2, new Val(${h.PointerToSymbolTable}, TYPE_COUNT));
fh->Assign(3, new Val(${h.NumberOfSymbols}, TYPE_COUNT));
fh->Assign(4, new Val(${h.SizeOfOptionalHeader}, TYPE_COUNT));
fh->Assign(2, val_mgr->GetCount(${h.PointerToSymbolTable}));
fh->Assign(3, val_mgr->GetCount(${h.NumberOfSymbols}));
fh->Assign(4, val_mgr->GetCount(${h.SizeOfOptionalHeader}));
fh->Assign(5, characteristics_to_bro(${h.Characteristics}, 16));
BifEvent::generate_pe_file_header((analyzer::Analyzer *) connection()->bro_analyzer(),
connection()->bro_analyzer()->GetFile()->GetVal()->Ref(),
@ -122,31 +122,31 @@ refine flow File += {
{
RecordVal* oh = new RecordVal(BifType::Record::PE::OptionalHeader);
oh->Assign(0, new Val(${h.magic}, TYPE_COUNT));
oh->Assign(1, new Val(${h.major_linker_version}, TYPE_COUNT));
oh->Assign(2, new Val(${h.minor_linker_version}, TYPE_COUNT));
oh->Assign(3, new Val(${h.size_of_code}, TYPE_COUNT));
oh->Assign(4, new Val(${h.size_of_init_data}, TYPE_COUNT));
oh->Assign(5, new Val(${h.size_of_uninit_data}, TYPE_COUNT));
oh->Assign(6, new Val(${h.addr_of_entry_point}, TYPE_COUNT));
oh->Assign(7, new Val(${h.base_of_code}, TYPE_COUNT));
oh->Assign(0, val_mgr->GetCount(${h.magic}));
oh->Assign(1, val_mgr->GetCount(${h.major_linker_version}));
oh->Assign(2, val_mgr->GetCount(${h.minor_linker_version}));
oh->Assign(3, val_mgr->GetCount(${h.size_of_code}));
oh->Assign(4, val_mgr->GetCount(${h.size_of_init_data}));
oh->Assign(5, val_mgr->GetCount(${h.size_of_uninit_data}));
oh->Assign(6, val_mgr->GetCount(${h.addr_of_entry_point}));
oh->Assign(7, val_mgr->GetCount(${h.base_of_code}));
if ( ${h.pe_format} != PE32_PLUS )
oh->Assign(8, new Val(${h.base_of_data}, TYPE_COUNT));
oh->Assign(8, val_mgr->GetCount(${h.base_of_data}));
oh->Assign(9, new Val(${h.image_base}, TYPE_COUNT));
oh->Assign(10, new Val(${h.section_alignment}, TYPE_COUNT));
oh->Assign(11, new Val(${h.file_alignment}, TYPE_COUNT));
oh->Assign(12, new Val(${h.os_version_major}, TYPE_COUNT));
oh->Assign(13, new Val(${h.os_version_minor}, TYPE_COUNT));
oh->Assign(14, new Val(${h.major_image_version}, TYPE_COUNT));
oh->Assign(15, new Val(${h.minor_image_version}, TYPE_COUNT));
oh->Assign(16, new Val(${h.minor_subsys_version}, TYPE_COUNT));
oh->Assign(17, new Val(${h.minor_subsys_version}, TYPE_COUNT));
oh->Assign(18, new Val(${h.size_of_image}, TYPE_COUNT));
oh->Assign(19, new Val(${h.size_of_headers}, TYPE_COUNT));
oh->Assign(20, new Val(${h.checksum}, TYPE_COUNT));
