Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Switch zeek:🆔:lookup to zeek:🆔:find

Browse source 
For parity with Scope since it now uses Find instead of Lookup
This commit is contained in:
Jon Siwek 2020-05-14 18:00:18 -07:00
parent 7843416e51
commit 4debad8caf
59 changed files with 339 additions and 339 deletions
Download patch file Download diff file Expand all files Collapse all files

8
NEWS
View file

@ -159,15 +159,15 @@ Deprecated Functionality
- ``ID::ID_Val()`` is deprecated, use ``ID::GetVal()``. - ``ID::ID_Val()`` is deprecated, use ``ID::GetVal()``.
- ``internal_type()`` is deprecated, use ``zeek::id::lookup_type()``. - ``internal_type()`` is deprecated, use ``zeek::id::find_type()``.
- ``internal_val()`` and ``internal_const_val()`` are deprecated, use - ``internal_val()`` and ``internal_const_val()`` are deprecated, use
``zeek::id::lookup_val()`` or ``zeek::id::lookup_const()``. ``zeek::id::find_val()`` or ``zeek::id::find_const()``.
- ``internal_func()`` is deprecated, use ``zeek::id::lookup_func()``. - ``internal_func()`` is deprecated, use ``zeek::id::find_func()``.
- ``opt_internal_val()`` is deprecated, use ``lookup_ID()`` or - ``opt_internal_val()`` is deprecated, use ``lookup_ID()`` or
``zeek::id::lookup_val()``. ``zeek::id::find_val()``.
- ``Val::Type()`` is deprecated, use ``Val::GetType``. - ``Val::Type()`` is deprecated, use ``Val::GetType``.

2
aux/bifcl

@ -1 +1 @@
Subproject commit b155d04585c61c8fdd0768e1f2a403b27447bb9d Subproject commit 2c7ded074fdea124fcae7845d1f8e77879925270

2
src/DNS_Mgr.cc
View file

@ -452,7 +452,7 @@ void DNS_Mgr::InitSource()
void DNS_Mgr::InitPostScript() void DNS_Mgr::InitPostScript()
{ {
dm_rec = zeek::id::lookup_type("dns_mapping")->AsRecordType(); dm_rec = zeek::id::find_type("dns_mapping")->AsRecordType();
// Registering will call Init() // Registering will call Init()
iosource_mgr->Register(this, true); iosource_mgr->Register(this, true);

10
src/Discard.cc
View file

@ -16,12 +16,12 @@
Discarder::Discarder() Discarder::Discarder()
{ {
check_ip = zeek::id::lookup_func("discarder_check_ip"); check_ip = zeek::id::find_func("discarder_check_ip");
check_tcp = zeek::id::lookup_func("discarder_check_tcp"); check_tcp = zeek::id::find_func("discarder_check_tcp");
check_udp = zeek::id::lookup_func("discarder_check_udp"); check_udp = zeek::id::find_func("discarder_check_udp");
check_icmp = zeek::id::lookup_func("discarder_check_icmp"); check_icmp = zeek::id::find_func("discarder_check_icmp");
discarder_maxlen = static_cast<int>(zeek::id::lookup_val("discarder_maxlen")->AsCount()); discarder_maxlen = static_cast<int>(zeek::id::find_val("discarder_maxlen")->AsCount());
} }
Discarder::~Discarder() Discarder::~Discarder()

4
src/EventHandler.cc
View file

@ -127,7 +127,7 @@ void EventHandler::NewEvent(const zeek::Args& vl)
return; return;
RecordType* args = FType()->Args(); RecordType* args = FType()->Args();
static auto call_argument_vector = zeek::id::lookup_type<VectorType>("call_argument_vector"); static auto call_argument_vector = zeek::id::find_type<VectorType>("call_argument_vector");
auto vargs = make_intrusive<VectorVal>(call_argument_vector); auto vargs = make_intrusive<VectorVal>(call_argument_vector);
for ( int i = 0; i < args->NumFields(); i++ ) for ( int i = 0; i < args->NumFields(); i++ )
@ -136,7 +136,7 @@ void EventHandler::NewEvent(const zeek::Args& vl)
const auto& ftype = args->GetFieldType(i); const auto& ftype = args->GetFieldType(i);
auto fdefault = args->FieldDefault(i); auto fdefault = args->FieldDefault(i);
static auto call_argument = zeek::id::lookup_type<RecordType>("call_argument"); static auto call_argument = zeek::id::find_type<RecordType>("call_argument");
auto rec = make_intrusive<RecordVal>(call_argument); auto rec = make_intrusive<RecordVal>(call_argument);
rec->Assign(0, make_intrusive<StringVal>(fname)); rec->Assign(0, make_intrusive<StringVal>(fname));

2
src/File.cc
View file

@ -278,7 +278,7 @@ RecordVal* BroFile::Rotate()
if ( f == stdin || f == stdout || f == stderr ) if ( f == stdin || f == stdout || f == stderr )
return nullptr; return nullptr;
static auto rotate_info = zeek::id::lookup_type<RecordType>("rotate_info"); static auto rotate_info = zeek::id::find_type<RecordType>("rotate_info");
RecordVal* info = new RecordVal(rotate_info); RecordVal* info = new RecordVal(rotate_info);
FILE* newf = rotate_file(name, info); FILE* newf = rotate_file(name, info);

28
src/Func.cc
View file

@ -748,21 +748,21 @@ void builtin_error(const char* msg, BroObj* arg)
void init_builtin_funcs() void init_builtin_funcs()
{ {
ProcStats = zeek::id::lookup_type("ProcStats")->AsRecordType(); ProcStats = zeek::id::find_type("ProcStats")->AsRecordType();
NetStats = zeek::id::lookup_type("NetStats")->AsRecordType(); NetStats = zeek::id::find_type("NetStats")->AsRecordType();
MatcherStats = zeek::id::lookup_type("MatcherStats")->AsRecordType(); MatcherStats = zeek::id::find_type("MatcherStats")->AsRecordType();
ConnStats = zeek::id::lookup_type("ConnStats")->AsRecordType(); ConnStats = zeek::id::find_type("ConnStats")->AsRecordType();
ReassemblerStats = zeek::id::lookup_type("ReassemblerStats")->AsRecordType(); ReassemblerStats = zeek::id::find_type("ReassemblerStats")->AsRecordType();
DNSStats = zeek::id::lookup_type("DNSStats")->AsRecordType(); DNSStats = zeek::id::find_type("DNSStats")->AsRecordType();
GapStats = zeek::id::lookup_type("GapStats")->AsRecordType(); GapStats = zeek::id::find_type("GapStats")->AsRecordType();
EventStats = zeek::id::lookup_type("EventStats")->AsRecordType(); EventStats = zeek::id::find_type("EventStats")->AsRecordType();
TimerStats = zeek::id::lookup_type("TimerStats")->AsRecordType(); TimerStats = zeek::id::find_type("TimerStats")->AsRecordType();
FileAnalysisStats = zeek::id::lookup_type("FileAnalysisStats")->AsRecordType(); FileAnalysisStats = zeek::id::find_type("FileAnalysisStats")->AsRecordType();
ThreadStats = zeek::id::lookup_type("ThreadStats")->AsRecordType(); ThreadStats = zeek::id::find_type("ThreadStats")->AsRecordType();
BrokerStats = zeek::id::lookup_type("BrokerStats")->AsRecordType(); BrokerStats = zeek::id::find_type("BrokerStats")->AsRecordType();
ReporterStats = zeek::id::lookup_type("ReporterStats")->AsRecordType(); ReporterStats = zeek::id::find_type("ReporterStats")->AsRecordType();
var_sizes = zeek::id::lookup_type("var_sizes")->AsTableType(); var_sizes = zeek::id::find_type("var_sizes")->AsTableType();
#include "zeek.bif.func_init" #include "zeek.bif.func_init"
#include "stats.bif.func_init" #include "stats.bif.func_init"

34
src/ID.cc
View file

@ -31,12 +31,12 @@ IntrusivePtr<TableType> zeek::id::count_set;
IntrusivePtr<VectorType> zeek::id::string_vec; IntrusivePtr<VectorType> zeek::id::string_vec;
IntrusivePtr<VectorType> zeek::id::index_vec; IntrusivePtr<VectorType> zeek::id::index_vec;
const IntrusivePtr<ID>& zeek::id::lookup(std::string_view name) const IntrusivePtr<ID>& zeek::id::find(std::string_view name)
{ {
return global_scope()->Find(name); return global_scope()->Find(name);
} }
const IntrusivePtr<BroType>& zeek::id::lookup_type(std::string_view name) const IntrusivePtr<BroType>& zeek::id::find_type(std::string_view name)
{ {
auto id = global_scope()->Find(name); auto id = global_scope()->Find(name);
@ -47,7 +47,7 @@ const IntrusivePtr<BroType>& zeek::id::lookup_type(std::string_view name)
return id->GetType(); return id->GetType();
} }
const IntrusivePtr<Val>& zeek::id::lookup_val(std::string_view name) const IntrusivePtr<Val>& zeek::id::find_val(std::string_view name)
{ {
auto id = global_scope()->Find(name); auto id = global_scope()->Find(name);
@ -58,7 +58,7 @@ const IntrusivePtr<Val>& zeek::id::lookup_val(std::string_view name)
return id->GetVal(); return id->GetVal();
} }
const IntrusivePtr<Val>& zeek::id::lookup_const(std::string_view name) const IntrusivePtr<Val>& zeek::id::find_const(std::string_view name)
{ {
auto id = global_scope()->Find(name); auto id = global_scope()->Find(name);
@ -73,9 +73,9 @@ const IntrusivePtr<Val>& zeek::id::lookup_const(std::string_view name)
return id->GetVal(); return id->GetVal();
} }
IntrusivePtr<Func> zeek::id::lookup_func(std::string_view name) IntrusivePtr<Func> zeek::id::find_func(std::string_view name)
{ {
const auto& v = zeek::id::lookup_val(name); const auto& v = zeek::id::find_val(name);
if ( ! v ) if ( ! v )
return nullptr; return nullptr;
@ -89,17 +89,17 @@ IntrusivePtr<Func> zeek::id::lookup_func(std::string_view name)
void zeek::id::detail::init() void zeek::id::detail::init()
{ {
conn_id = lookup_type<RecordType>("conn_id"); conn_id = zeek::id::find_type<RecordType>("conn_id");
endpoint = lookup_type<RecordType>("endpoint"); endpoint = zeek::id::find_type<RecordType>("endpoint");
connection = lookup_type<RecordType>("connection"); connection = zeek::id::find_type<RecordType>("connection");
fa_file = lookup_type<RecordType>("fa_file"); fa_file = zeek::id::find_type<RecordType>("fa_file");
fa_metadata = lookup_type<RecordType>("fa_metadata"); fa_metadata = zeek::id::find_type<RecordType>("fa_metadata");
transport_proto = lookup_type<EnumType>("transport_proto"); transport_proto = zeek::id::find_type<EnumType>("transport_proto");
string_set = lookup_type<TableType>("string_set"); string_set = zeek::id::find_type<TableType>("string_set");
string_array = lookup_type<TableType>("string_array"); string_array = zeek::id::find_type<TableType>("string_array");
count_set = lookup_type<TableType>("count_set"); count_set = zeek::id::find_type<TableType>("count_set");
string_vec = lookup_type<VectorType>("string_vec"); string_vec = zeek::id::find_type<VectorType>("string_vec");
index_vec = lookup_type<VectorType>("index_vec"); index_vec = zeek::id::find_type<VectorType>("index_vec");
} }
ID::ID(const char* arg_name, IDScope arg_scope, bool arg_is_export) ID::ID(const char* arg_name, IDScope arg_scope, bool arg_is_export)

22
src/ID.h
View file

@ -166,7 +166,7 @@ namespace zeek { namespace id {
* @return The identifier, which may reference a nil object if no such * @return The identifier, which may reference a nil object if no such
* name exists. * name exists.
*/ */
const IntrusivePtr<ID>& lookup(std::string_view name); const IntrusivePtr<ID>& find(std::string_view name);
/** /**
* Lookup an ID by its name and return its type. A fatal occurs if the ID * Lookup an ID by its name and return its type. A fatal occurs if the ID
@ -174,7 +174,7 @@ const IntrusivePtr<ID>& lookup(std::string_view name);
* @param name The identifier name to lookup * @param name The identifier name to lookup
* @return The type of the identifier. * @return The type of the identifier.
*/ */
const IntrusivePtr<BroType>& lookup_type(std::string_view name); const IntrusivePtr<BroType>& find_type(std::string_view name);
/** /**
* Lookup an ID by its name and return its type (as cast to @c T). * Lookup an ID by its name and return its type (as cast to @c T).
@ -183,8 +183,8 @@ const IntrusivePtr<BroType>& lookup_type(std::string_view name);
* @return The type of the identifier. * @return The type of the identifier.
*/ */
template<class T> template<class T>
IntrusivePtr<T> lookup_type(std::string_view name) IntrusivePtr<T> find_type(std::string_view name)
{ return cast_intrusive<T>(lookup_type(name)); } { return cast_intrusive<T>(find_type(name)); }
/** /**
* Lookup an ID by its name and return its value. A fatal occurs if the ID * Lookup an ID by its name and return its value. A fatal occurs if the ID
@ -192,7 +192,7 @@ IntrusivePtr<T> lookup_type(std::string_view name)
* @param name The identifier name to lookup * @param name The identifier name to lookup
* @return The current value of the identifier * @return The current value of the identifier
*/ */
const IntrusivePtr<Val>& lookup_val(std::string_view name); const IntrusivePtr<Val>& find_val(std::string_view name);
/** /**
* Lookup an ID by its name and return its value (as cast to @c T). * Lookup an ID by its name and return its value (as cast to @c T).
@ -201,8 +201,8 @@ const IntrusivePtr<Val>& lookup_val(std::string_view name);
* @return The current value of the identifier. * @return The current value of the identifier.
*/ */
template<class T> template<class T>
IntrusivePtr<T> lookup_val(std::string_view name) IntrusivePtr<T> find_val(std::string_view name)
{ return cast_intrusive<T>(lookup_val(name)); } { return cast_intrusive<T>(find_val(name)); }
/** /**
* Lookup an ID by its name and return its value. A fatal occurs if the ID * Lookup an ID by its name and return its value. A fatal occurs if the ID
@ -210,7 +210,7 @@ IntrusivePtr<T> lookup_val(std::string_view name)
* @param name The identifier name to lookup * @param name The identifier name to lookup
* @return The current value of the identifier * @return The current value of the identifier
*/ */
const IntrusivePtr<Val>& lookup_const(std::string_view name); const IntrusivePtr<Val>& find_const(std::string_view name);
/** /**
* Lookup an ID by its name and return its value (as cast to @c T). * Lookup an ID by its name and return its value (as cast to @c T).
@ -219,8 +219,8 @@ const IntrusivePtr<Val>& lookup_const(std::string_view name);
* @return The current value of the identifier. * @return The current value of the identifier.
*/ */
template<class T> template<class T>
IntrusivePtr<T> lookup_const(std::string_view name) IntrusivePtr<T> find_const(std::string_view name)
{ return cast_intrusive<T>(lookup_const(name)); } { return cast_intrusive<T>(find_const(name)); }
/** /**
* Lookup an ID by its name and return the function it references. * Lookup an ID by its name and return the function it references.
@ -228,7 +228,7 @@ IntrusivePtr<T> lookup_const(std::string_view name)
* @param name The identifier name to lookup * @param name The identifier name to lookup
* @return The current function value the identifier references. * @return The current function value the identifier references.
*/ */
IntrusivePtr<Func> lookup_func(std::string_view name); IntrusivePtr<Func> find_func(std::string_view name);
extern IntrusivePtr<RecordType> conn_id; extern IntrusivePtr<RecordType> conn_id;
extern IntrusivePtr<RecordType> endpoint; extern IntrusivePtr<RecordType> endpoint;

