Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Deprecate Analyzer::ConnectionEvent()

Browse source 
And update usages to Analyzer::EnqueueConnEvent()
This commit is contained in:
Jon Siwek 2020-03-25 18:36:58 -07:00
parent e394ea38bc
commit 5e496e43b7
34 changed files with 954 additions and 1043 deletions
Download patch file Download diff file Expand all files Collapse all files

508
src/analyzer/protocol/irc/IRC.cc
View file

@ -233,13 +233,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
// else ###
}
ConnectionEventFast(irc_network_info, {
BuildConnVal(),
val_mgr->GetBool(orig),
val_mgr->GetInt(users),
val_mgr->GetInt(services),
val_mgr->GetInt(servers),
});
EnqueueConnEvent(irc_network_info,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)},
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)},
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)}
);
}
break;
@ -270,24 +270,23 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts.size() > 0 && parts[0][0] == ':' )
parts[0] = parts[0].substr(1);
TableVal* set = new TableVal({NewRef{}, string_set});
auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
for ( unsigned int i = 0; i < parts.size(); ++i )
{
if ( parts[i][0] == '@' )
parts[i] = parts[i].substr(1);
Val* idx = new StringVal(parts[i].c_str());
set->Assign(idx, 0);
Unref(idx);
auto idx = make_intrusive<StringVal>(parts[i].c_str());
set->Assign(idx.get(), 0);
}
ConnectionEventFast(irc_names_info, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(type.c_str()),
new StringVal(channel.c_str()),
set,
});
EnqueueConnEvent(irc_names_info,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(type.c_str()),
make_intrusive<StringVal>(channel.c_str()),
std::move(set)
);
}
break;
@ -315,13 +314,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
// else ###
}
ConnectionEventFast(irc_server_info, {
BuildConnVal(),
val_mgr->GetBool(orig),
val_mgr->GetInt(users),
val_mgr->GetInt(services),
val_mgr->GetInt(servers),
});
EnqueueConnEvent(irc_server_info,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)},
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)},
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)}
);
}
break;
@ -337,11 +336,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts[i] == ":channels" )
channels = atoi(parts[i - 1].c_str());
ConnectionEventFast(irc_channel_info, {
BuildConnVal(),
val_mgr->GetBool(orig),
val_mgr->GetInt(channels),
});
EnqueueConnEvent(irc_channel_info,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(channels)}
);
}
break;
@ -369,12 +368,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
break;
}
ConnectionEventFast(irc_global_users, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(eop - prefix, prefix),
new StringVal(++msg),
});
EnqueueConnEvent(irc_global_users,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(eop - prefix, prefix),
make_intrusive<StringVal>(++msg)
);
break;
}
@ -394,12 +393,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
return;
}
val_list vl(6);
vl.push_back(BuildConnVal());
vl.push_back(val_mgr->GetBool(orig));
vl.push_back(new StringVal(parts[0].c_str()));
vl.push_back(new StringVal(parts[1].c_str()));
vl.push_back(new StringVal(parts[2].c_str()));
zeek::Args vl;
vl.reserve(6);
vl.emplace_back(AdoptRef{}, BuildConnVal());
vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig));
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
parts.erase(parts.begin(), parts.begin() + 4);
@ -410,9 +410,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( real_name[0] == ':' )
real_name = real_name.substr(1);
vl.push_back(new StringVal(real_name.c_str()));
vl.emplace_back(make_intrusive<StringVal>(real_name.c_str()));
ConnectionEventFast(irc_whois_user_line, std::move(vl));
EnqueueConnEvent(irc_whois_user_line, std::move(vl));
}
break;
@ -433,11 +433,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
return;
}
ConnectionEventFast(irc_whois_operator_line, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(parts[0].c_str()),