oh->Assign(21, new Val(${h.subsystem}, TYPE_COUNT));
oh->Assign(9, val_mgr->GetCount(${h.image_base}));
oh->Assign(10, val_mgr->GetCount(${h.section_alignment}));
oh->Assign(11, val_mgr->GetCount(${h.file_alignment}));
oh->Assign(12, val_mgr->GetCount(${h.os_version_major}));
oh->Assign(13, val_mgr->GetCount(${h.os_version_minor}));
oh->Assign(14, val_mgr->GetCount(${h.major_image_version}));
oh->Assign(15, val_mgr->GetCount(${h.minor_image_version}));
oh->Assign(16, val_mgr->GetCount(${h.minor_subsys_version}));
oh->Assign(17, val_mgr->GetCount(${h.minor_subsys_version}));
oh->Assign(18, val_mgr->GetCount(${h.size_of_image}));
oh->Assign(19, val_mgr->GetCount(${h.size_of_headers}));
oh->Assign(20, val_mgr->GetCount(${h.checksum}));
oh->Assign(21, val_mgr->GetCount(${h.subsystem}));
oh->Assign(22, characteristics_to_bro(${h.dll_characteristics}, 16));
oh->Assign(23, process_rvas(${h.rvas}));
@ -173,14 +173,14 @@ refine flow File += {
name_len = first_null - ${h.name}.data();
section_header->Assign(0, new StringVal(name_len, (const char*) ${h.name}.data()));
section_header->Assign(1, new Val(${h.virtual_size}, TYPE_COUNT));
section_header->Assign(2, new Val(${h.virtual_addr}, TYPE_COUNT));
section_header->Assign(3, new Val(${h.size_of_raw_data}, TYPE_COUNT));
section_header->Assign(4, new Val(${h.ptr_to_raw_data}, TYPE_COUNT));
section_header->Assign(5, new Val(${h.non_used_ptr_to_relocs}, TYPE_COUNT));
section_header->Assign(6, new Val(${h.non_used_ptr_to_line_nums}, TYPE_COUNT));
section_header->Assign(7, new Val(${h.non_used_num_of_relocs}, TYPE_COUNT));
section_header->Assign(8, new Val(${h.non_used_num_of_line_nums}, TYPE_COUNT));
section_header->Assign(1, val_mgr->GetCount(${h.virtual_size}));
section_header->Assign(2, val_mgr->GetCount(${h.virtual_addr}));
section_header->Assign(3, val_mgr->GetCount(${h.size_of_raw_data}));
section_header->Assign(4, val_mgr->GetCount(${h.ptr_to_raw_data}));
section_header->Assign(5, val_mgr->GetCount(${h.non_used_ptr_to_relocs}));
section_header->Assign(6, val_mgr->GetCount(${h.non_used_ptr_to_line_nums}));
section_header->Assign(7, val_mgr->GetCount(${h.non_used_num_of_relocs}));
section_header->Assign(8, val_mgr->GetCount(${h.non_used_num_of_line_nums}));
section_header->Assign(9, characteristics_to_bro(${h.characteristics}, 32));
BifEvent::generate_pe_section_header((analyzer::Analyzer *) connection()->bro_analyzer(),