32
src/IP.cc
View file

@ -37,14 +37,14 @@ static RecordType* ip6_mob_be_type = nullptr;
static inline RecordType* hdrType(RecordType*& type, const char* name) static inline RecordType* hdrType(RecordType*& type, const char* name)
{ {
if ( ! type ) if ( ! type )
type = zeek::id::lookup_type(name)->AsRecordType(); type = zeek::id::find_type(name)->AsRecordType();
return type; return type;
} }
static IntrusivePtr<VectorVal> BuildOptionsVal(const u_char* data, int len) static IntrusivePtr<VectorVal> BuildOptionsVal(const u_char* data, int len)
{ {
auto vv = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("ip6_options")); auto vv = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("ip6_options"));
while ( len > 0 ) while ( len > 0 )
{ {
@ -95,7 +95,7 @@ IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
rv->Assign(6, make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst))); rv->Assign(6, make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst)));
if ( ! chain ) if ( ! chain )
chain = make_intrusive<VectorVal>( chain = make_intrusive<VectorVal>(
zeek::id::lookup_type<VectorType>("ip6_ext_hdr_chain")); zeek::id::find_type<VectorType>("ip6_ext_hdr_chain"));
rv->Assign(7, std::move(chain)); rv->Assign(7, std::move(chain));
} }
break; break;
@ -367,7 +367,7 @@ IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal() const
static RecordType* pkt_hdr_type = nullptr; static RecordType* pkt_hdr_type = nullptr;
if ( ! pkt_hdr_type ) if ( ! pkt_hdr_type )
pkt_hdr_type = zeek::id::lookup_type("pkt_hdr")->AsRecordType(); pkt_hdr_type = zeek::id::find_type("pkt_hdr")->AsRecordType();
return ToPktHdrVal(make_intrusive<RecordVal>(pkt_hdr_type), 0); return ToPktHdrVal(make_intrusive<RecordVal>(pkt_hdr_type), 0);
} }
@ -385,9 +385,9 @@ IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int
if ( ! tcp_hdr_type ) if ( ! tcp_hdr_type )
{ {
tcp_hdr_type = zeek::id::lookup_type("tcp_hdr")->AsRecordType(); tcp_hdr_type = zeek::id::find_type("tcp_hdr")->AsRecordType();
udp_hdr_type = zeek::id::lookup_type("udp_hdr")->AsRecordType(); udp_hdr_type = zeek::id::find_type("udp_hdr")->AsRecordType();
icmp_hdr_type = zeek::id::lookup_type("icmp_hdr")->AsRecordType(); icmp_hdr_type = zeek::id::find_type("icmp_hdr")->AsRecordType();
} }
if ( ip4 ) if ( ip4 )
@ -697,18 +697,18 @@ IntrusivePtr<VectorVal> IPv6_Hdr_Chain::ToVal() const
{ {
if ( ! ip6_ext_hdr_type ) if ( ! ip6_ext_hdr_type )
{ {
ip6_ext_hdr_type = zeek::id::lookup_type("ip6_ext_hdr")->AsRecordType(); ip6_ext_hdr_type = zeek::id::find_type("ip6_ext_hdr")->AsRecordType();
ip6_hopopts_type = zeek::id::lookup_type("ip6_hopopts")->AsRecordType(); ip6_hopopts_type = zeek::id::find_type("ip6_hopopts")->AsRecordType();
ip6_dstopts_type = zeek::id::lookup_type("ip6_dstopts")->AsRecordType(); ip6_dstopts_type = zeek::id::find_type("ip6_dstopts")->AsRecordType();
ip6_routing_type = zeek::id::lookup_type("ip6_routing")->AsRecordType(); ip6_routing_type = zeek::id::find_type("ip6_routing")->AsRecordType();
ip6_fragment_type = zeek::id::lookup_type("ip6_fragment")->AsRecordType(); ip6_fragment_type = zeek::id::find_type("ip6_fragment")->AsRecordType();
ip6_ah_type = zeek::id::lookup_type("ip6_ah")->AsRecordType(); ip6_ah_type = zeek::id::find_type("ip6_ah")->AsRecordType();
ip6_esp_type = zeek::id::lookup_type("ip6_esp")->AsRecordType(); ip6_esp_type = zeek::id::find_type("ip6_esp")->AsRecordType();
ip6_mob_type = zeek::id::lookup_type("ip6_mobility_hdr")->AsRecordType(); ip6_mob_type = zeek::id::find_type("ip6_mobility_hdr")->AsRecordType();
} }
auto rval = make_intrusive<VectorVal>( auto rval = make_intrusive<VectorVal>(
zeek::id::lookup_type<VectorType>("ip6_ext_hdr_chain")); zeek::id::find_type<VectorType>("ip6_ext_hdr_chain"));
for ( size_t i = 1; i < chain.size(); ++i ) for ( size_t i = 1; i < chain.size(); ++i )
{ {

130
src/NetVar.cc
View file

@ -198,14 +198,14 @@ void init_event_handlers()
void init_general_global_var() void init_general_global_var()
{ {
table_expire_interval = zeek::id::lookup_val("table_expire_interval")->AsInterval(); table_expire_interval = zeek::id::find_val("table_expire_interval")->AsInterval();
table_expire_delay = zeek::id::lookup_val("table_expire_delay")->AsInterval(); table_expire_delay = zeek::id::find_val("table_expire_delay")->AsInterval();
table_incremental_step = zeek::id::lookup_val("table_incremental_step")->AsCount(); table_incremental_step = zeek::id::find_val("table_incremental_step")->AsCount();
packet_filter_default = zeek::id::lookup_val("packet_filter_default")->AsBool(); packet_filter_default = zeek::id::find_val("packet_filter_default")->AsBool();
sig_max_group_size = zeek::id::lookup_val("sig_max_group_size")->AsCount(); sig_max_group_size = zeek::id::find_val("sig_max_group_size")->AsCount();
check_for_unused_event_handlers = zeek::id::lookup_val("check_for_unused_event_handlers")->AsBool(); check_for_unused_event_handlers = zeek::id::find_val("check_for_unused_event_handlers")->AsBool();
record_all_packets = zeek::id::lookup_val("record_all_packets")->AsBool(); record_all_packets = zeek::id::find_val("record_all_packets")->AsBool();
bits_per_uid = zeek::id::lookup_val("bits_per_uid")->AsCount(); bits_per_uid = zeek::id::find_val("bits_per_uid")->AsCount();
} }
extern void zeek_legacy_netvar_init(); extern void zeek_legacy_netvar_init();
@ -220,102 +220,102 @@ void init_net_var()
zeek::id::detail::init(); zeek::id::detail::init();
zeek_legacy_netvar_init(); zeek_legacy_netvar_init();
ignore_checksums = zeek::id::lookup_val("ignore_checksums")->AsBool(); ignore_checksums = zeek::id::find_val("ignore_checksums")->AsBool();
partial_connection_ok = zeek::id::lookup_val("partial_connection_ok")->AsBool(); partial_connection_ok = zeek::id::find_val("partial_connection_ok")->AsBool();
tcp_SYN_ack_ok = zeek::id::lookup_val("tcp_SYN_ack_ok")->AsBool(); tcp_SYN_ack_ok = zeek::id::find_val("tcp_SYN_ack_ok")->AsBool();
tcp_match_undelivered = zeek::id::lookup_val("tcp_match_undelivered")->AsBool(); tcp_match_undelivered = zeek::id::find_val("tcp_match_undelivered")->AsBool();
encap_hdr_size = zeek::id::lookup_val("encap_hdr_size")->AsCount(); encap_hdr_size = zeek::id::find_val("encap_hdr_size")->AsCount();
frag_timeout = zeek::id::lookup_val("frag_timeout")->AsInterval(); frag_timeout = zeek::id::find_val("frag_timeout")->AsInterval();
tcp_SYN_timeout = zeek::id::lookup_val("tcp_SYN_timeout")->AsInterval(); tcp_SYN_timeout = zeek::id::find_val("tcp_SYN_timeout")->AsInterval();
tcp_session_timer = zeek::id::lookup_val("tcp_session_timer")->AsInterval(); tcp_session_timer = zeek::id::find_val("tcp_session_timer")->AsInterval();
tcp_connection_linger = zeek::id::lookup_val("tcp_connection_linger")->AsInterval(); tcp_connection_linger = zeek::id::find_val("tcp_connection_linger")->AsInterval();
tcp_attempt_delay = zeek::id::lookup_val("tcp_attempt_delay")->AsInterval(); tcp_attempt_delay = zeek::id::find_val("tcp_attempt_delay")->AsInterval();
tcp_close_delay = zeek::id::lookup_val("tcp_close_delay")->AsInterval(); tcp_close_delay = zeek::id::find_val("tcp_close_delay")->AsInterval();
tcp_reset_delay = zeek::id::lookup_val("tcp_reset_delay")->AsInterval(); tcp_reset_delay = zeek::id::find_val("tcp_reset_delay")->AsInterval();
tcp_partial_close_delay = zeek::id::lookup_val("tcp_partial_close_delay")->AsInterval(); tcp_partial_close_delay = zeek::id::find_val("tcp_partial_close_delay")->AsInterval();
tcp_max_initial_window = zeek::id::lookup_val("tcp_max_initial_window")->AsCount(); tcp_max_initial_window = zeek::id::find_val("tcp_max_initial_window")->AsCount();
tcp_max_above_hole_without_any_acks = zeek::id::lookup_val("tcp_max_above_hole_without_any_acks")->AsCount(); tcp_max_above_hole_without_any_acks = zeek::id::find_val("tcp_max_above_hole_without_any_acks")->AsCount();
tcp_excessive_data_without_further_acks = zeek::id::lookup_val("tcp_excessive_data_without_further_acks")->AsCount(); tcp_excessive_data_without_further_acks = zeek::id::find_val("tcp_excessive_data_without_further_acks")->AsCount();
tcp_max_old_segments = zeek::id::lookup_val("tcp_max_old_segments")->AsCount(); tcp_max_old_segments = zeek::id::find_val("tcp_max_old_segments")->AsCount();
non_analyzed_lifetime = zeek::id::lookup_val("non_analyzed_lifetime")->AsInterval(); non_analyzed_lifetime = zeek::id::find_val("non_analyzed_lifetime")->AsInterval();
tcp_inactivity_timeout = zeek::id::lookup_val("tcp_inactivity_timeout")->AsInterval(); tcp_inactivity_timeout = zeek::id::find_val("tcp_inactivity_timeout")->AsInterval();
udp_inactivity_timeout = zeek::id::lookup_val("udp_inactivity_timeout")->AsInterval(); udp_inactivity_timeout = zeek::id::find_val("udp_inactivity_timeout")->AsInterval();
icmp_inactivity_timeout = zeek::id::lookup_val("icmp_inactivity_timeout")->AsInterval(); icmp_inactivity_timeout = zeek::id::find_val("icmp_inactivity_timeout")->AsInterval();
tcp_storm_thresh = zeek::id::lookup_val("tcp_storm_thresh")->AsCount(); tcp_storm_thresh = zeek::id::find_val("tcp_storm_thresh")->AsCount();
tcp_storm_interarrival_thresh = zeek::id::lookup_val("tcp_storm_interarrival_thresh")->AsInterval(); tcp_storm_interarrival_thresh = zeek::id::find_val("tcp_storm_interarrival_thresh")->AsInterval();
tcp_content_deliver_all_orig = tcp_content_deliver_all_orig =
bool(zeek::id::lookup_val("tcp_content_deliver_all_orig")->AsBool()); bool(zeek::id::find_val("tcp_content_deliver_all_orig")->AsBool());
tcp_content_deliver_all_resp = tcp_content_deliver_all_resp =
bool(zeek::id::lookup_val("tcp_content_deliver_all_resp")->AsBool()); bool(zeek::id::find_val("tcp_content_deliver_all_resp")->AsBool());
udp_content_deliver_all_orig = udp_content_deliver_all_orig =
bool(zeek::id::lookup_val("udp_content_deliver_all_orig")->AsBool()); bool(zeek::id::find_val("udp_content_deliver_all_orig")->AsBool());
udp_content_deliver_all_resp = udp_content_deliver_all_resp =
bool(zeek::id::lookup_val("udp_content_deliver_all_resp")->AsBool()); bool(zeek::id::find_val("udp_content_deliver_all_resp")->AsBool());
udp_content_delivery_ports_use_resp = udp_content_delivery_ports_use_resp =
bool(zeek::id::lookup_val("udp_content_delivery_ports_use_resp")->AsBool()); bool(zeek::id::find_val("udp_content_delivery_ports_use_resp")->AsBool());
dns_session_timeout = zeek::id::lookup_val("dns_session_timeout")->AsInterval(); dns_session_timeout = zeek::id::find_val("dns_session_timeout")->AsInterval();
rpc_timeout = zeek::id::lookup_val("rpc_timeout")->AsInterval(); rpc_timeout = zeek::id::find_val("rpc_timeout")->AsInterval();
watchdog_interval = int(zeek::id::lookup_val("watchdog_interval")->AsInterval()); watchdog_interval = int(zeek::id::find_val("watchdog_interval")->AsInterval());
max_timer_expires = zeek::id::lookup_val("max_timer_expires")->AsCount(); max_timer_expires = zeek::id::find_val("max_timer_expires")->AsCount();
mime_segment_length = zeek::id::lookup_val("mime_segment_length")->AsCount(); mime_segment_length = zeek::id::find_val("mime_segment_length")->AsCount();
mime_segment_overlap_length = zeek::id::lookup_val("mime_segment_overlap_length")->AsCount(); mime_segment_overlap_length = zeek::id::find_val("mime_segment_overlap_length")->AsCount();
http_entity_data_delivery_size = zeek::id::lookup_val("http_entity_data_delivery_size")->AsCount(); http_entity_data_delivery_size = zeek::id::find_val("http_entity_data_delivery_size")->AsCount();
truncate_http_URI = zeek::id::lookup_val("truncate_http_URI")->AsInt(); truncate_http_URI = zeek::id::find_val("truncate_http_URI")->AsInt();
dns_skip_all_auth = zeek::id::lookup_val("dns_skip_all_auth")->AsBool(); dns_skip_all_auth = zeek::id::find_val("dns_skip_all_auth")->AsBool();
dns_skip_all_addl = zeek::id::lookup_val("dns_skip_all_addl")->AsBool(); dns_skip_all_addl = zeek::id::find_val("dns_skip_all_addl")->AsBool();
dns_max_queries = zeek::id::lookup_val("dns_max_queries")->AsCount(); dns_max_queries = zeek::id::find_val("dns_max_queries")->AsCount();
stp_delta = 0.0; stp_delta = 0.0;
if ( const auto& v = zeek::id::lookup_val("stp_delta") ) stp_delta = v->AsInterval(); if ( const auto& v = zeek::id::find_val("stp_delta") ) stp_delta = v->AsInterval();
stp_idle_min = 0.0; stp_idle_min = 0.0;
if ( const auto& v = zeek::id::lookup_val("stp_idle_min") ) stp_delta = v->AsInterval(); if ( const auto& v = zeek::id::find_val("stp_idle_min") ) stp_delta = v->AsInterval();
orig_addr_anonymization = 0; orig_addr_anonymization = 0;
if ( const auto& id = zeek::id::lookup("orig_addr_anonymization") ) if ( const auto& id = zeek::id::find("orig_addr_anonymization") )
if ( const auto& v = id->GetVal() ) if ( const auto& v = id->GetVal() )
orig_addr_anonymization = v->AsInt(); orig_addr_anonymization = v->AsInt();
resp_addr_anonymization = 0; resp_addr_anonymization = 0;
if ( const auto& id = zeek::id::lookup("resp_addr_anonymization") ) if ( const auto& id = zeek::id::find("resp_addr_anonymization") )
if ( const auto& v = id->GetVal() ) if ( const auto& v = id->GetVal() )
resp_addr_anonymization = v->AsInt(); resp_addr_anonymization = v->AsInt();
other_addr_anonymization = 0; other_addr_anonymization = 0;
if ( const auto& id = zeek::id::lookup("other_addr_anonymization") ) if ( const auto& id = zeek::id::find("other_addr_anonymization") )
if ( const auto& v = id->GetVal() ) if ( const auto& v = id->GetVal() )
other_addr_anonymization = v->AsInt(); other_addr_anonymization = v->AsInt();
connection_status_update_interval = 0.0; connection_status_update_interval = 0.0;
if ( const auto& id = zeek::id::lookup("connection_status_update_interval") ) if ( const auto& id = zeek::id::find("connection_status_update_interval") )
if ( const auto& v = id->GetVal() ) if ( const auto& v = id->GetVal() )
connection_status_update_interval = v->AsInterval(); connection_status_update_interval = v->AsInterval();
expensive_profiling_multiple = zeek::id::lookup_val("expensive_profiling_multiple")->AsCount(); expensive_profiling_multiple = zeek::id::find_val("expensive_profiling_multiple")->AsCount();
profiling_interval = zeek::id::lookup_val("profiling_interval")->AsInterval(); profiling_interval = zeek::id::find_val("profiling_interval")->AsInterval();
segment_profiling = zeek::id::lookup_val("segment_profiling")->AsBool(); segment_profiling = zeek::id::find_val("segment_profiling")->AsBool();
pkt_profile_mode = zeek::id::lookup_val("pkt_profile_mode")->InternalInt(); pkt_profile_mode = zeek::id::find_val("pkt_profile_mode")->InternalInt();
pkt_profile_freq = zeek::id::lookup_val("pkt_profile_freq")->AsDouble(); pkt_profile_freq = zeek::id::find_val("pkt_profile_freq")->AsDouble();
load_sample_freq = zeek::id::lookup_val("load_sample_freq")->AsCount(); load_sample_freq = zeek::id::find_val("load_sample_freq")->AsCount();
dpd_reassemble_first_packets = zeek::id::lookup_val("dpd_reassemble_first_packets")->AsBool(); dpd_reassemble_first_packets = zeek::id::find_val("dpd_reassemble_first_packets")->AsBool();
dpd_buffer_size = zeek::id::lookup_val("dpd_buffer_size")->AsCount(); dpd_buffer_size = zeek::id::find_val("dpd_buffer_size")->AsCount();
dpd_match_only_beginning = zeek::id::lookup_val("dpd_match_only_beginning")->AsBool(); dpd_match_only_beginning = zeek::id::find_val("dpd_match_only_beginning")->AsBool();
dpd_late_match_stop = zeek::id::lookup_val("dpd_late_match_stop")->AsBool(); dpd_late_match_stop = zeek::id::find_val("dpd_late_match_stop")->AsBool();
dpd_ignore_ports = zeek::id::lookup_val("dpd_ignore_ports")->AsBool(); dpd_ignore_ports = zeek::id::find_val("dpd_ignore_ports")->AsBool();
timer_mgr_inactivity_timeout = zeek::id::lookup_val("timer_mgr_inactivity_timeout")->AsInterval(); timer_mgr_inactivity_timeout = zeek::id::find_val("timer_mgr_inactivity_timeout")->AsInterval();
} }