});
EnqueueConnEvent(irc_whois_operator_line,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(parts[0].c_str())
);
}
break;
@ -463,21 +463,20 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts.size() > 0 && parts[0][0] == ':' )
parts[0] = parts[0].substr(1);
TableVal* set = new TableVal({NewRef{}, string_set});
auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
for ( unsigned int i = 0; i < parts.size(); ++i )
{
Val* idx = new StringVal(parts[i].c_str());
set->Assign(idx, 0);
Unref(idx);
auto idx = make_intrusive<StringVal>(parts[i].c_str());
set->Assign(idx.get(), 0);
}
ConnectionEventFast(irc_whois_channel_line, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(nick.c_str()),
set,
});
EnqueueConnEvent(irc_whois_channel_line,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(nick.c_str()),
std::move(set)
);
}
break;
@ -503,12 +502,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( *t == ':' )
++t;
ConnectionEventFast(irc_channel_topic, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(parts[1].c_str()),
new StringVal(t),
});
EnqueueConnEvent(irc_channel_topic,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(parts[1].c_str()),
make_intrusive<StringVal>(t)
);
}
else
{
@ -537,19 +536,19 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts[7][0] == ':' )
parts[7] = parts[7].substr(1);
ConnectionEventFast(irc_who_line, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(parts[0].c_str()),
new StringVal(parts[1].c_str()),
new StringVal(parts[2].c_str()),
new StringVal(parts[3].c_str()),
new StringVal(parts[4].c_str()),
new StringVal(parts[5].c_str()),
new StringVal(parts[6].c_str()),
val_mgr->GetInt(atoi(parts[7].c_str())),
new StringVal(parts[8].c_str()),
});
EnqueueConnEvent(irc_who_line,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(parts[0].c_str()),
make_intrusive<StringVal>(parts[1].c_str()),
make_intrusive<StringVal>(parts[2].c_str()),
make_intrusive<StringVal>(parts[3].c_str()),
make_intrusive<StringVal>(parts[4].c_str()),
make_intrusive<StringVal>(parts[5].c_str()),
make_intrusive<StringVal>(parts[6].c_str()),
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(atoi(parts[7].c_str()))},
make_intrusive<StringVal>(parts[8].c_str())
);
}
break;
@ -559,25 +558,21 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
case 433:
case 436:
if ( irc_invalid_nick )
{
ConnectionEventFast(irc_invalid_nick, {
BuildConnVal(),
val_mgr->GetBool(orig),
});
}
EnqueueConnEvent(irc_invalid_nick,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}
);
break;
// Operator responses.
case 381: // User is operator
case 491: // user is not operator
if ( irc_oper_response )
{
ConnectionEventFast(irc_oper_response, {
BuildConnVal(),
val_mgr->GetBool(orig),
val_mgr->GetBool(code == 381),
});
}
EnqueueConnEvent(irc_oper_response,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(code == 381)}
);
break;
case 670:
@ -588,13 +583,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
// All other server replies.
default:
if ( irc_reply )
ConnectionEventFast(irc_reply, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
val_mgr->GetCount(code),
new StringVal(params.c_str()),
});
EnqueueConnEvent(irc_reply,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(code)},
make_intrusive<StringVal>(params.c_str())
);
break;
}
return;
@ -659,31 +654,31 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( irc_dcc_message )
ConnectionEventFast(irc_dcc_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(target.c_str()),
new StringVal(parts[1].c_str()),
new StringVal(parts[2].c_str()),
new AddrVal(htonl(raw_ip)),
val_mgr->GetCount(atoi(parts[4].c_str())),
parts.size() >= 6 ?
EnqueueConnEvent(irc_dcc_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(parts[1].c_str()),
make_intrusive<StringVal>(parts[2].c_str()),
make_intrusive<AddrVal>(htonl(raw_ip)),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(atoi(parts[4].c_str()))},
IntrusivePtr{AdoptRef{}, parts.size() >= 6 ?
