Remove obsolete ZEEK_FORWARD_DECLARE_NAMESPACED macros

auxil/binpac

@@ -1 +1 @@
-Subproject commit 4aba04a27cbf1e4c5ee7c659e9abb8b735ca1f4b
+Subproject commit 410400cab13431814d5d9f88d643318845c84bcf

src/Attr.h

@@ -9,8 +9,6 @@
 #include "zeek/ZeekList.h"
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
-
 // Note that there are two kinds of attributes: the kind (here) which
 // modify expressions or supply metadata on types, and the kind that
 // are extra metadata on every variable instance.
@@ -22,6 +20,7 @@ using TypePtr = IntrusivePtr<Type>;
 
 namespace detail {
 
+class Expr;
 using ExprPtr = IntrusivePtr<Expr>;
 
 enum AttrTag {

src/Base64.h

@@ -3,10 +3,12 @@
 #include "zeek/zeek-config.h"
 #include <string>
 
-namespace zeek { class String; }
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 
-namespace zeek::detail {
+class String;
+class Connection;
+
+namespace detail {
 
 // Maybe we should have a base class for generic decoders?
 class Base64Converter {
@@ -63,4 +65,5 @@ protected:
 String* decode_base64(const String* s, const String* a = nullptr, Connection* conn = nullptr);
 String* encode_base64(const String* s, const String* a = nullptr, Connection* conn = nullptr);
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/BifReturnVal.h

@@ -5,12 +5,12 @@
 #include "zeek/zeek-config.h"
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 namespace zeek {
-using ValPtr = IntrusivePtr<Val>;
-}
 
-namespace zeek::detail {
+class Val;
+using ValPtr = IntrusivePtr<Val>;
+
+namespace detail {
 
 /**
  * A simple wrapper class to use for the return value of BIFs so that
@@ -30,4 +30,5 @@ public:
 	ValPtr rval;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/CompHash.h

@@ -7,15 +7,17 @@
 #include "zeek/Type.h"
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
-
 namespace zeek {
+
+class ListVal;
 using ListValPtr = zeek::IntrusivePtr<ListVal>;
-}
+
+} // namespace zeek
 
 namespace zeek::detail {
 
+class HashKey;
+
 class CompositeHash {
 public:
 	explicit CompositeHash(TypeListPtr composite_type);

src/Conn.h

@@ -21,23 +21,33 @@
 #include "zeek/analyzer/Tag.h"
 #include "zeek/analyzer/Analyzer.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ConnectionTimer, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EncapsulationStack, zeek);
-
-ZEEK_FORWARD_DECLARE_NAMESPACED(Specific_RE_Matcher, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleHdrTest, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TransportLayerAnalyzer, zeek, analyzer);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
-
 namespace zeek {
+
+class Connection;
+class NetSessions;
+class EncapsulationStack;
+class Val;
+class RecordVal;
+
 using ValPtr = IntrusivePtr<Val>;
 using RecordValPtr = IntrusivePtr<RecordVal>;
 
+namespace detail {
+
+class ConnectionTimer;
+class Specific_RE_Matcher;
+class RuleEndpointState;
+class RuleHdrTest;
+
+} // namespace detail
+
+namespace analyzer {
+
+class TransportLayerAnalyzer;
+class Analyzer;
+
+} // namespace analyzer
+
 enum ConnEventToFlag {
 	NUL_IN_LINE,
 	SINGULAR_CR,

src/DNS_Mgr.h

@@ -13,19 +13,20 @@
 #include "zeek/IPAddr.h"
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandler, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(DNS_Mgr_Request, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
-
 namespace zeek {
+
+class EventHandler;
+class RecordType;
+class Val;
+class ListVal;
+class TableVal;
+
 template <class T> class IntrusivePtr;
 using ValPtr = IntrusivePtr<Val>;
 using ListValPtr = IntrusivePtr<ListVal>;
 using TableValPtr = IntrusivePtr<TableVal>;
-}
+
+} // namespace zeek
 
 // Defined in nb_dns.h
 struct nb_dns_info;
@@ -33,6 +34,7 @@ struct nb_dns_result;
 
 namespace zeek::detail {
 
+class DNS_Mgr_Request;
 using DNS_mgr_request_list = PList<DNS_Mgr_Request>;
 
 class DNS_Mapping;

src/DbgBreakpoint.h

@@ -5,11 +5,11 @@
 #include <string>
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ParseLocationRec, zeek::detail);
-
 namespace zeek::detail {
 
+class Stmt;
+class ParseLocationRec;
+
 enum BreakCode { BC_NO_HIT, BC_HIT, BC_HIT_AND_DELETE };
 class DbgBreakpoint {
 	enum Kind { BP_STMT = 0, BP_FUNC, BP_LINE, BP_TIME };

src/DbgDisplay.h

@@ -2,10 +2,10 @@
 
 #pragma once
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
-
 namespace zeek::detail {
 
+class Expr;
+
 // Automatic displays: display these at each stoppage.
 class DbgDisplay {
 public:

src/DbgWatch.h

@@ -4,11 +4,12 @@
 
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
 namespace zeek { class Obj; }
 
 namespace zeek::detail {
 
+class Expr;
+
 class DbgWatch {
 public:
 	explicit DbgWatch(Obj* var_to_watch);

src/Debug.h

@@ -11,14 +11,9 @@
 #include "zeek/StmtEnums.h"
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(DbgBreakpoint, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(DbgWatch, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(DbgDisplay, zeek::detail);
-
 namespace zeek {
+
+class Val;
 template <class T> class IntrusivePtr;
 using ValPtr = zeek::IntrusivePtr<Val>;
 
@@ -26,6 +21,12 @@ extern std::string current_module;
 
 namespace detail {
 
+class Frame;
+class Stmt;
+class DbgBreakpoint;
+class DbgWatch;
+class DbgDisplay;
+
 // This needs to be defined before we do the includes that come after it.
 enum ParseLocationRecType { PLR_UNKNOWN, PLR_FILE_AND_LINE, PLR_FUNCTION };
 class ParseLocationRec {

src/DebugLogger.h

@@ -22,10 +22,10 @@
 
 #define PLUGIN_DBG_LOG(plugin, args...) ::zeek::detail::debug_logger.Log(plugin, args)
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Plugin, zeek, plugin);
-
 namespace zeek {
 
+namespace plugin { class Plugin; }
+
 // To add a new debugging stream, add a constant here as well as
 // an entry to DebugLogger::streams in DebugLogger.cc.
 

src/Desc.h

@@ -11,11 +11,10 @@
 #include "zeek/ZeekString.h" // for byte_vec
 #include "zeek/util.h" // for bro_int_t
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPPrefix, zeek);
-
 namespace zeek {
 