14
src/Reporter.cc
View file

@ -63,13 +63,13 @@ Reporter::~Reporter()
void Reporter::InitOptions() void Reporter::InitOptions()
{ {
info_to_stderr = zeek::id::lookup_val("Reporter::info_to_stderr")->AsBool(); info_to_stderr = zeek::id::find_val("Reporter::info_to_stderr")->AsBool();
warnings_to_stderr = zeek::id::lookup_val("Reporter::warnings_to_stderr")->AsBool(); warnings_to_stderr = zeek::id::find_val("Reporter::warnings_to_stderr")->AsBool();
errors_to_stderr = zeek::id::lookup_val("Reporter::errors_to_stderr")->AsBool(); errors_to_stderr = zeek::id::find_val("Reporter::errors_to_stderr")->AsBool();
weird_sampling_rate = zeek::id::lookup_val("Weird::sampling_rate")->AsCount(); weird_sampling_rate = zeek::id::find_val("Weird::sampling_rate")->AsCount();
weird_sampling_threshold = zeek::id::lookup_val("Weird::sampling_threshold")->AsCount(); weird_sampling_threshold = zeek::id::find_val("Weird::sampling_threshold")->AsCount();
weird_sampling_duration = zeek::id::lookup_val("Weird::sampling_duration")->AsInterval(); weird_sampling_duration = zeek::id::find_val("Weird::sampling_duration")->AsInterval();
auto wl_val = zeek::id::lookup_val("Weird::sampling_whitelist")->AsTableVal(); auto wl_val = zeek::id::find_val("Weird::sampling_whitelist")->AsTableVal();
auto wl_table = wl_val->AsTable(); auto wl_table = wl_val->AsTable();
HashKey* k; HashKey* k;

2
src/RuleCondition.cc
View file

@ -144,7 +144,7 @@ RuleConditionEval::RuleConditionEval(const char* func)
if ( f->Yield()->Tag() != TYPE_BOOL ) if ( f->Yield()->Tag() != TYPE_BOOL )
rules_error("eval function type must yield a 'bool'", func); rules_error("eval function type must yield a 'bool'", func);
static auto signature_state = zeek::id::lookup_type<RecordType>("signature_state"); static auto signature_state = zeek::id::find_type<RecordType>("signature_state");
TypeList tl; TypeList tl;
tl.Append(signature_state); tl.Append(signature_state);
tl.Append(base_type(TYPE_STRING)); tl.Append(base_type(TYPE_STRING));

2
src/RuleMatcher.cc
View file

@ -80,7 +80,7 @@ RuleHdrTest::RuleHdrTest(Prot arg_prot, Comp arg_comp, vector<IPPrefix> arg_v)
Val* RuleMatcher::BuildRuleStateValue(const Rule* rule, Val* RuleMatcher::BuildRuleStateValue(const Rule* rule,
const RuleEndpointState* state) const const RuleEndpointState* state) const
{ {
static auto signature_state = zeek::id::lookup_type<RecordType>("signature_state"); static auto signature_state = zeek::id::find_type<RecordType>("signature_state");
RecordVal* val = new RecordVal(signature_state); RecordVal* val = new RecordVal(signature_state);
val->Assign(0, make_intrusive<StringVal>(rule->ID())); val->Assign(0, make_intrusive<StringVal>(rule->ID()));
val->Assign(1, state->GetAnalyzer()->ConnVal()); val->Assign(1, state->GetAnalyzer()->ConnVal());

4
src/Sessions.cc
View file

@ -81,7 +81,7 @@ NetSessions::NetSessions()
dump_this_packet = false; dump_this_packet = false;
num_packets_processed = 0; num_packets_processed = 0;
static auto pkt_profile_file = zeek::id::lookup_val("pkt_profile_file"); static auto pkt_profile_file = zeek::id::find_val("pkt_profile_file");
if ( pkt_profile_mode && pkt_profile_freq > 0 && pkt_profile_file ) if ( pkt_profile_mode && pkt_profile_freq > 0 && pkt_profile_file )
pkt_profiler = new PacketProfiler(pkt_profile_mode, pkt_profiler = new PacketProfiler(pkt_profile_mode,
@ -1219,7 +1219,7 @@ bool NetSessions::IsLikelyServerPort(uint32_t port, TransportProto proto) const
if ( ! have_cache ) if ( ! have_cache )
{ {
auto likely_server_ports = zeek::id::lookup_val<TableVal>("likely_server_ports"); auto likely_server_ports = zeek::id::find_val<TableVal>("likely_server_ports");
auto lv = likely_server_ports->ToPureListVal(); auto lv = likely_server_ports->ToPureListVal();
for ( int i = 0; i < lv->Length(); i++ ) for ( int i = 0; i < lv->Length(); i++ )
port_cache.insert(lv->Idx(i)->InternalUnsigned()); port_cache.insert(lv->Idx(i)->InternalUnsigned());

8
src/SmithWaterman.cc
View file

@ -59,19 +59,19 @@ bool BroSubstring::DoesCover(const BroSubstring* bst) const
VectorVal* BroSubstring::VecToPolicy(Vec* vec) VectorVal* BroSubstring::VecToPolicy(Vec* vec)
{ {
RecordType* sw_substring_type = RecordType* sw_substring_type =
zeek::id::lookup_type("sw_substring")->AsRecordType(); zeek::id::find_type("sw_substring")->AsRecordType();
if ( ! sw_substring_type ) if ( ! sw_substring_type )
return nullptr; return nullptr;
RecordType* sw_align_type = RecordType* sw_align_type =
zeek::id::lookup_type("sw_align")->AsRecordType(); zeek::id::find_type("sw_align")->AsRecordType();
if ( ! sw_align_type ) if ( ! sw_align_type )
return nullptr; return nullptr;
auto sw_align_vec_type = zeek::id::lookup_type<VectorType>("sw_align_vec"); auto sw_align_vec_type = zeek::id::find_type<VectorType>("sw_align_vec");
auto result = auto result =
make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("sw_substring_vec")); make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("sw_substring_vec"));
if ( vec ) if ( vec )
{ {

2
src/Stats.cc
View file

@ -342,7 +342,7 @@ SampleLogger::SampleLogger()
static TableType* load_sample_info = nullptr; static TableType* load_sample_info = nullptr;
if ( ! load_sample_info ) if ( ! load_sample_info )
load_sample_info = zeek::id::lookup_type("load_sample_info")->AsTableType(); load_sample_info = zeek::id::find_type("load_sample_info")->AsTableType();
load_samples = new TableVal({NewRef{}, load_sample_info}); load_samples = new TableVal({NewRef{}, load_sample_info});
} }

4
src/Stmt.cc
View file

@ -201,7 +201,7 @@ static IntrusivePtr<EnumVal> lookup_enum_val(const char* module_name, const char
static void print_log(const std::vector<IntrusivePtr<Val>>& vals) static void print_log(const std::vector<IntrusivePtr<Val>>& vals)
{ {
auto plval = lookup_enum_val("Log", "PRINTLOG"); auto plval = lookup_enum_val("Log", "PRINTLOG");
auto record = make_intrusive<RecordVal>(zeek::id::lookup_type("Log::PrintLogInfo")->AsRecordType()); auto record = make_intrusive<RecordVal>(zeek::id::find_type("Log::PrintLogInfo")->AsRecordType());
auto vec = make_intrusive<VectorVal>(zeek::id::string_vec); auto vec = make_intrusive<VectorVal>(zeek::id::string_vec);
for ( const auto& val : vals ) for ( const auto& val : vals )
@ -237,7 +237,7 @@ IntrusivePtr<Val> PrintStmt::DoExec(std::vector<IntrusivePtr<Val>> vals,
} }
static auto print_log_type = static_cast<BifEnum::Log::PrintLogType>( static auto print_log_type = static_cast<BifEnum::Log::PrintLogType>(
zeek::id::lookup_val("Log::print_to_log")->AsEnum()); zeek::id::find_val("Log::print_to_log")->AsEnum());
switch ( print_log_type ) { switch ( print_log_type ) {
case BifEnum::Log::REDIRECT_NONE: case BifEnum::Log::REDIRECT_NONE:

2
src/TunnelEncapsulation.h
View file

@ -198,7 +198,7 @@ public:
IntrusivePtr<VectorVal> ToVal() const IntrusivePtr<VectorVal> ToVal() const
{ {
auto vv = make_intrusive<VectorVal>( auto vv = make_intrusive<VectorVal>(
zeek::id::lookup_type<VectorType>("EncapsulatingConnVector")); zeek::id::find_type<VectorType>("EncapsulatingConnVector"));
if ( conns ) if ( conns )
{ {

4
src/Type.cc
View file

@ -796,8 +796,8 @@ static string container_type_name(const BroType* ft)
IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
{ {
static auto record_field = zeek::id::lookup_type<RecordType>("record_field"); static auto record_field = zeek::id::find_type<RecordType>("record_field");
static auto record_field_table = zeek::id::lookup_type<TableType>("record_field_table"); static auto record_field_table = zeek::id::find_type<TableType>("record_field_table");
auto rval = make_intrusive<TableVal>(record_field_table); auto rval = make_intrusive<TableVal>(record_field_table);
for ( int i = 0; i < NumFields(); ++i ) for ( int i = 0; i < NumFields(); ++i )

