mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 11:08:20 +00:00
Clang format it all
This commit is contained in:
parent
12494aac45
commit
5cdc6e150e
18 changed files with 323 additions and 313 deletions
41
src/Flare.cc
41
src/Flare.cc
|
@ -12,19 +12,18 @@
|
|||
|
||||
#include <winsock2.h>
|
||||
|
||||
#define fatalError(...) \
|
||||
do \
|
||||
{ \
|
||||
if ( reporter ) \
|
||||
reporter->FatalError(__VA_ARGS__); \
|
||||
else \
|
||||
{ \
|
||||
fprintf(stderr, __VA_ARGS__); \
|
||||
fprintf(stderr, "\n"); \
|
||||
_exit(1); \
|
||||
} \
|
||||
} \
|
||||
while (0)
|
||||
#define fatalError(...) \
|
||||
do \
|
||||
{ \
|
||||
if ( reporter ) \
|
||||
reporter->FatalError(__VA_ARGS__); \
|
||||
else \
|
||||
{ \
|
||||
fprintf(stderr, __VA_ARGS__); \
|
||||
fprintf(stderr, "\n"); \
|
||||
_exit(1); \
|
||||
} \
|
||||
} while ( 0 )
|
||||
|
||||
#endif
|
||||
|
||||
|
@ -39,28 +38,28 @@ Flare::Flare()
|
|||
#else
|
||||
{
|
||||
WSADATA wsaData;
|
||||
if ( WSAStartup(MAKEWORD(2,2), &wsaData) != 0 )
|
||||
if ( WSAStartup(MAKEWORD(2, 2), &wsaData) != 0 )
|
||||
fatalError("WSAStartup failure: %d", WSAGetLastError());
|
||||
|
||||
recvfd = WSASocket(AF_INET, SOCK_DGRAM, IPPROTO_UDP, nullptr, 0,
|
||||
WSA_FLAG_OVERLAPPED | WSA_FLAG_NO_HANDLE_INHERIT);
|
||||
if ( recvfd == (int) INVALID_SOCKET )
|
||||
WSA_FLAG_OVERLAPPED | WSA_FLAG_NO_HANDLE_INHERIT);
|
||||
if ( recvfd == (int)INVALID_SOCKET )
|
||||
fatalError("WSASocket failure: %d", WSAGetLastError());
|
||||
sendfd = WSASocket(AF_INET, SOCK_DGRAM, IPPROTO_UDP, nullptr, 0,
|
||||
WSA_FLAG_OVERLAPPED | WSA_FLAG_NO_HANDLE_INHERIT);
|
||||
if ( sendfd == (int) INVALID_SOCKET )
|
||||
WSA_FLAG_OVERLAPPED | WSA_FLAG_NO_HANDLE_INHERIT);
|
||||
if ( sendfd == (int)INVALID_SOCKET )
|
||||
fatalError("WSASocket failure: %d", WSAGetLastError());
|
||||
|
||||
sockaddr_in sa;
|
||||
memset(&sa, 0, sizeof(sa));
|
||||
sa.sin_family = AF_INET;
|
||||
sa.sin_addr.s_addr = inet_addr("127.0.0.1");
|
||||
if ( bind(recvfd, (sockaddr*) &sa, sizeof(sa)) == SOCKET_ERROR )
|
||||
if ( bind(recvfd, (sockaddr*)&sa, sizeof(sa)) == SOCKET_ERROR )
|
||||
fatalError("bind failure: %d", WSAGetLastError());
|
||||
int salen = sizeof(sa);
|
||||
if ( getsockname(recvfd, (sockaddr*) &sa, &salen) == SOCKET_ERROR )
|
||||
if ( getsockname(recvfd, (sockaddr*)&sa, &salen) == SOCKET_ERROR )
|
||||
fatalError("getsockname failure: %d", WSAGetLastError());
|
||||
if ( connect(sendfd, (sockaddr*) &sa, sizeof(sa)) == SOCKET_ERROR )
|
||||
if ( connect(sendfd, (sockaddr*)&sa, sizeof(sa)) == SOCKET_ERROR )
|
||||
fatalError("connect failure: %d", WSAGetLastError());
|
||||
}
|
||||
#endif
|
||||
|
|
|
@ -26,9 +26,13 @@ public:
|
|||
*/
|
||||
int FD() const
|
||||
#if ! defined(_MSC_VER)
|
||||
{ return pipe.ReadFD(); }
|
||||
{
|
||||
return pipe.ReadFD();
|
||||
}
|
||||
#else
|
||||
{ return recvfd; }
|
||||
{
|
||||
return recvfd;
|
||||
}
|
||||
#endif
|
||||
|
||||
/**
|
||||
|
|
|
@ -372,7 +372,7 @@ protected:
|
|||
void Set(double d);
|
||||
void Set(const void* p);
|
||||
|
||||
union {
|
||||
union {
|
||||
bool b;
|
||||
int i;
|
||||
zeek_int_t bi;
|
||||
|
|
|