+class IPAddr;
+class IPPrefix;
 class File;
 class Type;
 

src/Dict.h

@@ -8,15 +8,14 @@
 
 #include "zeek/Hash.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IterCookie, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Dictionary, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(DictEntry, zeek::detail);
-
 // Type for function to be called when deleting elements.
 typedef void (*dict_delete_func)(void*);
 
 namespace zeek {
 
+class IterCookie;
+class Dictionary;
+
 enum DictOrder { ORDERED, UNORDERED };
 
 // A dict_delete_func that just calls delete.
@@ -24,6 +23,8 @@ extern void generic_delete_func(void*);
 
 namespace detail {
 
+class DictEntry;
+
 // Default number of hash buckets in dictionary.  The dictionary will increase the size
 // of the hash table as needed.
 constexpr uint32_t HASH_MASK = 0xFFFFFFFF; //only lower 32 bits.

src/Discard.h

@@ -7,11 +7,11 @@
 
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-
 namespace zeek {
+
+class IP_Hdr;
+class Val;
+class Func;
 using FuncPtr = IntrusivePtr<Func>;
 
 namespace detail {

src/EquivClass.h

@@ -4,10 +4,10 @@
 
 #include <stdio.h>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(CCL, zeek::detail);
-
 namespace zeek::detail {
 
+class CCL;
+
 class EquivClass {
 public:
 	explicit EquivClass(int size);

src/Event.h

@@ -12,10 +12,10 @@
 #include "zeek/ZeekArgs.h"
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventMgr, zeek);
-
 namespace zeek {
 
+class EventMgr;
+
 class Event final : public Obj {
 public:
 	Event(EventHandlerPtr handler, zeek::Args args,

src/EventHandler.h

@@ -9,9 +9,9 @@
 #include "zeek/ZeekArgs.h"
 #include "zeek/Type.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
-
 namespace zeek {
+
+class Func;
 using FuncPtr = IntrusivePtr<Func>;
 
 class EventHandler {

src/EventRegistry.h

@@ -10,12 +10,12 @@
 #include <string_view>
 #include <vector>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandler, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RE_Matcher, zeek);
-
 namespace zeek {
 
+class EventHandler;
+class EventHandlerPtr;
+class RE_Matcher;
+
 // The registry keeps track of all events that we provide or handle.
 class EventRegistry {
 public:

src/Expr.h

@@ -18,14 +18,13 @@
 #include "zeek/Val.h"
 #include "zeek/ZeekArgs.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
-
 namespace zeek {
 template <class T> class IntrusivePtr;
 
 namespace detail {
 
+class Frame;
+class Scope;
 struct function_ingredients;
 using IDPtr = IntrusivePtr<ID>;
 

src/File.h

@@ -16,11 +16,16 @@
 #include "zeek/IntrusivePtr.h"
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(PrintStmt, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Attributes, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
-
 namespace zeek {
+
+namespace detail {
+
+class PrintStmt;
+class Attributes;
+
+} // namespace detail;
+
+class RecordVal;
 class Type;
 using TypePtr = IntrusivePtr<Type>;
 

src/Frag.h

@@ -10,12 +10,15 @@
 #include "zeek/Reassem.h"
 #include "zeek/Timer.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(FragReassembler, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(FragTimer, zeek::detail);
 
-namespace zeek::detail {
+class NetSessions;
+class IP_Hdr;
+
+namespace detail {
+
+class FragReassembler;
+class FragTimer;
 
 using FragReassemblerKey = std::tuple<IPAddr, IPAddr, bro_uint_t>;
 
@@ -103,4 +106,5 @@ private:
 	FragReassembler* frag_reassembler;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/Frame.h

@@ -18,18 +18,21 @@
 #include "zeek/IntrusivePtr.h"
 #include "zeek/ZeekArgs.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(CallExpr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Trigger, zeek::detail::trigger);
-
 namespace zeek {
+
 using ValPtr = IntrusivePtr<Val>;
 
 namespace detail {
+
+class CallExpr;
 class ScriptFunc;
 using IDPtr = IntrusivePtr<ID>;
 
 namespace trigger {
+
+class Trigger;
 using TriggerPtr = IntrusivePtr<Trigger>;
+
 }
 
 class Frame;

src/Func.h

@@ -18,14 +18,6 @@
 #include "zeek/ZeekArgs.h"
 #include "zeek/BifReturnVal.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(CallExpr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(FuncType, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
-
 namespace caf {
 template <class> class expected;
 }
@@ -38,8 +30,16 @@ using caf::expected;
 
 namespace zeek {
 
+class Val;
+class FuncType;
+
 namespace detail {
 
+class Scope;
+class Stmt;
+class CallExpr;
+class ID;
+class Frame;
 using ScopePtr = IntrusivePtr<Scope>;
 using IDPtr = IntrusivePtr<ID>;
 using StmtPtr = IntrusivePtr<Stmt>;

src/Hash.h

@@ -26,10 +26,13 @@
 // to allow bro_md5_hmac access to the hmac seed
 #include "zeek/ZeekArgs.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(BifReturnVal, zeek::detail);
-
 namespace zeek { class String; }
+namespace zeek::detail {
+
+class Frame;
+class BifReturnVal;
+
+}
 
 namespace zeek::BifFunc {
 	extern zeek::detail::BifReturnVal md5_hmac_bif(zeek::detail::Frame* frame, const zeek::Args*);

src/ID.h

@@ -13,14 +13,14 @@
 #include "zeek/Notifier.h"
 #include "zeek/TraverseTypes.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableType, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(VectorType, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumType, zeek);
-
 namespace zeek {
+
+class Func;
+class Val;
+class RecordType;
+class TableType;
+class VectorType;
+class EnumType;
 class Type;
 using TypePtr = IntrusivePtr<Type>;
 using RecordTypePtr = IntrusivePtr<RecordType>;
@@ -29,6 +29,7 @@ using VectorTypePtr = IntrusivePtr<VectorType>;
 using EnumTypePtr = IntrusivePtr<EnumType>;
 using ValPtr = IntrusivePtr<Val>;
 using FuncPtr = IntrusivePtr<Func>;
+
 }
 
 namespace zeek::detail {

src/IP.h

@@ -16,15 +16,16 @@
 
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(FragReassembler, zeek::detail);
-
 namespace zeek {
+
+class IPAddr;
+class RecordVal;
+class VectorVal;
 using RecordValPtr = IntrusivePtr<RecordVal>;
 using VectorValPtr = IntrusivePtr<VectorVal>;
 