4
src/Val.cc
View file

@ -411,7 +411,7 @@ bool Val::WouldOverflow(const BroType* from_type, const BroType* to_type, const
IntrusivePtr<TableVal> Val::GetRecordFields() IntrusivePtr<TableVal> Val::GetRecordFields()
{ {
static auto record_field_table = zeek::id::lookup_type<TableType>("record_field_table"); static auto record_field_table = zeek::id::find_type<TableType>("record_field_table");
auto t = GetType().get(); auto t = GetType().get();
if ( t->Tag() != TYPE_RECORD && t->Tag() != TYPE_TYPE ) if ( t->Tag() != TYPE_RECORD && t->Tag() != TYPE_TYPE )
@ -1931,7 +1931,7 @@ IntrusivePtr<VectorVal> TableVal::LookupSubnets(const SubNetVal* search)
if ( ! subnets ) if ( ! subnets )
reporter->InternalError("LookupSubnets called on wrong table type"); reporter->InternalError("LookupSubnets called on wrong table type");
auto result = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("subnet_vec")); auto result = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("subnet_vec"));
auto matches = subnets->FindAll(search); auto matches = subnets->FindAll(search);
for ( auto element : matches ) for ( auto element : matches )

8
src/Var.cc
View file

@ -658,7 +658,7 @@ void end_func(IntrusivePtr<Stmt> body)
Val* internal_val(const char* name) Val* internal_val(const char* name)
{ {
return zeek::id::lookup_val(name).get(); return zeek::id::find_val(name).get();
} }
id_list gather_outer_ids(Scope* scope, Stmt* body) id_list gather_outer_ids(Scope* scope, Stmt* body)
@ -683,7 +683,7 @@ id_list gather_outer_ids(Scope* scope, Stmt* body)
Val* internal_const_val(const char* name) Val* internal_const_val(const char* name)
{ {
return zeek::id::lookup_const(name).get(); return zeek::id::find_const(name).get();
} }
Val* opt_internal_val(const char* name) Val* opt_internal_val(const char* name)
@ -761,12 +761,12 @@ ListVal* internal_list_val(const char* name)
BroType* internal_type(const char* name) BroType* internal_type(const char* name)
{ {
return zeek::id::lookup_type(name).get(); return zeek::id::find_type(name).get();
} }
Func* internal_func(const char* name) Func* internal_func(const char* name)
{ {
const auto& v = zeek::id::lookup_val(name); const auto& v = zeek::id::find_val(name);
if ( v ) if ( v )
return v->AsFunc(); return v->AsFunc();

22
src/Var.h
View file

@ -40,37 +40,37 @@ extern void end_func(IntrusivePtr<Stmt> body);
// Gather all IDs referenced inside a body that aren't part of a given scope. // Gather all IDs referenced inside a body that aren't part of a given scope.
extern id_list gather_outer_ids(Scope* scope, Stmt* body); extern id_list gather_outer_ids(Scope* scope, Stmt* body);
[[deprecated("Remove in v4.1. Use zeek::id::lookup_val().")]] [[deprecated("Remove in v4.1. Use zeek::id::find_val().")]]
extern Val* internal_val(const char* name); extern Val* internal_val(const char* name);
[[deprecated("Remove in v4.1. Use zeek::id::lookup_const().")]] [[deprecated("Remove in v4.1. Use zeek::id::find_const().")]]
extern Val* internal_const_val(const char* name); // internal error if not const extern Val* internal_const_val(const char* name); // internal error if not const
[[deprecated("Remove in v4.1. Use zeek::id::lookup() or zeek::id::lookup_val().")]] [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]]
extern Val* opt_internal_val(const char* name); // returns nil if not defined extern Val* opt_internal_val(const char* name); // returns nil if not defined
[[deprecated("Remove in v4.1. Use zeek::id::lookup() or zeek::id::lookup_val().")]] [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]]
extern double opt_internal_double(const char* name); extern double opt_internal_double(const char* name);
[[deprecated("Remove in v4.1. Use zeek::id::lookup() or zeek::id::lookup_val().")]] [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]]
extern bro_int_t opt_internal_int(const char* name); extern bro_int_t opt_internal_int(const char* name);
[[deprecated("Remove in v4.1. Use zeek::id::lookup() or zeek::id::lookup_val().")]] [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]]
extern bro_uint_t opt_internal_unsigned(const char* name); extern bro_uint_t opt_internal_unsigned(const char* name);
[[deprecated("Remove in v4.1. Use zeek::id::lookup() or zeek::id::lookup_val().")]] [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]]
extern StringVal* opt_internal_string(const char* name); extern StringVal* opt_internal_string(const char* name);
[[deprecated("Remove in v4.1. Use zeek::id::lookup() or zeek::id::lookup_val().")]] [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]]
extern TableVal* opt_internal_table(const char* name); // nil if not defined extern TableVal* opt_internal_table(const char* name); // nil if not defined
[[deprecated("Remove in v4.1. Use zeek::id::lookup(), zeek::id::lookup_val(), and/or TableVal::ToPureListVal().")]] [[deprecated("Remove in v4.1. Use zeek::id::find(), zeek::id::find_val(), and/or TableVal::ToPureListVal().")]]
extern ListVal* internal_list_val(const char* name); extern ListVal* internal_list_val(const char* name);
[[deprecated("Remove in v4.1. Use zeek::id::lookup_type().")]] [[deprecated("Remove in v4.1. Use zeek::id::find_type().")]]
extern BroType* internal_type(const char* name); extern BroType* internal_type(const char* name);
[[deprecated("Remove in v4.1. Use zeek::id::lookup_func().")]] [[deprecated("Remove in v4.1. Use zeek::id::find_func().")]]
extern Func* internal_func(const char* name); extern Func* internal_func(const char* name);
[[deprecated("Remove in v4.1. Use event_registry->Register().")]] [[deprecated("Remove in v4.1. Use event_registry->Register().")]]

6
src/analyzer/Manager.cc
View file

@ -438,8 +438,8 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
if ( tcp_contents && ! reass ) if ( tcp_contents && ! reass )
{ {
static auto tcp_content_delivery_ports_orig = zeek::id::lookup_val<TableVal>("tcp_content_delivery_ports_orig"); static auto tcp_content_delivery_ports_orig = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_orig");
static auto tcp_content_delivery_ports_resp = zeek::id::lookup_val<TableVal>("tcp_content_delivery_ports_resp"); static auto tcp_content_delivery_ports_resp = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_resp");
const auto& dport = val_mgr->Port(ntohs(conn->RespPort()), TRANSPORT_TCP); const auto& dport = val_mgr->Port(ntohs(conn->RespPort()), TRANSPORT_TCP);
if ( ! reass ) if ( ! reass )
@ -462,7 +462,7 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
uint16_t resp_port = ntohs(conn->RespPort()); uint16_t resp_port = ntohs(conn->RespPort());
if ( resp_port == 22 || resp_port == 23 || resp_port == 513 ) if ( resp_port == 22 || resp_port == 23 || resp_port == 513 )
{ {
static auto stp_skip_src = zeek::id::lookup_val<TableVal>("stp_skip_src"); static auto stp_skip_src = zeek::id::find_val<TableVal>("stp_skip_src");
AddrVal src(conn->OrigAddr()); AddrVal src(conn->OrigAddr());
if ( ! stp_skip_src->Lookup(&src) ) if ( ! stp_skip_src->Lookup(&src) )

10
src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
View file

@ -27,15 +27,15 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
if ( ! bt_tracker_headers ) if ( ! bt_tracker_headers )
{ {
bt_tracker_headers = bt_tracker_headers =
zeek::id::lookup_type("bt_tracker_headers")->AsTableType(); zeek::id::find_type("bt_tracker_headers")->AsTableType();
bittorrent_peer = bittorrent_peer =
zeek::id::lookup_type("bittorrent_peer")->AsRecordType(); zeek::id::find_type("bittorrent_peer")->AsRecordType();
bittorrent_peer_set = bittorrent_peer_set =
zeek::id::lookup_type("bittorrent_peer_set")->AsTableType(); zeek::id::find_type("bittorrent_peer_set")->AsTableType();
bittorrent_benc_value = bittorrent_benc_value =
zeek::id::lookup_type("bittorrent_benc_value")->AsRecordType(); zeek::id::find_type("bittorrent_benc_value")->AsRecordType();
bittorrent_benc_dir = bittorrent_benc_dir =
zeek::id::lookup_type("bittorrent_benc_dir")->AsTableType(); zeek::id::find_type("bittorrent_benc_dir")->AsTableType();
} }
keep_alive = false; keep_alive = false;

22
src/analyzer/protocol/dns/DNS.cc
View file

@ -91,8 +91,8 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
int skip_addl = dns_skip_all_addl; int skip_addl = dns_skip_all_addl;
if ( msg.ancount > 0 ) if ( msg.ancount > 0 )
{ // We did an answer, so can potentially skip auth/addl. { // We did an answer, so can potentially skip auth/addl.
static auto dns_skip_auth = zeek::id::lookup_val<TableVal>("dns_skip_auth"); static auto dns_skip_auth = zeek::id::find_val<TableVal>("dns_skip_auth");
static auto dns_skip_addl = zeek::id::lookup_val<TableVal>("dns_skip_addl"); static auto dns_skip_addl = zeek::id::find_val<TableVal>("dns_skip_addl");
skip_auth = skip_auth || msg.nscount == 0 || skip_auth = skip_auth || msg.nscount == 0 ||
dns_skip_auth->Lookup(&server); dns_skip_auth->Lookup(&server);
@ -595,7 +595,7 @@ bool DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg,
if ( dns_SOA_reply && ! msg->skip_event ) if ( dns_SOA_reply && ! msg->skip_event )
{ {
static auto dns_soa = zeek::id::lookup_type<RecordType>("dns_soa"); static auto dns_soa = zeek::id::find_type<RecordType>("dns_soa");
auto r = make_intrusive<RecordVal>(dns_soa); auto r = make_intrusive<RecordVal>(dns_soa);
r->Assign(0, make_intrusive<StringVal>(new BroString(mname, mname_end - mname, true))); r->Assign(0, make_intrusive<StringVal>(new BroString(mname, mname_end - mname, true)));
r->Assign(1, make_intrusive<StringVal>(new BroString(rname, rname_end - rname, true))); r->Assign(1, make_intrusive<StringVal>(new BroString(rname, rname_end - rname, true)));
@ -1439,7 +1439,7 @@ DNS_MsgInfo::DNS_MsgInfo(DNS_RawMsgHdr* hdr, int arg_is_query)
IntrusivePtr<RecordVal> DNS_MsgInfo::BuildHdrVal() IntrusivePtr<RecordVal> DNS_MsgInfo::BuildHdrVal()
{ {
static auto dns_msg = zeek::id::lookup_type<RecordType>("dns_msg"); static auto dns_msg = zeek::id::find_type<RecordType>("dns_msg");
auto r = make_intrusive<RecordVal>(dns_msg); auto r = make_intrusive<RecordVal>(dns_msg);
r->Assign(0, val_mgr->Count(id)); r->Assign(0, val_mgr->Count(id));
@ -1461,7 +1461,7 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildHdrVal()
IntrusivePtr<RecordVal> DNS_MsgInfo::BuildAnswerVal() IntrusivePtr<RecordVal> DNS_MsgInfo::BuildAnswerVal()
{ {
static auto dns_answer = zeek::id::lookup_type<RecordType>("dns_answer"); static auto dns_answer = zeek::id::find_type<RecordType>("dns_answer");
auto r = make_intrusive<RecordVal>(dns_answer); auto r = make_intrusive<RecordVal>(dns_answer);
r->Assign(0, val_mgr->Count(int(answer_type))); r->Assign(0, val_mgr->Count(int(answer_type)));
@ -1477,7 +1477,7 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildEDNS_Val()
{ {
// We have to treat the additional record type in EDNS differently // We have to treat the additional record type in EDNS differently
// than a regular resource record. // than a regular resource record.
static auto dns_edns_additional = zeek::id::lookup_type<RecordType>("dns_edns_additional"); static auto dns_edns_additional = zeek::id::find_type<RecordType>("dns_edns_additional");
auto r = make_intrusive<RecordVal>(dns_edns_additional); auto r = make_intrusive<RecordVal>(dns_edns_additional);
r->Assign(0, val_mgr->Count(int(answer_type))); r->Assign(0, val_mgr->Count(int(answer_type)));
@ -1511,7 +1511,7 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildEDNS_Val()
IntrusivePtr<RecordVal> DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig) IntrusivePtr<RecordVal> DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
{ {
static auto dns_tsig_additional = zeek::id::lookup_type<RecordType>("dns_tsig_additional"); static auto dns_tsig_additional = zeek::id::find_type<RecordType>("dns_tsig_additional");
auto r = make_intrusive<RecordVal>(dns_tsig_additional); auto r = make_intrusive<RecordVal>(dns_tsig_additional);
double rtime = tsig->time_s + tsig->time_ms / 1000.0; double rtime = tsig->time_s + tsig->time_ms / 1000.0;
@ -1531,7 +1531,7 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
IntrusivePtr<RecordVal> DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig) IntrusivePtr<RecordVal> DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
{ {
static auto dns_rrsig_rr = zeek::id::lookup_type<RecordType>("dns_rrsig_rr"); static auto dns_rrsig_rr = zeek::id::find_type<RecordType>("dns_rrsig_rr");
auto r = make_intrusive<RecordVal>(dns_rrsig_rr); auto r = make_intrusive<RecordVal>(dns_rrsig_rr);
r->Assign(0, query_name); r->Assign(0, query_name);
@ -1552,7 +1552,7 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey) IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
{ {
static auto dns_dnskey_rr = zeek::id::lookup_type<RecordType>("dns_dnskey_rr"); static auto dns_dnskey_rr = zeek::id::find_type<RecordType>("dns_dnskey_rr");
auto r = make_intrusive<RecordVal>(dns_dnskey_rr); auto r = make_intrusive<RecordVal>(dns_dnskey_rr);
r->Assign(0, query_name); r->Assign(0, query_name);
@ -1568,7 +1568,7 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
IntrusivePtr<RecordVal> DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3) IntrusivePtr<RecordVal> DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
{ {
static auto dns_nsec3_rr = zeek::id::lookup_type<RecordType>("dns_nsec3_rr"); static auto dns_nsec3_rr = zeek::id::find_type<RecordType>("dns_nsec3_rr");
auto r = make_intrusive<RecordVal>(dns_nsec3_rr); auto r = make_intrusive<RecordVal>(dns_nsec3_rr);
r->Assign(0, query_name); r->Assign(0, query_name);
@ -1588,7 +1588,7 @@ IntrusivePtr<RecordVal> DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDS_Val(DS_DATA* ds) IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDS_Val(DS_DATA* ds)
{ {
static auto dns_ds_rr = zeek::id::lookup_type<RecordType>("dns_ds_rr"); static auto dns_ds_rr = zeek::id::find_type<RecordType>("dns_ds_rr");
auto r = make_intrusive<RecordVal>(dns_ds_rr); auto r = make_intrusive<RecordVal>(dns_ds_rr);
r->Assign(0, query_name); r->Assign(0, query_name);