@ -546,7 +546,7 @@ void IPv6_Hdr_Chain::Init(const struct ip6_hdr* ip6, int total_len, bool set_nex
|
|||
total_len -= cur_len;
|
||||
|
||||
} while ( current_type != IPPROTO_FRAGMENT && current_type != IPPROTO_ESP &&
|
||||
current_type != IPPROTO_MOBILITY && isIPv6ExtHeader(next_type) );
|
||||
current_type != IPPROTO_MOBILITY && isIPv6ExtHeader(next_type) );
|
||||
}
|
||||
|
||||
bool IPv6_Hdr_Chain::IsFragment() const
|
||||
|
|
|
@ -3962,7 +3962,6 @@ ValManager::ValManager()
|
|||
|
||||
for ( auto i = 0u; i < PREALLOCATED_INTS; ++i )
|
||||
ints[i] = Val::MakeInt(PREALLOCATED_INT_LOWEST + i);
|
||||
|
||||
}
|
||||
|
||||
const PortValPtr& ValManager::Port(uint32_t port_num, TransportProto port_type)
|
||||
|
@ -3975,9 +3974,7 @@ const PortValPtr& ValManager::Port(uint32_t port_num, TransportProto port_type)
|
|||
|
||||
std::pair key{port_num, port_type};
|
||||
if ( ports.find(key) == ports.end() )
|
||||
{
|
||||
ports[key] = IntrusivePtr{AdoptRef{}, new PortVal(PortVal::Mask(port_num, port_type))};
|
||||
}
|
||||
|
||||
return ports[key];
|
||||
}
|
||||
|
|
|
@ -63,7 +63,7 @@ string SQLite::GetTableType(int arg_type, int arg_subtype)
|
|||
case TYPE_INT:
|
||||
case TYPE_COUNT:
|
||||
case TYPE_PORT: // note that we do not save the protocol at the moment. Just like in the
|
||||
// case of the ascii-writer
|
||||
// case of the ascii-writer
|
||||
type = "integer";
|
||||
break;
|
||||
|
||||
|
|
|
@ -64,7 +64,7 @@ struct ip6_ext
|
|||
|
||||
struct ip6_hdr
|
||||
{
|
||||
union {
|
||||
union {
|
||||
struct ip6_hdrctl
|
||||
{
|
||||
uint32_t ip6_un1_flow; /* 4 bits version, 8 bits TC, 20 bits
|
||||
|
@ -335,7 +335,7 @@ inline float htonf(float f)
|
|||
inline uint64_t ntohll(uint64_t i)
|
||||
{
|
||||
u_char c;
|
||||
union {
|
||||
union {
|
||||
uint64_t i;
|
||||
u_char c[8];
|
||||
} x;
|
||||
|
|
|
@ -94,7 +94,7 @@ bool ARPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|||
auto ah = (const struct arp_pkthdr*)data;
|
||||
|
||||
// Check the size.
|
||||
size_t min_length = (ar_tpa(ah) - (caddr_t) data) + ah->ar_pln;
|
||||
size_t min_length = (ar_tpa(ah) - (caddr_t)data) + ah->ar_pln;
|
||||
if ( min_length > len )
|
||||
{
|
||||
Weird("truncated_ARP", packet);
|
||||
|
|
|
@ -62,7 +62,8 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|||
return false;
|
||||
}
|
||||
|
||||
ip_hdr = std::make_shared<IP_Hdr>((const struct ip6_hdr*)data, false, static_cast<int>(len));
|
||||
packet->ip_hdr = std::make_shared<IP_Hdr>((const struct ip6_hdr*)data, false,
|
||||
static_cast<int>(len));
|
||||
packet->l3_proto = L3_IPV6;
|
||||
}
|
||||
else
|
||||
|
|
|
@ -3,7 +3,7 @@
|
|||
#include "zeek/plugin/Manager.h"
|
||||
|
||||
#include <dirent.h>
|
||||
#if !defined(_MSC_VER)
|
||||
#if ! defined(_MSC_VER)
|
||||
#include <dlfcn.h>
|
||||
#include <glob.h>
|
||||
#endif
|
||||
|
@ -355,7 +355,7 @@ void Manager::ActivateDynamicPlugins(bool all)
|
|||
for ( const auto& x : requested_plugins )
|
||||
{
|
||||
if ( ! x.empty() )
|
||||
plugins_to_activate.emplace(x, false);
|
||||
plugins_to_activate.emplace(x, false);
|
||||
}
|
||||
|
||||
// Activate plugins that our environment tells us to.