+namespace detail { class FragReassembler; }
+
 #ifdef ENABLE_MOBILE_IPV6
 
 #ifndef IPPROTO_MOBILITY

src/IPAddr.h

@@ -10,9 +10,6 @@
 
 #include "zeek/threading/SerialTypes.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
-namespace analyzer { class ExpectedConn; }
-
 typedef in_addr in4_addr;
 
 namespace zeek {
@@ -22,6 +19,8 @@ struct ConnID;
 
 namespace detail {
 
+class HashKey;
+
 struct ConnIDKey {
 	in6_addr ip1;
 	in6_addr ip2;

src/NFA.h

@@ -5,10 +5,6 @@
 #include "zeek/Obj.h"
 #include "zeek/List.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(CCL, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EquivClass, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
-
 #define NO_ACCEPT 0
 
 #define NO_UPPER_BOUND -1
@@ -20,7 +16,14 @@ ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
 #define SYM_EPSILON 259
 #define SYM_CCL 260
 
-namespace zeek::detail {
+namespace zeek {
+
+class Func;
+
+namespace detail {
+
+class CCL;
+class EquivClass;
 
 class NFA_State;
 using NFA_state_list = PList<NFA_State>;
@@ -136,4 +139,5 @@ extern NFA_state_list* epsilon_closure(NFA_state_list* states);
 // For sorting NFA states based on their ID fields (decreasing)
 extern bool NFA_state_cmp_neg(const NFA_State* v1, const NFA_State* v2);
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/Obj.h

@@ -6,9 +6,10 @@
 
 #include <limits.h>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
-
 namespace zeek {
+
+class ODesc;
+
 namespace detail {
 
 class Location final {

src/OpaqueVal.h

@@ -13,11 +13,11 @@
 
 namespace broker { class data; }
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(BloomFilter, zeek, probabilistic);
-ZEEK_FORWARD_DECLARE_NAMESPACED(CardinalityCounter, zeek, probabilistic, detail);
-
 namespace zeek {
 
+namespace probabilistic { class BloomFilter; }
+namespace probabilistic::detail { class CardinalityCounter; }
+
 class OpaqueVal;
 using OpaqueValPtr = IntrusivePtr<OpaqueVal>;
 

src/PacketFilter.h

@@ -7,10 +7,12 @@
 #include "zeek/IPAddr.h"
 #include "zeek/PrefixTable.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 
-namespace zeek::detail {
+class IP_Hdr;
+class Val;
+
+namespace detail {
 
 class PacketFilter {
 public:
@@ -50,4 +52,5 @@ private:
 	PrefixTable dst_filter;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/PrefixTable.h

@@ -4,14 +4,17 @@ extern "C" {
 	#include "zeek/patricia.h"
 }
 
+#include <tuple>
 #include <list>
 
 #include "zeek/IPAddr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(SubNetVal, zeek);
 
-namespace zeek::detail {
+class Val;
+class SubNetVal;
+
+namespace detail {
 
 class PrefixTable {
 private:
@@ -64,4 +67,5 @@ private:
 	data_fn_t delete_function;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/PriorityQueue.h

@@ -7,10 +7,10 @@
 #include <math.h>
 #include <stdint.h>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(PriorityQueue, zeek::detail);
-
 namespace zeek::detail {
 
+class PriorityQueue;
+
 class PQ_Element {
 public:
 	explicit PQ_Element(double t) : time(t) 	{}

src/RE.h

@@ -14,22 +14,22 @@
 
 typedef int (*cce_func)(int);
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(NFA_Machine, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(DFA_Machine, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(DFA_State, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Specific_RE_Matcher, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RE_Matcher, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(CCL, zeek::detail);
-
 // This method is automatically generated by flex and shouldn't be namespaced
 extern int re_lex(void);
 
 namespace zeek {
 
 class String;
+class RE_Matcher;
 
 namespace detail {
 
+class NFA_Machine;
+class DFA_Machine;
+class DFA_State;
+class Specific_RE_Matcher;
+class CCL;
+
 extern int case_insensitive;
 extern CCL* curr_ccl;
 extern NFA_Machine* nfa;

src/RandTest.h

@@ -8,9 +8,11 @@
                         bits than the mantissa of your "double"
                         floating point type. */
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EntropyVal, zeek);
+namespace zeek {
 
-namespace zeek::detail {
+class EntropyVal;
+
+namespace detail {
 
 class RandTest {
 public:
@@ -32,4 +34,5 @@ private:
 	       sccu0, scclast, scct1, scct2, scct3;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/Reporter.h

@@ -15,22 +15,29 @@
 #include "zeek/ZeekList.h"
 #include "zeek/net_util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Location, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Reporter, zeek);
-
 namespace zeek {
+
+class Connection;
+class EventHandlerPtr;
+class RecordVal;
+class StringVal;
+class IPAddr;
+class Reporter;
+
 template <class T> class IntrusivePtr;
 using RecordValPtr = IntrusivePtr<RecordVal>;
 using StringValPtr = IntrusivePtr<StringVal>;
 
+namespace detail {
+
+class Location;
+class Expr;
+
+} // namespace detail
+
+namespace analyzer { class Analyzer; }
+namespace file_analysis { class File; }
+
 // One cannot raise this exception directly, go through the
 // Reporter's methods instead.
 

src/Rule.h

@@ -8,14 +8,14 @@
 #include "zeek/List.h"
 #include "zeek/Obj.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleCondition, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleAction, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleHdrTest, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleMatcher, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
-
 namespace zeek::detail {
 
+class RuleCondition;
+class RuleAction;
+class RuleHdrTest;
+class RuleMatcher;
+class Rule;
+
 using rule_list = PList<Rule>;
 using rule_dict = std::map<std::string, Rule*>;
 

src/RuleAction.h

@@ -5,11 +5,11 @@
 #include <sys/types.h> // for u_char
 #include <string>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);
-
 namespace zeek::detail {
 
+class Rule;
+class RuleEndpointState;
+
 // Base class of all rule actions.
 class RuleAction {
 public:

src/RuleCondition.h

@@ -5,12 +5,12 @@
 
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail);
-
 namespace zeek::detail {
 
+class RuleEndpointState;
+class Rule;
+class ID;
+
 // Base class for all rule conditions except patterns and "header".
 class RuleCondition {
 public:

src/RuleMatcher.h

@@ -27,18 +27,22 @@ extern FILE* rules_in;
 extern int rules_line_number;
 extern const char* current_rule_file;
 
-namespace zeek { class File; }
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(RE_Match_State, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Specific_RE_Matcher, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleMatcher, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPPrefix, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
-ZEEK_FORWARD_DECLARE_NAMESPACED(IntSet, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(PIA, zeek, analyzer::pia);
 
-namespace zeek::detail {
+class File;
+class IP_Hdr;
+class IPPrefix;
+class Val;
+
+namespace analyzer { class Analyzer; }
+namespace analyzer::pia { class PIA; }
+
+namespace detail {
+
+class RE_Match_State;
+class Specific_RE_Matcher;
+class RuleMatcher;
+class IntSet;
 
 extern RuleMatcher* rule_matcher;
 