4
src/analyzer/protocol/http/HTTP.cc
View file

@ -615,7 +615,7 @@ HTTP_Message::~HTTP_Message()
IntrusivePtr<RecordVal> HTTP_Message::BuildMessageStat(bool interrupted, const char* msg) IntrusivePtr<RecordVal> HTTP_Message::BuildMessageStat(bool interrupted, const char* msg)
{ {
static auto http_message_stat = zeek::id::lookup_type<RecordType>("http_message_stat"); static auto http_message_stat = zeek::id::find_type<RecordType>("http_message_stat");
auto stat = make_intrusive<RecordVal>(http_message_stat); auto stat = make_intrusive<RecordVal>(http_message_stat);
int field = 0; int field = 0;
stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME)); stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME));
@ -1152,7 +1152,7 @@ void HTTP_Analyzer::GenStats()
{ {
if ( http_stats ) if ( http_stats )
{ {
static auto http_stats_rec = zeek::id::lookup_type<RecordType>("http_stats_rec"); static auto http_stats_rec = zeek::id::find_type<RecordType>("http_stats_rec");
auto r = make_intrusive<RecordVal>(http_stats_rec); auto r = make_intrusive<RecordVal>(http_stats_rec);
r->Assign(0, val_mgr->Count(num_requests)); r->Assign(0, val_mgr->Count(num_requests));
r->Assign(1, val_mgr->Count(num_replies)); r->Assign(1, val_mgr->Count(num_replies));

12
src/analyzer/protocol/icmp/ICMP.cc
View file

@ -225,7 +225,7 @@ ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
{ {
if ( ! icmp_conn_val ) if ( ! icmp_conn_val )
{ {
static auto icmp_conn = zeek::id::lookup_type<RecordType>("icmp_conn"); static auto icmp_conn = zeek::id::find_type<RecordType>("icmp_conn");
icmp_conn_val = make_intrusive<RecordVal>(icmp_conn); icmp_conn_val = make_intrusive<RecordVal>(icmp_conn);
icmp_conn_val->Assign(0, make_intrusive<AddrVal>(Conn()->OrigAddr())); icmp_conn_val->Assign(0, make_intrusive<AddrVal>(Conn()->OrigAddr()));
@ -351,7 +351,7 @@ IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP4Context(int len, const u_char
} }
} }
static auto icmp_context = zeek::id::lookup_type<RecordType>("icmp_context"); static auto icmp_context = zeek::id::find_type<RecordType>("icmp_context");
auto iprec = make_intrusive<RecordVal>(icmp_context); auto iprec = make_intrusive<RecordVal>(icmp_context);
auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id); auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
@ -411,7 +411,7 @@ IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP6Context(int len, const u_char
} }
} }
static auto icmp_context = zeek::id::lookup_type<RecordType>("icmp_context"); static auto icmp_context = zeek::id::find_type<RecordType>("icmp_context");
auto iprec = make_intrusive<RecordVal>(icmp_context); auto iprec = make_intrusive<RecordVal>(icmp_context);
auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id); auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
@ -729,13 +729,13 @@ IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_cha
if ( ! icmp6_nd_option_type ) if ( ! icmp6_nd_option_type )
{ {
icmp6_nd_option_type = zeek::id::lookup_type("icmp6_nd_option")->AsRecordType(); icmp6_nd_option_type = zeek::id::find_type("icmp6_nd_option")->AsRecordType();
icmp6_nd_prefix_info_type = icmp6_nd_prefix_info_type =
zeek::id::lookup_type("icmp6_nd_prefix_info")->AsRecordType(); zeek::id::find_type("icmp6_nd_prefix_info")->AsRecordType();
} }
auto vv = make_intrusive<VectorVal>( auto vv = make_intrusive<VectorVal>(
zeek::id::lookup_type<VectorType>("icmp6_nd_options")); zeek::id::find_type<VectorType>("icmp6_nd_options"));
while ( caplen > 0 ) while ( caplen > 0 )
{ {

4
src/analyzer/protocol/irc/IRC.cc
View file

@ -44,8 +44,8 @@ inline void IRC_Analyzer::SkipLeadingWhitespace(string& str)
void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{ {
static auto irc_join_list = zeek::id::lookup_type<TableType>("irc_join_list"); static auto irc_join_list = zeek::id::find_type<TableType>("irc_join_list");
static auto irc_join_info = zeek::id::lookup_type<RecordType>("irc_join_info"); static auto irc_join_info = zeek::id::find_type<RecordType>("irc_join_info");
tcp::TCP_ApplicationAnalyzer::DeliverStream(length, line, orig); tcp::TCP_ApplicationAnalyzer::DeliverStream(length, line, orig);
if ( starttls ) if ( starttls )

2
src/analyzer/protocol/krb/krb-padata.pac
View file

@ -13,7 +13,7 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
%code{ %code{
VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error) VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error)
{ {
auto vv = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("KRB::Type_Value_Vector")); auto vv = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Type_Value_Vector"));
if ( ! data->data()->has_padata() ) if ( ! data->data()->has_padata() )
return vv.release(); return vv.release();

4
src/analyzer/protocol/krb/krb-types.pac
View file

@ -35,7 +35,7 @@ VectorVal* proc_cipher_list(const Array* list)
VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list) VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list)
{ {
auto addrs = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("KRB::Host_Address_Vector")); auto addrs = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Host_Address_Vector"));
for ( uint i = 0; i < list->addresses()->size(); ++i ) for ( uint i = 0; i < list->addresses()->size(); ++i )
{ {
@ -94,7 +94,7 @@ RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list) IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list)
{ {
auto tickets = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("KRB::Ticket_Vector")); auto tickets = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Ticket_Vector"));
for ( uint i = 0; i < list->tickets()->size(); ++i ) for ( uint i = 0; i < list->tickets()->size(); ++i )
{ {

14
src/analyzer/protocol/login/Login.cc
View file

@ -45,13 +45,13 @@ Login_Analyzer::Login_Analyzer(const char* name, Connection* conn)
if ( ! re_skip_authentication ) if ( ! re_skip_authentication )
{ {
IntrusivePtr<ListVal> skip_authentication = zeek::id::lookup_val("skip_authentication")->AsTableVal()->ToPureListVal(); IntrusivePtr<ListVal> skip_authentication = zeek::id::find_val("skip_authentication")->AsTableVal()->ToPureListVal();
IntrusivePtr<ListVal> direct_login_prompts = zeek::id::lookup_val("direct_login_prompts")->AsTableVal()->ToPureListVal(); IntrusivePtr<ListVal> direct_login_prompts = zeek::id::find_val("direct_login_prompts")->AsTableVal()->ToPureListVal();
IntrusivePtr<ListVal> login_prompts = zeek::id::lookup_val("login_prompts")->AsTableVal()->ToPureListVal(); IntrusivePtr<ListVal> login_prompts = zeek::id::find_val("login_prompts")->AsTableVal()->ToPureListVal();
IntrusivePtr<ListVal> login_non_failure_msgs = zeek::id::lookup_val("login_non_failure_msgs")->AsTableVal()->ToPureListVal(); IntrusivePtr<ListVal> login_non_failure_msgs = zeek::id::find_val("login_non_failure_msgs")->AsTableVal()->ToPureListVal();
IntrusivePtr<ListVal> login_failure_msgs = zeek::id::lookup_val("login_failure_msgs")->AsTableVal()->ToPureListVal(); IntrusivePtr<ListVal> login_failure_msgs = zeek::id::find_val("login_failure_msgs")->AsTableVal()->ToPureListVal();
IntrusivePtr<ListVal> login_success_msgs = zeek::id::lookup_val("login_success_msgs")->AsTableVal()->ToPureListVal(); IntrusivePtr<ListVal> login_success_msgs = zeek::id::find_val("login_success_msgs")->AsTableVal()->ToPureListVal();
IntrusivePtr<ListVal> login_timeouts = zeek::id::lookup_val("login_timeouts")->AsTableVal()->ToPureListVal(); IntrusivePtr<ListVal> login_timeouts = zeek::id::find_val("login_timeouts")->AsTableVal()->ToPureListVal();
#ifdef USE_PERFTOOLS_DEBUG #ifdef USE_PERFTOOLS_DEBUG
HeapLeakChecker::Disabler disabler; HeapLeakChecker::Disabler disabler;

4
src/analyzer/protocol/mime/MIME.cc
View file

@ -1289,7 +1289,7 @@ void MIME_Entity::DebugPrintHeaders()
IntrusivePtr<RecordVal> MIME_Message::BuildHeaderVal(MIME_Header* h) IntrusivePtr<RecordVal> MIME_Message::BuildHeaderVal(MIME_Header* h)
{ {
static auto mime_header_rec = zeek::id::lookup_type<RecordType>("mime_header_rec"); static auto mime_header_rec = zeek::id::find_type<RecordType>("mime_header_rec");
auto header_record = make_intrusive<RecordVal>(mime_header_rec); auto header_record = make_intrusive<RecordVal>(mime_header_rec);
header_record->Assign(0, new_string_val(h->get_name())); header_record->Assign(0, new_string_val(h->get_name()));
auto upper_hn = new_string_val(h->get_name()); auto upper_hn = new_string_val(h->get_name());
@ -1301,7 +1301,7 @@ IntrusivePtr<RecordVal> MIME_Message::BuildHeaderVal(MIME_Header* h)
IntrusivePtr<TableVal> MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist) IntrusivePtr<TableVal> MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist)
{ {
static auto mime_header_list = zeek::id::lookup_type<TableType>("mime_header_list"); static auto mime_header_list = zeek::id::find_type<TableType>("mime_header_list");
auto t = make_intrusive<TableVal>(mime_header_list); auto t = make_intrusive<TableVal>(mime_header_list);
for ( unsigned int i = 0; i < hlist.size(); ++i ) for ( unsigned int i = 0; i < hlist.size(); ++i )

2
src/analyzer/protocol/mqtt/commands/publish.pac
View file

@ -31,7 +31,7 @@ refine flow MQTT_Flow += {
reinterpret_cast<const char*>(${msg.topic.str}.begin()))); reinterpret_cast<const char*>(${msg.topic.str}.begin())));
auto len = ${msg.payload}.length(); auto len = ${msg.payload}.length();
static auto max_payload_size = zeek::id::lookup("MQTT::max_payload_size"); static auto max_payload_size = zeek::id::find("MQTT::max_payload_size");
auto max = max_payload_size->GetVal()->AsCount(); auto max = max_payload_size->GetVal()->AsCount();
if ( len > static_cast<int>(max) ) if ( len > static_cast<int>(max) )

8
src/analyzer/protocol/rpc/Portmap.cc
View file

@ -138,7 +138,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
event = success ? pm_request_dump : pm_attempt_dump; event = success ? pm_request_dump : pm_attempt_dump;
if ( success ) if ( success )
{ {
static auto pm_mappings = zeek::id::lookup_type<TableType>("pm_mappings"); static auto pm_mappings = zeek::id::find_type<TableType>("pm_mappings");
TableVal* mappings = new TableVal(pm_mappings); TableVal* mappings = new TableVal(pm_mappings);
uint32_t nmap = 0; uint32_t nmap = 0;
@ -194,7 +194,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
Val* PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) Val* PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
{ {
static auto pm_mapping = zeek::id::lookup_type<RecordType>("pm_mapping"); static auto pm_mapping = zeek::id::find_type<RecordType>("pm_mapping");
RecordVal* mapping = new RecordVal(pm_mapping); RecordVal* mapping = new RecordVal(pm_mapping);
mapping->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); mapping->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
@ -215,7 +215,7 @@ Val* PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
{ {
static auto pm_port_request = zeek::id::lookup_type<RecordType>("pm_port_request"); static auto pm_port_request = zeek::id::find_type<RecordType>("pm_port_request");
RecordVal* pr = new RecordVal(pm_port_request); RecordVal* pr = new RecordVal(pm_port_request);
pr->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); pr->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
@ -236,7 +236,7 @@ Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
Val* PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len) Val* PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len)
{ {
static auto pm_callit_request = zeek::id::lookup_type<RecordType>("pm_callit_request"); static auto pm_callit_request = zeek::id::find_type<RecordType>("pm_callit_request");
RecordVal* c = new RecordVal(pm_callit_request); RecordVal* c = new RecordVal(pm_callit_request);
c->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); c->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));

4
src/analyzer/protocol/sip/sip-analyzer.pac
View file

@ -67,7 +67,7 @@ refine flow SIP_Flow += {
function build_sip_headers_val(): BroVal function build_sip_headers_val(): BroVal
%{ %{
static auto mime_header_list = zeek::id::lookup_type<TableType>("mime_header_list"); static auto mime_header_list = zeek::id::find_type<TableType>("mime_header_list");
TableVal* t = new TableVal(mime_header_list); TableVal* t = new TableVal(mime_header_list);
for ( unsigned int i = 0; i < headers.size(); ++i ) for ( unsigned int i = 0; i < headers.size(); ++i )
@ -102,7 +102,7 @@ refine flow SIP_Flow += {
function build_sip_header_val(name: const_bytestring, value: const_bytestring): BroVal function build_sip_header_val(name: const_bytestring, value: const_bytestring): BroVal
%{ %{
static auto mime_header_rec = zeek::id::lookup_type<RecordType>("mime_header_rec"); static auto mime_header_rec = zeek::id::find_type<RecordType>("mime_header_rec");
RecordVal* header_record = new RecordVal(mime_header_rec); RecordVal* header_record = new RecordVal(mime_header_rec);
IntrusivePtr<StringVal> name_val; IntrusivePtr<StringVal> name_val;

8
src/analyzer/protocol/socks/socks-analyzer.pac
View file

@ -24,7 +24,7 @@ refine connection SOCKS_Conn += {
%{ %{
if ( socks_request ) if ( socks_request )
{ {
static auto socks_address = zeek::id::lookup_type<RecordType>("SOCKS::Address"); static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
auto sa = make_intrusive<RecordVal>(socks_address); auto sa = make_intrusive<RecordVal>(socks_address);
sa->Assign(0, make_intrusive<AddrVal>(htonl(${request.addr}))); sa->Assign(0, make_intrusive<AddrVal>(htonl(${request.addr})));
@ -49,7 +49,7 @@ refine connection SOCKS_Conn += {
%{ %{
if ( socks_reply ) if ( socks_reply )
{ {
static auto socks_address = zeek::id::lookup_type<RecordType>("SOCKS::Address"); static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
auto sa = make_intrusive<RecordVal>(socks_address); auto sa = make_intrusive<RecordVal>(socks_address);
sa->Assign(0, make_intrusive<AddrVal>(htonl(${reply.addr}))); sa->Assign(0, make_intrusive<AddrVal>(htonl(${reply.addr})));
@ -82,7 +82,7 @@ refine connection SOCKS_Conn += {
return false; return false;
} }
static auto socks_address = zeek::id::lookup_type<RecordType>("SOCKS::Address"); static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
auto sa = make_intrusive<RecordVal>(socks_address); auto sa = make_intrusive<RecordVal>(socks_address);
// This is dumb and there must be a better way (checking for presence of a field)... // This is dumb and there must be a better way (checking for presence of a field)...
@ -122,7 +122,7 @@ refine connection SOCKS_Conn += {
function socks5_reply(reply: SOCKS5_Reply): bool function socks5_reply(reply: SOCKS5_Reply): bool
%{ %{
static auto socks_address = zeek::id::lookup_type<RecordType>("SOCKS::Address"); static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
auto sa = make_intrusive<RecordVal>(socks_address); auto sa = make_intrusive<RecordVal>(socks_address);
// This is dumb and there must be a better way (checking for presence of a field)... // This is dumb and there must be a better way (checking for presence of a field)...