|
||||
|
|
|
@ -661,7 +661,7 @@ public:
|
|||
|
||||
private:
|
||||
Type type;
|
||||
union {
|
||||
union {
|
||||
bool bool_;
|
||||
double double_;
|
||||
const Event* event;
|
||||
|
|
|
@ -1,54 +1,57 @@
|
|||
|
||||
#include <mutex>
|
||||
|
||||
#include "Plugin.h"
|
||||
|
||||
#include "zeek/Func.h"
|
||||
#include "zeek/Event.h"
|
||||
#include <mutex>
|
||||
|
||||
#include "zeek/Conn.h"
|
||||
#include "zeek/Desc.h"
|
||||
#include "zeek/threading/Formatter.h"
|
||||
#include "zeek/Event.h"
|
||||
#include "zeek/Func.h"
|
||||
#include "zeek/RunState.h"
|
||||
#include "zeek/threading/Formatter.h"
|
||||
|
||||
#include "statistics.bif.h"
|
||||
|
||||
namespace zeek::plugin::statistics { Plugin plugin; }
|
||||
namespace zeek::plugin::statistics
|
||||
{
|
||||
Plugin plugin;
|
||||
}
|
||||
|
||||
using namespace zeek::plugin::statistics;
|
||||
|
||||
zeek::plugin::Configuration Plugin::Configure()
|
||||
{
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Statistics";
|
||||
config.description = "Statistics module";
|
||||
config.version.major = 1;
|
||||
config.version.minor = 0;
|
||||
config.version.patch = 0;
|
||||
return config;
|
||||
}
|
||||
{
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Statistics";
|
||||
config.description = "Statistics module";
|
||||
config.version.major = 1;
|
||||
config.version.minor = 0;
|
||||
config.version.patch = 0;
|
||||
return config;
|
||||
}
|
||||
|
||||
bool Plugin::HookQueueEvent(zeek::Event* event)
|
||||
{
|
||||
const char* name = event->Handler()->Name();
|
||||
{
|
||||
const char* name = event->Handler()->Name();
|
||||
|
||||
std::lock_guard<std::mutex> scopedLock(m_lock);
|
||||
if (m_eventNameCounters.find(name) == m_eventNameCounters.end())
|
||||
{
|
||||
m_eventNameCounters[name] = 0;
|
||||
}
|
||||
m_eventNameCounters[name]++;
|
||||
return false;
|
||||
}
|
||||
std::lock_guard<std::mutex> scopedLock(m_lock);
|
||||
if ( m_eventNameCounters.find(name) == m_eventNameCounters.end() )
|
||||
{
|
||||
m_eventNameCounters[name] = 0;
|
||||
}
|
||||
m_eventNameCounters[name]++;
|
||||
return false;
|
||||
}
|
||||
|
||||
std::unordered_map<const char*, int> Plugin::GetAndResetEventStatistics()
|
||||
{
|
||||
std::lock_guard<std::mutex> scopedLock(m_lock);
|
||||
std::unordered_map<const char*, int> result(m_eventNameCounters);
|
||||
m_eventNameCounters.clear();
|
||||
return result;
|
||||
}
|
||||
{
|
||||
std::lock_guard<std::mutex> scopedLock(m_lock);
|
||||
std::unordered_map<const char*, int> result(m_eventNameCounters);
|
||||
m_eventNameCounters.clear();
|
||||
return result;
|
||||
}
|
||||
|
||||
void Plugin::StartEventNamesStatisticsMonitor()
|
||||
{
|
||||
EnableHook(zeek::plugin::HOOK_QUEUE_EVENT);
|
||||
}
|
||||
{
|
||||
EnableHook(zeek::plugin::HOOK_QUEUE_EVENT);
|
||||
}
|
||||
|
|
|
@ -1,15 +1,17 @@
|
|||
|
||||
#pragma once
|
||||
|
||||
#include <unordered_map>
|
||||
#include <mutex>
|
||||
#include <string>
|
||||
#include <unordered_map>
|
||||
|
||||
#include "zeek/plugin/Plugin.h"
|
||||
|
||||
namespace zeek::plugin::statistics {
|
||||
namespace zeek::plugin::statistics
|
||||
{
|
||||
|
||||
class Plugin : public zeek::plugin::Plugin
|
||||
{
|
||||
{
|
||||
protected:
|
||||
bool HookQueueEvent(zeek::Event* event) override;
|
||||
|
||||
|
@ -18,12 +20,11 @@ protected:
|
|||
public:
|
||||
std::unordered_map<const char*, int> GetAndResetEventStatistics();
|
||||
void StartEventNamesStatisticsMonitor();
|
||||
|
||||
|
||||
private:
|
||||
std::unordered_map<const char*, int> m_eventNameCounters;
|
||||
std::mutex m_lock;
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
extern Plugin plugin;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -995,12 +995,14 @@ std::optional<SupervisedNode> Stem::Poll()
|
|||
node_pollfd_indices[name] = pfd_idx;
|
||||
|
||||
if ( node.stdout_pipe.pipe )
|
||||
pfds[pfd_idx++] = {static_cast<decltype(pollfd::fd)>(node.stdout_pipe.pipe->ReadFD()), POLLIN, 0};
|
||||
pfds[pfd_idx++] = {static_cast<decltype(pollfd::fd)>(node.stdout_pipe.pipe->ReadFD()),
|
||||
POLLIN, 0};
|
||||
else
|
||||
pfds[pfd_idx++] = {static_cast<decltype(pollfd::fd)>(-1), POLLIN, 0};
|
||||
|
||||
if ( node.stderr_pipe.pipe )
|
||||
pfds[pfd_idx++] = {static_cast<decltype(pollfd::fd)>(node.stderr_pipe.pipe->ReadFD()), POLLIN, 0};
|
||||
pfds[pfd_idx++] = {static_cast<decltype(pollfd::fd)>(node.stderr_pipe.pipe->ReadFD()),
|
||||
POLLIN, 0};
|
||||
else
|
||||
pfds[pfd_idx++] = {static_cast<decltype(pollfd::fd)>(-1), POLLIN, 0};
|
||||
}
|
||||
|
|
|
@ -49,8 +49,9 @@ void BasicThread::SetName(const char* arg_name)
|
|||
void BasicThread::SetOSName(const char* arg_name)
|
||||
{
|
||||
// Do it only if libc++ supports pthread_t.