@@ -390,4 +394,5 @@ private:
 	RuleEndpointState* resp_match_state;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/RunState.h

@@ -7,12 +7,19 @@
 #include <string>
 #include <optional>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
-ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
 
-namespace zeek::run_state {
+class Packet;
+
+namespace iosource {
+
+class IOSource;
+class PktSrc;
+class PktDumper;
+
+} // namespace iosource
+
+namespace run_state {
 namespace detail {
 
 extern void init_run(const std::optional<std::string>& interfaces,
@@ -103,4 +110,5 @@ extern const zeek::Packet* current_pkt;
 extern int current_dispatched;
 extern double current_timestamp;
 
-} // namespace zeek::run_state
+} // namespace run_state
+} // namespace zeek

src/Scope.h

@@ -12,18 +12,16 @@
 #include "zeek/IntrusivePtr.h"
 #include "zeek/TraverseTypes.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Type, zeek);
-
-ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Attr, zeek::detail);
-
 namespace zeek {
 
+class Type;
 template <class T> class IntrusivePtr;
 using TypePtr = IntrusivePtr<Type>;
 
 namespace detail {
 
+class Attr;
+class ID;
 using AttrPtr = IntrusivePtr<Attr>;
 using IDPtr = IntrusivePtr<ID>;
 

src/ScriptCoverageManager.h

@@ -6,10 +6,11 @@
 #include <string>
 
 #include "zeek/util.h"
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
 
 namespace zeek::detail {
 
+class Stmt;
+
 /**
  * A simple class for managing stats of Bro script coverage across Bro runs.
  */

src/SerializationFormat.h

@@ -7,13 +7,15 @@
 #include <stdint.h>
 #include <string>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPPrefix, zeek);
-
 struct in_addr;
 struct in6_addr;
 
-namespace zeek::detail {
+namespace zeek {
+
+class IPAddr;
+class IPPrefix;
+
+namespace detail {
 
 // Abstract base class.
 class SerializationFormat {
@@ -138,3 +140,4 @@ public:
 };
 
 } // namespace zeek::detail
+} // namespace zeek

src/Sessions.h

@@ -11,17 +11,17 @@
 #include "zeek/NetVar.h"
 #include "zeek/analyzer/protocol/tcp/Stats.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EncapsulationStack, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 class ConnCompressor;
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(SteppingStoneManager, zeek, analyzer::stepping_stone);
-
 namespace zeek {
 
+class EncapsulationStack;
+class Packet;
+class Connection;
 struct ConnID;
 
+namespace analyzer::stepping_stone { class SteppingStoneManager; }
+
 struct SessionStats {
 	size_t num_TCP_conns;
 	size_t max_TCP_conns;

src/Stats.h

@@ -9,13 +9,15 @@
 #include <sys/resource.h>
 #include <stdint.h>
 
-namespace zeek { class File; }
+namespace zeek {
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
+class File;
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
+class Func;
-ZEEK_FORWARD_DECLARE_NAMESPACED(Location, zeek::detail);
+class TableVal;
 
-namespace zeek::detail {
+namespace detail {
+
+class Location;
 
 // Object called by SegmentProfiler when it is done and reports its
 // cumulative CPU/memory statistics.
@@ -142,4 +144,5 @@ protected:
 	uint64_t byte_cnt;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/Stmt.h

@@ -10,11 +10,10 @@
 #include "zeek/Dict.h"
 #include "zeek/ID.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(NameExpr, zeek::detail);
-
 namespace zeek::detail {
 
+class CompositeHash;
+class NameExpr;
 using NameExprPtr = IntrusivePtr<zeek::detail::NameExpr>;
 
 class ExprListStmt : public Stmt {

src/StmtBase.h

@@ -12,17 +12,17 @@
 #include "zeek/TraverseTypes.h"
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
-
-namespace zeek::run_state { extern double network_time; }
-
 namespace zeek {
+
 class Val;
 using ValPtr = IntrusivePtr<Val>;
-}
 
-namespace zeek::detail {
+namespace run_state { extern double network_time; }
+
+namespace detail {
+
+class CompositeHash;
+class Frame;
 
 class CatchReturnStmt;
 class ExprStmt;
@@ -184,4 +184,5 @@ protected:
 	StmtPtr original = nullptr;
 };
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/Tag.h

@@ -10,11 +10,10 @@
 #include "zeek/IntrusivePtr.h"
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumType, zeek);
-
 namespace zeek {
 
+class EnumVal;
+class EnumType;
 using EnumTypePtr = IntrusivePtr<EnumType>;
 using EnumValPtr = IntrusivePtr<EnumVal>;
 

src/Timer.h

@@ -7,7 +7,7 @@
 #include "zeek/PriorityQueue.h"
 #include "zeek/iosource/IOSource.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
+namespace zeek { class ODesc; }
 
 namespace zeek::detail {
 

src/Traverse.h

@@ -4,13 +4,16 @@
 
 #include "zeek/TraverseTypes.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail);
 
-namespace zeek::detail {
+class Func;
+
+namespace detail {
+
+class Scope;
+class Stmt;
+class Expr;
+class ID;
 
 class TraversalCallback {
 public:
@@ -40,4 +43,5 @@ public:
 
 TraversalCode traverse_all(TraversalCallback* cb);
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/TraverseTypes.h

@@ -4,10 +4,10 @@
 
 #include "zeek/zeek-config.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(TraversalCallback, zeek::detail);
-
 namespace zeek::detail {
 
+class TraversalCallback;
+
 enum TraversalCode {
 	TC_CONTINUE = 0,
 	TC_ABORTALL = 1,

src/Trigger.h

@@ -10,15 +10,19 @@
 #include "zeek/util.h"
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
+
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
+class ODesc;
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
+class Val;
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
+
-ZEEK_FORWARD_DECLARE_NAMESPACED(CallExpr, zeek::detail);
+namespace detail {
-ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail);
+
+class Frame;
+class Stmt;
+class Expr;
+class CallExpr;
+class ID;
 
-namespace zeek::detail {
 namespace trigger {
 
 
@@ -149,4 +153,5 @@ private:
 
 extern trigger::Manager* trigger_mgr;
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/TunnelEncapsulation.h

@@ -11,10 +11,10 @@
 #include "zeek/ID.h"
 #include "zeek/UID.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
-
 namespace zeek {
 
+class Connection;
+
 /**
  * Represents various types of tunnel "connections", that is, a pair of
  * endpoints whose communication encapsulates inner IP packets.  This could

src/Type.h

@@ -15,22 +15,23 @@
 #include "zeek/ZeekList.h"
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ListExpr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Attributes, zeek::detail);
-
 namespace zeek {
 