val_mgr->GetCount(atoi(parts[5].c_str())) :
val_mgr->GetCount(0),
});
val_mgr->GetCount(0)}
);
}
else
{
if ( irc_privmsg_message )
ConnectionEventFast(irc_privmsg_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(target.c_str()),
new StringVal(message.c_str()),
});
EnqueueConnEvent(irc_privmsg_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
}
@ -702,13 +697,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( message[0] == ':' )
message = message.substr(1);
ConnectionEventFast(irc_notice_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(target.c_str()),
new StringVal(message.c_str()),
});
EnqueueConnEvent(irc_notice_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
else if ( irc_squery_message && command == "SQUERY" )
@ -726,34 +721,35 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( message[0] == ':' )
message = message.substr(1);
ConnectionEventFast(irc_squery_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(target.c_str()),
new StringVal(message.c_str()),
});
EnqueueConnEvent(irc_squery_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
else if ( irc_user_message && command == "USER" )
{
// extract username and real name
vector<string> parts = SplitWords(params, ' ');
val_list vl(6);
vl.push_back(BuildConnVal());
vl.push_back(val_mgr->GetBool(orig));
zeek::Args vl;
vl.reserve(6);
vl.emplace_back(AdoptRef{}, BuildConnVal());
vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig));
if ( parts.size() > 0 )
vl.push_back(new StringVal(parts[0].c_str()));
else vl.push_back(val_mgr->GetEmptyString());
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
else vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
if ( parts.size() > 1 )
vl.push_back(new StringVal(parts[1].c_str()));
else vl.push_back(val_mgr->GetEmptyString());
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
else vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
if ( parts.size() > 2 )
vl.push_back(new StringVal(parts[2].c_str()));
else vl.push_back(val_mgr->GetEmptyString());
vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
else vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
string realname;
for ( unsigned int i = 3; i < parts.size(); i++ )
@ -764,9 +760,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
}
const char* name = realname.c_str();
vl.push_back(new StringVal(*name == ':' ? name + 1 : name));
vl.emplace_back(make_intrusive<StringVal>(*name == ':' ? name + 1 : name));
ConnectionEventFast(irc_user_message, std::move(vl));
EnqueueConnEvent(irc_user_message, std::move(vl));
}
else if ( irc_oper_message && command == "OPER" )
@ -774,14 +770,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
// extract username and password
vector<string> parts = SplitWords(params, ' ');
if ( parts.size() == 2 )
{
ConnectionEventFast(irc_oper_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(parts[0].c_str()),
new StringVal(parts[1].c_str()),
});
}
EnqueueConnEvent(irc_oper_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(parts[0].c_str()),
make_intrusive<StringVal>(parts[1].c_str())
);
else
Weird("irc_invalid_oper_message_format");
@ -797,12 +791,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
return;
}
val_list vl(6);
vl.push_back(BuildConnVal());
vl.push_back(val_mgr->GetBool(orig));
vl.push_back(new StringVal(prefix.c_str()));
vl.push_back(new StringVal(parts[0].c_str()));
vl.push_back(new StringVal(parts[1].c_str()));
zeek::Args vl;
vl.reserve(6);
vl.emplace_back(AdoptRef{}, BuildConnVal());
vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig));
vl.emplace_back(make_intrusive<StringVal>(prefix.c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
if ( parts.size() > 2 )
{
string comment = parts[2];
@ -812,12 +808,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( comment[0] == ':' )
comment = comment.substr(1);
vl.push_back(new StringVal(comment.c_str()));
vl.emplace_back(make_intrusive<StringVal>(comment.c_str()));
}
else
vl.push_back(val_mgr->GetEmptyString());
vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString());
ConnectionEventFast(irc_kick_message, std::move(vl));
EnqueueConnEvent(irc_kick_message, std::move(vl));
}
else if ( irc_join_message && command == "JOIN" )
@ -841,7 +837,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
nickname = prefix.substr(0, pos);
}
TableVal* list = new TableVal({NewRef{}, irc_join_list});
auto list = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, irc_join_list});
vector<string> channels = SplitWords(parts[0], ',');
vector<string> passwords;
@ -865,11 +861,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
Unref(info);
}
ConnectionEventFast(irc_join_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
list,
});
EnqueueConnEvent(irc_join_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
std::move(list)
);
}
else if ( irc_join_message && command == "NJOIN" )
@ -886,13 +882,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
parts[1] = parts[1].substr(1);
vector<string> users = SplitWords(parts[1], ',');
TableVal* list = new TableVal({NewRef{}, irc_join_list});
auto list = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, irc_join_list});
string empty_string = "";
for ( unsigned int i = 0; i < users.size(); ++i )
{
RecordVal* info = new RecordVal(irc_join_info);
auto info = make_intrusive<RecordVal>(irc_join_info);
string nick = users[i];
string mode = "none";
@ -922,15 +918,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
// User mode:
info->Assign(3, make_intrusive<StringVal>(mode.c_str()));
list->Assign(info, 0);
Unref(info);
list->Assign(info.get(), 0);
}
ConnectionEventFast(irc_join_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
list,
});
EnqueueConnEvent(irc_join_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
std::move(list)
);
}
else if ( irc_part_message && command == "PART" )
@ -957,22 +952,21 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
nick = nick.substr(0, pos);
vector<string> channelList = SplitWords(channels, ',');
TableVal* set = new TableVal({NewRef{}, string_set});
auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
for ( unsigned int i = 0; i < channelList.size(); ++i )
{
Val* idx = new StringVal(channelList[i].c_str());
set->Assign(idx, 0);
Unref(idx);
auto idx = make_intrusive<StringVal>(channelList[i].c_str());
set->Assign(idx.get(), 0);
}
ConnectionEventFast(irc_part_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(nick.c_str()),
set,
new StringVal(message.c_str()),
});
EnqueueConnEvent(irc_part_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(nick.c_str()),
std::move(set),
make_intrusive<StringVal>(message.c_str())
);
}
else if ( irc_quit_message && command == "QUIT" )
@ -989,12 +983,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
nickname = prefix.substr(0, pos);
}
ConnectionEventFast(irc_quit_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(nickname.c_str()),
new StringVal(message.c_str()),
});
EnqueueConnEvent(irc_quit_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(nickname.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
else if ( irc_nick_message && command == "NICK" )
@ -1003,12 +997,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( nick[0] == ':' )
nick = nick.substr(1);
ConnectionEventFast(irc_nick_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(nick.c_str())
});
EnqueueConnEvent(irc_nick_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(nick.c_str())
);
}
else if ( irc_who_message && command == "WHO" )
@ -1028,14 +1022,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts.size() > 0 && parts[0].size() > 0 && parts[0][0] == ':' )
parts[0] = parts[0].substr(1);
ConnectionEventFast(irc_who_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
EnqueueConnEvent(irc_who_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
parts.size() > 0 ?