|
||||
if constexpr(std::is_same<std::thread::native_handle_type, pthread_t>::value)
|
||||
zeek::util::detail::set_thread_name(arg_name, reinterpret_cast<pthread_t>(thread.native_handle()));
|
||||
if constexpr ( std::is_same<std::thread::native_handle_type, pthread_t>::value )
|
||||
zeek::util::detail::set_thread_name(arg_name,
|
||||
reinterpret_cast<pthread_t>(thread.native_handle()));
|
||||
}
|
||||
|
||||
const char* BasicThread::Fmt(const char* format, ...)
|
||||
|
|
61
src/util.cc
61
src/util.cc
|
@ -40,9 +40,9 @@
|
|||
#include <algorithm>
|
||||
#include <array>
|
||||
#include <iostream>
|
||||
#include <random>
|
||||
#include <string>
|
||||
#include <vector>
|
||||
#include <random>
|
||||
|
||||
#include "zeek/3rdparty/ConvertUTF.h"
|
||||
#include "zeek/3rdparty/doctest.h"
|
||||
|
@ -662,15 +662,16 @@ TEST_CASE("util normalize_path")
|
|||
string normalize_path(std::string_view path)
|
||||
{
|
||||
#ifdef _MSC_VER
|
||||
if (0 == path.compare(zeek::detail::ScannedFile::canonical_stdin_path)) {
|
||||
if ( 0 == path.compare(zeek::detail::ScannedFile::canonical_stdin_path) )
|
||||
{
|
||||
return string(path);
|
||||
}
|
||||
}
|
||||
// "//" interferes with std::weakly_canonical
|
||||
string stringPath = string(path);
|
||||
if (stringPath._Starts_with("//"))
|
||||
{
|
||||
if ( stringPath._Starts_with("//") )
|
||||
{
|
||||
stringPath.erase(0, 2);
|
||||
}
|
||||
}
|
||||
return zeek::filesystem::path(stringPath).lexically_normal().string();
|
||||
#else
|
||||
if ( path.find("/.") == std::string_view::npos && path.find("//") == std::string_view::npos )
|
||||
|
@ -1805,37 +1806,35 @@ FILE* open_file(const string& path, const string& mode)
|
|||
return rval;
|
||||
}
|
||||
|
||||
TEST_CASE("util path ops")
|
||||
{
|
||||
TEST_CASE("util path ops"){
|
||||
#ifdef _MSC_VER
|
||||
// TODO: adapt these tests to Windows paths
|
||||
// TODO: adapt these tests to Windows paths
|
||||
#else
|
||||
SUBCASE("SafeDirname")
|
||||
{
|
||||
SafeDirname d("/this/is/a/path", false);
|
||||
CHECK(d.result == "/this/is/a");
|
||||
SUBCASE("SafeDirname"){SafeDirname d("/this/is/a/path", false);
|
||||
CHECK(d.result == "/this/is/a");
|
||||
|
||||
SafeDirname d2("invalid", false);
|
||||
CHECK(d2.result == ".");
|
||||
SafeDirname d2("invalid", false);
|
||||
CHECK(d2.result == ".");
|
||||
|
||||
SafeDirname d3("./filename", false);
|
||||
CHECK(d2.result == ".");
|
||||
}
|
||||
|
||||
SUBCASE("SafeBasename")
|
||||
{
|
||||
SafeBasename b("/this/is/a/path", false);
|
||||
CHECK(b.result == "path");
|
||||
CHECK(! b.error);
|
||||
|
||||
SafeBasename b2("justafile", false);
|
||||
CHECK(b2.result == "justafile");
|
||||
CHECK(! b2.error);
|
||||
}
|
||||
#endif
|
||||
SafeDirname d3("./filename", false);
|
||||
CHECK(d2.result == ".");
|
||||
}
|
||||
|
||||
SafeDirname::SafeDirname(const char* path, bool error_aborts) : SafePathOp()
|
||||
SUBCASE("SafeBasename")
|
||||
{
|
||||
SafeBasename b("/this/is/a/path", false);
|
||||
CHECK(b.result == "path");
|
||||
CHECK(! b.error);
|
||||
|
||||
SafeBasename b2("justafile", false);
|
||||
CHECK(b2.result == "justafile");
|
||||
CHECK(! b2.error);
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
SafeDirname::SafeDirname(const char* path, bool error_aborts)
|
||||
: SafePathOp()
|
||||
{
|
||||
DoFunc(path ? path : "", error_aborts);
|
||||
}
|
||||
|
|
11
src/util.h
11
src/util.h
|
@ -16,7 +16,6 @@
|
|||
|
||||
#include <libgen.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <array>
|
||||
#include <cinttypes>
|
||||
#include <cstdarg>
|
||||
|
@ -82,13 +81,19 @@ extern "C"
|
|||
#ifdef _MSC_VER
|
||||
#include <pthread.h>
|
||||
#include <filesystem>
|
||||
namespace zeek { namespace filesystem = std::filesystem; }
|
||||
namespace zeek
|
||||
{
|
||||
namespace filesystem = std::filesystem;
|
||||
}
|
||||
inline constexpr std::string_view path_list_separator = ";";
|
||||
#else
|
||||
// Expose ghc::filesystem as zeek::filesystem until we can
|
||||
// switch to std::filesystem on all platforms.