+class Val;
+class EnumVal;
+class TableVal;
 using ValPtr = IntrusivePtr<Val>;
 using EnumValPtr = IntrusivePtr<EnumVal>;
 using TableValPtr = IntrusivePtr<TableVal>;
 
 namespace detail {
+
+class Expr;
+class ListExpr;
+class Attributes;
 using ListExprPtr = IntrusivePtr<ListExpr>;
-}
+
+} // namespace detail
 
 // BRO types.
 enum TypeTag {

src/Val.h

@@ -27,33 +27,31 @@
 #define ICMP_PORT_MASK	0x30000
 
 namespace zeek {
-class String;
-}
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
+class String;
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
+class Func;
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
+class IPAddr;
-ZEEK_FORWARD_DECLARE_NAMESPACED(IPPrefix, zeek);
+class IPPrefix;
-namespace zeek {
+class RE_Matcher;
 class File;
 using FilePtr = zeek::IntrusivePtr<File>;
-}
 
-namespace zeek::detail { class ScriptFunc; }
+namespace detail {
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(PrefixTable, zeek::detail);
+class ScriptFunc;
-ZEEK_FORWARD_DECLARE_NAMESPACED(RE_Matcher, zeek);
+class Frame;
+class PrefixTable;
+class CompositeHash;
+class HashKey;
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
+} // namespace detail
-ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);
 
-namespace zeek {
 namespace run_state {
 
 extern double network_time;
 extern double zeek_start_network_time;
 
-}
+} // namespace run_state
 
 using FuncPtr = IntrusivePtr<Func>;
 using FilePtr = IntrusivePtr<File>;

src/Var.h

@@ -6,17 +6,19 @@
 #include "zeek/ID.h"
 #include "zeek/Type.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(FuncType, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
 
-namespace zeek::detail {
+class EventHandlerPtr;
+class StringVal;
+class TableVal;
+class ListVal;
+class FuncType;
 
+namespace detail {
+
+class Expr;
+class Scope;
+class Stmt;
 using StmtPtr = IntrusivePtr<Stmt>;
 
 enum DeclType { VAR_REGULAR, VAR_CONST, VAR_REDEF, VAR_OPTION, };
@@ -41,4 +43,5 @@ extern void end_func(StmtPtr body);
 // Gather all IDs referenced inside a body that aren't part of a given scope.
 extern IDPList gather_outer_ids(Scope* scope, Stmt* body);
 
-} // namespace zeek::detail
+} // namespace detail
+} // namespace zeek

src/ZeekList.h

@@ -4,15 +4,18 @@
 
 #include "zeek/List.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Attr, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Timer, zeek::detail);
-
 namespace zeek {
+namespace detail {
 
+class Expr;
+class ID;
+class Stmt;
+class Attr;
+class Timer;
+
+} // namespace detail
+
+class Val;
 class Type;
 
 using ValPList = PList<Val>;

src/ZeekString.h

@@ -10,12 +10,12 @@
 #include <string>
 #include <iosfwd>
 
+namespace zeek {
+
 // Forward declaration, for helper functions that convert (sub)string vectors
 // to and from policy-level representations.
 //
-ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek);
+class VectorVal;
-
-namespace zeek {
 
 typedef u_char* byte_vec;
 

src/analyzer/Analyzer.h

@@ -16,20 +16,23 @@
 #include "zeek/Timer.h"
 #include "zeek/IntrusivePtr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TCP_ApplicationAnalyzer, zeek, analyzer::tcp);
-ZEEK_FORWARD_DECLARE_NAMESPACED(PIA, zeek, analyzer::pia);
-
 namespace zeek {
-using RecordValPtr = zeek::IntrusivePtr<RecordVal>;
+
+class Connection;
+class IP_Hdr;
 class File;
 using FilePtr = zeek::IntrusivePtr<File>;
-}
+using RecordValPtr = zeek::IntrusivePtr<RecordVal>;
+
+namespace detail { class Rule; }
+
+} // namespace zeek
 
 namespace zeek::analyzer {
 
+namespace tcp { class TCP_ApplicationAnalyzer; }
+namespace pia { class PIA; }
+
 class Analyzer;
 class AnalyzerTimer;
 class SupportAnalyzer;

src/analyzer/Component.h

@@ -10,10 +10,13 @@
 
 #include "zeek/util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
 
-namespace zeek::analyzer {
+class Connection;
+
+namespace analyzer {
+
+class Analyzer;
 
 /**
  * Component description for plugins providing analyzers.
@@ -107,4 +110,5 @@ private:
 	bool enabled;	// True if the analyzer is enabled.
 };
 
-} // namespace zeek::analyzer
+} // namespace analyzer
+} // namespace zeek

src/analyzer/Tag.h

@@ -6,17 +6,21 @@
 #include "zeek/zeek-config.h"
 #include "zeek/Tag.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
+namespace zeek {
+
+class EnumVal;
+
+namespace plugin {
 
-namespace zeek::plugin {
 template <class T> class TaggedComponent;
 template <class T, class C> class ComponentManager;
-}
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, analyzer);
+} // namespace plugin
-ZEEK_FORWARD_DECLARE_NAMESPACED(Component, zeek, analyzer);
 
-namespace zeek::analyzer {
+namespace analyzer {
+
+class Manager;
+class Component;
 
 /**
  * Class to identify a protocol analyzer type.
@@ -111,4 +115,5 @@ protected:
 	explicit Tag(EnumValPtr val);
 };
 
-} // namespace zeek::analyzer
+} // namespace analyzer
+} // namespace zeek

src/analyzer/protocol/bittorrent/BitTorrentTracker.h

@@ -6,9 +6,11 @@
 
 #define BTTRACKER_BUF 2048
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
+namespace zeek {
 
-namespace zeek::analyzer::bittorrent {
+class StringVal;
+
+namespace analyzer::bittorrent {
 
 // If the following is defined, then the analyzer will store all of
 // the headers seen in tracker messages.
@@ -133,4 +135,5 @@ protected:
 	bool stop_orig, stop_resp;
 };
 
-} // namespace zeek::analyzer::bittorrent
+} // namespace analyzer::bittorrent
+} // namespace zeek

src/analyzer/protocol/ftp/FTP.h

@@ -4,7 +4,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(NVT_Analyzer, zeek, analyzer::login);
+namespace zeek::analyzer::login { class NVT_Analyzer; }
 
 namespace zeek::analyzer::ftp {
 

src/analyzer/protocol/icmp/ICMP.h

@@ -6,12 +6,12 @@
 #include "zeek/analyzer/Analyzer.h"
 #include "zeek/net_util.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek);
 namespace zeek {
-using VectorValPtr = IntrusivePtr<VectorVal>;
-}
 