4
src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
View file

@ -155,7 +155,7 @@ refine connection Handshake_Conn += {
if ( ! ssl_extension_signature_algorithm ) if ( ! ssl_extension_signature_algorithm )
return true; return true;
auto slist = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("signature_and_hashalgorithm_vec")); auto slist = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("signature_and_hashalgorithm_vec"));
if ( supported_signature_algorithms ) if ( supported_signature_algorithms )
{ {
@ -492,7 +492,7 @@ refine connection Handshake_Conn += {
if ( ! ssl_extension_pre_shared_key_server_hello ) if ( ! ssl_extension_pre_shared_key_server_hello )
return true; return true;
auto slist = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("psk_identity_vec")); auto slist = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("psk_identity_vec"));
if ( identities && identities->identities() ) if ( identities && identities->identities() )
{ {

4
src/analyzer/protocol/tcp/TCP.cc
View file

@ -107,7 +107,7 @@ static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip,
options += opt_len; options += opt_len;
} }
static auto SYN_packet = zeek::id::lookup_type<RecordType>("SYN_packet"); static auto SYN_packet = zeek::id::find_type<RecordType>("SYN_packet");
RecordVal* v = new RecordVal(SYN_packet); RecordVal* v = new RecordVal(SYN_packet);
v->Assign(0, val_mgr->Bool(is_orig)); v->Assign(0, val_mgr->Bool(is_orig));
@ -2078,7 +2078,7 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl
RecordVal* TCPStats_Endpoint::BuildStats() RecordVal* TCPStats_Endpoint::BuildStats()
{ {
static auto endpoint_stats = zeek::id::lookup_type<RecordType>("endpoint_stats"); static auto endpoint_stats = zeek::id::find_type<RecordType>("endpoint_stats");
RecordVal* stats = new RecordVal(endpoint_stats); RecordVal* stats = new RecordVal(endpoint_stats);
stats->Assign(0, val_mgr->Count(num_pkts)); stats->Assign(0, val_mgr->Count(num_pkts));

4
src/analyzer/protocol/tcp/TCP_Reassembler.cc
View file

@ -42,8 +42,8 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer,
if ( ::tcp_contents ) if ( ::tcp_contents )
{ {
static auto tcp_content_delivery_ports_orig = zeek::id::lookup_val<TableVal>("tcp_content_delivery_ports_orig"); static auto tcp_content_delivery_ports_orig = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_orig");
static auto tcp_content_delivery_ports_resp = zeek::id::lookup_val<TableVal>("tcp_content_delivery_ports_resp"); static auto tcp_content_delivery_ports_resp = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_resp");
const auto& dst_port_val = val_mgr->Port(ntohs(tcp_analyzer->Conn()->RespPort()), const auto& dst_port_val = val_mgr->Port(ntohs(tcp_analyzer->Conn()->RespPort()),
TRANSPORT_TCP); TRANSPORT_TCP);
const auto& ports = IsOrig() ? const auto& ports = IsOrig() ?

6
src/analyzer/protocol/teredo/Teredo.cc
View file

@ -104,9 +104,9 @@ IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
if ( ! teredo_hdr_type ) if ( ! teredo_hdr_type )
{ {
teredo_hdr_type = zeek::id::lookup_type("teredo_hdr")->AsRecordType(); teredo_hdr_type = zeek::id::find_type("teredo_hdr")->AsRecordType();
teredo_auth_type = zeek::id::lookup_type("teredo_auth")->AsRecordType(); teredo_auth_type = zeek::id::find_type("teredo_auth")->AsRecordType();
teredo_origin_type = zeek::id::lookup_type("teredo_origin")->AsRecordType(); teredo_origin_type = zeek::id::find_type("teredo_origin")->AsRecordType();
} }
auto teredo_hdr = make_intrusive<RecordVal>(teredo_hdr_type); auto teredo_hdr = make_intrusive<RecordVal>(teredo_hdr_type);

6
src/analyzer/protocol/udp/UDP.cc
View file

@ -134,9 +134,9 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
if ( udp_contents ) if ( udp_contents )
{ {
static auto udp_content_ports = zeek::id::lookup_val<TableVal>("udp_content_ports"); static auto udp_content_ports = zeek::id::find_val<TableVal>("udp_content_ports");
static auto udp_content_delivery_ports_orig = zeek::id::lookup_val<TableVal>("udp_content_delivery_ports_orig"); static auto udp_content_delivery_ports_orig = zeek::id::find_val<TableVal>("udp_content_delivery_ports_orig");
static auto udp_content_delivery_ports_resp = zeek::id::lookup_val<TableVal>("udp_content_delivery_ports_resp"); static auto udp_content_delivery_ports_resp = zeek::id::find_val<TableVal>("udp_content_delivery_ports_resp");
bool do_udp_contents = false; bool do_udp_contents = false;
const auto& sport_val = val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP); const auto& sport_val = val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP);
const auto& dport_val = val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP); const auto& dport_val = val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP);

2
src/broker/Data.cc
View file

@ -1154,7 +1154,7 @@ IntrusivePtr<Val> bro_broker::DataVal::castTo(BroType* t)
BroType* bro_broker::DataVal::ScriptDataType() BroType* bro_broker::DataVal::ScriptDataType()
{ {
if ( ! script_data_type ) if ( ! script_data_type )
script_data_type = zeek::id::lookup_type("Broker::Data").get(); script_data_type = zeek::id::find_type("Broker::Data").get();
return script_data_type; return script_data_type;
} }

10
src/broker/Manager.cc
View file

@ -148,8 +148,8 @@ void Manager::InitPostScript()
default_log_topic_prefix = default_log_topic_prefix =
get_option("Broker::default_log_topic_prefix")->AsString()->CheckString(); get_option("Broker::default_log_topic_prefix")->AsString()->CheckString();
log_topic_func = get_option("Broker::log_topic")->AsFunc(); log_topic_func = get_option("Broker::log_topic")->AsFunc();
log_id_type = zeek::id::lookup_type("Log::ID")->AsEnumType(); log_id_type = zeek::id::find_type("Log::ID")->AsEnumType();
writer_id_type = zeek::id::lookup_type("Log::Writer")->AsEnumType(); writer_id_type = zeek::id::find_type("Log::Writer")->AsEnumType();
opaque_of_data_type = new OpaqueType("Broker::Data"); opaque_of_data_type = new OpaqueType("Broker::Data");
opaque_of_set_iterator = new OpaqueType("Broker::SetIterator"); opaque_of_set_iterator = new OpaqueType("Broker::SetIterator");
@ -157,7 +157,7 @@ void Manager::InitPostScript()
opaque_of_vector_iterator = new OpaqueType("Broker::VectorIterator"); opaque_of_vector_iterator = new OpaqueType("Broker::VectorIterator");
opaque_of_record_iterator = new OpaqueType("Broker::RecordIterator"); opaque_of_record_iterator = new OpaqueType("Broker::RecordIterator");
opaque_of_store_handle = new OpaqueType("Broker::Store"); opaque_of_store_handle = new OpaqueType("Broker::Store");
vector_of_data_type = make_intrusive<VectorType>(zeek::id::lookup_type("Broker::Data")); vector_of_data_type = make_intrusive<VectorType>(zeek::id::find_type("Broker::Data"));
// Register as a "dont-count" source first, we may change that later. // Register as a "dont-count" source first, we may change that later.
iosource_mgr->Register(this, true); iosource_mgr->Register(this, true);
@ -1245,13 +1245,13 @@ void Manager::ProcessStatus(broker::status stat)
if ( ! event ) if ( ! event )
return; return;
auto ei = zeek::id::lookup_type("Broker::EndpointInfo")->AsRecordType(); auto ei = zeek::id::find_type("Broker::EndpointInfo")->AsRecordType();
auto endpoint_info = make_intrusive<RecordVal>(ei); auto endpoint_info = make_intrusive<RecordVal>(ei);
if ( ctx ) if ( ctx )
{ {
endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(ctx->node))); endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(ctx->node)));
auto ni = zeek::id::lookup_type("Broker::NetworkInfo")->AsRecordType(); auto ni = zeek::id::find_type("Broker::NetworkInfo")->AsRecordType();
auto network_info = make_intrusive<RecordVal>(ni); auto network_info = make_intrusive<RecordVal>(ni);
if ( ctx->network ) if ( ctx->network )

2
src/broker/Store.cc
View file

@ -15,7 +15,7 @@ EnumVal* query_status(bool success)
if ( ! store_query_status ) if ( ! store_query_status )
{ {
store_query_status = zeek::id::lookup_type("Broker::QueryStatus")->AsEnumType(); store_query_status = zeek::id::find_type("Broker::QueryStatus")->AsEnumType();
success_val = store_query_status->Lookup("Broker", "SUCCESS"); success_val = store_query_status->Lookup("Broker", "SUCCESS");
failure_val = store_query_status->Lookup("Broker", "FAILURE"); failure_val = store_query_status->Lookup("Broker", "FAILURE");
} }

8
src/broker/comm.bif
View file

@ -94,14 +94,14 @@ function Broker::__unpeer%(a: string, p: port%): bool
function Broker::__peers%(%): PeerInfos function Broker::__peers%(%): PeerInfos
%{ %{
bro_broker::Manager::ScriptScopeGuard ssg; bro_broker::Manager::ScriptScopeGuard ssg;
auto rval = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("Broker::PeerInfos")); auto rval = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("Broker::PeerInfos"));
auto i = 0; auto i = 0;
for ( auto& p : broker_mgr->Peers() ) for ( auto& p : broker_mgr->Peers() )
{ {
auto pi = zeek::id::lookup_type("Broker::PeerInfo")->AsRecordType(); auto pi = zeek::id::find_type("Broker::PeerInfo")->AsRecordType();
auto ei = zeek::id::lookup_type("Broker::EndpointInfo")->AsRecordType(); auto ei = zeek::id::find_type("Broker::EndpointInfo")->AsRecordType();
auto ni = zeek::id::lookup_type("Broker::NetworkInfo")->AsRecordType(); auto ni = zeek::id::find_type("Broker::NetworkInfo")->AsRecordType();
auto peer_info = new RecordVal(pi); auto peer_info = new RecordVal(pi);
auto endpoint_info = new RecordVal(ei); auto endpoint_info = new RecordVal(ei);
auto network_info = new RecordVal(ni); auto network_info = new RecordVal(ni);

6
src/file_analysis/Manager.cc
View file

@ -431,7 +431,7 @@ string Manager::GetFileID(const analyzer::Tag& tag, Connection* c, bool is_orig)
bool Manager::IsDisabled(const analyzer::Tag& tag) bool Manager::IsDisabled(const analyzer::Tag& tag)
{ {
if ( ! disabled ) if ( ! disabled )
disabled = zeek::id::lookup_const("Files::disable")->AsTableVal(); disabled = zeek::id::find_const("Files::disable")->AsTableVal();
auto index = val_mgr->Count(bool(tag)); auto index = val_mgr->Count(bool(tag));
auto yield = disabled->Lookup(index.get()); auto yield = disabled->Lookup(index.get());
@ -498,8 +498,8 @@ string Manager::DetectMIME(const u_char* data, uint64_t len) const
IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m) IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
{ {
static auto mime_matches = zeek::id::lookup_type<VectorType>("mime_matches"); static auto mime_matches = zeek::id::find_type<VectorType>("mime_matches");
static auto mime_match = zeek::id::lookup_type<RecordType>("mime_match"); static auto mime_match = zeek::id::find_type<RecordType>("mime_match");
auto rval = make_intrusive<VectorVal>(mime_matches); auto rval = make_intrusive<VectorVal>(mime_matches);
for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin(); for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin();

2
src/file_analysis/analyzer/entropy/Entropy.cc
View file

@ -60,7 +60,7 @@ void Entropy::Finalize()
montepi = scc = ent = mean = chisq = 0.0; montepi = scc = ent = mean = chisq = 0.0;
entropy->Get(&ent, &chisq, &mean, &montepi, &scc); entropy->Get(&ent, &chisq, &mean, &montepi, &scc);
static auto entropy_test_result = zeek::id::lookup_type<RecordType>("entropy_test_result"); static auto entropy_test_result = zeek::id::find_type<RecordType>("entropy_test_result");
auto ent_result = make_intrusive<RecordVal>(entropy_test_result); auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
ent_result->Assign(0, make_intrusive<Val>(ent, TYPE_DOUBLE)); ent_result->Assign(0, make_intrusive<Val>(ent, TYPE_DOUBLE));
ent_result->Assign(1, make_intrusive<Val>(chisq, TYPE_DOUBLE)); ent_result->Assign(1, make_intrusive<Val>(chisq, TYPE_DOUBLE));

2
src/file_analysis/analyzer/x509/OCSP.cc
View file

@ -634,7 +634,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
//ocsp_resp_record->Assign(7, make_intrusive<StringVal>(len, buf)); //ocsp_resp_record->Assign(7, make_intrusive<StringVal>(len, buf));
//BIO_reset(bio); //BIO_reset(bio);
certs_vector = new VectorVal(zeek::id::lookup_type<VectorType>("x509_opaque_vector")); certs_vector = new VectorVal(zeek::id::find_type<VectorType>("x509_opaque_vector"));
vl.emplace_back(AdoptRef{}, certs_vector); vl.emplace_back(AdoptRef{}, certs_vector);
#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER) #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)