50
src/file_analysis/analyzer/unified2/unified2-analyzer.pac
View file

@ -54,7 +54,7 @@ refine flow Flow += {
case 17: proto = TRANSPORT_UDP; break;
}
return port_mgr->Get(n, proto);
return val_mgr->GetPort(n, proto);
%}
#function proc_record(rec: Record) : bool
@ -67,19 +67,19 @@ refine flow Flow += {
if ( ::unified2_event )
{
RecordVal* ids_event = new RecordVal(BifType::Record::Unified2::IDSEvent);
ids_event->Assign(0, new Val(${ev.sensor_id}, TYPE_COUNT));
ids_event->Assign(1, new Val(${ev.event_id}, TYPE_COUNT));
ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id}));
ids_event->Assign(1, val_mgr->GetCount(${ev.event_id}));
ids_event->Assign(2, new Val(ts_to_double(${ev.ts}), TYPE_TIME));
ids_event->Assign(3, new Val(${ev.signature_id}, TYPE_COUNT));
ids_event->Assign(4, new Val(${ev.generator_id}, TYPE_COUNT));
ids_event->Assign(5, new Val(${ev.signature_revision}, TYPE_COUNT));
ids_event->Assign(6, new Val(${ev.classification_id}, TYPE_COUNT));
ids_event->Assign(7, new Val(${ev.priority_id}, TYPE_COUNT));
ids_event->Assign(3, val_mgr->GetCount(${ev.signature_id}));
ids_event->Assign(4, val_mgr->GetCount(${ev.generator_id}));
ids_event->Assign(5, val_mgr->GetCount(${ev.signature_revision}));
ids_event->Assign(6, val_mgr->GetCount(${ev.classification_id}));
ids_event->Assign(7, val_mgr->GetCount(${ev.priority_id}));
ids_event->Assign(8, unified2_addr_to_bro_addr(${ev.src_ip}));
ids_event->Assign(9, unified2_addr_to_bro_addr(${ev.dst_ip}));
ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol}));
ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol}));
ids_event->Assign(17, new Val(${ev.packet_action}, TYPE_COUNT));
ids_event->Assign(17, val_mgr->GetCount(${ev.packet_action}));
val_list* vl = new val_list();
vl->append(connection()->bro_analyzer()->GetFile()->GetVal()->Ref());
@ -94,23 +94,23 @@ refine flow Flow += {
if ( ::unified2_event )
{
RecordVal* ids_event = new RecordVal(BifType::Record::Unified2::IDSEvent);
ids_event->Assign(0, new Val(${ev.sensor_id}, TYPE_COUNT));
ids_event->Assign(1, new Val(${ev.event_id}, TYPE_COUNT));
ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id}));
ids_event->Assign(1, val_mgr->GetCount(${ev.event_id}));
ids_event->Assign(2, new Val(ts_to_double(${ev.ts}), TYPE_TIME));
ids_event->Assign(3, new Val(${ev.signature_id}, TYPE_COUNT));
ids_event->Assign(4, new Val(${ev.generator_id}, TYPE_COUNT));
ids_event->Assign(5, new Val(${ev.signature_revision}, TYPE_COUNT));
ids_event->Assign(6, new Val(${ev.classification_id}, TYPE_COUNT));
ids_event->Assign(7, new Val(${ev.priority_id}, TYPE_COUNT));
ids_event->Assign(3, val_mgr->GetCount(${ev.signature_id}));
ids_event->Assign(4, val_mgr->GetCount(${ev.generator_id}));
ids_event->Assign(5, val_mgr->GetCount(${ev.signature_revision}));
ids_event->Assign(6, val_mgr->GetCount(${ev.classification_id}));
ids_event->Assign(7, val_mgr->GetCount(${ev.priority_id}));
ids_event->Assign(8, unified2_addr_to_bro_addr(${ev.src_ip}));
ids_event->Assign(9, unified2_addr_to_bro_addr(${ev.dst_ip}));
ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol}));
ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol}));
ids_event->Assign(12, new Val(${ev.impact_flag}, TYPE_COUNT));
ids_event->Assign(13, new Val(${ev.impact}, TYPE_COUNT));
ids_event->Assign(14, new Val(${ev.blocked}, TYPE_COUNT));
ids_event->Assign(15, new Val(${ev.mpls_label}, TYPE_COUNT));
ids_event->Assign(16, new Val(${ev.vlan_id}, TYPE_COUNT));
ids_event->Assign(12, val_mgr->GetCount(${ev.impact_flag}));
ids_event->Assign(13, val_mgr->GetCount(${ev.impact}));
ids_event->Assign(14, val_mgr->GetCount(${ev.blocked}));
ids_event->Assign(15, val_mgr->GetCount(${ev.mpls_label}));
ids_event->Assign(16, val_mgr->GetCount(${ev.vlan_id}));
val_list* vl = new val_list();
vl->append(connection()->bro_analyzer()->GetFile()->GetVal()->Ref());
@ -126,11 +126,11 @@ refine flow Flow += {
if ( ::unified2_packet )
{
RecordVal* packet = new RecordVal(BifType::Record::Unified2::Packet);
packet->Assign(0, new Val(${pkt.sensor_id}, TYPE_COUNT));
packet->Assign(1, new Val(${pkt.event_id}, TYPE_COUNT));
packet->Assign(2, new Val(${pkt.event_second}, TYPE_COUNT));
packet->Assign(0, val_mgr->GetCount(${pkt.sensor_id}));
packet->Assign(1, val_mgr->GetCount(${pkt.event_id}));
packet->Assign(2, val_mgr->GetCount(${pkt.event_second}));
packet->Assign(3, new Val(ts_to_double(${pkt.packet_ts}), TYPE_TIME));
packet->Assign(4, new Val(${pkt.link_type}, TYPE_COUNT));
packet->Assign(4, val_mgr->GetCount(${pkt.link_type}));
packet->Assign(5, bytestring_to_val(${pkt.packet_data}));
val_list* vl = new val_list();