-namespace zeek::analyzer::icmp {
+class VectorVal;
+using VectorValPtr = IntrusivePtr<VectorVal>;
+
+namespace analyzer::icmp {
 
 enum ICMP_EndpointState {
 	ICMP_INACTIVE,	// no packet seen
@@ -95,4 +95,5 @@ private:
 extern int ICMP4_counterpart(int icmp_type, int icmp_code, bool& is_one_way);
 extern int ICMP6_counterpart(int icmp_type, int icmp_code, bool& is_one_way);
 
-} // namespace zeek::analyzer::icmp
+} // namespace analyzer::icmp
+} // namespace zeek

src/analyzer/protocol/login/NVT.h

@@ -11,10 +11,10 @@
 #define TELNET_OPTION_ENVIRON 39
 #define NUM_TELNET_OPTIONS 5
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(NVT_Analyzer, zeek, analyzer::login);
-
 namespace zeek::analyzer::login {
 
+class NVT_Analyzer;
+
 class TelnetOption {
 public:
 	TelnetOption(NVT_Analyzer* endp, unsigned int code);

src/analyzer/protocol/login/RSH.h

@@ -5,10 +5,10 @@
 #include "zeek/analyzer/protocol/login/Login.h"
 #include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Rsh_Analyzer, zeek, analyzer::login);
-
 namespace zeek::analyzer::login {
 
+class Rsh_Analyzer;
+
 enum rsh_state {
 	RSH_FIRST_NULL,		// waiting to see first NUL
 	RSH_CLIENT_USER_NAME,	// scanning client user name up to NUL

src/analyzer/protocol/login/Rlogin.h

@@ -5,10 +5,10 @@
 #include "zeek/analyzer/protocol/login/Login.h"
 #include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Rlogin_Analyzer, zeek, analyzer::login);
-
 namespace zeek::analyzer::login {
 
+class Rlogin_Analyzer;
+
 enum rlogin_state {
 	RLOGIN_FIRST_NULL,	// waiting to see first NUL
 	RLOGIN_CLIENT_USER_NAME,	// scanning client user name up to NUL

src/analyzer/protocol/mime/MIME.h

@@ -10,16 +10,16 @@
 #include "zeek/Reporter.h"
 #include "zeek/analyzer/Analyzer.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Base64Converter, zeek::detail);
-
 namespace zeek {
+
+class TableVal;
+class StringVal;
 using TableValPtr = IntrusivePtr<TableVal>;
 using StringValPtr = IntrusivePtr<StringVal>;
-}
 
-namespace zeek::analyzer::mime {
+namespace detail { class Base64Converter; }
+
+namespace analyzer::mime {
 
 // MIME: Multipurpose Internet Mail Extensions
 // Follows RFC 822 & 2822 (Internet Mail), 2045-2049 (MIME)
@@ -287,4 +287,5 @@ extern int MIME_get_value(int len, const char* data, String*& buf,
 extern int MIME_get_field_name(int len, const char* data, data_chunk_t* name);
 extern String* MIME_decode_quoted_pairs(data_chunk_t buf);
 
-} // namespace zeek::analyzer::mime
+} // namespace analyzer::mime
+} // namespace zeek

src/analyzer/protocol/pia/PIA.h

@@ -6,7 +6,7 @@
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/RuleMatcher.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);
+namespace zeek::detail { class RuleEndpointState; }
 
 namespace zeek::analyzer::pia {
 

src/analyzer/protocol/stepping-stone/SteppingStone.h

@@ -5,9 +5,11 @@
 #include "zeek/Queue.h"
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
+namespace zeek {
 
-namespace zeek::analyzer::stepping_stone {
+class NetSessions;
+
+namespace analyzer::stepping_stone {
 
 class SteppingStoneEndpoint;
 class SteppingStoneManager;
@@ -81,4 +83,5 @@ protected:
 	int endp_cnt = 0;
 };
 
-} // namespace zeek::analyzer::stepping_stone
+} // namespace analyzer::stepping_stone
+} // namespace zeek

src/analyzer/protocol/tcp/TCP.h

@@ -14,13 +14,14 @@
 //   protocol running on top of TCP.
 //
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(PIA_TCP, zeek, analyzer::pia);
+namespace zeek::analyzer::pia { class PIA_TCP; }
-ZEEK_FORWARD_DECLARE_NAMESPACED(TCP_Endpoint, zeek, analyzer::tcp);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TCP_Reassembler, zeek, analyzer::tcp);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TCP_ApplicationAnalyzer, zeek, analyzer::tcp);
 
 namespace zeek::analyzer::tcp {
 
+class TCP_Endpoint;
+class TCP_Reassembler;
+class TCP_ApplicationAnalyzer;
+
 class TCP_Analyzer final : public analyzer::TransportLayerAnalyzer {
 public:
 	explicit TCP_Analyzer(Connection* conn);

src/analyzer/protocol/tcp/TCP_Endpoint.h

@@ -5,12 +5,15 @@
 #include "zeek/IPAddr.h"
 #include "zeek/File.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TCP_Analyzer, zeek, analyzer::tcp);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TCP_Reassembler, zeek, analyzer::tcp);
 
-namespace zeek::analyzer::tcp {
+class Connection;
+class IP_Hdr;
+
+namespace analyzer::tcp {
+
+class TCP_Analyzer;
+class TCP_Reassembler;
 
 enum EndpointState {
 	TCP_ENDPOINT_INACTIVE,	// no SYN (or other packets) seen for this side
@@ -251,4 +254,5 @@ protected:
 #define ENDIAN_BIG 2
 #define ENDIAN_CONFUSED 3
 
-} // namespace zeek::analyzer::tcp
+} // namespace analyzer::tcp
+} // namespace zeek

src/analyzer/protocol/tcp/TCP_Reassembler.h

@@ -5,11 +5,17 @@
 #include "zeek/analyzer/protocol/tcp/TCP_Flags.h"
 #include "zeek/File.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TCP_Analyzer, zeek, analyzer::tcp);
 
-namespace zeek::analyzer::tcp {
+class Connection;
+
+namespace analyzer {
+
+class Analyzer;
+
+namespace tcp {
+
+class TCP_Analyzer;
 
 class TCP_Reassembler final : public Reassembler {
 public:
@@ -112,4 +118,6 @@ private:
 	Type type;
 };
 
-} // namespace zeek::analyzer::tcp
+} // namespace tcp
+} // namespace analyzer
+} // namespace zeek

src/broker/Data.h

@@ -5,13 +5,18 @@
 #include "zeek/Frame.h"
 #include "zeek/Expr.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
+namespace zeek {
-namespace zeek::threading {
+
+class ODesc;
+
+namespace threading {
+
 struct Value;
 struct Field;
-}
 
-namespace zeek::Broker::detail {
+} // namespace threading
+
+namespace Broker::detail {
 
 extern OpaqueTypePtr opaque_of_data_type;
 extern OpaqueTypePtr opaque_of_set_iterator;
@@ -288,4 +293,5 @@ protected:
 	DECLARE_OPAQUE_VALUE(zeek::Broker::detail::RecordIterator)
 };
 