2
src/file_analysis/analyzer/x509/X509.cc
View file

@ -391,7 +391,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
else if ( gen->type == GEN_IPADD ) else if ( gen->type == GEN_IPADD )
{ {
if ( ips == nullptr ) if ( ips == nullptr )
ips = new VectorVal(zeek::id::lookup_type<VectorType>("addr_vec")); ips = new VectorVal(zeek::id::find_type<VectorType>("addr_vec"));
uint32_t* addr = (uint32_t*) gen->d.ip->data; uint32_t* addr = (uint32_t*) gen->d.ip->data;

2
src/file_analysis/analyzer/x509/functions.bif
View file

@ -556,7 +556,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
} }
int num_certs = sk_X509_num(chain); int num_certs = sk_X509_num(chain);
chainVector = new VectorVal(zeek::id::lookup_type<VectorType>("x509_opaque_vector")); chainVector = new VectorVal(zeek::id::find_type<VectorType>("x509_opaque_vector"));
for ( int i = 0; i < num_certs; i++ ) for ( int i = 0; i < num_certs; i++ )
{ {

4
src/iosource/Packet.cc
View file

@ -594,8 +594,8 @@ void Packet::ProcessLayer2()
IntrusivePtr<RecordVal> Packet::ToRawPktHdrVal() const IntrusivePtr<RecordVal> Packet::ToRawPktHdrVal() const
{ {
static auto raw_pkt_hdr_type = zeek::id::lookup_type<RecordType>("raw_pkt_hdr"); static auto raw_pkt_hdr_type = zeek::id::find_type<RecordType>("raw_pkt_hdr");
static auto l2_hdr_type = zeek::id::lookup_type<RecordType>("l2_hdr"); static auto l2_hdr_type = zeek::id::find_type<RecordType>("l2_hdr");
auto pkt_hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type); auto pkt_hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
RecordVal* l2_hdr = new RecordVal(l2_hdr_type); RecordVal* l2_hdr = new RecordVal(l2_hdr_type);

112
src/legacy-netvar-init.cc
View file

@ -12,69 +12,69 @@ void zeek_legacy_netvar_init()
::connection_type = zeek::id::connection.get(); ::connection_type = zeek::id::connection.get();
::fa_file_type = zeek::id::fa_file.get(); ::fa_file_type = zeek::id::fa_file.get();
::fa_metadata_type = zeek::id::fa_metadata.get(); ::fa_metadata_type = zeek::id::fa_metadata.get();
::icmp_conn = zeek::id::lookup_type("icmp_conn")->AsRecordType(); ::icmp_conn = zeek::id::find_type("icmp_conn")->AsRecordType();
::icmp_context = zeek::id::lookup_type("icmp_context")->AsRecordType(); ::icmp_context = zeek::id::find_type("icmp_context")->AsRecordType();
::signature_state = zeek::id::lookup_type("signature_state")->AsRecordType(); ::signature_state = zeek::id::find_type("signature_state")->AsRecordType();
::SYN_packet = zeek::id::lookup_type("SYN_packet")->AsRecordType(); ::SYN_packet = zeek::id::find_type("SYN_packet")->AsRecordType();
::pcap_packet = zeek::id::lookup_type("pcap_packet")->AsRecordType(); ::pcap_packet = zeek::id::find_type("pcap_packet")->AsRecordType();
::raw_pkt_hdr_type = zeek::id::lookup_type("raw_pkt_hdr")->AsRecordType(); ::raw_pkt_hdr_type = zeek::id::find_type("raw_pkt_hdr")->AsRecordType();
::l2_hdr_type = zeek::id::lookup_type("l2_hdr")->AsRecordType(); ::l2_hdr_type = zeek::id::find_type("l2_hdr")->AsRecordType();
::transport_proto = zeek::id::transport_proto.get(); ::transport_proto = zeek::id::transport_proto.get();
::string_set = zeek::id::string_set.get(); ::string_set = zeek::id::string_set.get();
::string_array = zeek::id::string_array.get(); ::string_array = zeek::id::string_array.get();
::count_set = zeek::id::count_set.get(); ::count_set = zeek::id::count_set.get();
::string_vec = zeek::id::string_vec.get(); ::string_vec = zeek::id::string_vec.get();
::index_vec = zeek::id::index_vec.get(); ::index_vec = zeek::id::index_vec.get();
::mime_matches = zeek::id::lookup_type("mime_matches")->AsVectorType(); ::mime_matches = zeek::id::find_type("mime_matches")->AsVectorType();
::mime_match = zeek::id::lookup_type("mime_match")->AsRecordType(); ::mime_match = zeek::id::find_type("mime_match")->AsRecordType();
::socks_address = zeek::id::lookup_type("SOCKS::Address")->AsRecordType(); ::socks_address = zeek::id::find_type("SOCKS::Address")->AsRecordType();
::mime_header_rec = zeek::id::lookup_type("mime_header_rec")->AsRecordType(); ::mime_header_rec = zeek::id::find_type("mime_header_rec")->AsRecordType();
::mime_header_list = zeek::id::lookup_type("mime_header_list")->AsTableType(); ::mime_header_list = zeek::id::find_type("mime_header_list")->AsTableType();
::http_stats_rec = zeek::id::lookup_type("http_stats_rec")->AsRecordType(); ::http_stats_rec = zeek::id::find_type("http_stats_rec")->AsRecordType();
::http_message_stat = zeek::id::lookup_type("http_message_stat")->AsRecordType(); ::http_message_stat = zeek::id::find_type("http_message_stat")->AsRecordType();
::pm_mapping = zeek::id::lookup_type("pm_mapping")->AsRecordType(); ::pm_mapping = zeek::id::find_type("pm_mapping")->AsRecordType();
::pm_mappings = zeek::id::lookup_type("pm_mappings")->AsTableType(); ::pm_mappings = zeek::id::find_type("pm_mappings")->AsTableType();
::pm_port_request = zeek::id::lookup_type("pm_port_request")->AsRecordType(); ::pm_port_request = zeek::id::find_type("pm_port_request")->AsRecordType();
::pm_callit_request = zeek::id::lookup_type("pm_callit_request")->AsRecordType(); ::pm_callit_request = zeek::id::find_type("pm_callit_request")->AsRecordType();
::geo_location = zeek::id::lookup_type("geo_location")->AsRecordType(); ::geo_location = zeek::id::find_type("geo_location")->AsRecordType();
::entropy_test_result = zeek::id::lookup_type("entropy_test_result")->AsRecordType(); ::entropy_test_result = zeek::id::find_type("entropy_test_result")->AsRecordType();
::dns_msg = zeek::id::lookup_type("dns_msg")->AsRecordType(); ::dns_msg = zeek::id::find_type("dns_msg")->AsRecordType();
::dns_answer = zeek::id::lookup_type("dns_answer")->AsRecordType(); ::dns_answer = zeek::id::find_type("dns_answer")->AsRecordType();
::dns_soa = zeek::id::lookup_type("dns_soa")->AsRecordType(); ::dns_soa = zeek::id::find_type("dns_soa")->AsRecordType();
::dns_edns_additional = zeek::id::lookup_type("dns_edns_additional")->AsRecordType(); ::dns_edns_additional = zeek::id::find_type("dns_edns_additional")->AsRecordType();
::dns_tsig_additional = zeek::id::lookup_type("dns_tsig_additional")->AsRecordType(); ::dns_tsig_additional = zeek::id::find_type("dns_tsig_additional")->AsRecordType();
::dns_rrsig_rr = zeek::id::lookup_type("dns_rrsig_rr")->AsRecordType(); ::dns_rrsig_rr = zeek::id::find_type("dns_rrsig_rr")->AsRecordType();
::dns_dnskey_rr = zeek::id::lookup_type("dns_dnskey_rr")->AsRecordType(); ::dns_dnskey_rr = zeek::id::find_type("dns_dnskey_rr")->AsRecordType();
::dns_nsec3_rr = zeek::id::lookup_type("dns_nsec3_rr")->AsRecordType(); ::dns_nsec3_rr = zeek::id::find_type("dns_nsec3_rr")->AsRecordType();
::dns_ds_rr = zeek::id::lookup_type("dns_ds_rr")->AsRecordType(); ::dns_ds_rr = zeek::id::find_type("dns_ds_rr")->AsRecordType();
::rotate_info = zeek::id::lookup_type("rotate_info")->AsRecordType(); ::rotate_info = zeek::id::find_type("rotate_info")->AsRecordType();
::irc_join_list = zeek::id::lookup_type("irc_join_list")->AsTableType(); ::irc_join_list = zeek::id::find_type("irc_join_list")->AsTableType();
::irc_join_info = zeek::id::lookup_type("irc_join_info")->AsRecordType(); ::irc_join_info = zeek::id::find_type("irc_join_info")->AsRecordType();
::script_id = zeek::id::lookup_type("script_id")->AsRecordType(); ::script_id = zeek::id::find_type("script_id")->AsRecordType();
::id_table = zeek::id::lookup_type("id_table")->AsTableType(); ::id_table = zeek::id::find_type("id_table")->AsTableType();
::record_field = zeek::id::lookup_type("record_field")->AsRecordType(); ::record_field = zeek::id::find_type("record_field")->AsRecordType();
::record_field_table = zeek::id::lookup_type("record_field_table")->AsTableType(); ::record_field_table = zeek::id::find_type("record_field_table")->AsTableType();
::call_argument = zeek::id::lookup_type("call_argument")->AsRecordType(); ::call_argument = zeek::id::find_type("call_argument")->AsRecordType();
::call_argument_vector = zeek::id::lookup_type("call_argument_vector")->AsVectorType(); ::call_argument_vector = zeek::id::find_type("call_argument_vector")->AsVectorType();
::log_rotate_base_time = zeek::id::lookup_val("log_rotate_base_time")->AsStringVal(); ::log_rotate_base_time = zeek::id::find_val("log_rotate_base_time")->AsStringVal();
::pkt_profile_file = zeek::id::lookup_val("pkt_profile_file").get(); ::pkt_profile_file = zeek::id::find_val("pkt_profile_file").get();
::likely_server_ports = zeek::id::lookup_val("likely_server_ports")->AsTableVal(); ::likely_server_ports = zeek::id::find_val("likely_server_ports")->AsTableVal();
::tcp_content_delivery_ports_orig = zeek::id::lookup_val("tcp_content_delivery_ports_orig")->AsTableVal(); ::tcp_content_delivery_ports_orig = zeek::id::find_val("tcp_content_delivery_ports_orig")->AsTableVal();
::tcp_content_delivery_ports_resp = zeek::id::lookup_val("tcp_content_delivery_ports_resp")->AsTableVal(); ::tcp_content_delivery_ports_resp = zeek::id::find_val("tcp_content_delivery_ports_resp")->AsTableVal();
::stp_skip_src = zeek::id::lookup_val("stp_skip_src")->AsTableVal(); ::stp_skip_src = zeek::id::find_val("stp_skip_src")->AsTableVal();
::dns_skip_auth = zeek::id::lookup_val("dns_skip_auth")->AsTableVal(); ::dns_skip_auth = zeek::id::find_val("dns_skip_auth")->AsTableVal();
::dns_skip_addl = zeek::id::lookup_val("dns_skip_addl")->AsTableVal(); ::dns_skip_addl = zeek::id::find_val("dns_skip_addl")->AsTableVal();
::udp_content_ports = zeek::id::lookup_val("udp_content_ports")->AsTableVal(); ::udp_content_ports = zeek::id::find_val("udp_content_ports")->AsTableVal();
::udp_content_delivery_ports_orig = zeek::id::lookup_val("udp_content_delivery_ports_orig")->AsTableVal(); ::udp_content_delivery_ports_orig = zeek::id::find_val("udp_content_delivery_ports_orig")->AsTableVal();
::udp_content_delivery_ports_resp = zeek::id::lookup_val("udp_content_delivery_ports_resp")->AsTableVal(); ::udp_content_delivery_ports_resp = zeek::id::find_val("udp_content_delivery_ports_resp")->AsTableVal();
::profiling_file = zeek::id::lookup_val("profiling_file").get(); ::profiling_file = zeek::id::find_val("profiling_file").get();
::global_hash_seed = zeek::id::lookup_val("global_hash_seed")->AsStringVal(); ::global_hash_seed = zeek::id::find_val("global_hash_seed")->AsStringVal();
::tcp_reassembler_ports_orig = zeek::id::lookup_val("tcp_reassembler_ports_orig")->AsTableVal(); ::tcp_reassembler_ports_orig = zeek::id::find_val("tcp_reassembler_ports_orig")->AsTableVal();
::tcp_reassembler_ports_resp = zeek::id::lookup_val("tcp_reassembler_ports_resp")->AsTableVal(); ::tcp_reassembler_ports_resp = zeek::id::find_val("tcp_reassembler_ports_resp")->AsTableVal();
::peer_description = zeek::id::lookup_val("peer_description")->AsStringVal(); ::peer_description = zeek::id::find_val("peer_description")->AsStringVal();
::trace_output_file = zeek::id::lookup_val("trace_output_file")->AsStringVal(); ::trace_output_file = zeek::id::find_val("trace_output_file")->AsStringVal();
::cmd_line_bpf_filter = zeek::id::lookup_val("cmd_line_bpf_filter")->AsStringVal(); ::cmd_line_bpf_filter = zeek::id::find_val("cmd_line_bpf_filter")->AsStringVal();
auto anon_id = global_scope()->Lookup("preserve_orig_addr"); auto anon_id = global_scope()->Lookup("preserve_orig_addr");