50
src/file_analysis/analyzer/x509/OCSP.cc
View file

@ -89,10 +89,10 @@ bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, val_list* vl, BIO* bio)
if ( ! res )
{
reporter->Weird("OpenSSL failed to get OCSP_CERTID info");
vl->append(new StringVal(""));
vl->append(new StringVal(""));
vl->append(new StringVal(""));
vl->append(new StringVal(""));
vl->append(val_mgr->GetEmptyString());
vl->append(val_mgr->GetEmptyString());
vl->append(val_mgr->GetEmptyString());
vl->append(val_mgr->GetEmptyString());
return false;
}
@ -208,7 +208,7 @@ static StringVal* parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
der_basic_resp_len = i2d_OCSP_BASICRESP(basic_resp, &der_basic_resp_dat);
if ( der_basic_resp_len <= 0 )
return new StringVal("");
return val_mgr->GetEmptyString();
const unsigned char* const_der_basic_resp_dat = der_basic_resp_dat;
@ -218,14 +218,14 @@ static StringVal* parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
if ( ! bseq )
{
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
if ( sk_ASN1_TYPE_num(bseq) < 3 )
{
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
auto constexpr sig_alg_idx = 1u;
@ -235,7 +235,7 @@ static StringVal* parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
{
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
auto aseq_str = aseq_type->value.asn1_string;
@ -248,7 +248,7 @@ static StringVal* parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
{
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
if ( sk_ASN1_TYPE_num(aseq) < 1 )
@ -256,7 +256,7 @@ static StringVal* parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
sk_ASN1_TYPE_free(aseq);
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
auto constexpr alg_obj_idx = 0u;
@ -267,7 +267,7 @@ static StringVal* parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
sk_ASN1_TYPE_free(aseq);
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
auto alg_obj = alg_obj_type->value.object;
@ -290,7 +290,7 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
der_basic_resp_len = i2d_OCSP_BASICRESP(basic_resp, &der_basic_resp_dat);
if ( der_basic_resp_len <= 0 )
return new Val(-1, TYPE_COUNT);
return val_mgr->GetCount(-1);
const unsigned char* const_der_basic_resp_dat = der_basic_resp_dat;
@ -300,14 +300,14 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
if ( ! bseq )
{
OPENSSL_free(der_basic_resp_dat);
return new Val(-1, TYPE_COUNT);
return val_mgr->GetCount(-1);
}
if ( sk_ASN1_TYPE_num(bseq) < 3 )
{
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new Val(-1, TYPE_COUNT);
return val_mgr->GetCount(-1);
}
auto constexpr resp_data_idx = 0u;
@ -317,7 +317,7 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
{
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new Val(-1, TYPE_COUNT);
return val_mgr->GetCount(-1);
}
auto dseq_str = dseq_type->value.asn1_string;
@ -330,7 +330,7 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
{
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
if ( sk_ASN1_TYPE_num(dseq) < 1 )
@ -338,7 +338,7 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
sk_ASN1_TYPE_free(dseq);
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new StringVal("");
return val_mgr->GetEmptyString();
}
/*- ResponseData ::= SEQUENCE {
@ -358,14 +358,14 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
// Not present, use default value.
return new Val(0, TYPE_COUNT);
return val_mgr->GetCount(0);
}
uint64_t asn1_int = ASN1_INTEGER_get(version_type->value.integer);
sk_ASN1_TYPE_free(dseq);
sk_ASN1_TYPE_free(bseq);
OPENSSL_free(der_basic_resp_dat);
return new Val(asn1_int, TYPE_COUNT);
return val_mgr->GetCount(asn1_int);
}
static uint64 parse_request_version(OCSP_REQUEST* req)
@ -431,7 +431,7 @@ void file_analysis::OCSP::ParseRequest(OCSP_REQUEST* req, const char* fid)
// TODO: try to parse out general name ?
#endif
vl->append(new Val(version, TYPE_COUNT));
vl->append(val_mgr->GetCount(version));
BIO *bio = BIO_new(BIO_s_mem());
@ -507,7 +507,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPVal *resp_val, const char* fid)
vl->append(status_val);
#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
vl->append(new Val((uint64)ASN1_INTEGER_get(resp_data->version), TYPE_COUNT));
vl->append(val_mgr->GetCount((uint64)ASN1_INTEGER_get(resp_data->version)));
#else
vl->append(parse_basic_resp_data_version(basic_resp));
#endif
@ -522,7 +522,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPVal *resp_val, const char* fid)
else
{
reporter->Weird("OpenSSL failed to get OCSP responder id");
vl->append(new StringVal(""));
vl->append(val_mgr->GetEmptyString());
}
// producedAt
@ -591,19 +591,19 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPVal *resp_val, const char* fid)
}
else
{
rvl->append(new Val(0, TYPE_TIME));
rvl->append(new Val(0.0, TYPE_TIME));
rvl->append(new StringVal(0, ""));
}
if ( this_update )
rvl->append(new Val(GetTimeFromAsn1(this_update, fid, reporter), TYPE_TIME));
else
rvl->append(new Val(0, TYPE_TIME));
rvl->append(new Val(0.0, TYPE_TIME));
if ( next_update )
rvl->append(new Val(GetTimeFromAsn1(next_update, fid, reporter), TYPE_TIME));
else
rvl->append(new Val(0, TYPE_TIME));
rvl->append(new Val(0.0, TYPE_TIME));
mgr.QueueEvent(ocsp_response_certificate, rvl);