-} // namespace zeek::Broker
+} // namespace Broker::detail
+} // namespace zeek

src/broker/Manager.h

@@ -22,15 +22,16 @@
 #include "zeek/iosource/IOSource.h"
 #include "zeek/logging/WriterBackend.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(VectorType, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
-
 namespace zeek {
+
+class Func;
+class VectorType;
+class TableVal;
 using VectorTypePtr = IntrusivePtr<VectorType>;
 using TableValPtr = IntrusivePtr<TableVal>;
 
+namespace detail { class Frame; }
+
 namespace Broker {
 
 namespace detail {

src/file_analysis/Analyzer.h

@@ -6,15 +6,14 @@
 
 #include "zeek/file_analysis/Tag.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
 namespace zeek {
+
+class RecordVal;
 using RecordValPtr = IntrusivePtr<RecordVal>;
-}
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
+namespace file_analysis {
-
-namespace zeek::file_analysis {
 
+class File;
 using ID = uint32_t;
 
 /**
@@ -175,4 +174,5 @@ private:
 	static ID id_counter;
 };
 
-} // namespace zeek::file_analysis
+} // namespace file_analysis
+} // namespace zeek

src/file_analysis/AnalyzerSet.h

@@ -8,16 +8,19 @@
 #include "zeek/Dict.h"
 #include "zeek/file_analysis/Tag.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(CompositeHash, zeek::detail);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
 namespace zeek {
+
+class RecordVal;
 using RecordValPtr = IntrusivePtr<RecordVal>;
-}
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, file_analysis);
+namespace detail { class CompositeHash; }
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
 
-namespace zeek::file_analysis::detail {
+namespace file_analysis {
+
+class Analyzer;
+class File;
+
+namespace detail {
 
 /**
  * A set of file analysis analyzers indexed by an \c AnalyzerArgs (script-layer
@@ -237,4 +240,6 @@ private:
 	ModQueue mod_queue;	/**< A queue of analyzer additions/removals requests. */
 };
 
-} // namespace zeek::file_analysis::detail
+} // namespace detail
+} // namespace file_analysis
+} // namespace zeek

src/file_analysis/Component.h

@@ -8,16 +8,16 @@
 #include "zeek/plugin/Component.h"
 #include "zeek/plugin/TaggedComponent.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
 namespace zeek {
+
+class RecordVal;
 using RecordValPtr = zeek::IntrusivePtr<RecordVal>;
-}
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
+namespace file_analysis {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, file_analysis);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, file_analysis);
 
-namespace zeek::file_analysis {
+class File;
+class Analyzer;
+class Manager;
 
 /**
  * Component description for plugins providing file analyzers.
@@ -81,4 +81,5 @@ private:
 	factory_function factory_func;	// The analyzer's factory callback.
 };
 
-} // namespace zeek::file_analysis
+} // namespace file_analysis
+} // namespace zeek

src/file_analysis/File.h

@@ -13,19 +13,19 @@
 #include "zeek/ZeekArgs.h"
 #include "zeek/WeirdState.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek);
 namespace zeek {
+
+class Connection;
+class EventHandlerPtr;
+class RecordVal;
+class RecordType;
 using RecordValPtr = IntrusivePtr<RecordVal>;
 using RecordTypePtr = IntrusivePtr<RecordType>;
-}
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(FileReassembler, zeek, file_analysis);
+namespace file_analysis {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Tag, zeek, file_analysis);
 
-namespace zeek::file_analysis {
+class FileReassembler;
+class Tag;
 
 /**
  * Wrapper class around \c fa_file record values from script layer.
@@ -367,3 +367,4 @@ protected:
 };
 
 } // namespace file_analysis
+} // namespace zeek

src/file_analysis/FileReassembler.cc

@@ -3,10 +3,10 @@
 #include "zeek/file_analysis/FileReassembler.h"
 #include "zeek/file_analysis/File.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
-
 namespace zeek::file_analysis {
 
+class File;
+
 FileReassembler::FileReassembler(File *f, uint64_t starting_offset)
 	: Reassembler(starting_offset, REASSEM_FILE), the_file(f), flushing(false)
 	{

src/file_analysis/FileReassembler.h

@@ -4,12 +4,14 @@
 
 #include "zeek/Reassem.h"
 
-namespace zeek { class File; }
+namespace zeek {
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
+class Connection;
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
+class File;
 
-namespace zeek::file_analysis {
+namespace file_analysis {
+
+class File;
 
 class FileReassembler final : public Reassembler {
 public:
@@ -57,4 +59,5 @@ protected:
 	bool flushing = false;
 };
 
-} // namespace zeek::file_analysis
+} // namespace file_analysis
+} // namespace zeek

src/file_analysis/Manager.h

@@ -14,16 +14,23 @@
 #include "zeek/analyzer/Tag.h"
 #include "zeek/file_analysis/FileTimer.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Tag, zeek, analyzer);
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Tag, zeek, file_analysis);
-
 namespace zeek {
+
+class TableVal;
+class VectorVal;
+
+namespace analyzer {
+
+class Analyzer;
+class Tag;
+
+} // namespace analyzer
+
 namespace file_analysis {
 
+class File;
+class Tag;
+
 /**
  * Main entry point for interacting with file analysis.
  */

src/file_analysis/Tag.h

@@ -5,16 +5,18 @@
 #include "zeek/zeek-config.h"
 #include "zeek/Tag.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
-
 namespace zeek::plugin {
 	template <class T> class TaggedComponent;
 	template <class T, class C> class ComponentManager;
 }
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Component, zeek, file_analysis);
+namespace zeek {
 
-namespace zeek::file_analysis {
+class EnumVal;
+
+namespace file_analysis {
+
+class Component;
 
 /**
  * Class to identify a file analyzer type.
@@ -108,4 +110,5 @@ protected:
 	explicit Tag(EnumValPtr val);
 };
 
-} // namespace zeek::file_analysis
+} // namespace file_analysis
+} // namespace zeek

src/file_analysis/analyzer/x509/OCSP.h

@@ -7,9 +7,11 @@
 
 #include "zeek/file_analysis/analyzer/x509/X509Common.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
+namespace zeek::file_analysis {
 
-namespace zeek::file_analysis::detail {
+class File;
+
+namespace detail {
 
 class OCSP : public file_analysis::detail::X509Common {
 public:
@@ -34,4 +36,5 @@ private:
 	bool request = false; // true if ocsp request, false if reply
 };
 