8
src/logging/Manager.cc
View file

@ -313,7 +313,7 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval)
streams[idx]->event = event ? event_registry->Lookup(event->Name()) : nullptr; streams[idx]->event = event ? event_registry->Lookup(event->Name()) : nullptr;
streams[idx]->columns = columns->Ref()->AsRecordType(); streams[idx]->columns = columns->Ref()->AsRecordType();
streams[idx]->enable_remote = zeek::id::lookup_val("Log::enable_remote_logging")->AsBool(); streams[idx]->enable_remote = zeek::id::find_val("Log::enable_remote_logging")->AsBool();
DBG_LOG(DBG_LOGGING, "Created new logging stream '%s', raising event %s", DBG_LOG(DBG_LOGGING, "Created new logging stream '%s', raising event %s",
streams[idx]->name.c_str(), event ? streams[idx]->event->Name() : "<none>"); streams[idx]->name.c_str(), event ? streams[idx]->event->Name() : "<none>");
@ -1193,7 +1193,7 @@ WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBacken
// Still need to set the WriterInfo's rotation parameters, which we // Still need to set the WriterInfo's rotation parameters, which we
// computed above. // computed above.
static auto log_rotate_base_time = zeek::id::lookup_val<StringVal>("log_rotate_base_time"); static auto log_rotate_base_time = zeek::id::find_val<StringVal>("log_rotate_base_time");
static auto base_time = log_rotate_base_time->AsString()->CheckString(); static auto base_time = log_rotate_base_time->AsString()->CheckString();
winfo->info->rotation_interval = winfo->interval; winfo->info->rotation_interval = winfo->interval;
@ -1276,7 +1276,7 @@ bool Manager::WriteFromRemote(EnumVal* id, EnumVal* writer, const string& path,
void Manager::SendAllWritersTo(const broker::endpoint_info& ei) void Manager::SendAllWritersTo(const broker::endpoint_info& ei)
{ {
auto et = zeek::id::lookup_type("Log::Writer")->AsEnumType(); auto et = zeek::id::find_type("Log::Writer")->AsEnumType();
for ( vector<Stream *>::iterator s = streams.begin(); s != streams.end(); ++s ) for ( vector<Stream *>::iterator s = streams.begin(); s != streams.end(); ++s )
{ {
@ -1453,7 +1453,7 @@ void Manager::InstallRotationTimer(WriterInfo* winfo)
if ( ! winfo->open_time ) if ( ! winfo->open_time )
winfo->open_time = network_time; winfo->open_time = network_time;
static auto log_rotate_base_time = zeek::id::lookup_val<StringVal>("log_rotate_base_time"); static auto log_rotate_base_time = zeek::id::find_val<StringVal>("log_rotate_base_time");
static auto base_time = log_rotate_base_time->AsString()->CheckString(); static auto base_time = log_rotate_base_time->AsString()->CheckString();
double base = parse_rotate_base_time(base_time); double base = parse_rotate_base_time(base_time);

2
src/probabilistic/Hasher.cc
View file

@ -23,7 +23,7 @@ Hasher::seed_t Hasher::MakeSeed(const void* data, size_t size)
assert(sizeof(tmpseed) == 16); assert(sizeof(tmpseed) == 16);
static auto global_hash_seed = zeek::id::lookup_val<StringVal>("global_hash_seed"); static auto global_hash_seed = zeek::id::find_val<StringVal>("global_hash_seed");
if ( data ) if ( data )
hash_update(ctx, data, size); hash_update(ctx, data, size);

2
src/stats.bif
View file

@ -470,7 +470,7 @@ function get_reporter_stats%(%): ReporterStats
auto r = make_intrusive<RecordVal>(ReporterStats); auto r = make_intrusive<RecordVal>(ReporterStats);
int n = 0; int n = 0;
auto weirds_by_type = make_intrusive<TableVal>(zeek::id::lookup_type<TableType>("table_string_of_count")); auto weirds_by_type = make_intrusive<TableVal>(zeek::id::find_type<TableType>("table_string_of_count"));
for ( auto& kv : reporter->GetWeirdsByType() ) for ( auto& kv : reporter->GetWeirdsByType() )
{ {

2
src/strings.bif
View file

@ -204,7 +204,7 @@ static IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
int max_num_sep) int max_num_sep)
{ {
// string_vec is used early in the version script - do not use the NetVar. // string_vec is used early in the version script - do not use the NetVar.
auto rval = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("string_vec")); auto rval = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("string_vec"));
const u_char* s = str_val->Bytes(); const u_char* s = str_val->Bytes();
int n = str_val->Len(); int n = str_val->Len();
const u_char* end_of_s = s + n; const u_char* end_of_s = s + n;

6
src/zeek-setup.cc
View file

@ -361,7 +361,7 @@ static std::vector<std::string> get_script_signature_files()
// Parse rule files defined on the script level. // Parse rule files defined on the script level.
char* script_signature_files = char* script_signature_files =
copy_string(zeek::id::lookup_val("signature_files")->AsString()->CheckString()); copy_string(zeek::id::find_val("signature_files")->AsString()->CheckString());
char* tmp = script_signature_files; char* tmp = script_signature_files;
char* s; char* s;
@ -722,7 +722,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
if ( ! options.pcap_file && ! options.interface ) if ( ! options.pcap_file && ! options.interface )
{ {
const auto& interfaces_val = zeek::id::lookup_val("interfaces"); const auto& interfaces_val = zeek::id::find_val("interfaces");
if ( interfaces_val ) if ( interfaces_val )
{ {
char* interfaces_str = char* interfaces_str =
@ -780,7 +780,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
if ( profiling_interval > 0 ) if ( profiling_interval > 0 )
{ {
const auto& profiling_file = zeek::id::lookup_val("profiling_file"); const auto& profiling_file = zeek::id::find_val("profiling_file");
profiling_logger = new ProfileLogger(profiling_file->AsFile(), profiling_logger = new ProfileLogger(profiling_file->AsFile(),
profiling_interval); profiling_interval);

28
src/zeek.bif
View file

@ -1051,7 +1051,7 @@ function find_entropy%(data: string%): entropy_test_result
e.Feed(data->Bytes(), data->Len()); e.Feed(data->Bytes(), data->Len());
e.Get(&ent, &chisq, &mean, &montepi, &scc); e.Get(&ent, &chisq, &mean, &montepi, &scc);
static auto entropy_test_result = zeek::id::lookup_type<RecordType>("entropy_test_result"); static auto entropy_test_result = zeek::id::find_type<RecordType>("entropy_test_result");
auto ent_result = make_intrusive<RecordVal>(entropy_test_result); auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
ent_result->Assign(0, make_intrusive<Val>(ent, TYPE_DOUBLE)); ent_result->Assign(0, make_intrusive<Val>(ent, TYPE_DOUBLE));
ent_result->Assign(1, make_intrusive<Val>(chisq, TYPE_DOUBLE)); ent_result->Assign(1, make_intrusive<Val>(chisq, TYPE_DOUBLE));
@ -1103,7 +1103,7 @@ function entropy_test_finish%(handle: opaque of entropy%): entropy_test_result
montepi = scc = ent = mean = chisq = 0.0; montepi = scc = ent = mean = chisq = 0.0;
static_cast<EntropyVal*>(handle)->Get(&ent, &chisq, &mean, &montepi, &scc); static_cast<EntropyVal*>(handle)->Get(&ent, &chisq, &mean, &montepi, &scc);
static auto entropy_test_result = zeek::id::lookup_type<RecordType>("entropy_test_result"); static auto entropy_test_result = zeek::id::find_type<RecordType>("entropy_test_result");
auto ent_result = make_intrusive<RecordVal>(entropy_test_result); auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
ent_result->Assign(0, make_intrusive<Val>(ent, TYPE_DOUBLE)); ent_result->Assign(0, make_intrusive<Val>(ent, TYPE_DOUBLE));
ent_result->Assign(1, make_intrusive<Val>(chisq, TYPE_DOUBLE)); ent_result->Assign(1, make_intrusive<Val>(chisq, TYPE_DOUBLE));
@ -1826,7 +1826,7 @@ function record_type_to_vector%(rt: string%): string_vec
%{ %{
auto result = make_intrusive<VectorVal>(zeek::id::string_vec); auto result = make_intrusive<VectorVal>(zeek::id::string_vec);
RecordType* type = zeek::id::lookup_type(rt->CheckString())->AsRecordType(); RecordType* type = zeek::id::find_type(rt->CheckString())->AsRecordType();
for ( int i = 0; i < type->NumFields(); ++i ) for ( int i = 0; i < type->NumFields(); ++i )
result->Assign(i+1, make_intrusive<StringVal>(type->FieldName(i))); result->Assign(i+1, make_intrusive<StringVal>(type->FieldName(i)));
@ -1891,7 +1891,7 @@ function reading_traces%(%): bool
## .. zeek:see:: reading_live_traffic reading_traces ## .. zeek:see:: reading_live_traffic reading_traces
function packet_source%(%): PacketSource function packet_source%(%): PacketSource
%{ %{
auto ps_type = zeek::id::lookup_type("PacketSource")->AsRecordType(); auto ps_type = zeek::id::find_type("PacketSource")->AsRecordType();
auto ps = iosource_mgr->GetPktSrc(); auto ps = iosource_mgr->GetPktSrc();
auto r = make_intrusive<RecordVal>(ps_type); auto r = make_intrusive<RecordVal>(ps_type);
@ -1941,14 +1941,14 @@ function global_sizes%(%): var_sizes
## .. zeek:see:: global_sizes ## .. zeek:see:: global_sizes
function global_ids%(%): id_table function global_ids%(%): id_table
%{ %{
static auto id_table = zeek::id::lookup_type<TableType>("id_table"); static auto id_table = zeek::id::find_type<TableType>("id_table");
auto ids = make_intrusive<TableVal>(id_table); auto ids = make_intrusive<TableVal>(id_table);
const auto& globals = global_scope()->Vars(); const auto& globals = global_scope()->Vars();
for ( const auto& global : globals ) for ( const auto& global : globals )
{ {
ID* id = global.second.get(); ID* id = global.second.get();
static auto script_id = zeek::id::lookup_type<RecordType>("script_id"); static auto script_id = zeek::id::find_type<RecordType>("script_id");
auto rec = make_intrusive<RecordVal>(script_id); auto rec = make_intrusive<RecordVal>(script_id);
rec->Assign(0, make_intrusive<StringVal>(type_name(id->GetType()->Tag()))); rec->Assign(0, make_intrusive<StringVal>(type_name(id->GetType()->Tag())));
rec->Assign(1, val_mgr->Bool(id->IsExport())); rec->Assign(1, val_mgr->Bool(id->IsExport()));
@ -1994,7 +1994,7 @@ function lookup_ID%(id: string%) : any
## Returns: A table that describes the fields of a record. ## Returns: A table that describes the fields of a record.
function record_fields%(rec: any%): record_field_table function record_fields%(rec: any%): record_field_table
%{ %{
static auto record_field_table = zeek::id::lookup_type<TableType>("record_field_table"); static auto record_field_table = zeek::id::find_type<TableType>("record_field_table");
if ( rec->GetType()->Tag() == TYPE_STRING ) if ( rec->GetType()->Tag() == TYPE_STRING )
{ {
@ -2189,7 +2189,7 @@ function is_v6_subnet%(s: subnet%): bool
## Returns: The vector of addresses contained in the routing header data. ## Returns: The vector of addresses contained in the routing header data.
function routing0_data_to_addrs%(s: string%): addr_vec function routing0_data_to_addrs%(s: string%): addr_vec
%{ %{
auto rval = make_intrusive<VectorVal>(zeek::id::lookup_type<VectorType>("addr_vec")); auto rval = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("addr_vec"));
int len = s->Len(); int len = s->Len();
const u_char* bytes = s->Bytes(); const u_char* bytes = s->Bytes();
@ -3385,7 +3385,7 @@ function dump_current_packet%(file_name: string%) : bool
## .. zeek:see:: dump_current_packet dump_packet ## .. zeek:see:: dump_current_packet dump_packet
function get_current_packet%(%) : pcap_packet function get_current_packet%(%) : pcap_packet
%{ %{
static auto pcap_packet = zeek::id::lookup_type<RecordType>("pcap_packet"); static auto pcap_packet = zeek::id::find_type<RecordType>("pcap_packet");
const Packet* p; const Packet* p;
auto pkt = make_intrusive<RecordVal>(pcap_packet); auto pkt = make_intrusive<RecordVal>(pcap_packet);
@ -3427,7 +3427,7 @@ function get_current_packet_header%(%) : raw_pkt_hdr
return p->ToRawPktHdrVal(); return p->ToRawPktHdrVal();
} }
static auto raw_pkt_hdr_type = zeek::id::lookup_type<RecordType>("raw_pkt_hdr"); static auto raw_pkt_hdr_type = zeek::id::find_type<RecordType>("raw_pkt_hdr");
auto hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type); auto hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
return hdr; return hdr;
%} %}
@ -3998,7 +3998,7 @@ function mmdb_open_asn_db%(f: string%) : bool
## .. zeek:see:: lookup_asn ## .. zeek:see:: lookup_asn
function lookup_location%(a: addr%) : geo_location function lookup_location%(a: addr%) : geo_location
%{ %{
static auto geo_location = zeek::id::lookup_type<RecordType>("geo_location"); static auto geo_location = zeek::id::find_type<RecordType>("geo_location");
auto location = make_intrusive<RecordVal>(geo_location); auto location = make_intrusive<RecordVal>(geo_location);
#ifdef USE_GEOIP #ifdef USE_GEOIP
@ -4630,7 +4630,7 @@ function rotate_file%(f: file%): rotate_info
return info; return info;
// Record indicating error. // Record indicating error.
static auto rotate_info = zeek::id::lookup_type<RecordType>("rotate_info"); static auto rotate_info = zeek::id::find_type<RecordType>("rotate_info");
info = make_intrusive<RecordVal>(rotate_info); info = make_intrusive<RecordVal>(rotate_info);
info->Assign(0, val_mgr->EmptyString()); info->Assign(0, val_mgr->EmptyString());
info->Assign(1, val_mgr->EmptyString()); info->Assign(1, val_mgr->EmptyString());
@ -4650,7 +4650,7 @@ function rotate_file%(f: file%): rotate_info
## .. zeek:see:: rotate_file calc_next_rotate ## .. zeek:see:: rotate_file calc_next_rotate
function rotate_file_by_name%(f: string%): rotate_info function rotate_file_by_name%(f: string%): rotate_info
%{ %{
static auto rotate_info = zeek::id::lookup_type<RecordType>("rotate_info"); static auto rotate_info = zeek::id::find_type<RecordType>("rotate_info");
auto info = make_intrusive<RecordVal>(rotate_info); auto info = make_intrusive<RecordVal>(rotate_info);
bool is_pkt_dumper = false; bool is_pkt_dumper = false;
@ -4705,7 +4705,7 @@ function rotate_file_by_name%(f: string%): rotate_info
## .. zeek:see:: rotate_file rotate_file_by_name ## .. zeek:see:: rotate_file rotate_file_by_name
function calc_next_rotate%(i: interval%) : interval function calc_next_rotate%(i: interval%) : interval
%{ %{
static auto log_rotate_base_time = zeek::id::lookup_val<StringVal>("log_rotate_base_time"); static auto log_rotate_base_time = zeek::id::find_val<StringVal>("log_rotate_base_time");
static auto base_time = log_rotate_base_time->AsString()->CheckString(); static auto base_time = log_rotate_base_time->AsString()->CheckString();
double base = parse_rotate_base_time(base_time); double base = parse_rotate_base_time(base_time);