10
src/file_analysis/analyzer/x509/X509.cc
View file

@ -96,7 +96,7 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, const char*
RecordVal* pX509Cert = new RecordVal(BifType::Record::X509::Certificate);
BIO *bio = BIO_new(BIO_s_mem());
pX509Cert->Assign(0, new Val((uint64) X509_get_version(ssl_cert) + 1, TYPE_COUNT));
pX509Cert->Assign(0, val_mgr->GetCount((uint64) X509_get_version(ssl_cert) + 1));
i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert));
int len = BIO_read(bio, buf, sizeof(buf));
pX509Cert->Assign(1, new StringVal(len, buf));
@ -204,7 +204,7 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, const char*
unsigned int length = KeyLength(pkey);
if ( length > 0 )
pX509Cert->Assign(10, new Val(length, TYPE_COUNT));
pX509Cert->Assign(10, val_mgr->GetCount(length));
EVP_PKEY_free(pkey);
}
@ -222,10 +222,10 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex)
if ( constr )
{
RecordVal* pBasicConstraint = new RecordVal(BifType::Record::X509::BasicConstraints);
pBasicConstraint->Assign(0, new Val(constr->ca ? 1 : 0, TYPE_BOOL));
pBasicConstraint->Assign(0, val_mgr->GetBool(constr->ca ? 1 : 0));
if ( constr->pathlen )
pBasicConstraint->Assign(1, new Val((int32_t) ASN1_INTEGER_get(constr->pathlen), TYPE_COUNT));
pBasicConstraint->Assign(1, val_mgr->GetCount((int32_t) ASN1_INTEGER_get(constr->pathlen)));
val_list* vl = new val_list();
vl->append(GetFile()->GetVal()->Ref());
@ -365,7 +365,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
if ( ips != 0 )
sanExt->Assign(3, ips);
sanExt->Assign(4, new Val(otherfields, TYPE_BOOL));
sanExt->Assign(4, val_mgr->GetBool(otherfields));
val_list* vl = new val_list();
vl->append(GetFile()->GetVal()->Ref());

6
src/file_analysis/analyzer/x509/X509Common.cc
View file

@ -261,7 +261,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, EventHandlerP
pX509Ext->Assign(1, new StringVal(short_name));
pX509Ext->Assign(2, new StringVal(oid));
pX509Ext->Assign(3, new Val(critical, TYPE_BOOL));
pX509Ext->Assign(3, val_mgr->GetBool(critical));
pX509Ext->Assign(4, ext_val);
// send off generic extension event
@ -274,7 +274,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, EventHandlerP
vl->append(GetFile()->GetVal()->Ref());
vl->append(pX509Ext);
if ( h == ocsp_extension )
vl->append(new Val(global ? 1 : 0, TYPE_BOOL));
vl->append(val_mgr->GetBool(global ? 1 : 0));
mgr.QueueEvent(h, vl);
@ -300,7 +300,7 @@ StringVal* file_analysis::X509Common::GetExtensionFromBIO(BIO* bio)
if ( length == 0 )
{
BIO_free_all(bio);
return new StringVal("");
return val_mgr->GetEmptyString();
}
char* buffer = (char*) malloc(length);