|
||||
#include "zeek/3rdparty/ghc/filesystem.hpp"
|
||||
namespace zeek { namespace filesystem = ghc::filesystem; }
|
||||
namespace zeek
|
||||
{
|
||||
namespace filesystem = ghc::filesystem;
|
||||
}
|
||||
inline constexpr std::string_view path_list_separator = ":";
|
||||
#endif
|
||||
|
||||
|
|
|
@ -1,7 +1,5 @@
|
|||
// See the file "COPYING" in the main distribution directory for copyright.
|
||||
|
||||
#include <unistd.h>
|
||||
|
||||
#include "zeek/zeek-setup.h"
|
||||
|
||||
#include "zeek/zeek-config.h"
|
||||
|
@ -10,6 +8,7 @@
|
|||
#include <openssl/opensslv.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
#include <csignal>
|
||||
#include <cstdio>
|
||||
#include <cstdlib>
|
||||
|
@ -888,229 +887,228 @@ SetupResult setup(int argc, char** argv, Options* zopts)
|
|||
#ifdef USE_PERFTOOLS_DEBUG
|
||||
}
|
||||
#endif
|
||||
set_signal_mask(false);
|
||||
set_signal_mask(false);
|
||||
|
||||
if ( reporter->Errors() > 0 )
|
||||
if ( reporter->Errors() > 0 )
|
||||
{
|
||||
early_shutdown();
|
||||
exit(1);
|
||||
}
|
||||
|
||||
reporter->InitOptions();
|
||||
KeyedHash::InitOptions();
|
||||
zeekygen_mgr->GenerateDocs();
|
||||
|
||||
if ( options.pcap_filter )
|
||||
{
|
||||
const auto& id = global_scope()->Find("cmd_line_bpf_filter");
|
||||
|
||||
if ( ! id )
|
||||
reporter->InternalError("global cmd_line_bpf_filter not defined");
|
||||
|
||||
id->SetVal(make_intrusive<StringVal>(*options.pcap_filter));
|
||||
}
|
||||
|
||||
std::vector<SignatureFile> all_signature_files;
|
||||
|
||||
// Append signature files given on the command line
|
||||
for ( const auto& sf : options.signature_files )
|
||||
all_signature_files.emplace_back(sf);
|
||||
|
||||
// Append signature files defined in "signature_files" script option
|
||||
for ( auto&& sf : get_script_signature_files() )
|
||||
all_signature_files.emplace_back(std::move(sf));
|
||||
|
||||
// Append signature files defined in @load-sigs
|
||||
for ( const auto& sf : zeek::detail::sig_files )
|
||||
all_signature_files.emplace_back(sf);
|
||||
|
||||
if ( ! all_signature_files.empty() )
|
||||
{
|
||||
rule_matcher = new RuleMatcher(options.signature_re_level);
|
||||
if ( ! rule_matcher->ReadFiles(all_signature_files) )
|
||||
{
|
||||
early_shutdown();
|
||||
exit(1);
|
||||
}
|
||||
|
||||
reporter->InitOptions();
|
||||
KeyedHash::InitOptions();
|
||||
zeekygen_mgr->GenerateDocs();
|
||||
if ( options.print_signature_debug_info )
|
||||
rule_matcher->PrintDebug();
|
||||
|
||||
if ( options.pcap_filter )
|
||||
file_mgr->InitMagic();
|
||||
}
|
||||
|
||||
if ( g_policy_debug )
|
||||
// ### Add support for debug command file.