-} // namespace zeek::file_analysis::detail
+} // namespace detail
+} // namespace zeek::file_analysis

src/file_analysis/analyzer/x509/X509Common.h

@@ -10,18 +10,20 @@
 
 #include "zeek/file_analysis/Analyzer.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandlerPtr, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Reporter, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Tag, zeek, file_analysis);
-
 namespace zeek {
+
+class EventHandlerPtr;
+class Reporter;
+class StringVal;
 template <class T> class IntrusivePtr;
 using StringValPtr = IntrusivePtr<StringVal>;
-}
 
-namespace zeek::file_analysis::detail {
+namespace file_analysis {
+
+class File;
+class Tag;
+
+namespace detail {
 
 class X509Common : public file_analysis::Analyzer {
 public:
@@ -53,4 +55,6 @@ protected:
 	virtual void ParseExtensionsSpecific(X509_EXTENSION* ex, bool, ASN1_OBJECT*, const char*) = 0;
 };
 
-} // namespace zeek::file_analysis
+} // namespace detail
+} // namespace file_analysis
+} // namespace zeek

src/input.h

@@ -34,10 +34,10 @@ extern void do_doc_token_stop();
 extern int line_number;
 extern const char* filename;
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
-
 namespace zeek::detail {
 
+class Stmt;
+
 extern int zeek_argc;
 extern char** zeek_argv;
 extern const char* prog;

src/input/Component.h

@@ -6,11 +6,11 @@
 #include "zeek/plugin/TaggedComponent.h"
 #include "zeek/input/Tag.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderBackend, zeek, input);
-
 namespace zeek::input {
 
+class ReaderFrontend;
+class ReaderBackend;
+
 /**
  * Component description for plugins providing log readers.
  */

src/input/Manager.h

@@ -12,13 +12,15 @@
 #include "zeek/threading/SerialTypes.h"
 #include "zeek/input/Tag.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
-ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderBackend, zeek, input);
-
 namespace zeek {
+
+class RecordVal;
+
 namespace input {
 
+class ReaderFrontend;
+class ReaderBackend;
+
 /**
  * Singleton class for managing input streams.
  */

src/input/ReaderBackend.h

@@ -9,10 +9,10 @@
 
 #include "zeek/input/Component.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek::input);
-
 namespace zeek::input {
 
+class ReaderFrontend;
+
 /**
  * The modes a reader can be in.
  */

src/input/ReaderFrontend.h

@@ -5,10 +5,13 @@
 #include "zeek/input/ReaderBackend.h"
 #include "zeek/threading/SerialTypes.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
+namespace zeek {
-ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, input);
 
-namespace zeek::input {
+class EnumVal;
+
+namespace input {
+
+class Manager;
 
 /**
  * Bridge class between the input::Manager and backend input threads. The
@@ -130,4 +133,5 @@ private:
 	const char* name;	// Descriptive name.
 };
 
-} // namespace zeek::input
+} // namespace input
+} // namespace zeek

src/input/Tag.h

@@ -5,17 +5,21 @@
 #include "zeek/zeek-config.h"
 #include "zeek/Tag.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
+namespace zeek {
+
+class EnumVal;
+
+namespace plugin {
 
-namespace zeek::plugin {
 template <class T> class TaggedComponent;
 template <class T, class C> class ComponentManager;
-}
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, input);
+} // namespace plugin
-ZEEK_FORWARD_DECLARE_NAMESPACED(Component, zeek, input);
 
-namespace zeek::input {
+namespace input {
+
+class Manager;
+class Component;
 
 /**
  * Class to identify a reader type.
@@ -109,4 +113,5 @@ protected:
 	explicit Tag(EnumValPtr val);
 };
 
-} // namespace zeek::input
+} // namespace input
+} // namespace zeek

src/iosource/Component.h

@@ -7,12 +7,12 @@
 
 #include "zeek/plugin/Component.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
-ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
-ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
-
 namespace zeek::iosource {
 
+class IOSource;
+class PktSrc;
+class PktDumper;
+
 /**
  * Component description for plugins providing IOSources.
  */

src/iosource/Manager.h

@@ -14,12 +14,12 @@
 struct timespec;
 struct kevent;
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
-ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
-
 namespace zeek {
 namespace iosource {
 
+class PktSrc;
+class PktDumper;
+
 /**
  * Manager class for IO sources. This handles all of the polling of sources
  * in the main loop.

src/iosource/Packet.h

@@ -19,12 +19,12 @@ typedef struct timeval pkt_timeval;
 #include "zeek/TunnelEncapsulation.h"
 #include "zeek/IP.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
-
 namespace zeek {
 
+class ODesc;
+class Val;
+class RecordVal;
+
 template <class T> class IntrusivePtr;
 using ValPtr = IntrusivePtr<Val>;
 using RecordValPtr = IntrusivePtr<RecordVal>;

src/iosource/PktDumper.h

@@ -5,9 +5,11 @@
 #include "zeek/zeek-config.h"
 #include <string>
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
+namespace zeek {
 
-namespace zeek::iosource {
+class Packet;
+
+namespace iosource {
 
 /**
  * Base class for packet dumpers.
@@ -133,4 +135,5 @@ private:
 	std::string errmsg;
 };
 
-} // namespace zeek::iosource
+} // namespace iosource
+} // namespace zeek

src/iosource/PktSrc.h

@@ -9,10 +9,11 @@
 #include "zeek/iosource/Packet.h"
 
 struct pcap_pkthdr;
-ZEEK_FORWARD_DECLARE_NAMESPACED(BPF_Program, zeek::iosource::detail);
 
 namespace zeek::iosource {
 
+namespace detail { class BPF_Program; }
+
 /**
  * Base class for packet sources.
  */

src/logging/Component.h

@@ -6,11 +6,11 @@
 #include "zeek/plugin/Component.h"
 #include "zeek/plugin/TaggedComponent.h"
 
-ZEEK_FORWARD_DECLARE_NAMESPACED(WriterFrontend, zeek, logging);
-ZEEK_FORWARD_DECLARE_NAMESPACED(WriterBackend, zeek, logging);
-
 namespace zeek::logging {
 
+class WriterFrontend;
+class WriterBackend;
+
 /**
  * Component description for plugins providing log writers.
  */

src/logging/Manager.h

@@ -15,14 +15,15 @@
 #include "zeek/logging/WriterBackend.h"
 
 namespace broker { struct endpoint_info; }
-ZEEK_FORWARD_DECLARE_NAMESPACED(SerializationFormat, zeek::detail);
-
-ZEEK_FORWARD_DECLARE_NAMESPACED(WriterFrontend, zeek, logging);
-ZEEK_FORWARD_DECLARE_NAMESPACED(RotationFinishedMessage, zeek, logging);
 
 namespace zeek {
+
+namespace detail { class SerializationFormat; }
+
 namespace logging {
 
+class WriterFrontend;
+class RotationFinishedMessage;
 class RotationTimer;
 
 /**