12
src/file_analysis/analyzer/x509/functions.bif
View file

@ -32,7 +32,7 @@ RecordVal* x509_result_record(uint64_t num, const char* reason, Val* chainVector
{
RecordVal* rrecord = new RecordVal(BifType::Record::X509::Result);
rrecord->Assign(0, new Val(num, TYPE_INT));
rrecord->Assign(0, val_mgr->GetInt(num));
rrecord->Assign(1, new StringVal(reason));
if ( chainVector )
rrecord->Assign(2, chainVector);
@ -231,7 +231,7 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F
StringVal* ext_val = file_analysis::X509::GetExtensionFromBIO(bio);
if ( ! ext_val )
ext_val = new StringVal("");
ext_val = val_mgr->GetEmptyString();
return ext_val;
%}
@ -662,7 +662,7 @@ function sct_verify%(cert: opaque of x509, logid: string, log_key: string, signa
if ( precert && issuer_key_hash->Len() != 32)
{
reporter->Error("Invalid issuer_key_hash length");
return new Val(0, TYPE_BOOL);
return val_mgr->GetBool(0);
}
std::string data;
@ -686,7 +686,7 @@ function sct_verify%(cert: opaque of x509, logid: string, log_key: string, signa
if ( pos < 0 )
{
reporter->Error("NID_ct_precert_scts not found");
return new Val(0, TYPE_BOOL);
return val_mgr->GetBool(0);
}
#else
int num_ext = X509_get_ext_count(x);
@ -781,7 +781,7 @@ function sct_verify%(cert: opaque of x509, logid: string, log_key: string, signa
EVP_MD_CTX_destroy(mdctx);
EVP_PKEY_free(key);
return new Val(success, TYPE_BOOL);
return val_mgr->GetBool(success);
sct_verify_err:
if (mdctx)
@ -790,7 +790,7 @@ sct_verify_err:
EVP_PKEY_free(key);
reporter->Error("%s", errstr.c_str());
return new Val(0, TYPE_BOOL);
return val_mgr->GetBool(0);
%}

18
src/file_analysis/file_analysis.bif
View file

@ -12,28 +12,28 @@ type AnalyzerArgs: record;
function Files::__set_timeout_interval%(file_id: string, t: interval%): bool
%{
bool result = file_mgr->SetTimeoutInterval(file_id->CheckString(), t);
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
## :bro:see:`Files::enable_reassembly`.
function Files::__enable_reassembly%(file_id: string%): bool
%{
bool result = file_mgr->EnableReassembly(file_id->CheckString());
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
## :bro:see:`Files::disable_reassembly`.
function Files::__disable_reassembly%(file_id: string%): bool
%{
bool result = file_mgr->DisableReassembly(file_id->CheckString());
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
## :bro:see:`Files::set_reassembly_buffer_size`.
function Files::__set_reassembly_buffer%(file_id: string, max: count%): bool
%{
bool result = file_mgr->SetReassemblyBuffer(file_id->CheckString(), max);
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
## :bro:see:`Files::add_analyzer`.
@ -44,7 +44,7 @@ function Files::__add_analyzer%(file_id: string, tag: Files::Tag, args: any%): b
bool result = file_mgr->AddAnalyzer(file_id->CheckString(),
file_mgr->GetComponentTag(tag), rv);
Unref(rv);
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
## :bro:see:`Files::remove_analyzer`.
@ -55,14 +55,14 @@ function Files::__remove_analyzer%(file_id: string, tag: Files::Tag, args: any%)
bool result = file_mgr->RemoveAnalyzer(file_id->CheckString(),
file_mgr->GetComponentTag(tag) , rv);
Unref(rv);
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
## :bro:see:`Files::stop`.
function Files::__stop%(file_id: string%): bool
%{
bool result = file_mgr->IgnoreFile(file_id->CheckString());
return new Val(result, TYPE_BOOL);
return val_mgr->GetBool(result);
%}
## :bro:see:`Files::analyzer_name`.
@ -75,9 +75,9 @@ function Files::__analyzer_name%(tag: Files::Tag%) : string
function Files::__file_exists%(fuid: string%): bool
%{
if ( file_mgr->LookupFile(fuid->CheckString()) != nullptr )
return new Val(true, TYPE_BOOL);
return val_mgr->GetTrue();
else
return new Val(false, TYPE_BOOL);
return val_mgr->GetFalse();
%}
## :bro:see:`Files::lookup_file`.