|
||||
dbg_init_debugger(nullptr);
|
||||
|
||||
if ( ! options.pcap_file && ! options.interface )
|
||||
{
|
||||
const auto& interfaces_val = id::find_val("interfaces");
|
||||
if ( interfaces_val )
|
||||
{
|
||||
const auto& id = global_scope()->Find("cmd_line_bpf_filter");
|
||||
char* interfaces_str = interfaces_val->AsString()->Render();
|
||||
|
||||
if ( ! id )
|
||||
reporter->InternalError("global cmd_line_bpf_filter not defined");
|
||||
if ( interfaces_str[0] != '\0' )
|
||||
options.interface = interfaces_str;
|
||||
|
||||
id->SetVal(make_intrusive<StringVal>(*options.pcap_filter));
|
||||
delete[] interfaces_str;
|
||||
}
|
||||
}
|
||||
|
||||
std::vector<SignatureFile> all_signature_files;
|
||||
if ( options.parse_only )
|
||||
{
|
||||
if ( analysis_options.usage_issues > 0 )
|
||||
analyze_scripts(options.no_unused_warnings);
|
||||
|
||||
// Append signature files given on the command line
|
||||
for ( const auto& sf : options.signature_files )
|
||||
all_signature_files.emplace_back(sf);
|
||||
early_shutdown();
|
||||
exit(reporter->Errors() != 0);
|
||||
}
|
||||
|
||||
// Append signature files defined in "signature_files" script option
|
||||
for ( auto&& sf : get_script_signature_files() )
|
||||
all_signature_files.emplace_back(std::move(sf));
|
||||
auto init_stmts = stmts ? analyze_global_stmts(stmts) : nullptr;
|
||||
|
||||
// Append signature files defined in @load-sigs
|
||||
for ( const auto& sf : zeek::detail::sig_files )
|
||||
all_signature_files.emplace_back(sf);
|
||||
analyze_scripts(options.no_unused_warnings);
|
||||
|
||||
if ( ! all_signature_files.empty() )
|
||||
{
|
||||
rule_matcher = new RuleMatcher(options.signature_re_level);
|
||||
if ( ! rule_matcher->ReadFiles(all_signature_files) )
|
||||
{
|
||||
early_shutdown();
|
||||
exit(1);
|
||||
}
|
||||
if ( analysis_options.report_recursive )
|
||||
{
|
||||
// This option is report-and-exit.
|
||||
early_shutdown();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
if ( options.print_signature_debug_info )
|
||||
rule_matcher->PrintDebug();
|
||||
if ( dns_type != DNS_PRIME )
|
||||
run_state::detail::init_run(options.interface, options.pcap_file, options.pcap_output_file,
|
||||
options.use_watchdog);
|
||||
|
||||
file_mgr->InitMagic();
|
||||
}
|
||||
if ( ! g_policy_debug )
|
||||
{
|
||||
(void)setsignal(SIGTERM, sig_handler);
|
||||
(void)setsignal(SIGINT, sig_handler);
|
||||
(void)setsignal(SIGPIPE, SIG_IGN);
|
||||
}
|
||||
|
||||
if ( g_policy_debug )
|
||||
// ### Add support for debug command file.
|
||||
dbg_init_debugger(nullptr);
|
||||
// Cooperate with nohup(1).
|
||||
if ( (oldhandler = setsignal(SIGHUP, sig_handler)) != SIG_DFL )
|
||||
(void)setsignal(SIGHUP, oldhandler);
|
||||
|
||||
if ( ! options.pcap_file && ! options.interface )
|
||||
{
|
||||
const auto& interfaces_val = id::find_val("interfaces");
|
||||
if ( interfaces_val )
|
||||
{
|
||||
char* interfaces_str = interfaces_val->AsString()->Render();
|
||||
// If we were priming the DNS cache (i.e. -P was passed as an argument), flush anything
|
||||
// remaining to be resolved and save the cache to disk. We can just exit now because
|
||||
// we've done everything we need to do. The run loop isn't started in this case, so
|
||||
// nothing else should be happening.
|
||||
if ( dns_type == DNS_PRIME )
|
||||
{
|
||||
dns_mgr->Resolve();
|
||||
|
||||
if ( interfaces_str[0] != '\0' )
|
||||
options.interface = interfaces_str;
|
||||
if ( ! dns_mgr->Save() )
|
||||
reporter->FatalError("can't update DNS cache");
|
||||
|
||||
delete[] interfaces_str;
|
||||
}
|
||||
}
|
||||
|
||||
if ( options.parse_only )
|
||||
{
|
||||
if ( analysis_options.usage_issues > 0 )
|
||||
analyze_scripts(options.no_unused_warnings);
|
||||
|
||||
early_shutdown();
|
||||
exit(reporter->Errors() != 0);
|
||||
}
|
||||
|
||||
auto init_stmts = stmts ? analyze_global_stmts(stmts) : nullptr;
|
||||
|
||||
analyze_scripts(options.no_unused_warnings);
|
||||
|
||||
if ( analysis_options.report_recursive )
|
||||
{
|
||||
// This option is report-and-exit.