new StringVal(parts[0].c_str()) :
val_mgr->GetEmptyString(),
val_mgr->GetBool(oper),
});
make_intrusive<StringVal>(parts[0].c_str()) :
IntrusivePtr{AdoptRef{}, val_mgr->GetEmptyString()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(oper)}
);
}
else if ( irc_whois_message && command == "WHOIS" )
@ -1058,12 +1052,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
else
users = parts[0];
ConnectionEventFast(irc_whois_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(server.c_str()),
new StringVal(users.c_str()),
});
EnqueueConnEvent(irc_whois_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(server.c_str()),
make_intrusive<StringVal>(users.c_str())
);
}
else if ( irc_error_message && command == "ERROR" )
@ -1071,12 +1065,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( params[0] == ':' )
params = params.substr(1);
ConnectionEventFast(irc_error_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(params.c_str()),
});
EnqueueConnEvent(irc_error_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(params.c_str())
);
}
else if ( irc_invite_message && command == "INVITE" )
@ -1087,13 +1081,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts[1].size() > 0 && parts[1][0] == ':' )
parts[1] = parts[1].substr(1);
ConnectionEventFast(irc_invite_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(parts[0].c_str()),
new StringVal(parts[1].c_str()),
});
EnqueueConnEvent(irc_invite_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(parts[0].c_str()),
make_intrusive<StringVal>(parts[1].c_str())
);
}
else
Weird("irc_invalid_invite_message_format");
@ -1102,14 +1096,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
else if ( irc_mode_message && command == "MODE" )
{
if ( params.size() > 0 )
{
ConnectionEventFast(irc_mode_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(params.c_str()),
});
}
EnqueueConnEvent(irc_mode_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(params.c_str())
);
else
Weird("irc_invalid_mode_message_format");
@ -1117,11 +1109,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
else if ( irc_password_message && command == "PASS" )
{
ConnectionEventFast(irc_password_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(params.c_str()),
});
EnqueueConnEvent(irc_password_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(params.c_str())
);
}
else if ( irc_squit_message && command == "SQUIT" )
@ -1139,13 +1131,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
message = message.substr(1);
}
ConnectionEventFast(irc_squit_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(server.c_str()),
new StringVal(message.c_str()),
});
EnqueueConnEvent(irc_squit_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(server.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
@ -1153,13 +1145,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
if ( irc_request )
{
ConnectionEventFast(irc_request, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(command.c_str()),
new StringVal(params.c_str()),
});
EnqueueConnEvent(irc_request,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(command.c_str()),
make_intrusive<StringVal>(params.c_str())
);
}
}
@ -1167,13 +1159,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
if ( irc_message )
{
ConnectionEventFast(irc_message, {
BuildConnVal(),
val_mgr->GetBool(orig),
new StringVal(prefix.c_str()),
new StringVal(command.c_str()),
new StringVal(params.c_str()),
});
EnqueueConnEvent(irc_message,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(command.c_str()),
make_intrusive<StringVal>(params.c_str())
);
}
}
@ -1203,7 +1195,7 @@ void IRC_Analyzer::StartTLS()
AddChildAnalyzer(ssl);
if ( irc_starttls )
ConnectionEventFast(irc_starttls, {BuildConnVal()});
EnqueueConnEvent(irc_starttls, IntrusivePtr{AdoptRef{}, BuildConnVal()});
}
vector<string> IRC_Analyzer::SplitWords(const string& input, char split)