|
||||
early_shutdown();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
if ( dns_type != DNS_PRIME )
|
||||
run_state::detail::init_run(options.interface, options.pcap_file,
|
||||
options.pcap_output_file, options.use_watchdog);
|
||||
|
||||
if ( ! g_policy_debug )
|
||||
{
|
||||
(void)setsignal(SIGTERM, sig_handler);
|
||||
(void)setsignal(SIGINT, sig_handler);
|
||||
(void)setsignal(SIGPIPE, SIG_IGN);
|
||||
}
|
||||
|
||||
// Cooperate with nohup(1).
|
||||
if ( (oldhandler = setsignal(SIGHUP, sig_handler)) != SIG_DFL )
|
||||
(void)setsignal(SIGHUP, oldhandler);
|
||||
|
||||
// If we were priming the DNS cache (i.e. -P was passed as an argument), flush anything
|
||||
// remaining to be resolved and save the cache to disk. We can just exit now because
|
||||
// we've done everything we need to do. The run loop isn't started in this case, so
|
||||
// nothing else should be happening.
|
||||
if ( dns_type == DNS_PRIME )
|
||||
{
|
||||
dns_mgr->Resolve();
|
||||
|
||||
if ( ! dns_mgr->Save() )
|
||||
reporter->FatalError("can't update DNS cache");
|
||||
|
||||
event_mgr.Drain();
|
||||
early_shutdown();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
// Print the ID.
|
||||
if ( options.identifier_to_print )
|
||||
{
|
||||
const auto& id = global_scope()->Find(*options.identifier_to_print);
|
||||
if ( ! id )
|
||||
reporter->FatalError("No such ID: %s\n", options.identifier_to_print->data());
|
||||
|
||||
ODesc desc;
|
||||
desc.SetQuotes(true);
|
||||
desc.SetIncludeStats(true);
|
||||
id->DescribeExtended(&desc);
|
||||
|
||||
fprintf(stdout, "%s\n", desc.Description());
|
||||
early_shutdown();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
if ( profiling_interval > 0 )
|
||||
{
|
||||
const auto& profiling_file = id::find_val("profiling_file");
|
||||
profiling_logger = std::make_shared<ProfileLogger>(profiling_file->AsFile(),
|
||||
profiling_interval);
|
||||
|
||||
if ( segment_profiling )
|
||||
segment_logger = profiling_logger;
|
||||
}
|
||||
|
||||
if ( ! run_state::reading_live && ! run_state::reading_traces )
|
||||
// Set up network_time to track real-time, since
|
||||
// we don't have any other source for it.
|
||||
run_state::detail::update_network_time(util::current_time());
|
||||
|
||||
if ( CPP_activation_hook )
|
||||
(*CPP_activation_hook)();
|
||||
|
||||
if ( zeek_init )
|
||||
event_mgr.Enqueue(zeek_init, Args{});
|
||||
|
||||
EventRegistry::string_list dead_handlers = event_registry->UnusedHandlers();
|
||||
|
||||
if ( ! dead_handlers.empty() && check_for_unused_event_handlers )
|
||||
{
|
||||
for ( const string& handler : dead_handlers )
|
||||
reporter->Warning("event handler never invoked: %s", handler.c_str());
|
||||
}
|
||||
|
||||
// Enable LeakSanitizer before zeek_init() and even before executing
|
||||
// top-level statements. Even though it's not bad if a leak happens only
|
||||
// once at initialization, we have to assume that script-layer code causing
|
||||
// such a leak can be placed in any arbitrary event handler and potentially
|
||||
// cause more severe problems.
|
||||
ZEEK_LSAN_ENABLE();
|
||||
|
||||
if ( init_stmts )
|
||||
{
|
||||
StmtFlowType flow;
|
||||
Frame f(init_stmts->Scope()->Length(), nullptr, nullptr);
|
||||
g_frame_stack.push_back(&f);
|
||||
|
||||
try
|
||||
{
|
||||
init_stmts->Body()->Exec(&f, flow);
|
||||
}
|
||||
catch ( InterpreterException& )
|
||||
{
|
||||
reporter->FatalError("failed to execute script statements at top-level scope");
|
||||
}
|
||||
|
||||
g_frame_stack.pop_back();
|
||||
}
|
||||
|
||||
if ( options.ignore_checksums )
|
||||
ignore_checksums = 1;
|
||||
|
||||
if ( zeek_script_loaded )
|
||||
{
|
||||
// Queue events reporting loaded scripts.
|
||||
for ( const auto& file : zeek::detail::files_scanned )
|
||||
{
|
||||
if ( file.skipped )
|
||||
continue;
|
||||
|
||||
event_mgr.Enqueue(zeek_script_loaded, make_intrusive<StringVal>(file.name.c_str()),
|
||||
val_mgr->Count(file.include_level));
|
||||
}
|
||||
}
|
||||
|
||||
reporter->ReportViaEvents(true);
|
||||
|
||||
// Drain the event queue here to support the protocols framework configuring DPM
|
||||
event_mgr.Drain();
|
||||
early_shutdown();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
if ( reporter->Errors() > 0 && ! getenv("ZEEK_ALLOW_INIT_ERRORS") )
|
||||
reporter->FatalError("errors occurred while initializing");
|
||||
// Print the ID.
|
||||
if ( options.identifier_to_print )
|
||||
{
|
||||
const auto& id = global_scope()->Find(*options.identifier_to_print);
|
||||
if ( ! id )
|
||||
reporter->FatalError("No such ID: %s\n", options.identifier_to_print->data());
|
||||
|
||||
run_state::detail::zeek_init_done = true;
|
||||
packet_mgr->DumpDebug();
|
||||
analyzer_mgr->DumpDebug();
|
||||
ODesc desc;
|
||||
desc.SetQuotes(true);
|
||||
desc.SetIncludeStats(true);
|
||||
id->DescribeExtended(&desc);
|
||||
|
||||
run_state::detail::have_pending_timers = ! run_state::reading_traces &&
|
||||
timer_mgr->Size() > 0;
|
||||
fprintf(stdout, "%s\n", desc.Description());
|
||||
early_shutdown();
|
||||
exit(0);
|
||||
}
|
||||
|
||||
return {0, std::move(options)};
|
||||
if ( profiling_interval > 0 )
|
||||
{
|
||||
const auto& profiling_file = id::find_val("profiling_file");
|
||||
profiling_logger = std::make_shared<ProfileLogger>(profiling_file->AsFile(),
|
||||
profiling_interval);
|
||||
|
||||
if ( segment_profiling )
|
||||
segment_logger = profiling_logger;
|
||||
}
|
||||
|
||||
if ( ! run_state::reading_live && ! run_state::reading_traces )
|
||||
// Set up network_time to track real-time, since
|
||||
// we don't have any other source for it.
|
||||
run_state::detail::update_network_time(util::current_time());
|
||||
|
||||
if ( CPP_activation_hook )
|
||||
(*CPP_activation_hook)();
|
||||
|
||||
if ( zeek_init )
|
||||
event_mgr.Enqueue(zeek_init, Args{});
|
||||
|
||||
EventRegistry::string_list dead_handlers = event_registry->UnusedHandlers();
|
||||
|
||||
if ( ! dead_handlers.empty() && check_for_unused_event_handlers )
|
||||
{
|
||||
for ( const string& handler : dead_handlers )
|
||||
reporter->Warning("event handler never invoked: %s", handler.c_str());
|
||||
}
|
||||
|
||||
// Enable LeakSanitizer before zeek_init() and even before executing
|
||||
// top-level statements. Even though it's not bad if a leak happens only
|
||||
// once at initialization, we have to assume that script-layer code causing
|
||||
// such a leak can be placed in any arbitrary event handler and potentially
|
||||
// cause more severe problems.
|
||||
ZEEK_LSAN_ENABLE();
|
||||
|
||||
if ( init_stmts )
|
||||
{
|
||||
StmtFlowType flow;
|
||||
Frame f(init_stmts->Scope()->Length(), nullptr, nullptr);
|
||||
g_frame_stack.push_back(&f);
|
||||
|
||||
try
|
||||
{
|
||||
init_stmts->Body()->Exec(&f, flow);
|
||||
}
|
||||
catch ( InterpreterException& )
|
||||
{
|
||||
reporter->FatalError("failed to execute script statements at top-level scope");
|
||||
}
|
||||
|
||||
g_frame_stack.pop_back();
|
||||
}
|
||||
|
||||
if ( options.ignore_checksums )
|
||||
ignore_checksums = 1;
|
||||
|
||||
if ( zeek_script_loaded )
|
||||
{
|
||||
// Queue events reporting loaded scripts.
|
||||
for ( const auto& file : zeek::detail::files_scanned )
|
||||
{
|
||||
if ( file.skipped )
|
||||
continue;
|
||||
|
||||
event_mgr.Enqueue(zeek_script_loaded, make_intrusive<StringVal>(file.name.c_str()),
|
||||
val_mgr->Count(file.include_level));
|
||||
}
|
||||
}
|
||||
|
||||
reporter->ReportViaEvents(true);
|
||||
|
||||
// Drain the event queue here to support the protocols framework configuring DPM
|
||||
event_mgr.Drain();
|
||||
|
||||
if ( reporter->Errors() > 0 && ! getenv("ZEEK_ALLOW_INIT_ERRORS") )
|
||||
reporter->FatalError("errors occurred while initializing");
|
||||
|
||||
run_state::detail::zeek_init_done = true;
|
||||
packet_mgr->DumpDebug();
|
||||
analyzer_mgr->DumpDebug();
|
||||
|
||||
run_state::detail::have_pending_timers = ! run_state::reading_traces && timer_mgr->Size() > 0;
|
||||
|
||||
return {0, std::move(options)};
|
||||
}
|
||||
|
||||
int cleanup(bool did_run_loop)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue