diff --git a/src/Conn.cc b/src/Conn.cc index 591d80b7f2..6cbf140228 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -343,23 +343,23 @@ const RecordValPtr& Connection::ConnVal() id_val->Assign(3, val_mgr->Port(ntohs(resp_port), prot_type)); auto orig_endp = make_intrusive(id::endpoint); - orig_endp->Assign(0, val_mgr->Count(0)); - orig_endp->Assign(1, val_mgr->Count(0)); - orig_endp->Assign(4, val_mgr->Count(orig_flow_label)); + orig_endp->Assign(0, 0); + orig_endp->Assign(1, 0); + orig_endp->Assign(4, orig_flow_label); const int l2_len = sizeof(orig_l2_addr); char null[l2_len]{}; if ( memcmp(&orig_l2_addr, &null, l2_len) != 0 ) - orig_endp->Assign(5, make_intrusive(fmt_mac(orig_l2_addr, l2_len))); + orig_endp->Assign(5, fmt_mac(orig_l2_addr, l2_len)); auto resp_endp = make_intrusive(id::endpoint); - resp_endp->Assign(0, val_mgr->Count(0)); - resp_endp->Assign(1, val_mgr->Count(0)); - resp_endp->Assign(4, val_mgr->Count(resp_flow_label)); + resp_endp->Assign(0, 0); + resp_endp->Assign(1, 0); + resp_endp->Assign(4, resp_flow_label); if ( memcmp(&resp_l2_addr, &null, l2_len) != 0 ) - resp_endp->Assign(5, make_intrusive(fmt_mac(resp_l2_addr, l2_len))); + resp_endp->Assign(5, fmt_mac(resp_l2_addr, l2_len)); conn_val->Assign(0, std::move(id_val)); conn_val->Assign(1, std::move(orig_endp)); @@ -371,25 +371,25 @@ const RecordValPtr& Connection::ConnVal() if ( ! uid ) uid.Set(zeek::detail::bits_per_uid); - conn_val->Assign(7, make_intrusive(uid.Base62("C").c_str())); + conn_val->Assign(7, uid.Base62("C")); if ( encapsulation && encapsulation->Depth() > 0 ) conn_val->Assign(8, encapsulation->ToVal()); if ( vlan != 0 ) - conn_val->Assign(9, val_mgr->Int(vlan)); + conn_val->Assign(9, vlan); if ( inner_vlan != 0 ) - conn_val->Assign(10, val_mgr->Int(inner_vlan)); + conn_val->Assign(10, inner_vlan); } if ( root_analyzer ) root_analyzer->UpdateConnVal(conn_val.get()); - conn_val->Assign(3, make_intrusive(start_time)); // ### - conn_val->Assign(4, make_intrusive(last_time - start_time)); - conn_val->Assign(6, make_intrusive(history.c_str())); + conn_val->AssignTime(3, start_time); // ### + conn_val->AssignInterval(4, last_time - start_time); + conn_val->Assign(6, history); conn_val->SetOrigin(this); @@ -418,7 +418,7 @@ void Connection::AppendAddl(const char* str) const char* old = cv->GetFieldAs(6)->CheckString(); const char* format = *old ? "%s %s" : "%s%s"; - cv->Assign(6, make_intrusive(util::fmt(format, old, str))); + cv->Assign(6, util::fmt(format, old, str)); } // Returns true if the character at s separates a version number. @@ -632,7 +632,7 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label) if ( conn_val ) { RecordVal* endp = conn_val->GetFieldAs(is_orig ? 1 : 2); - endp->Assign(4, val_mgr->Count(flow_label)); + endp->Assign(4, flow_label); } if ( connection_flow_label_changed && diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc index 67578b0034..6dcbb80cdf 100644 --- a/src/DNS_Mgr.cc +++ b/src/DNS_Mgr.cc @@ -718,10 +718,10 @@ ValPtr DNS_Mgr::BuildMappingVal(DNS_Mapping* dm) { auto r = make_intrusive(dm_rec); - r->Assign(0, make_intrusive(dm->CreationTime())); - r->Assign(1, make_intrusive(dm->ReqHost() ? dm->ReqHost() : "")); + r->AssignTime(0, dm->CreationTime()); + r->Assign(1, dm->ReqHost() ? dm->ReqHost() : ""); r->Assign(2, make_intrusive(dm->ReqAddr())); - r->Assign(3, val_mgr->Bool(dm->Valid())); + r->Assign(3, dm->Valid()); auto h = dm->Host(); r->Assign(4, h ? std::move(h) : make_intrusive("")); diff --git a/src/File.cc b/src/File.cc index 964c92da14..9216d29416 100644 --- a/src/File.cc +++ b/src/File.cc @@ -290,7 +290,7 @@ RecordVal* File::Rotate() return nullptr; } - info->Assign(2, open_time); + info->AssignTime(2, open_time); Unlink(); diff --git a/src/IP.cc b/src/IP.cc index 67473c8532..e85ba0a39c 100644 --- a/src/IP.cc +++ b/src/IP.cc @@ -24,12 +24,12 @@ static VectorValPtr BuildOptionsVal(const u_char* data, int len) static auto ip6_option_type = id::find_type("ip6_option"); const struct ip6_opt* opt = (const struct ip6_opt*) data; auto rv = make_intrusive(ip6_option_type); - rv->Assign(0, val_mgr->Count(opt->ip6o_type)); + rv->Assign(0, opt->ip6o_type); if ( opt->ip6o_type == 0 ) { // Pad1 option - rv->Assign(1, val_mgr->Count(0)); + rv->Assign(1, 0); rv->Assign(2, val_mgr->EmptyString()); data += sizeof(uint8_t); len -= sizeof(uint8_t); @@ -38,9 +38,8 @@ static VectorValPtr BuildOptionsVal(const u_char* data, int len) { // PadN or other option uint16_t off = 2 * sizeof(uint8_t); - rv->Assign(1, val_mgr->Count(opt->ip6o_len)); - rv->Assign(2, make_intrusive( - new String(data + off, opt->ip6o_len, true))); + rv->Assign(1, opt->ip6o_len); + rv->Assign(2, new String(data + off, opt->ip6o_len, true)); data += opt->ip6o_len + off; len -= opt->ip6o_len + off; } @@ -61,11 +60,11 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const static auto ip6_hdr_type = id::find_type("ip6_hdr"); rv = make_intrusive(ip6_hdr_type); const struct ip6_hdr* ip6 = (const struct ip6_hdr*)data; - rv->Assign(0, val_mgr->Count((ntohl(ip6->ip6_flow) & 0x0ff00000)>>20)); - rv->Assign(1, val_mgr->Count(ntohl(ip6->ip6_flow) & 0x000fffff)); - rv->Assign(2, val_mgr->Count(ntohs(ip6->ip6_plen))); - rv->Assign(3, val_mgr->Count(ip6->ip6_nxt)); - rv->Assign(4, val_mgr->Count(ip6->ip6_hlim)); + rv->Assign(0, (ntohl(ip6->ip6_flow) & 0x0ff00000)>>20); + rv->Assign(1, ntohl(ip6->ip6_flow) & 0x000fffff); + rv->Assign(2, ntohs(ip6->ip6_plen)); + rv->Assign(3, ip6->ip6_nxt); + rv->Assign(4, ip6->ip6_hlim); rv->Assign(5, make_intrusive(IPAddr(ip6->ip6_src))); rv->Assign(6, make_intrusive(IPAddr(ip6->ip6_dst))); if ( ! chain ) @@ -80,8 +79,8 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const static auto ip6_hopopts_type = id::find_type("ip6_hopopts"); rv = make_intrusive(ip6_hopopts_type); const struct ip6_hbh* hbh = (const struct ip6_hbh*)data; - rv->Assign(0, val_mgr->Count(hbh->ip6h_nxt)); - rv->Assign(1, val_mgr->Count(hbh->ip6h_len)); + rv->Assign(0, hbh->ip6h_nxt); + rv->Assign(1, hbh->ip6h_len); uint16_t off = 2 * sizeof(uint8_t); rv->Assign(2, BuildOptionsVal(data + off, Length() - off)); @@ -93,8 +92,8 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const static auto ip6_dstopts_type = id::find_type("ip6_dstopts"); rv = make_intrusive(ip6_dstopts_type); const struct ip6_dest* dst = (const struct ip6_dest*)data; - rv->Assign(0, val_mgr->Count(dst->ip6d_nxt)); - rv->Assign(1, val_mgr->Count(dst->ip6d_len)); + rv->Assign(0, dst->ip6d_nxt); + rv->Assign(1, dst->ip6d_len); uint16_t off = 2 * sizeof(uint8_t); rv->Assign(2, BuildOptionsVal(data + off, Length() - off)); } @@ -105,12 +104,12 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const static auto ip6_routing_type = id::find_type("ip6_routing"); rv = make_intrusive(ip6_routing_type); const struct ip6_rthdr* rt = (const struct ip6_rthdr*)data; - rv->Assign(0, val_mgr->Count(rt->ip6r_nxt)); - rv->Assign(1, val_mgr->Count(rt->ip6r_len)); - rv->Assign(2, val_mgr->Count(rt->ip6r_type)); - rv->Assign(3, val_mgr->Count(rt->ip6r_segleft)); + rv->Assign(0, rt->ip6r_nxt); + rv->Assign(1, rt->ip6r_len); + rv->Assign(2, rt->ip6r_type); + rv->Assign(3, rt->ip6r_segleft); uint16_t off = 4 * sizeof(uint8_t); - rv->Assign(4, make_intrusive(new String(data + off, Length() - off, true))); + rv->Assign(4, new String(data + off, Length() - off, true)); } break; @@ -119,12 +118,12 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const static auto ip6_fragment_type = id::find_type("ip6_fragment"); rv = make_intrusive(ip6_fragment_type); const struct ip6_frag* frag = (const struct ip6_frag*)data; - rv->Assign(0, val_mgr->Count(frag->ip6f_nxt)); - rv->Assign(1, val_mgr->Count(frag->ip6f_reserved)); - rv->Assign(2, val_mgr->Count((ntohs(frag->ip6f_offlg) & 0xfff8)>>3)); - rv->Assign(3, val_mgr->Count((ntohs(frag->ip6f_offlg) & 0x0006)>>1)); - rv->Assign(4, val_mgr->Bool(ntohs(frag->ip6f_offlg) & 0x0001)); - rv->Assign(5, val_mgr->Count(ntohl(frag->ip6f_ident))); + rv->Assign(0, frag->ip6f_nxt); + rv->Assign(1, frag->ip6f_reserved); + rv->Assign(2, (ntohs(frag->ip6f_offlg) & 0xfff8)>>3); + rv->Assign(3, (ntohs(frag->ip6f_offlg) & 0x0006)>>1); + rv->Assign(4, bool(ntohs(frag->ip6f_offlg) & 0x0001)); + rv->Assign(5, ntohl(frag->ip6f_ident)); } break; @@ -132,18 +131,18 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const { static auto ip6_ah_type = id::find_type("ip6_ah"); rv = make_intrusive(ip6_ah_type); - rv->Assign(0, val_mgr->Count(((ip6_ext*)data)->ip6e_nxt)); - rv->Assign(1, val_mgr->Count(((ip6_ext*)data)->ip6e_len)); - rv->Assign(2, val_mgr->Count(ntohs(((uint16_t*)data)[1]))); - rv->Assign(3, val_mgr->Count(ntohl(((uint32_t*)data)[1]))); + rv->Assign(0, ((ip6_ext*)data)->ip6e_nxt); + rv->Assign(1, ((ip6_ext*)data)->ip6e_len); + rv->Assign(2, ntohs(((uint16_t*)data)[1])); + rv->Assign(3, ntohl(((uint32_t*)data)[1])); if ( Length() >= 12 ) { // Sequence Number and ICV fields can only be extracted if // Payload Len was non-zero for this header. - rv->Assign(4, val_mgr->Count(ntohl(((uint32_t*)data)[2]))); + rv->Assign(4, ntohl(((uint32_t*)data)[2])); uint16_t off = 3 * sizeof(uint32_t); - rv->Assign(5, make_intrusive(new String(data + off, Length() - off, true))); + rv->Assign(5, new String(data + off, Length() - off, true)); } } break; @@ -153,8 +152,8 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const static auto ip6_esp_type = id::find_type("ip6_esp"); rv = make_intrusive(ip6_esp_type); const uint32_t* esp = (const uint32_t*)data; - rv->Assign(0, val_mgr->Count(ntohl(esp[0]))); - rv->Assign(1, val_mgr->Count(ntohl(esp[1]))); + rv->Assign(0, ntohl(esp[0])); + rv->Assign(1, ntohl(esp[1])); } break; @@ -164,15 +163,15 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const static auto ip6_mob_type = id::find_type("ip6_mobility_hdr"); rv = make_intrusive(ip6_mob_type); const struct ip6_mobility* mob = (const struct ip6_mobility*) data; - rv->Assign(0, val_mgr->Count(mob->ip6mob_payload)); - rv->Assign(1, val_mgr->Count(mob->ip6mob_len)); - rv->Assign(2, val_mgr->Count(mob->ip6mob_type)); - rv->Assign(3, val_mgr->Count(mob->ip6mob_rsv)); - rv->Assign(4, val_mgr->Count(ntohs(mob->ip6mob_chksum))); + rv->Assign(0, mob->ip6mob_payload); + rv->Assign(1, mob->ip6mob_len); + rv->Assign(2, mob->ip6mob_type); + rv->Assign(3, mob->ip6mob_rsv); + rv->Assign(4, ntohs(mob->ip6mob_chksum)); static auto ip6_mob_msg_type = id::find_type("ip6_mobility_msg"); auto msg = make_intrusive(ip6_mob_msg_type); - msg->Assign(0, val_mgr->Count(mob->ip6mob_type)); + msg->Assign(0, mob->ip6mob_type); uint16_t off = sizeof(ip6_mobility); const u_char* msg_data = data + off; @@ -190,7 +189,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 0: { auto m = make_intrusive(ip6_mob_brr_type); - m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); + m->Assign(0, ntohs(*((uint16_t*)msg_data))); off += sizeof(uint16_t); m->Assign(1, BuildOptionsVal(data + off, Length() - off)); msg->Assign(1, std::move(m)); @@ -200,8 +199,8 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 1: { auto m = make_intrusive(ip6_mob_hoti_type); - m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); - m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); + m->Assign(0, ntohs(*((uint16_t*)msg_data))); + m->Assign(1, ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))); off += sizeof(uint16_t) + sizeof(uint64_t); m->Assign(2, BuildOptionsVal(data + off, Length() - off)); msg->Assign(2, std::move(m)); @@ -211,8 +210,8 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 2: { auto m = make_intrusive(ip6_mob_coti_type); - m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); - m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); + m->Assign(0, ntohs(*((uint16_t*)msg_data))); + m->Assign(1, ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))); off += sizeof(uint16_t) + sizeof(uint64_t); m->Assign(2, BuildOptionsVal(data + off, Length() - off)); msg->Assign(3, std::move(m)); @@ -222,9 +221,9 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 3: { auto m = make_intrusive(ip6_mob_hot_type); - m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); - m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); - m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t)))))); + m->Assign(0, ntohs(*((uint16_t*)msg_data))); + m->Assign(1, ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))); + m->Assign(2, ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))); off += sizeof(uint16_t) + 2 * sizeof(uint64_t); m->Assign(3, BuildOptionsVal(data + off, Length() - off)); msg->Assign(4, std::move(m)); @@ -234,9 +233,9 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 4: { auto m = make_intrusive(ip6_mob_cot_type); - m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); - m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); - m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t)))))); + m->Assign(0, ntohs(*((uint16_t*)msg_data))); + m->Assign(1, ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))); + m->Assign(2, ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))); off += sizeof(uint16_t) + 2 * sizeof(uint64_t); m->Assign(3, BuildOptionsVal(data + off, Length() - off)); msg->Assign(5, std::move(m)); @@ -246,12 +245,12 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 5: { auto m = make_intrusive(ip6_mob_bu_type); - m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); - m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000)); - m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000)); - m->Assign(3, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000)); - m->Assign(4, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000)); - m->Assign(5, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t)))))); + m->Assign(0, ntohs(*((uint16_t*)msg_data)))); + m->Assign(1, bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000)); + m->Assign(2, bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000)); + m->Assign(3, bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000)); + m->Assign(4, bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000)); + m->Assign(5, ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))); off += 3 * sizeof(uint16_t); m->Assign(6, BuildOptionsVal(data + off, Length() - off)); msg->Assign(6, std::move(m)); @@ -261,10 +260,10 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 6: { auto m = make_intrusive(ip6_mob_back_type); - m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data))); - m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80)); - m->Assign(2, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))))); - m->Assign(3, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t)))))); + m->Assign(0, *((uint8_t*)msg_data)); + m->Assign(1, bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80)); + m->Assign(2, ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t))))); + m->Assign(3, ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))); off += 3 * sizeof(uint16_t); m->Assign(4, BuildOptionsVal(data + off, Length() - off)); msg->Assign(7, std::move(m)); @@ -274,7 +273,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 7: { auto m = make_intrusive(ip6_mob_be_type); - m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data))); + m->Assign(0, *((uint8_t*)msg_data)); const in6_addr* hoa = (const in6_addr*)(msg_data + sizeof(uint16_t)); m->Assign(1, make_intrusive(IPAddr(*hoa))); off += sizeof(uint16_t) + sizeof(in6_addr); @@ -331,12 +330,12 @@ RecordValPtr IP_Hdr::ToIPHdrVal() const { static auto ip4_hdr_type = id::find_type("ip4_hdr"); rval = make_intrusive(ip4_hdr_type); - rval->Assign(0, val_mgr->Count(ip4->ip_hl * 4)); - rval->Assign(1, val_mgr->Count(ip4->ip_tos)); - rval->Assign(2, val_mgr->Count(ntohs(ip4->ip_len))); - rval->Assign(3, val_mgr->Count(ntohs(ip4->ip_id))); - rval->Assign(4, val_mgr->Count(ip4->ip_ttl)); - rval->Assign(5, val_mgr->Count(ip4->ip_p)); + rval->Assign(0, ip4->ip_hl * 4); + rval->Assign(1, ip4->ip_tos); + rval->Assign(2, ntohs(ip4->ip_len)); + rval->Assign(3, ntohs(ip4->ip_id)); + rval->Assign(4, ip4->ip_ttl); + rval->Assign(5, ip4->ip_p); rval->Assign(6, make_intrusive(ip4->ip_src.s_addr)); rval->Assign(7, make_intrusive(ip4->ip_dst.s_addr)); } @@ -380,13 +379,13 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const tcp_hdr->Assign(0, val_mgr->Port(ntohs(tp->th_sport), TRANSPORT_TCP)); tcp_hdr->Assign(1, val_mgr->Port(ntohs(tp->th_dport), TRANSPORT_TCP)); - tcp_hdr->Assign(2, val_mgr->Count(uint32_t(ntohl(tp->th_seq)))); - tcp_hdr->Assign(3, val_mgr->Count(uint32_t(ntohl(tp->th_ack)))); - tcp_hdr->Assign(4, val_mgr->Count(tcp_hdr_len)); - tcp_hdr->Assign(5, val_mgr->Count(data_len)); - tcp_hdr->Assign(6, val_mgr->Count(tp->th_x2)); - tcp_hdr->Assign(7, val_mgr->Count(tp->th_flags)); - tcp_hdr->Assign(8, val_mgr->Count(ntohs(tp->th_win))); + tcp_hdr->Assign(2, uint32_t(ntohl(tp->th_seq))); + tcp_hdr->Assign(3, uint32_t(ntohl(tp->th_ack))); + tcp_hdr->Assign(4, tcp_hdr_len); + tcp_hdr->Assign(5, data_len); + tcp_hdr->Assign(6, tp->th_x2); + tcp_hdr->Assign(7, tp->th_flags); + tcp_hdr->Assign(8, ntohs(tp->th_win)); pkt_hdr->Assign(sindex + 2, std::move(tcp_hdr)); break; @@ -399,7 +398,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const udp_hdr->Assign(0, val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP)); udp_hdr->Assign(1, val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP)); - udp_hdr->Assign(2, val_mgr->Count(ntohs(up->uh_ulen))); + udp_hdr->Assign(2, ntohs(up->uh_ulen)); pkt_hdr->Assign(sindex + 3, std::move(udp_hdr)); break; @@ -410,7 +409,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const const struct icmp* icmpp = (const struct icmp *) data; auto icmp_hdr = make_intrusive(icmp_hdr_type); - icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp_type)); + icmp_hdr->Assign(0, icmpp->icmp_type); pkt_hdr->Assign(sindex + 4, std::move(icmp_hdr)); break; @@ -421,7 +420,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const const struct icmp6_hdr* icmpp = (const struct icmp6_hdr*) data; auto icmp_hdr = make_intrusive(icmp_hdr_type); - icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp6_type)); + icmp_hdr->Assign(0, icmpp->icmp6_type); pkt_hdr->Assign(sindex + 4, std::move(icmp_hdr)); break; @@ -675,7 +674,7 @@ VectorValPtr IPv6_Hdr_Chain::ToVal() const auto v = chain[i]->ToVal(); auto ext_hdr = make_intrusive(ip6_ext_hdr_type); uint8_t type = chain[i]->Type(); - ext_hdr->Assign(0, val_mgr->Count(type)); + ext_hdr->Assign(0, type); switch (type) { case IPPROTO_HOPOPTS: diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc index 0dda936540..2c71985411 100644 --- a/src/RuleMatcher.cc +++ b/src/RuleMatcher.cc @@ -86,10 +86,10 @@ Val* RuleMatcher::BuildRuleStateValue(const Rule* rule, { static auto signature_state = id::find_type("signature_state"); auto* val = new RecordVal(signature_state); - val->Assign(0, make_intrusive(rule->ID())); + val->Assign(0, rule->ID()); val->Assign(1, state->GetAnalyzer()->ConnVal()); - val->Assign(2, val_mgr->Bool(state->is_orig)); - val->Assign(3, val_mgr->Count(state->payload_size)); + val->Assign(2, state->is_orig); + val->Assign(3, state->payload_size); return val; } diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc index 1b567e0b05..6076606c03 100644 --- a/src/SmithWaterman.cc +++ b/src/SmithWaterman.cc @@ -74,7 +74,7 @@ VectorVal* Substring::VecToPolicy(Vec* vec) Substring* bst = (*vec)[i]; auto st_val = make_intrusive(sw_substring_type); - st_val->Assign(0, make_intrusive(new String(*bst))); + st_val->Assign(0, new String(*bst)); auto aligns = make_intrusive(sw_align_vec_type); @@ -83,14 +83,14 @@ VectorVal* Substring::VecToPolicy(Vec* vec) const BSSAlign& align = (bst->GetAlignments())[j]; auto align_val = make_intrusive(sw_align_type); - align_val->Assign(0, make_intrusive(new String(*align.string))); - align_val->Assign(1, val_mgr->Count(align.index)); + align_val->Assign(0, new String(*align.string)); + align_val->Assign(1, align.index); aligns->Assign(j, std::move(align_val)); } st_val->Assign(1, std::move(aligns)); - st_val->Assign(2, val_mgr->Bool(bst->IsNewAlignment())); + st_val->Assign(2, bst->IsNewAlignment()); result->Assign(i, std::move(st_val)); } } diff --git a/src/Stmt.cc b/src/Stmt.cc index 95eb9a1035..0be99146ac 100644 --- a/src/Stmt.cc +++ b/src/Stmt.cc @@ -297,7 +297,7 @@ static void print_log(const std::vector& vals) vec->Assign(vec->Size(), make_intrusive(d.Description())); } - record->Assign(0, make_intrusive(run_state::network_time)); + record->AssignTime(0, run_state::network_time); record->Assign(1, std::move(vec)); log_mgr->Write(plval.get(), record.get()); } diff --git a/src/TunnelEncapsulation.cc b/src/TunnelEncapsulation.cc index 831ea91f9f..0d83fe4f99 100644 --- a/src/TunnelEncapsulation.cc +++ b/src/TunnelEncapsulation.cc @@ -30,7 +30,7 @@ RecordValPtr EncapsulatingConn::ToVal() const rv->Assign(0, std::move(id_val)); rv->Assign(1, BifType::Enum::Tunnel::Type->GetEnumVal(type)); - rv->Assign(2, make_intrusive(uid.Base62("C").c_str())); + rv->Assign(2, uid.Base62("C")); return rv; } diff --git a/src/Type.cc b/src/Type.cc index 4aecb487f7..3543edd195 100644 --- a/src/Type.cc +++ b/src/Type.cc @@ -987,8 +987,8 @@ TableValPtr RecordType::GetRecordFieldsVal(const RecordVal* rv) const auto nr = make_intrusive(record_field); string s = container_type_name(ft.get()); - nr->Assign(0, make_intrusive(s)); - nr->Assign(1, val_mgr->Bool(logged)); + nr->Assign(0, s); + nr->Assign(1, logged); nr->Assign(2, std::move(fv)); nr->Assign(3, FieldDefault(i)); auto field_name = make_intrusive(FieldName(i)); diff --git a/src/ZeekArgs.cc b/src/ZeekArgs.cc index ed4a28c146..60defa6583 100644 --- a/src/ZeekArgs.cc +++ b/src/ZeekArgs.cc @@ -32,12 +32,12 @@ VectorValPtr MakeCallArgumentVector(const Args& vals, static auto call_argument = id::find_type("call_argument"); auto rec = make_intrusive(call_argument); - rec->Assign(0, make_intrusive(fname)); + rec->Assign(0, fname); ODesc d; d.SetShort(); ftype->Describe(&d); - rec->Assign(1, make_intrusive(d.Description())); + rec->Assign(1, d.Description()); if ( fdefault ) rec->Assign(2, std::move(fdefault)); diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc index c01a087c3b..2f757c6969 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc +++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc @@ -500,7 +500,7 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name, auto benc_value = make_intrusive(bittorrent_benc_value); auto name_ = make_intrusive(name_len, name); - benc_value->Assign(type, val_mgr->Int(value)); + benc_value->Assign(type, int(value)); res_val_benc->Assign(std::move(name_), std::move(benc_value)); } diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc index b5214749b0..60d7fffc93 100644 --- a/src/analyzer/protocol/conn-size/ConnSize.cc +++ b/src/analyzer/protocol/conn-size/ConnSize.cc @@ -184,10 +184,10 @@ void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val) if ( bytesidx < 0 ) reporter->InternalError("'endpoint' record missing 'num_bytes_ip' field"); - orig_endp->Assign(pktidx, val_mgr->Count(orig_pkts)); - orig_endp->Assign(bytesidx, val_mgr->Count(orig_bytes)); - resp_endp->Assign(pktidx, val_mgr->Count(resp_pkts)); - resp_endp->Assign(bytesidx, val_mgr->Count(resp_bytes)); + orig_endp->Assign(pktidx, orig_pkts); + orig_endp->Assign(bytesidx, orig_bytes); + resp_endp->Assign(pktidx, resp_pkts); + resp_endp->Assign(bytesidx, resp_bytes); Analyzer::UpdateConnVal(conn_val); } diff --git a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac index 99fe9913bc..39db461742 100644 --- a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac +++ b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac @@ -54,16 +54,16 @@ refine flow DHCP_Flow += { double secs = static_cast(${msg.secs}); auto dhcp_msg_val = zeek::make_intrusive(zeek::BifType::Record::DHCP::Msg); - dhcp_msg_val->Assign(0, zeek::val_mgr->Count(${msg.op})); - dhcp_msg_val->Assign(1, zeek::val_mgr->Count(${msg.type})); - dhcp_msg_val->Assign(2, zeek::val_mgr->Count(${msg.xid})); - dhcp_msg_val->Assign(3, zeek::make_intrusive(secs)); - dhcp_msg_val->Assign(4, zeek::val_mgr->Count(${msg.flags})); + dhcp_msg_val->Assign(0, ${msg.op}); + dhcp_msg_val->Assign(1, ${msg.type}); + dhcp_msg_val->Assign(2, ${msg.xid}); + dhcp_msg_val->AssignInterval(3, secs); + dhcp_msg_val->Assign(4, ${msg.flags}); dhcp_msg_val->Assign(5, zeek::make_intrusive(htonl(${msg.ciaddr}))); dhcp_msg_val->Assign(6, zeek::make_intrusive(htonl(${msg.yiaddr}))); dhcp_msg_val->Assign(7, zeek::make_intrusive(htonl(${msg.siaddr}))); dhcp_msg_val->Assign(8, zeek::make_intrusive(htonl(${msg.giaddr}))); - dhcp_msg_val->Assign(9, zeek::make_intrusive(mac_str)); + dhcp_msg_val->Assign(9, mac_str); int last_non_null = 0; diff --git a/src/analyzer/protocol/dhcp/dhcp-options.pac b/src/analyzer/protocol/dhcp/dhcp-options.pac index bd658a802f..d83ff93243 100644 --- a/src/analyzer/protocol/dhcp/dhcp-options.pac +++ b/src/analyzer/protocol/dhcp/dhcp-options.pac @@ -34,7 +34,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_time_offset_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(25, zeek::val_mgr->Int(${v.time_offset})); + ${context.flow}->options->Assign(25, int(${v.time_offset})); return true; %} }; @@ -250,7 +250,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_forwarding_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(6, zeek::val_mgr->Bool(${v.forwarding} == 0 ? false : true)); + ${context.flow}->options->Assign(6, ${v.forwarding} == 0 ? false : true); return true; %} @@ -414,7 +414,7 @@ refine flow DHCP_Flow += { function process_lease_option(v: OptionValue): bool %{ double lease = static_cast(${v.lease}); - ${context.flow}->options->Assign(11, zeek::make_intrusive(lease)); + ${context.flow}->options->AssignInterval(11, lease); return true; %} @@ -521,7 +521,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_max_message_size_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(15, zeek::val_mgr->Count(${v.max_msg_size})); + ${context.flow}->options->Assign(15, ${v.max_msg_size}); return true; %} @@ -546,7 +546,7 @@ refine flow DHCP_Flow += { function process_renewal_time_option(v: OptionValue): bool %{ double renewal_time = static_cast(${v.renewal_time}); - ${context.flow}->options->Assign(16, zeek::make_intrusive(renewal_time)); + ${context.flow}->options->AssignInterval(16, renewal_time); return true; %} @@ -571,7 +571,7 @@ refine flow DHCP_Flow += { function process_rebinding_time_option(v: OptionValue): bool %{ double rebinding_time = static_cast(${v.rebinding_time}); - ${context.flow}->options->Assign(17, zeek::make_intrusive(rebinding_time)); + ${context.flow}->options->AssignInterval(17, rebinding_time); return true; %} @@ -626,7 +626,7 @@ refine flow DHCP_Flow += { function process_client_id_option(v: OptionValue): bool %{ auto client_id = zeek::make_intrusive(zeek::BifType::Record::DHCP::ClientID); - client_id->Assign(0, zeek::val_mgr->Count(${v.client_id.hwtype})); + client_id->Assign(0, ${v.client_id.hwtype}); zeek::StringValPtr sv; if ( ${v.client_id.hwtype} == 0 ) @@ -695,9 +695,9 @@ refine flow DHCP_Flow += { function process_client_fqdn_option(v: OptionValue): bool %{ auto client_fqdn = zeek::make_intrusive(zeek::BifType::Record::DHCP::ClientFQDN); - client_fqdn->Assign(0, zeek::val_mgr->Count(${v.client_fqdn.flags})); - client_fqdn->Assign(1, zeek::val_mgr->Count(${v.client_fqdn.rcode1})); - client_fqdn->Assign(2, zeek::val_mgr->Count(${v.client_fqdn.rcode2})); + client_fqdn->Assign(0, ${v.client_fqdn.flags}); + client_fqdn->Assign(1, ${v.client_fqdn.rcode1}); + client_fqdn->Assign(2, ${v.client_fqdn.rcode2}); const char* domain_name = reinterpret_cast(${v.client_fqdn.domain_name}.begin()); client_fqdn->Assign(3, zeek::make_intrusive(${v.client_fqdn.domain_name}.length(), domain_name)); @@ -760,7 +760,7 @@ refine flow DHCP_Flow += { ptrsubopt != ${v.relay_agent_inf}->end(); ++ptrsubopt ) { auto r = zeek::make_intrusive(zeek::BifType::Record::DHCP::SubOpt); - r->Assign(0, zeek::val_mgr->Count((*ptrsubopt)->code())); + r->Assign(0, (*ptrsubopt)->code()); r->Assign(1, to_stringval((*ptrsubopt)->value())); relay_agent_sub_opt->Assign(i, std::move(r)); @@ -790,7 +790,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_auto_config_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(23, zeek::val_mgr->Bool(${v.auto_config} == 0 ? false : true)); + ${context.flow}->options->Assign(23, ${v.auto_config} == 0 ? false : true); return true; %} diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc index 8b4ec7168b..48be5bd7db 100644 --- a/src/analyzer/protocol/dns/DNS.cc +++ b/src/analyzer/protocol/dns/DNS.cc @@ -622,13 +622,13 @@ bool DNS_Interpreter::ParseRR_SOA(detail::DNS_MsgInfo* msg, { static auto dns_soa = id::find_type("dns_soa"); auto r = make_intrusive(dns_soa); - r->Assign(0, make_intrusive(new String(mname, mname_end - mname, true))); - r->Assign(1, make_intrusive(new String(rname, rname_end - rname, true))); - r->Assign(2, val_mgr->Count(serial)); - r->Assign(3, make_intrusive(double(refresh), Seconds)); - r->Assign(4, make_intrusive(double(retry), Seconds)); - r->Assign(5, make_intrusive(double(expire), Seconds)); - r->Assign(6, make_intrusive(double(minimum), Seconds)); + r->Assign(0, new String(mname, mname_end - mname, true)); + r->Assign(1, new String(rname, rname_end - rname, true)); + r->Assign(2, serial); + r->AssignInterval(3, double(refresh)); + r->AssignInterval(4, double(retry)); + r->AssignInterval(5, double(expire)); + r->AssignInterval(6, double(minimum)); analyzer->EnqueueConnEvent(dns_SOA_reply, analyzer->ConnVal(), @@ -1849,19 +1849,19 @@ RecordValPtr DNS_MsgInfo::BuildHdrVal() static auto dns_msg = id::find_type("dns_msg"); auto r = make_intrusive(dns_msg); - r->Assign(0, val_mgr->Count(id)); - r->Assign(1, val_mgr->Count(opcode)); - r->Assign(2, val_mgr->Count(rcode)); - r->Assign(3, val_mgr->Bool(QR)); - r->Assign(4, val_mgr->Bool(AA)); - r->Assign(5, val_mgr->Bool(TC)); - r->Assign(6, val_mgr->Bool(RD)); - r->Assign(7, val_mgr->Bool(RA)); - r->Assign(8, val_mgr->Count(Z)); - r->Assign(9, val_mgr->Count(qdcount)); - r->Assign(10, val_mgr->Count(ancount)); - r->Assign(11, val_mgr->Count(nscount)); - r->Assign(12, val_mgr->Count(arcount)); + r->Assign(0, id); + r->Assign(1, opcode); + r->Assign(2, rcode); + r->Assign(3, bool(QR)); + r->Assign(4, bool(AA)); + r->Assign(5, bool(TC)); + r->Assign(6, bool(RD)); + r->Assign(7, bool(RA)); + r->Assign(8, Z); + r->Assign(9, qdcount); + r->Assign(10, ancount); + r->Assign(11, nscount); + r->Assign(12, arcount); return r; } @@ -1871,11 +1871,11 @@ RecordValPtr DNS_MsgInfo::BuildAnswerVal() static auto dns_answer = id::find_type("dns_answer"); auto r = make_intrusive(dns_answer); - r->Assign(0, val_mgr->Count(int(answer_type))); + r->Assign(0, int(answer_type)); r->Assign(1, query_name); - r->Assign(2, val_mgr->Count(atype)); - r->Assign(3, val_mgr->Count(aclass)); - r->Assign(4, make_intrusive(double(ttl), Seconds)); + r->Assign(2, atype); + r->Assign(3, aclass); + r->AssignInterval(4, double(ttl)); return r; } @@ -1887,14 +1887,14 @@ RecordValPtr DNS_MsgInfo::BuildEDNS_Val() static auto dns_edns_additional = id::find_type("dns_edns_additional"); auto r = make_intrusive(dns_edns_additional); - r->Assign(0, val_mgr->Count(int(answer_type))); + r->Assign(0, uint64_t(answer_type)); r->Assign(1, query_name); // type = 0x29 or 41 = EDNS - r->Assign(2, val_mgr->Count(atype)); + r->Assign(2, atype); // sender's UDP payload size, per RFC 2671 4.3 - r->Assign(3, val_mgr->Count(aclass)); + r->Assign(3, aclass); // Need to break the TTL field into three components: // initial: [------------- ttl (32) ---------------------] @@ -1907,11 +1907,11 @@ RecordValPtr DNS_MsgInfo::BuildEDNS_Val() unsigned int return_error = (ercode << 8) | rcode; - r->Assign(4, val_mgr->Count(return_error)); - r->Assign(5, val_mgr->Count(version)); - r->Assign(6, val_mgr->Count(z)); - r->Assign(7, make_intrusive(double(ttl), Seconds)); - r->Assign(8, val_mgr->Count(is_query)); + r->Assign(4, return_error); + r->Assign(5, version); + r->Assign(6, z); + r->AssignInterval(7, double(ttl)); + r->Assign(8, is_query); return r; } @@ -1922,8 +1922,8 @@ RecordValPtr DNS_MsgInfo::BuildEDNS_ECS_Val(struct EDNS_ECS* opt) auto r = make_intrusive(dns_edns_ecs); r->Assign(0, opt->ecs_family); - r->Assign(1, val_mgr->Count(opt->ecs_src_pfx_len)); - r->Assign(2, val_mgr->Count(opt->ecs_scp_pfx_len)); + r->Assign(1, opt->ecs_src_pfx_len); + r->Assign(2, opt->ecs_scp_pfx_len); r->Assign(3, opt->ecs_addr); return r; @@ -1934,8 +1934,8 @@ RecordValPtr DNS_MsgInfo::BuildEDNS_TCP_KA_Val(struct EDNS_TCP_KEEPALIVE* opt) static auto dns_edns_tcp_keepalive = id::find_type("dns_edns_tcp_keepalive"); auto r = make_intrusive(dns_edns_tcp_keepalive); - r->Assign(0, val_mgr->Bool(opt->keepalive_timeout_omitted)); - r->Assign(1, val_mgr->Count(opt->keepalive_timeout)); + r->Assign(0, bool(opt->keepalive_timeout_omitted)); + r->Assign(1, opt->keepalive_timeout); return r; } @@ -1945,9 +1945,9 @@ RecordValPtr DNS_MsgInfo::BuildEDNS_COOKIE_Val(struct EDNS_COOKIE* opt) static auto dns_edns_cookie = id::find_type("dns_edns_cookie"); auto r = make_intrusive(dns_edns_cookie); - r->Assign(0, make_intrusive(opt->client_cookie)); + r->Assign(0, opt->client_cookie); if (opt->server_cookie != nullptr) { - r->Assign(1, make_intrusive(opt->server_cookie)); + r->Assign(1, opt->server_cookie); } return r; @@ -1959,16 +1959,16 @@ RecordValPtr DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig) auto r = make_intrusive(dns_tsig_additional); double rtime = tsig->time_s + tsig->time_ms / 1000.0; - // r->Assign(0, val_mgr->Count(int(answer_type))); + // r->Assign(0, uint64_t(answer_type)); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, make_intrusive(tsig->alg_name)); - r->Assign(3, make_intrusive(tsig->sig)); - r->Assign(4, make_intrusive(rtime)); - r->Assign(5, make_intrusive(double(tsig->fudge))); - r->Assign(6, val_mgr->Count(tsig->orig_id)); - r->Assign(7, val_mgr->Count(tsig->rr_error)); - r->Assign(8, val_mgr->Count(is_query)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, tsig->alg_name); + r->Assign(3, tsig->sig); + r->AssignTime(4, rtime); + r->AssignTime(5, double(tsig->fudge)); + r->Assign(6, tsig->orig_id); + r->Assign(7, tsig->rr_error); + r->Assign(8, is_query); return r; } @@ -1979,17 +1979,17 @@ RecordValPtr DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig) auto r = make_intrusive(dns_rrsig_rr); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, val_mgr->Count(rrsig->type_covered)); - r->Assign(3, val_mgr->Count(rrsig->algorithm)); - r->Assign(4, val_mgr->Count(rrsig->labels)); - r->Assign(5, make_intrusive(double(rrsig->orig_ttl), Seconds)); - r->Assign(6, make_intrusive(double(rrsig->sig_exp))); - r->Assign(7, make_intrusive(double(rrsig->sig_incep))); - r->Assign(8, val_mgr->Count(rrsig->key_tag)); - r->Assign(9, make_intrusive(rrsig->signer_name)); - r->Assign(10, make_intrusive(rrsig->signature)); - r->Assign(11, val_mgr->Count(is_query)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, rrsig->type_covered); + r->Assign(3, rrsig->algorithm); + r->Assign(4, rrsig->labels); + r->AssignInterval(5, double(rrsig->orig_ttl)); + r->AssignTime(6, double(rrsig->sig_exp)); + r->AssignTime(7, double(rrsig->sig_incep)); + r->Assign(8, rrsig->key_tag); + r->Assign(9, rrsig->signer_name); + r->Assign(10, rrsig->signature); + r->Assign(11, is_query); return r; } @@ -2000,12 +2000,12 @@ RecordValPtr DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey) auto r = make_intrusive(dns_dnskey_rr); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, val_mgr->Count(dnskey->dflags)); - r->Assign(3, val_mgr->Count(dnskey->dprotocol)); - r->Assign(4, val_mgr->Count(dnskey->dalgorithm)); - r->Assign(5, make_intrusive(dnskey->public_key)); - r->Assign(6, val_mgr->Count(is_query)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, dnskey->dflags); + r->Assign(3, dnskey->dprotocol); + r->Assign(4, dnskey->dalgorithm); + r->Assign(5, dnskey->public_key); + r->Assign(6, is_query); return r; } @@ -2016,16 +2016,16 @@ RecordValPtr DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3) auto r = make_intrusive(dns_nsec3_rr); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, val_mgr->Count(nsec3->nsec_flags)); - r->Assign(3, val_mgr->Count(nsec3->nsec_hash_algo)); - r->Assign(4, val_mgr->Count(nsec3->nsec_iter)); - r->Assign(5, val_mgr->Count(nsec3->nsec_salt_len)); - r->Assign(6, make_intrusive(nsec3->nsec_salt)); - r->Assign(7, val_mgr->Count(nsec3->nsec_hlen)); - r->Assign(8, make_intrusive(nsec3->nsec_hash)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, nsec3->nsec_flags); + r->Assign(3, nsec3->nsec_hash_algo); + r->Assign(4, nsec3->nsec_iter); + r->Assign(5, nsec3->nsec_salt_len); + r->Assign(6, nsec3->nsec_salt); + r->Assign(7, nsec3->nsec_hlen); + r->Assign(8, nsec3->nsec_hash); r->Assign(9, std::move(nsec3->bitmaps)); - r->Assign(10, val_mgr->Count(is_query)); + r->Assign(10, is_query); return r; } @@ -2036,13 +2036,13 @@ RecordValPtr DNS_MsgInfo::BuildNSEC3PARAM_Val(NSEC3PARAM_DATA* nsec3param) auto r = make_intrusive(dns_nsec3param_rr); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, val_mgr->Count(nsec3param->nsec_flags)); - r->Assign(3, val_mgr->Count(nsec3param->nsec_hash_algo)); - r->Assign(4, val_mgr->Count(nsec3param->nsec_iter)); - r->Assign(5, val_mgr->Count(nsec3param->nsec_salt_len)); - r->Assign(6, make_intrusive(nsec3param->nsec_salt)); - r->Assign(7, val_mgr->Count(is_query)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, nsec3param->nsec_flags); + r->Assign(3, nsec3param->nsec_hash_algo); + r->Assign(4, nsec3param->nsec_iter); + r->Assign(5, nsec3param->nsec_salt_len); + r->Assign(6, nsec3param->nsec_salt); + r->Assign(7, is_query); return r; } @@ -2053,12 +2053,12 @@ RecordValPtr DNS_MsgInfo::BuildDS_Val(DS_DATA* ds) auto r = make_intrusive(dns_ds_rr); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, val_mgr->Count(ds->key_tag)); - r->Assign(3, val_mgr->Count(ds->algorithm)); - r->Assign(4, val_mgr->Count(ds->digest_type)); - r->Assign(5, make_intrusive(ds->digest_val)); - r->Assign(6, val_mgr->Count(is_query)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, ds->key_tag); + r->Assign(3, ds->algorithm); + r->Assign(4, ds->digest_type); + r->Assign(5, ds->digest_val); + r->Assign(6, is_query); return r; } @@ -2069,12 +2069,12 @@ RecordValPtr DNS_MsgInfo::BuildBINDS_Val(BINDS_DATA* binds) auto r = make_intrusive(dns_binds_rr); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, val_mgr->Count(binds->algorithm)); - r->Assign(3, val_mgr->Count(binds->key_id)); - r->Assign(4, val_mgr->Count(binds->removal_flag)); - r->Assign(5, make_intrusive(binds->complete_flag)); - r->Assign(6, val_mgr->Count(is_query)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, binds->algorithm); + r->Assign(3, binds->key_id); + r->Assign(4, binds->removal_flag); + r->Assign(5, binds->complete_flag); + r->Assign(6, is_query); return r; } @@ -2085,15 +2085,15 @@ RecordValPtr DNS_MsgInfo::BuildLOC_Val(LOC_DATA* loc) auto r = make_intrusive(dns_loc_rr); r->Assign(0, query_name); - r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, val_mgr->Count(loc->version)); - r->Assign(3, val_mgr->Count(loc->size)); - r->Assign(4, val_mgr->Count(loc->horiz_pre)); - r->Assign(5, val_mgr->Count(loc->vert_pre)); - r->Assign(6, val_mgr->Count(loc->latitude)); - r->Assign(7, val_mgr->Count(loc->longitude)); - r->Assign(8, val_mgr->Count(loc->altitude)); - r->Assign(9, val_mgr->Count(is_query)); + r->Assign(1, uint64_t(answer_type)); + r->Assign(2, loc->version); + r->Assign(3, loc->size); + r->Assign(4, loc->horiz_pre); + r->Assign(5, loc->vert_pre); + r->Assign(6, uint64_t(loc->latitude)); + r->Assign(7, uint64_t(loc->longitude)); + r->Assign(8, uint64_t(loc->altitude)); + r->Assign(9, is_query); return r; } diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif index 7037a939cc..8ff3a40bfa 100644 --- a/src/analyzer/protocol/ftp/functions.bif +++ b/src/analyzer/protocol/ftp/functions.bif @@ -35,13 +35,13 @@ static zeek::ValPtr parse_port(const char* line) r->Assign(0, zeek::make_intrusive(htonl(addr))); r->Assign(1, zeek::val_mgr->Port(port, TRANSPORT_TCP)); - r->Assign(2, zeek::val_mgr->Bool(good)); + r->Assign(2, good); } else { r->Assign(0, zeek::make_intrusive(uint32_t(0))); r->Assign(1, zeek::val_mgr->Port(0, TRANSPORT_TCP)); - r->Assign(2, zeek::val_mgr->False()); + r->Assign(2, false); } return r; @@ -111,7 +111,7 @@ static zeek::ValPtr parse_eftp(const char* line) r->Assign(0, zeek::make_intrusive(addr)); r->Assign(1, zeek::val_mgr->Port(port, TRANSPORT_TCP)); - r->Assign(2, zeek::val_mgr->Bool(good)); + r->Assign(2, good); return r; } diff --git a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac index c595373496..abb35d42f1 100644 --- a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac +++ b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac @@ -9,21 +9,21 @@ zeek::RecordValPtr BuildGTPv1Hdr(const GTPv1_Header* pdu) { auto rv = zeek::make_intrusive(zeek::BifType::Record::gtpv1_hdr); - rv->Assign(0, zeek::val_mgr->Count(pdu->version())); - rv->Assign(1, zeek::val_mgr->Bool(pdu->pt_flag())); - rv->Assign(2, zeek::val_mgr->Bool(pdu->rsv())); - rv->Assign(3, zeek::val_mgr->Bool(pdu->e_flag())); - rv->Assign(4, zeek::val_mgr->Bool(pdu->s_flag())); - rv->Assign(5, zeek::val_mgr->Bool(pdu->pn_flag())); - rv->Assign(6, zeek::val_mgr->Count(pdu->msg_type())); - rv->Assign(7, zeek::val_mgr->Count(pdu->length())); - rv->Assign(8, zeek::val_mgr->Count(pdu->teid())); + rv->Assign(0, pdu->version()); + rv->Assign(1, bool(pdu->pt_flag())); + rv->Assign(2, bool(pdu->rsv())); + rv->Assign(3, bool(pdu->e_flag())); + rv->Assign(4, bool(pdu->s_flag())); + rv->Assign(5, bool(pdu->pn_flag())); + rv->Assign(6, pdu->msg_type()); + rv->Assign(7, pdu->length()); + rv->Assign(8, pdu->teid()); if ( pdu->has_opt() ) { - rv->Assign(9, zeek::val_mgr->Count(pdu->opt_hdr()->seq())); - rv->Assign(10, zeek::val_mgr->Count(pdu->opt_hdr()->n_pdu())); - rv->Assign(11, zeek::val_mgr->Count(pdu->opt_hdr()->next_type())); + rv->Assign(9, pdu->opt_hdr()->seq()); + rv->Assign(10, pdu->opt_hdr()->n_pdu()); + rv->Assign(11, pdu->opt_hdr()->next_type()); } return rv; @@ -37,10 +37,10 @@ static zeek::ValPtr BuildIMSI(const InformationElement* ie) static zeek::ValPtr BuildRAI(const InformationElement* ie) { auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_rai); - ev->Assign(0, zeek::val_mgr->Count(ie->rai()->mcc())); - ev->Assign(1, zeek::val_mgr->Count(ie->rai()->mnc())); - ev->Assign(2, zeek::val_mgr->Count(ie->rai()->lac())); - ev->Assign(3, zeek::val_mgr->Count(ie->rai()->rac())); + ev->Assign(0, ie->rai()->mcc()); + ev->Assign(1, ie->rai()->mnc()); + ev->Assign(2, ie->rai()->lac()); + ev->Assign(3, ie->rai()->rac()); return ev; } @@ -87,8 +87,8 @@ static zeek::ValPtr BuildTraceType(const InformationElement* ie) zeek::ValPtr BuildEndUserAddr(const InformationElement* ie) { auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_end_user_addr); - ev->Assign(0, zeek::val_mgr->Count(ie->end_user_addr()->pdp_type_org())); - ev->Assign(1, zeek::val_mgr->Count(ie->end_user_addr()->pdp_type_num())); + ev->Assign(0, ie->end_user_addr()->pdp_type_org()); + ev->Assign(1, ie->end_user_addr()->pdp_type_num()); int len = ie->end_user_addr()->pdp_addr().length(); @@ -106,8 +106,7 @@ zeek::ValPtr BuildEndUserAddr(const InformationElement* ie) zeek::IPAddr(IPv6, (const uint32*) d, zeek::IPAddr::Network))); break; default: - ev->Assign(3, zeek::make_intrusive( - new zeek::String((const u_char*) d, len, false))); + ev->Assign(3, new zeek::String((const u_char*) d, len, false)); break; } } @@ -143,7 +142,7 @@ zeek::ValPtr BuildGSN_Addr(const InformationElement* ie) ev->Assign(0, zeek::make_intrusive( zeek::IPAddr(IPv6, (const uint32*) d, zeek::IPAddr::Network))); else - ev->Assign(1, zeek::make_intrusive(new zeek::String((const u_char*) d, len, false))); + ev->Assign(1, new zeek::String((const u_char*) d, len, false)); return ev; } @@ -162,8 +161,8 @@ zeek::ValPtr BuildQoS_Profile(const InformationElement* ie) const u_char* d = (const u_char*) ie->qos_profile()->data().data(); int len = ie->qos_profile()->data().length(); - ev->Assign(0, zeek::val_mgr->Count(ie->qos_profile()->alloc_retention_priority())); - ev->Assign(1, zeek::make_intrusive(new zeek::String(d, len, false))); + ev->Assign(0, ie->qos_profile()->alloc_retention_priority()); + ev->Assign(1, new zeek::String(d, len, false)); return ev; } @@ -196,8 +195,8 @@ zeek::ValPtr BuildPrivateExt(const InformationElement* ie) const uint8* d = ie->private_ext()->value().data(); int len = ie->private_ext()->value().length(); - ev->Assign(0, zeek::val_mgr->Count(ie->private_ext()->id())); - ev->Assign(1, zeek::make_intrusive(new zeek::String((const u_char*) d, len, false))); + ev->Assign(0, ie->private_ext()->id()); + ev->Assign(1, new zeek::String((const u_char*) d, len, false)); return ev; } diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index c0f3ece9c6..a7544d4c91 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -626,12 +626,12 @@ RecordValPtr HTTP_Message::BuildMessageStat(bool interrupted, const char* msg) static auto http_message_stat = id::find_type("http_message_stat"); auto stat = make_intrusive(http_message_stat); int field = 0; - stat->Assign(field++, make_intrusive(start_time)); - stat->Assign(field++, val_mgr->Bool(interrupted)); - stat->Assign(field++, make_intrusive(msg)); - stat->Assign(field++, val_mgr->Count(body_length)); - stat->Assign(field++, val_mgr->Count(content_gap_length)); - stat->Assign(field++, val_mgr->Count(header_length)); + stat->AssignTime(field++, start_time); + stat->Assign(field++, bool(interrupted)); + stat->Assign(field++, msg); + stat->Assign(field++, uint64_t(body_length)); + stat->Assign(field++, uint64_t(content_gap_length)); + stat->Assign(field++, uint64_t(header_length)); return stat; } @@ -1165,10 +1165,10 @@ void HTTP_Analyzer::GenStats() { static auto http_stats_rec = id::find_type("http_stats_rec"); auto r = make_intrusive(http_stats_rec); - r->Assign(0, val_mgr->Count(num_requests)); - r->Assign(1, val_mgr->Count(num_replies)); - r->Assign(2, make_intrusive(request_version.ToDouble())); - r->Assign(3, make_intrusive(reply_version.ToDouble())); + r->Assign(0, num_requests); + r->Assign(1, num_replies); + r->Assign(2, request_version.ToDouble()); + r->Assign(3, reply_version.ToDouble()); // DEBUG_MSG("%.6f http_stats\n", run_state::network_time); EnqueueConnEvent(http_stats, ConnVal(), std::move(r)); diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc index 1a3ccbaae2..9e9179eb27 100644 --- a/src/analyzer/protocol/icmp/ICMP.cc +++ b/src/analyzer/protocol/icmp/ICMP.cc @@ -224,11 +224,11 @@ RecordValPtr ICMP_Analyzer::BuildInfo(const struct icmp* icmpp, int len, { static auto icmp_info = id::find_type("icmp_info"); auto rval = make_intrusive(icmp_info); - rval->Assign(0, val_mgr->Bool(icmpv6)); - rval->Assign(1, val_mgr->Count(icmpp->icmp_type)); - rval->Assign(2, val_mgr->Count(icmpp->icmp_code)); - rval->Assign(3, val_mgr->Count(len)); - rval->Assign(4, val_mgr->Count(ip_hdr->TTL())); + rval->Assign(0, bool(icmpv6)); + rval->Assign(1, uint32_t(icmpp->icmp_type)); + rval->Assign(2, uint32_t(icmpp->icmp_code)); + rval->Assign(3, uint32_t(len)); + rval->Assign(4, uint32_t(ip_hdr->TTL())); return rval; } @@ -355,13 +355,13 @@ RecordValPtr ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data) id_val->Assign(3, val_mgr->Port(dst_port, proto)); iprec->Assign(0, std::move(id_val)); - iprec->Assign(1, val_mgr->Count(ip_len)); - iprec->Assign(2, val_mgr->Count(proto)); - iprec->Assign(3, val_mgr->Count(frag_offset)); - iprec->Assign(4, val_mgr->Bool(bad_hdr_len)); - iprec->Assign(5, val_mgr->Bool(bad_checksum)); - iprec->Assign(6, val_mgr->Bool(MF)); - iprec->Assign(7, val_mgr->Bool(DF)); + iprec->Assign(1, uint32_t(ip_len)); + iprec->Assign(2, uint32_t(proto)); + iprec->Assign(3, uint32_t(frag_offset)); + iprec->Assign(4, bool(bad_hdr_len)); + iprec->Assign(5, bool(bad_checksum)); + iprec->Assign(6, bool(MF)); + iprec->Assign(7, bool(DF)); return iprec; } @@ -415,14 +415,14 @@ RecordValPtr ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data) id_val->Assign(3, val_mgr->Port(dst_port, proto)); iprec->Assign(0, std::move(id_val)); - iprec->Assign(1, val_mgr->Count(ip_len)); - iprec->Assign(2, val_mgr->Count(proto)); - iprec->Assign(3, val_mgr->Count(frag_offset)); - iprec->Assign(4, val_mgr->Bool(bad_hdr_len)); + iprec->Assign(1, uint32_t(ip_len)); + iprec->Assign(2, uint32_t(proto)); + iprec->Assign(3, uint32_t(frag_offset)); + iprec->Assign(4, bool(bad_hdr_len)); // bad_checksum is always false since IPv6 layer doesn't have a checksum. - iprec->Assign(5, val_mgr->False()); - iprec->Assign(6, val_mgr->Bool(MF)); - iprec->Assign(7, val_mgr->Bool(DF)); + iprec->Assign(5, false); + iprec->Assign(6, bool(MF)); + iprec->Assign(7, bool(DF)); return iprec; } @@ -472,14 +472,14 @@ void ICMP_Analyzer::UpdateEndpointVal(const ValPtr& endp_arg, bool is_orig) if ( size < 0 ) { - endp->Assign(0, val_mgr->Count(0)); - endp->Assign(1, val_mgr->Count(int(ICMP_INACTIVE))); + endp->Assign(0, 0); + endp->Assign(1, int(ICMP_INACTIVE)); } else { - endp->Assign(0, val_mgr->Count(size)); - endp->Assign(1, val_mgr->Count(int(ICMP_ACTIVE))); + endp->Assign(0, size); + endp->Assign(1, int(ICMP_ACTIVE)); } } @@ -743,8 +743,8 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) } auto rv = make_intrusive(icmp6_nd_option_type); - rv->Assign(0, val_mgr->Count(type)); - rv->Assign(1, val_mgr->Count(length)); + rv->Assign(0, type); + rv->Assign(1, length); // Adjust length to be in units of bytes, exclude type/length fields. length = length * 8 - 2; @@ -763,7 +763,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) if ( caplen >= length ) { String* link_addr = new String(data, length, false); - rv->Assign(2, make_intrusive(link_addr)); + rv->Assign(2, link_addr); } else set_payload_field = true; @@ -783,11 +783,11 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) uint32_t valid_life = *((const uint32_t*)(data + 2)); uint32_t prefer_life = *((const uint32_t*)(data + 6)); in6_addr prefix = *((const in6_addr*)(data + 14)); - info->Assign(0, val_mgr->Count(prefix_len)); - info->Assign(1, val_mgr->Bool(L_flag)); - info->Assign(2, val_mgr->Bool(A_flag)); - info->Assign(3, make_intrusive((double)ntohl(valid_life), Seconds)); - info->Assign(4, make_intrusive((double)ntohl(prefer_life), Seconds)); + info->Assign(0, prefix_len); + info->Assign(1, L_flag); + info->Assign(2, A_flag); + info->AssignInterval(3, double(ntohl(valid_life))); + info->AssignInterval(4, double(ntohl(prefer_life))); info->Assign(5, make_intrusive(IPAddr(prefix))); rv->Assign(3, std::move(info)); } @@ -816,7 +816,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) // MTU option { if ( caplen >= 6 ) - rv->Assign(5, val_mgr->Count(ntohl(*((const uint32_t*)(data + 2))))); + rv->Assign(5, uint32_t(ntohl(*((const uint32_t*)(data + 2))))); else set_payload_field = true; @@ -833,7 +833,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) if ( set_payload_field ) { String* payload = new String(data, std::min((int)length, caplen), false); - rv->Assign(6, make_intrusive(payload)); + rv->Assign(6, payload); } data += length; diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc index 1b529f1bb9..afb2a4dde8 100644 --- a/src/analyzer/protocol/irc/IRC.cc +++ b/src/analyzer/protocol/irc/IRC.cc @@ -841,14 +841,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) for ( size_t i = 0; i < channels.size(); ++i ) { auto info = make_intrusive(irc_join_info); - info->Assign(0, make_intrusive(nickname.c_str())); - info->Assign(1, make_intrusive(channels[i].c_str())); + info->Assign(0, nickname); + info->Assign(1, channels[i]); if ( i < passwords.size() ) - info->Assign(2, make_intrusive(passwords[i].c_str())); + info->Assign(2, passwords[i]); else - info->Assign(2, make_intrusive(empty_string.c_str())); + info->Assign(2, empty_string); // User mode. - info->Assign(3, make_intrusive(empty_string.c_str())); + info->Assign(3, empty_string); list->Assign(std::move(info), nullptr); } @@ -903,12 +903,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) mode = "voice"; } - info->Assign(0, make_intrusive(nick.c_str())); - info->Assign(1, make_intrusive(channel.c_str())); + info->Assign(0, nick); + info->Assign(1, channel); // Password: - info->Assign(2, make_intrusive(empty_string.c_str())); + info->Assign(2, empty_string); // User mode: - info->Assign(3, make_intrusive(mode.c_str())); + info->Assign(3, mode); list->Assign(std::move(info), nullptr); } diff --git a/src/analyzer/protocol/krb/krb-analyzer.pac b/src/analyzer/protocol/krb/krb-analyzer.pac index ead1219a6e..708861d731 100644 --- a/src/analyzer/protocol/krb/krb-analyzer.pac +++ b/src/analyzer/protocol/krb/krb-analyzer.pac @@ -10,19 +10,19 @@ zeek::RecordValPtr proc_krb_kdc_options(const KRB_KDC_Options* opts) { auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::KDC_Options); - rv->Assign(0, zeek::val_mgr->Bool(opts->forwardable())); - rv->Assign(1, zeek::val_mgr->Bool(opts->forwarded())); - rv->Assign(2, zeek::val_mgr->Bool(opts->proxiable())); - rv->Assign(3, zeek::val_mgr->Bool(opts->proxy())); - rv->Assign(4, zeek::val_mgr->Bool(opts->allow_postdate())); - rv->Assign(5, zeek::val_mgr->Bool(opts->postdated())); - rv->Assign(6, zeek::val_mgr->Bool(opts->renewable())); - rv->Assign(7, zeek::val_mgr->Bool(opts->opt_hardware_auth())); - rv->Assign(8, zeek::val_mgr->Bool(opts->disable_transited_check())); - rv->Assign(9, zeek::val_mgr->Bool(opts->renewable_ok())); - rv->Assign(10, zeek::val_mgr->Bool(opts->enc_tkt_in_skey())); - rv->Assign(11, zeek::val_mgr->Bool(opts->renew())); - rv->Assign(12, zeek::val_mgr->Bool(opts->validate())); + rv->Assign(0, bool(opts->forwardable())); + rv->Assign(1, bool(opts->forwarded())); + rv->Assign(2, bool(opts->proxiable())); + rv->Assign(3, bool(opts->proxy())); + rv->Assign(4, bool(opts->allow_postdate())); + rv->Assign(5, bool(opts->postdated())); + rv->Assign(6, bool(opts->renewable())); + rv->Assign(7, bool(opts->opt_hardware_auth())); + rv->Assign(8, bool(opts->disable_transited_check())); + rv->Assign(9, bool(opts->renewable_ok())); + rv->Assign(10, bool(opts->enc_tkt_in_skey())); + rv->Assign(11, bool(opts->renew())); + rv->Assign(12, bool(opts->validate())); return rv; } @@ -259,8 +259,8 @@ refine connection KRB_Conn += { if ( krb_ap_request ) { auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::AP_Options); - rv->Assign(0, zeek::val_mgr->Bool(${msg.ap_options.use_session_key})); - rv->Assign(1, zeek::val_mgr->Bool(${msg.ap_options.mutual_required})); + rv->Assign(0, bool(${msg.ap_options.use_session_key})); + rv->Assign(1, bool(${msg.ap_options.mutual_required})); auto rvticket = proc_ticket(${msg.ticket}); auto authenticationinfo = zeek_analyzer()->GetAuthenticationInfo( diff --git a/src/analyzer/protocol/krb/krb-padata.pac b/src/analyzer/protocol/krb/krb-padata.pac index ccf55a4302..33667cca41 100644 --- a/src/analyzer/protocol/krb/krb-padata.pac +++ b/src/analyzer/protocol/krb/krb-padata.pac @@ -37,7 +37,7 @@ zeek::VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const ZeekAnaly case PA_PW_SALT: { auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); - type_val->Assign(0, zeek::val_mgr->Count(element->data_type())); + type_val->Assign(0, uint64_t(data_type)); type_val->Assign(1, to_stringval(element->pa_data_element()->pa_pw_salt()->encoding()->content())); vv->Assign(vv->Size(), std::move(type_val)); break; @@ -45,7 +45,7 @@ zeek::VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const ZeekAnaly case PA_ENCTYPE_INFO: { auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); - type_val->Assign(0, zeek::val_mgr->Count(element->data_type())); + type_val->Assign(0, uint64_t(data_type)); type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info()->salt())); vv->Assign(vv->Size(), std::move(type_val)); break; @@ -53,7 +53,7 @@ zeek::VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const ZeekAnaly case PA_ENCTYPE_INFO2: { auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); - type_val->Assign(0, zeek::val_mgr->Count(element->data_type())); + type_val->Assign(0, uint64_t(data_type)); type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info2()->salt())); vv->Assign(vv->Size(), std::move(type_val)); break; @@ -113,7 +113,7 @@ zeek::VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const ZeekAnaly if ( ! is_error && element->pa_data_element()->unknown()->meta()->length() > 0 ) { auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); - type_val->Assign(0, zeek::val_mgr->Count(element->data_type())); + type_val->Assign(0, uint64_t(data_type)); type_val->Assign(1, to_stringval(element->pa_data_element()->unknown()->content())); vv->Assign(vv->Size(), std::move(type_val)); } diff --git a/src/analyzer/protocol/modbus/modbus-analyzer.pac b/src/analyzer/protocol/modbus/modbus-analyzer.pac index 5701529272..ccadd55a63 100644 --- a/src/analyzer/protocol/modbus/modbus-analyzer.pac +++ b/src/analyzer/protocol/modbus/modbus-analyzer.pac @@ -30,10 +30,10 @@ zeek::RecordValPtr HeaderToVal(ModbusTCP_TransportHeader* header) { auto modbus_header = zeek::make_intrusive(zeek::BifType::Record::ModbusHeaders); - modbus_header->Assign(0, zeek::val_mgr->Count(header->tid())); - modbus_header->Assign(1, zeek::val_mgr->Count(header->pid())); - modbus_header->Assign(2, zeek::val_mgr->Count(header->uid())); - modbus_header->Assign(3, zeek::val_mgr->Count(header->fc())); + modbus_header->Assign(0, header->tid()); + modbus_header->Assign(1, header->pid()); + modbus_header->Assign(2, header->uid()); + modbus_header->Assign(3, header->fc()); return modbus_header; } diff --git a/src/analyzer/protocol/mqtt/commands/connack.pac b/src/analyzer/protocol/mqtt/commands/connack.pac index dcc8da5858..bf810e6ab4 100644 --- a/src/analyzer/protocol/mqtt/commands/connack.pac +++ b/src/analyzer/protocol/mqtt/commands/connack.pac @@ -16,8 +16,8 @@ refine flow MQTT_Flow += { if ( mqtt_connack ) { auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::ConnectAckMsg); - m->Assign(0, zeek::val_mgr->Count(${msg.return_code})); - m->Assign(1, zeek::val_mgr->Bool(${msg.session_present})); + m->Assign(0, ${msg.return_code}); + m->Assign(1, bool(${msg.session_present})); zeek::BifEvent::enqueue_mqtt_connack(connection()->zeek_analyzer(), connection()->zeek_analyzer()->Conn(), std::move(m)); diff --git a/src/analyzer/protocol/mqtt/commands/connect.pac b/src/analyzer/protocol/mqtt/commands/connect.pac index b6db5864f7..22d78a713d 100644 --- a/src/analyzer/protocol/mqtt/commands/connect.pac +++ b/src/analyzer/protocol/mqtt/commands/connect.pac @@ -47,14 +47,14 @@ refine flow MQTT_Flow += { auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::ConnectMsg); m->Assign(0, zeek::make_intrusive(${msg.protocol_name.str}.length(), reinterpret_cast(${msg.protocol_name.str}.begin()))); - m->Assign(1, zeek::val_mgr->Count(${msg.protocol_version})); + m->Assign(1, ${msg.protocol_version}); m->Assign(2, zeek::make_intrusive(${msg.client_id.str}.length(), reinterpret_cast(${msg.client_id.str}.begin()))); - m->Assign(3, zeek::make_intrusive(double(${msg.keep_alive}), Seconds)); + m->AssignInterval(3, double(${msg.keep_alive})); - m->Assign(4, zeek::val_mgr->Bool(${msg.clean_session})); - m->Assign(5, zeek::val_mgr->Bool(${msg.will_retain})); - m->Assign(6, zeek::val_mgr->Count(${msg.will_qos})); + m->Assign(4, bool(${msg.clean_session})); + m->Assign(5, bool(${msg.will_retain})); + m->Assign(6, ${msg.will_qos}); if ( ${msg.will_flag} ) { diff --git a/src/analyzer/protocol/mqtt/commands/publish.pac b/src/analyzer/protocol/mqtt/commands/publish.pac index af1513bbb2..c2868b8fa4 100644 --- a/src/analyzer/protocol/mqtt/commands/publish.pac +++ b/src/analyzer/protocol/mqtt/commands/publish.pac @@ -24,9 +24,9 @@ refine flow MQTT_Flow += { if ( mqtt_publish ) { auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::PublishMsg); - m->Assign(0, zeek::val_mgr->Bool(${msg.dup})); - m->Assign(1, zeek::val_mgr->Count(${msg.qos})); - m->Assign(2, zeek::val_mgr->Bool(${msg.retain})); + m->Assign(0, bool(${msg.dup})); + m->Assign(1, ${msg.qos}); + m->Assign(2, bool(${msg.retain})); m->Assign(3, ${msg.topic.str}.length(), reinterpret_cast(${msg.topic.str}.begin())); @@ -40,7 +40,7 @@ refine flow MQTT_Flow += { m->Assign(4, len, reinterpret_cast(${msg.payload}.begin())); - m->Assign(5, zeek::val_mgr->Count(${msg.payload}.length())); + m->Assign(5, ${msg.payload}.length()); zeek::BifEvent::enqueue_mqtt_publish(connection()->zeek_analyzer(), connection()->zeek_analyzer()->Conn(), diff --git a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac index 6501cc649b..4cb534da4b 100644 --- a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac +++ b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac @@ -20,10 +20,10 @@ zeek::RecordValPtr build_version_record(NTLM_Version* val) { auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Version); - result->Assign(0, zeek::val_mgr->Count(${val.major_version})); - result->Assign(1, zeek::val_mgr->Count(${val.minor_version})); - result->Assign(2, zeek::val_mgr->Count(${val.build_number})); - result->Assign(3, zeek::val_mgr->Count(${val.ntlm_revision})); + result->Assign(0, ${val.major_version}); + result->Assign(1, ${val.minor_version}); + result->Assign(2, ${val.build_number}); + result->Assign(3, ${val.ntlm_revision}); return result; } @@ -31,28 +31,28 @@ zeek::RecordValPtr build_negotiate_flag_record(NTLM_Negotiate_Flags* val) { auto flags = zeek::make_intrusive(zeek::BifType::Record::NTLM::NegotiateFlags); - flags->Assign(0, zeek::val_mgr->Bool(${val.negotiate_56})); - flags->Assign(1, zeek::val_mgr->Bool(${val.negotiate_key_exch})); - flags->Assign(2, zeek::val_mgr->Bool(${val.negotiate_128})); - flags->Assign(3, zeek::val_mgr->Bool(${val.negotiate_version})); - flags->Assign(4, zeek::val_mgr->Bool(${val.negotiate_target_info})); - flags->Assign(5, zeek::val_mgr->Bool(${val.request_non_nt_session_key})); - flags->Assign(6, zeek::val_mgr->Bool(${val.negotiate_identify})); - flags->Assign(7, zeek::val_mgr->Bool(${val.negotiate_extended_sessionsecurity})); - flags->Assign(8, zeek::val_mgr->Bool(${val.target_type_server})); - flags->Assign(9, zeek::val_mgr->Bool(${val.target_type_domain})); - flags->Assign(10, zeek::val_mgr->Bool(${val.negotiate_always_sign})); - flags->Assign(11, zeek::val_mgr->Bool(${val.negotiate_oem_workstation_supplied})); - flags->Assign(12, zeek::val_mgr->Bool(${val.negotiate_oem_domain_supplied})); - flags->Assign(13, zeek::val_mgr->Bool(${val.negotiate_anonymous_connection})); - flags->Assign(14, zeek::val_mgr->Bool(${val.negotiate_ntlm})); - flags->Assign(15, zeek::val_mgr->Bool(${val.negotiate_lm_key})); - flags->Assign(16, zeek::val_mgr->Bool(${val.negotiate_datagram})); - flags->Assign(17, zeek::val_mgr->Bool(${val.negotiate_seal})); - flags->Assign(18, zeek::val_mgr->Bool(${val.negotiate_sign})); - flags->Assign(19, zeek::val_mgr->Bool(${val.request_target})); - flags->Assign(20, zeek::val_mgr->Bool(${val.negotiate_oem})); - flags->Assign(21, zeek::val_mgr->Bool(${val.negotiate_unicode})); + flags->Assign(0, bool(${val.negotiate_56})); + flags->Assign(1, bool(${val.negotiate_key_exch})); + flags->Assign(2, bool(${val.negotiate_128})); + flags->Assign(3, bool(${val.negotiate_version})); + flags->Assign(4, bool(${val.negotiate_target_info})); + flags->Assign(5, bool(${val.request_non_nt_session_key})); + flags->Assign(6, bool(${val.negotiate_identify})); + flags->Assign(7, bool(${val.negotiate_extended_sessionsecurity})); + flags->Assign(8, bool(${val.target_type_server})); + flags->Assign(9, bool(${val.target_type_domain})); + flags->Assign(10, bool(${val.negotiate_always_sign})); + flags->Assign(11, bool(${val.negotiate_oem_workstation_supplied})); + flags->Assign(12, bool(${val.negotiate_oem_domain_supplied})); + flags->Assign(13, bool(${val.negotiate_anonymous_connection})); + flags->Assign(14, bool(${val.negotiate_ntlm})); + flags->Assign(15, bool(${val.negotiate_lm_key})); + flags->Assign(16, bool(${val.negotiate_datagram})); + flags->Assign(17, bool(${val.negotiate_seal})); + flags->Assign(18, bool(${val.negotiate_sign})); + flags->Assign(19, bool(${val.request_target})); + flags->Assign(20, bool(${val.negotiate_oem})); + flags->Assign(21, bool(${val.negotiate_unicode})); return flags; } @@ -96,13 +96,13 @@ refine connection NTLM_Conn += { result->Assign(4, utf16_to_utf8_val(zeek_analyzer()->Conn(), ${val.pairs[i].dns_tree_name.data})); break; case 6: - result->Assign(5, zeek::val_mgr->Bool(${val.pairs[i].constrained_auth})); + result->Assign(5, bool(${val.pairs[i].constrained_auth})); break; case 7: result->Assign(6, filetime2zeektime(${val.pairs[i].timestamp})); break; case 8: - result->Assign(7, zeek::val_mgr->Count(${val.pairs[i].single_host.machine_id})); + result->Assign(7, ${val.pairs[i].single_host.machine_id}); break; case 9: result->Assign(8, utf16_to_utf8_val(zeek_analyzer()->Conn(), ${val.pairs[i].target_name.data})); diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index 41906dd075..c00c23b3d1 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -36,9 +36,9 @@ { auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::StandardMessage); - rv->Assign(0, zeek::val_mgr->Count(${nsm.stratum})); - rv->Assign(1, zeek::make_intrusive(pow(2, ${nsm.poll}))); - rv->Assign(2, zeek::make_intrusive(pow(2, ${nsm.precision}))); + rv->Assign(0, ${nsm.stratum}); + rv->AssignInterval(1, pow(2, ${nsm.poll})); + rv->AssignInterval(2, pow(2, ${nsm.precision})); rv->Assign(3, proc_ntp_short(${nsm.root_delay})); rv->Assign(4, proc_ntp_short(${nsm.root_dispersion})); @@ -66,19 +66,19 @@ if ( ${nsm.mac_len} == 20 ) { - rv->Assign(12, zeek::val_mgr->Count(${nsm.mac.key_id})); + rv->Assign(12, ${nsm.mac.key_id}); rv->Assign(13, to_stringval(${nsm.mac.digest})); } else if ( ${nsm.mac_len} == 24 ) { - rv->Assign(12, zeek::val_mgr->Count(${nsm.mac_ext.key_id})); + rv->Assign(12, ${nsm.mac_ext.key_id}); rv->Assign(13, to_stringval(${nsm.mac_ext.digest})); } if ( ${nsm.has_exts} ) { // TODO: add extension fields - rv->Assign(14, zeek::val_mgr->Count((uint32) ${nsm.exts}->size())); + rv->Assign(14, (uint32) ${nsm.exts}->size()); } return rv; @@ -89,20 +89,20 @@ { auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::ControlMessage); - rv->Assign(0, zeek::val_mgr->Count(${ncm.OpCode})); - rv->Assign(1, zeek::val_mgr->Bool(${ncm.R})); - rv->Assign(2, zeek::val_mgr->Bool(${ncm.E})); - rv->Assign(3, zeek::val_mgr->Bool(${ncm.M})); - rv->Assign(4, zeek::val_mgr->Count(${ncm.sequence})); - rv->Assign(5, zeek::val_mgr->Count(${ncm.status})); - rv->Assign(6, zeek::val_mgr->Count(${ncm.association_id})); + rv->Assign(0, ${ncm.OpCode}); + rv->Assign(1, bool(${ncm.R})); + rv->Assign(2, bool(${ncm.E})); + rv->Assign(3, bool(${ncm.M})); + rv->Assign(4, ${ncm.sequence}); + rv->Assign(5, ${ncm.status}); + rv->Assign(6, ${ncm.association_id}); if ( ${ncm.c} > 0 ) rv->Assign(7, to_stringval(${ncm.data})); if ( ${ncm.has_control_mac} ) { - rv->Assign(8, zeek::val_mgr->Count(${ncm.mac.key_id})); + rv->Assign(8, ${ncm.mac.key_id}); rv->Assign(9, to_stringval(${ncm.mac.crypto_checksum})); } @@ -114,11 +114,11 @@ { auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::Mode7Message); - rv->Assign(0, zeek::val_mgr->Count(${m7.request_code})); - rv->Assign(1, zeek::val_mgr->Bool(${m7.auth_bit})); - rv->Assign(2, zeek::val_mgr->Count(${m7.sequence})); - rv->Assign(3, zeek::val_mgr->Count(${m7.implementation})); - rv->Assign(4, zeek::val_mgr->Count(${m7.error_code})); + rv->Assign(0, ${m7.request_code}); + rv->Assign(1, bool(${m7.auth_bit})); + rv->Assign(2, ${m7.sequence}); + rv->Assign(3, ${m7.implementation}); + rv->Assign(4, ${m7.error_code}); if ( ${m7.data_len} > 0 ) rv->Assign(5, to_stringval(${m7.data})); @@ -139,8 +139,8 @@ refine flow NTP_Flow += { return false; auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::Message); - rv->Assign(0, zeek::val_mgr->Count(${msg.version})); - rv->Assign(1, zeek::val_mgr->Count(${msg.mode})); + rv->Assign(0, ${msg.version}); + rv->Assign(1, ${msg.mode}); // The standard record if ( ${msg.mode} >=1 && ${msg.mode} <= 5 ) diff --git a/src/analyzer/protocol/radius/radius-analyzer.pac b/src/analyzer/protocol/radius/radius-analyzer.pac index 20a2e93bef..59dc4a64ff 100644 --- a/src/analyzer/protocol/radius/radius-analyzer.pac +++ b/src/analyzer/protocol/radius/radius-analyzer.pac @@ -8,8 +8,8 @@ refine flow RADIUS_Flow += { return false; auto result = zeek::make_intrusive(zeek::BifType::Record::RADIUS::Message); - result->Assign(0, zeek::val_mgr->Count(${msg.code})); - result->Assign(1, zeek::val_mgr->Count(${msg.trans_id})); + result->Assign(0, ${msg.code}); + result->Assign(1, ${msg.trans_id}); result->Assign(2, to_stringval(${msg.authenticator})); if ( ${msg.attributes}->size() ) diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac index 3f4007824a..c3820813c8 100644 --- a/src/analyzer/protocol/rdp/rdp-analyzer.pac +++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac @@ -66,35 +66,35 @@ refine flow RDP_Flow += { if ( rdp_client_core_data ) { auto ec_flags = zeek::make_intrusive(zeek::BifType::Record::RDP::EarlyCapabilityFlags); - ec_flags->Assign(0, zeek::val_mgr->Bool(${ccore.SUPPORT_ERRINFO_PDU})); - ec_flags->Assign(1, zeek::val_mgr->Bool(${ccore.WANT_32BPP_SESSION})); - ec_flags->Assign(2, zeek::val_mgr->Bool(${ccore.SUPPORT_STATUSINFO_PDU})); - ec_flags->Assign(3, zeek::val_mgr->Bool(${ccore.STRONG_ASYMMETRIC_KEYS})); - ec_flags->Assign(4, zeek::val_mgr->Bool(${ccore.SUPPORT_MONITOR_LAYOUT_PDU})); - ec_flags->Assign(5, zeek::val_mgr->Bool(${ccore.SUPPORT_NETCHAR_AUTODETECT})); - ec_flags->Assign(6, zeek::val_mgr->Bool(${ccore.SUPPORT_DYNVC_GFX_PROTOCOL})); - ec_flags->Assign(7, zeek::val_mgr->Bool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE})); - ec_flags->Assign(8, zeek::val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU})); + ec_flags->Assign(0, bool(${ccore.SUPPORT_ERRINFO_PDU})); + ec_flags->Assign(1, bool(${ccore.WANT_32BPP_SESSION})); + ec_flags->Assign(2, bool(${ccore.SUPPORT_STATUSINFO_PDU})); + ec_flags->Assign(3, bool(${ccore.STRONG_ASYMMETRIC_KEYS})); + ec_flags->Assign(4, bool(${ccore.SUPPORT_MONITOR_LAYOUT_PDU})); + ec_flags->Assign(5, bool(${ccore.SUPPORT_NETCHAR_AUTODETECT})); + ec_flags->Assign(6, bool(${ccore.SUPPORT_DYNVC_GFX_PROTOCOL})); + ec_flags->Assign(7, bool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE})); + ec_flags->Assign(8, bool(${ccore.SUPPORT_HEARTBEAT_PDU})); auto ccd = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientCoreData); - ccd->Assign(0, zeek::val_mgr->Count(${ccore.version_major})); - ccd->Assign(1, zeek::val_mgr->Count(${ccore.version_minor})); - ccd->Assign(2, zeek::val_mgr->Count(${ccore.desktop_width})); - ccd->Assign(3, zeek::val_mgr->Count(${ccore.desktop_height})); - ccd->Assign(4, zeek::val_mgr->Count(${ccore.color_depth})); - ccd->Assign(5, zeek::val_mgr->Count(${ccore.sas_sequence})); - ccd->Assign(6, zeek::val_mgr->Count(${ccore.keyboard_layout})); - ccd->Assign(7, zeek::val_mgr->Count(${ccore.client_build})); + ccd->Assign(0, ${ccore.version_major}); + ccd->Assign(1, ${ccore.version_minor}); + ccd->Assign(2, ${ccore.desktop_width}); + ccd->Assign(3, ${ccore.desktop_height}); + ccd->Assign(4, ${ccore.color_depth}); + ccd->Assign(5, ${ccore.sas_sequence}); + ccd->Assign(6, ${ccore.keyboard_layout}); + ccd->Assign(7, ${ccore.client_build}); ccd->Assign(8, utf16_to_utf8_val(connection()->zeek_analyzer()->Conn(), ${ccore.client_name})); - ccd->Assign(9, zeek::val_mgr->Count(${ccore.keyboard_type})); - ccd->Assign(10, zeek::val_mgr->Count(${ccore.keyboard_sub})); - ccd->Assign(11, zeek::val_mgr->Count(${ccore.keyboard_function_key})); + ccd->Assign(9, ${ccore.keyboard_type}); + ccd->Assign(10, ${ccore.keyboard_sub}); + ccd->Assign(11, ${ccore.keyboard_function_key}); ccd->Assign(12, utf16_to_utf8_val(connection()->zeek_analyzer()->Conn(), ${ccore.ime_file_name})); - ccd->Assign(13, zeek::val_mgr->Count(${ccore.post_beta2_color_depth})); - ccd->Assign(14, zeek::val_mgr->Count(${ccore.client_product_id})); - ccd->Assign(15, zeek::val_mgr->Count(${ccore.serial_number})); - ccd->Assign(16, zeek::val_mgr->Count(${ccore.high_color_depth})); - ccd->Assign(17, zeek::val_mgr->Count(${ccore.supported_color_depths})); + ccd->Assign(13, ${ccore.post_beta2_color_depth}); + ccd->Assign(14, ${ccore.client_product_id}); + ccd->Assign(15, ${ccore.serial_number}); + ccd->Assign(16, ${ccore.high_color_depth}); + ccd->Assign(17, ${ccore.supported_color_depths}); ccd->Assign(18, std::move(ec_flags)); ccd->Assign(19, utf16_to_utf8_val(connection()->zeek_analyzer()->Conn(), ${ccore.dig_product_id})); @@ -112,8 +112,8 @@ refine flow RDP_Flow += { return false; auto csd = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientSecurityData); - csd->Assign(0, zeek::val_mgr->Count(${csec.encryption_methods})); - csd->Assign(1, zeek::val_mgr->Count(${csec.ext_encryption_methods})); + csd->Assign(0, ${csec.encryption_methods}); + csd->Assign(1, ${csec.ext_encryption_methods}); zeek::BifEvent::enqueue_rdp_client_security_data(connection()->zeek_analyzer(), connection()->zeek_analyzer()->Conn(), @@ -135,19 +135,19 @@ refine flow RDP_Flow += { auto channel_def = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientChannelDef); channel_def->Assign(0, to_stringval(${cnetwork.channel_def_array[i].name})); - channel_def->Assign(1, zeek::val_mgr->Count(${cnetwork.channel_def_array[i].options})); + channel_def->Assign(1, ${cnetwork.channel_def_array[i].options}); - channel_def->Assign(2, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED})); - channel_def->Assign(3, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP})); - channel_def->Assign(4, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_SC})); - channel_def->Assign(5, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_CS})); - channel_def->Assign(6, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_HIGH})); - channel_def->Assign(7, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_MED})); - channel_def->Assign(8, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_LOW})); - channel_def->Assign(9, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS_RDP})); - channel_def->Assign(10, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS})); - channel_def->Assign(11, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_SHOW_PROTOCOL})); - channel_def->Assign(12, zeek::val_mgr->Bool(${cnetwork.channel_def_array[i].REMOTE_CONTROL_PERSISTENT})); + channel_def->Assign(2, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED})); + channel_def->Assign(3, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP})); + channel_def->Assign(4, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_SC})); + channel_def->Assign(5, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_CS})); + channel_def->Assign(6, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_HIGH})); + channel_def->Assign(7, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_MED})); + channel_def->Assign(8, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_LOW})); + channel_def->Assign(9, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS_RDP})); + channel_def->Assign(10, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS})); + channel_def->Assign(11, bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_SHOW_PROTOCOL})); + channel_def->Assign(12, bool(${cnetwork.channel_def_array[i].REMOTE_CONTROL_PERSISTENT})); channels->Assign(channels->Size(), std::move(channel_def)); } @@ -166,12 +166,12 @@ refine flow RDP_Flow += { return false; auto ccld = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientClusterData); - ccld->Assign(0, zeek::val_mgr->Count(${ccluster.flags})); - ccld->Assign(1, zeek::val_mgr->Count(${ccluster.redir_session_id})); - ccld->Assign(2, zeek::val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED})); - ccld->Assign(3, zeek::val_mgr->Count(${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK})); - ccld->Assign(4, zeek::val_mgr->Bool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID})); - ccld->Assign(5, zeek::val_mgr->Bool(${ccluster.REDIRECTED_SMARTCARD})); + ccld->Assign(0, ${ccluster.flags}); + ccld->Assign(1, ${ccluster.redir_session_id}); + ccld->Assign(2, bool(${ccluster.REDIRECTION_SUPPORTED})); + ccld->Assign(3, ${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK}); + ccld->Assign(4, bool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID})); + ccld->Assign(5, bool(${ccluster.REDIRECTED_SMARTCARD})); zeek::BifEvent::enqueue_rdp_client_cluster_data(connection()->zeek_analyzer(), connection()->zeek_analyzer()->Conn(), diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc index d857d37288..def96ed3e1 100644 --- a/src/analyzer/protocol/rpc/MOUNT.cc +++ b/src/analyzer/protocol/rpc/MOUNT.cc @@ -188,16 +188,16 @@ Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c, auto info = make_intrusive(BifType::Record::MOUNT3::info_t); info->Assign(0, BifType::Enum::rpc_status->GetEnumVal(rpc_status)); info->Assign(1, BifType::Enum::MOUNT3::status_t->GetEnumVal(mount_status)); - info->Assign(2, make_intrusive(c->StartTime())); - info->Assign(3, make_intrusive(c->LastTime() - c->StartTime())); - info->Assign(4, val_mgr->Count(c->RPCLen())); - info->Assign(5, make_intrusive(rep_start_time)); - info->Assign(6, make_intrusive(rep_last_time - rep_start_time)); - info->Assign(7, val_mgr->Count(reply_len)); - info->Assign(8, val_mgr->Count(c->Uid())); - info->Assign(9, val_mgr->Count(c->Gid())); - info->Assign(10, val_mgr->Count(c->Stamp())); - info->Assign(11, make_intrusive(c->MachineName())); + info->AssignTime(2, c->StartTime()); + info->AssignInterval(3, c->LastTime() - c->StartTime()); + info->Assign(4, c->RPCLen()); + info->AssignTime(5, rep_start_time); + info->AssignInterval(6, rep_last_time - rep_start_time); + info->Assign(7, reply_len); + info->Assign(8, c->Uid()); + info->Assign(9, c->Gid()); + info->Assign(10, c->Stamp()); + info->Assign(11, c->MachineName()); info->Assign(12, std::move(auxgids)); vl.emplace_back(std::move(info)); @@ -259,7 +259,7 @@ RecordValPtr MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n, auth_flavors_count = max_auth_flavors; } - auto enum_vector = make_intrusive(base_type(TYPE_ENUM)); + auto enum_vector = make_intrusive(BifType::Enum::MOUNT3::auth_flavor_t); auto auth_flavors = make_intrusive(std::move(enum_vector)); for ( auto i = 0u; i < auth_flavors_count; ++i ) diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc index 589f3ac1bd..d8ca614538 100644 --- a/src/analyzer/protocol/rpc/NFS.cc +++ b/src/analyzer/protocol/rpc/NFS.cc @@ -321,16 +321,16 @@ Args NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status auto info = make_intrusive(BifType::Record::NFS3::info_t); info->Assign(0, BifType::Enum::rpc_status->GetEnumVal(rpc_status)); info->Assign(1, BifType::Enum::NFS3::status_t->GetEnumVal(nfs_status)); - info->Assign(2, make_intrusive(c->StartTime())); - info->Assign(3, make_intrusive(c->LastTime()-c->StartTime())); - info->Assign(4, val_mgr->Count(c->RPCLen())); - info->Assign(5, make_intrusive(rep_start_time)); - info->Assign(6, make_intrusive(rep_last_time-rep_start_time)); - info->Assign(7, val_mgr->Count(reply_len)); - info->Assign(8, val_mgr->Count(c->Uid())); - info->Assign(9, val_mgr->Count(c->Gid())); - info->Assign(10, val_mgr->Count(c->Stamp())); - info->Assign(11, make_intrusive(c->MachineName())); + info->AssignTime(2, c->StartTime()); + info->AssignInterval(3, c->LastTime()-c->StartTime()); + info->Assign(4, c->RPCLen()); + info->AssignTime(5, rep_start_time); + info->AssignInterval(6, rep_last_time-rep_start_time); + info->Assign(7, reply_len); + info->Assign(8, c->Uid()); + info->Assign(9, c->Gid()); + info->Assign(10, c->Stamp()); + info->Assign(11, c->MachineName()); info->Assign(12, std::move(auxgids)); vl.emplace_back(std::move(info)); @@ -554,7 +554,7 @@ RecordValPtr NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NF rep->Assign(0, nfs3_post_op_attr(buf, n)); bytes_read = extract_XDR_uint32(buf, n); - rep->Assign(1, val_mgr->Count(bytes_read)); + rep->Assign(1, bytes_read); rep->Assign(2, ExtractBool(buf, n)); rep->Assign(3, nfs3_file_data(buf, n, offset, bytes_read)); } @@ -637,9 +637,9 @@ RecordValPtr NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n) writeargs->Assign(0, nfs3_fh(buf, n)); offset = extract_XDR_uint64(buf, n); - writeargs->Assign(1, val_mgr->Count(offset)); // offset + writeargs->Assign(1, offset); // offset bytes = extract_XDR_uint32(buf, n); - writeargs->Assign(2, val_mgr->Count(bytes)); // size + writeargs->Assign(2, bytes); // size writeargs->Assign(3, nfs3_stable_how(buf, n)); writeargs->Assign(4, nfs3_file_data(buf, n, offset, bytes)); @@ -722,7 +722,7 @@ RecordValPtr NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n { auto args = make_intrusive(BifType::Record::NFS3::readdirargs_t); - args->Assign(0, val_mgr->Bool(isplus)); + args->Assign(0, isplus); args->Assign(1, nfs3_fh(buf, n)); args->Assign(2, ExtractUint64(buf,n)); // cookie args->Assign(3, ExtractUint64(buf,n)); // cookieverf @@ -739,7 +739,7 @@ RecordValPtr NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf, { auto rep = make_intrusive(BifType::Record::NFS3::readdir_reply_t); - rep->Assign(0, val_mgr->Bool(isplus)); + rep->Assign(0, isplus); if ( status == BifEnum::NFS3::NFS3ERR_OK ) { @@ -779,29 +779,29 @@ RecordValPtr NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf, return rep; } -ValPtr NFS_Interp::ExtractUint32(const u_char*& buf, int& n) +uint32_t NFS_Interp::ExtractUint32(const u_char*& buf, int& n) { - return val_mgr->Count(extract_XDR_uint32(buf, n)); + return extract_XDR_uint32(buf, n); } -ValPtr NFS_Interp::ExtractUint64(const u_char*& buf, int& n) +uint64_t NFS_Interp::ExtractUint64(const u_char*& buf, int& n) { - return val_mgr->Count(extract_XDR_uint64(buf, n)); + return extract_XDR_uint64(buf, n); } -ValPtr NFS_Interp::ExtractTime(const u_char*& buf, int& n) +double NFS_Interp::ExtractTime(const u_char*& buf, int& n) { - return make_intrusive(extract_XDR_time(buf, n)); + return extract_XDR_time(buf, n); } -ValPtr NFS_Interp::ExtractInterval(const u_char*& buf, int& n) +double NFS_Interp::ExtractInterval(const u_char*& buf, int& n) { - return make_intrusive(double(extract_XDR_uint32(buf, n)), 1.0); + return double(extract_XDR_uint32(buf, n)); } -ValPtr NFS_Interp::ExtractBool(const u_char*& buf, int& n) +bool NFS_Interp::ExtractBool(const u_char*& buf, int& n) { - return val_mgr->Bool(extract_XDR_uint32(buf, n)); + return extract_XDR_uint32(buf, n); } } // namespace detail diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h index 3082ffffe7..0082b1da31 100644 --- a/src/analyzer/protocol/rpc/NFS.h +++ b/src/analyzer/protocol/rpc/NFS.h @@ -73,11 +73,11 @@ protected: // * size is the amount of bytes read (or requested to be written), StringValPtr nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size); - ValPtr ExtractUint32(const u_char*& buf, int& n); - ValPtr ExtractUint64(const u_char*& buf, int& n); - ValPtr ExtractTime(const u_char*& buf, int& n); - ValPtr ExtractInterval(const u_char*& buf, int& n); - ValPtr ExtractBool(const u_char*& buf, int& n); + uint32_t ExtractUint32(const u_char*& buf, int& n); + uint64_t ExtractUint64(const u_char*& buf, int& n); + double ExtractTime(const u_char*& buf, int& n); + double ExtractInterval(const u_char*& buf, int& n); + bool ExtractBool(const u_char*& buf, int& n); }; } // namespace detail diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc index 3d0893a363..4b47f894e5 100644 --- a/src/analyzer/protocol/rpc/Portmap.cc +++ b/src/analyzer/protocol/rpc/Portmap.cc @@ -195,8 +195,8 @@ ValPtr PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) static auto pm_mapping = id::find_type("pm_mapping"); auto mapping = make_intrusive(pm_mapping); - mapping->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); - mapping->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len))); + mapping->Assign(0, extract_XDR_uint32(buf, len)); + mapping->Assign(1, extract_XDR_uint32(buf, len)); bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP; uint32_t port = extract_XDR_uint32(buf, len); @@ -213,11 +213,11 @@ ValPtr PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) static auto pm_port_request = id::find_type("pm_port_request"); auto pr = make_intrusive(pm_port_request); - pr->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); - pr->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len))); + pr->Assign(0, extract_XDR_uint32(buf, len)); + pr->Assign(1, extract_XDR_uint32(buf, len)); bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP; - pr->Assign(2, val_mgr->Bool(is_tcp)); + pr->Assign(2, bool(is_tcp)); (void) extract_XDR_uint32(buf, len); // consume the bogus port if ( ! buf ) @@ -231,13 +231,13 @@ ValPtr PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len) static auto pm_callit_request = id::find_type("pm_callit_request"); auto c = make_intrusive(pm_callit_request); - c->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); - c->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len))); - c->Assign(2, val_mgr->Count(extract_XDR_uint32(buf, len))); + c->Assign(0, extract_XDR_uint32(buf, len)); + c->Assign(1, extract_XDR_uint32(buf, len)); + c->Assign(2, extract_XDR_uint32(buf, len)); int arg_n; (void) extract_XDR_opaque(buf, len, arg_n); - c->Assign(3, val_mgr->Count(arg_n)); + c->Assign(3, arg_n); if ( ! buf ) return nullptr; diff --git a/src/analyzer/protocol/smb/smb-time.pac b/src/analyzer/protocol/smb/smb-time.pac index 3f163b21a0..51a5e6c9a9 100644 --- a/src/analyzer/protocol/smb/smb-time.pac +++ b/src/analyzer/protocol/smb/smb-time.pac @@ -1,21 +1,20 @@ %header{ -zeek::ValPtr filetime2zeektime(uint64_t ts); -zeek::ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz); +double filetime2zeektime(uint64_t ts); +double time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz); zeek::RecordValPtr SMB_BuildMACTimes(uint64_t modify, uint64_t access, uint64_t create, uint64_t change); %} %code{ -zeek::ValPtr filetime2zeektime(uint64_t ts) +double filetime2zeektime(uint64_t ts) { // Zeek can't support times back to the 1600's // so we subtract a lot of seconds. - double secs = (ts / 10000000.0L) - 11644473600.0L; - return zeek::make_intrusive(secs); + return (ts / 10000000.0L) - 11644473600.0L; } -zeek::ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz) +double time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz) { tm lTime; lTime.tm_sec = ${t.two_seconds} * 2; @@ -25,8 +24,7 @@ zeek::ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz) lTime.tm_mon = ${d.month}; lTime.tm_year = 1980 + ${d.year}; lTime.tm_isdst = -1; - double lResult = mktime(&lTime); - return zeek::make_intrusive(lResult + tz); + return mktime(&lTime) + tz; } zeek::RecordValPtr SMB_BuildMACTimes(uint64_t modify, uint64_t access, diff --git a/src/analyzer/protocol/smb/smb1-com-negotiate.pac b/src/analyzer/protocol/smb/smb1-com-negotiate.pac index 0a576e7a61..ee5f70b06a 100644 --- a/src/analyzer/protocol/smb/smb1-com-negotiate.pac +++ b/src/analyzer/protocol/smb/smb1-com-negotiate.pac @@ -42,7 +42,7 @@ refine connection SMB_Conn += { case 0x01: { auto core = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseCore); - core->Assign(0, zeek::val_mgr->Count(${val.dialect_index})); + core->Assign(0, ${val.dialect_index}); response->Assign(0, std::move(core)); } @@ -51,23 +51,23 @@ refine connection SMB_Conn += { case 0x0d: { auto security = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseSecurity); - security->Assign(0, zeek::val_mgr->Bool(${val.lanman.security_user_level})); - security->Assign(1, zeek::val_mgr->Bool(${val.lanman.security_challenge_response})); + security->Assign(0, bool(${val.lanman.security_user_level})); + security->Assign(1, bool(${val.lanman.security_challenge_response})); auto raw = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateRawMode); - raw->Assign(0, zeek::val_mgr->Bool(${val.lanman.raw_read_supported})); - raw->Assign(1, zeek::val_mgr->Bool(${val.lanman.raw_write_supported})); + raw->Assign(0, bool(${val.lanman.raw_read_supported})); + raw->Assign(1, bool(${val.lanman.raw_write_supported})); auto lanman = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseLANMAN); - lanman->Assign(0, zeek::val_mgr->Count(${val.word_count})); - lanman->Assign(1, zeek::val_mgr->Count(${val.dialect_index})); + lanman->Assign(0, ${val.word_count}); + lanman->Assign(1, ${val.dialect_index}); lanman->Assign(2, std::move(security)); - lanman->Assign(3, zeek::val_mgr->Count(${val.lanman.max_buffer_size})); - lanman->Assign(4, zeek::val_mgr->Count(${val.lanman.max_mpx_count})); + lanman->Assign(3, ${val.lanman.max_buffer_size}); + lanman->Assign(4, ${val.lanman.max_mpx_count}); - lanman->Assign(5, zeek::val_mgr->Count(${val.lanman.max_number_vcs})); + lanman->Assign(5, ${val.lanman.max_number_vcs}); lanman->Assign(6, std::move(raw)); - lanman->Assign(7, zeek::val_mgr->Count(${val.lanman.session_key})); + lanman->Assign(7, ${val.lanman.session_key}); lanman->Assign(8, time_from_lanman(${val.lanman.server_time}, ${val.lanman.server_date}, ${val.lanman.server_tz})); lanman->Assign(9, to_stringval(${val.lanman.encryption_key})); @@ -80,44 +80,44 @@ refine connection SMB_Conn += { case 0x11: { auto security = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseSecurity); - security->Assign(0, zeek::val_mgr->Bool(${val.ntlm.security_user_level})); - security->Assign(1, zeek::val_mgr->Bool(${val.ntlm.security_challenge_response})); - security->Assign(2, zeek::val_mgr->Bool(${val.ntlm.security_signatures_enabled})); - security->Assign(3, zeek::val_mgr->Bool(${val.ntlm.security_signatures_required})); + security->Assign(0, bool(${val.ntlm.security_user_level})); + security->Assign(1, bool(${val.ntlm.security_challenge_response})); + security->Assign(2, bool(${val.ntlm.security_signatures_enabled})); + security->Assign(3, bool(${val.ntlm.security_signatures_required})); auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateCapabilities); - capabilities->Assign(0, zeek::val_mgr->Bool(${val.ntlm.capabilities_raw_mode})); - capabilities->Assign(1, zeek::val_mgr->Bool(${val.ntlm.capabilities_mpx_mode})); - capabilities->Assign(2, zeek::val_mgr->Bool(${val.ntlm.capabilities_unicode})); - capabilities->Assign(3, zeek::val_mgr->Bool(${val.ntlm.capabilities_large_files})); - capabilities->Assign(4, zeek::val_mgr->Bool(${val.ntlm.capabilities_nt_smbs})); + capabilities->Assign(0, bool(${val.ntlm.capabilities_raw_mode})); + capabilities->Assign(1, bool(${val.ntlm.capabilities_mpx_mode})); + capabilities->Assign(2, bool(${val.ntlm.capabilities_unicode})); + capabilities->Assign(3, bool(${val.ntlm.capabilities_large_files})); + capabilities->Assign(4, bool(${val.ntlm.capabilities_nt_smbs})); - capabilities->Assign(5, zeek::val_mgr->Bool(${val.ntlm.capabilities_rpc_remote_apis})); - capabilities->Assign(6, zeek::val_mgr->Bool(${val.ntlm.capabilities_status32})); - capabilities->Assign(7, zeek::val_mgr->Bool(${val.ntlm.capabilities_level_2_oplocks})); - capabilities->Assign(8, zeek::val_mgr->Bool(${val.ntlm.capabilities_lock_and_read})); - capabilities->Assign(9, zeek::val_mgr->Bool(${val.ntlm.capabilities_nt_find})); + capabilities->Assign(5, bool(${val.ntlm.capabilities_rpc_remote_apis})); + capabilities->Assign(6, bool(${val.ntlm.capabilities_status32})); + capabilities->Assign(7, bool(${val.ntlm.capabilities_level_2_oplocks})); + capabilities->Assign(8, bool(${val.ntlm.capabilities_lock_and_read})); + capabilities->Assign(9, bool(${val.ntlm.capabilities_nt_find})); - capabilities->Assign(10, zeek::val_mgr->Bool(${val.ntlm.capabilities_dfs})); - capabilities->Assign(11, zeek::val_mgr->Bool(${val.ntlm.capabilities_infolevel_passthru})); - capabilities->Assign(12, zeek::val_mgr->Bool(${val.ntlm.capabilities_large_readx})); - capabilities->Assign(13, zeek::val_mgr->Bool(${val.ntlm.capabilities_large_writex})); - capabilities->Assign(14, zeek::val_mgr->Bool(${val.ntlm.capabilities_unix})); + capabilities->Assign(10, bool(${val.ntlm.capabilities_dfs})); + capabilities->Assign(11, bool(${val.ntlm.capabilities_infolevel_passthru})); + capabilities->Assign(12, bool(${val.ntlm.capabilities_large_readx})); + capabilities->Assign(13, bool(${val.ntlm.capabilities_large_writex})); + capabilities->Assign(14, bool(${val.ntlm.capabilities_unix})); - capabilities->Assign(15, zeek::val_mgr->Bool(${val.ntlm.capabilities_bulk_transfer})); - capabilities->Assign(16, zeek::val_mgr->Bool(${val.ntlm.capabilities_compressed_data})); - capabilities->Assign(17, zeek::val_mgr->Bool(${val.ntlm.capabilities_extended_security})); + capabilities->Assign(15, bool(${val.ntlm.capabilities_bulk_transfer})); + capabilities->Assign(16, bool(${val.ntlm.capabilities_compressed_data})); + capabilities->Assign(17, bool(${val.ntlm.capabilities_extended_security})); auto ntlm = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseNTLM); - ntlm->Assign(0, zeek::val_mgr->Count(${val.word_count})); - ntlm->Assign(1, zeek::val_mgr->Count(${val.dialect_index})); + ntlm->Assign(0, ${val.word_count}); + ntlm->Assign(1, ${val.dialect_index}); ntlm->Assign(2, std::move(security)); - ntlm->Assign(3, zeek::val_mgr->Count(${val.ntlm.max_buffer_size})); - ntlm->Assign(4, zeek::val_mgr->Count(${val.ntlm.max_mpx_count})); + ntlm->Assign(3, ${val.ntlm.max_buffer_size}); + ntlm->Assign(4, ${val.ntlm.max_mpx_count}); - ntlm->Assign(5, zeek::val_mgr->Count(${val.ntlm.max_number_vcs})); - ntlm->Assign(6, zeek::val_mgr->Count(${val.ntlm.max_raw_size})); - ntlm->Assign(7, zeek::val_mgr->Count(${val.ntlm.session_key})); + ntlm->Assign(5, ${val.ntlm.max_number_vcs}); + ntlm->Assign(6, ${val.ntlm.max_raw_size}); + ntlm->Assign(7, ${val.ntlm.session_key}); ntlm->Assign(8, std::move(capabilities)); ntlm->Assign(9, filetime2zeektime(${val.ntlm.server_time})); diff --git a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac index b6b51ac390..d80ca86c24 100644 --- a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac +++ b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac @@ -14,13 +14,13 @@ refine connection SMB_Conn += { { auto request = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXRequest); - request->Assign(0, zeek::val_mgr->Count(${val.word_count})); + request->Assign(0, ${val.word_count}); switch ( ${val.word_count} ) { case 10: // pre NT LM 0.12 - request->Assign(1, zeek::val_mgr->Count(${val.lanman.max_buffer_size})); - request->Assign(2, zeek::val_mgr->Count(${val.lanman.max_mpx_count})); - request->Assign(3, zeek::val_mgr->Count(${val.lanman.vc_number})); - request->Assign(4, zeek::val_mgr->Count(${val.lanman.session_key})); + request->Assign(1, ${val.lanman.max_buffer_size}); + request->Assign(2, ${val.lanman.max_mpx_count}); + request->Assign(3, ${val.lanman.vc_number}); + request->Assign(4, ${val.lanman.session_key}); request->Assign(5, smb_string2stringval(${val.lanman.native_os})); request->Assign(6, smb_string2stringval(${val.lanman.native_lanman})); @@ -32,17 +32,17 @@ refine connection SMB_Conn += { case 12: // NT LM 0.12 with extended security { auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities); - capabilities->Assign(0, zeek::val_mgr->Bool(${val.ntlm_extended_security.capabilities.unicode})); - capabilities->Assign(1, zeek::val_mgr->Bool(${val.ntlm_extended_security.capabilities.large_files})); - capabilities->Assign(2, zeek::val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_smbs})); - capabilities->Assign(3, zeek::val_mgr->Bool(${val.ntlm_extended_security.capabilities.status32})); - capabilities->Assign(4, zeek::val_mgr->Bool(${val.ntlm_extended_security.capabilities.level_2_oplocks})); - capabilities->Assign(5, zeek::val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_find})); + capabilities->Assign(0, bool(${val.ntlm_extended_security.capabilities.unicode})); + capabilities->Assign(1, bool(${val.ntlm_extended_security.capabilities.large_files})); + capabilities->Assign(2, bool(${val.ntlm_extended_security.capabilities.nt_smbs})); + capabilities->Assign(3, bool(${val.ntlm_extended_security.capabilities.status32})); + capabilities->Assign(4, bool(${val.ntlm_extended_security.capabilities.level_2_oplocks})); + capabilities->Assign(5, bool(${val.ntlm_extended_security.capabilities.nt_find})); - request->Assign(1, zeek::val_mgr->Count(${val.ntlm_extended_security.max_buffer_size})); - request->Assign(2, zeek::val_mgr->Count(${val.ntlm_extended_security.max_mpx_count})); - request->Assign(3, zeek::val_mgr->Count(${val.ntlm_extended_security.vc_number})); - request->Assign(4, zeek::val_mgr->Count(${val.ntlm_extended_security.session_key})); + request->Assign(1, ${val.ntlm_extended_security.max_buffer_size}); + request->Assign(2, ${val.ntlm_extended_security.max_mpx_count}); + request->Assign(3, ${val.ntlm_extended_security.vc_number}); + request->Assign(4, ${val.ntlm_extended_security.session_key}); request->Assign(5, smb_string2stringval(${val.ntlm_extended_security.native_os})); request->Assign(6, smb_string2stringval(${val.ntlm_extended_security.native_lanman})); @@ -54,17 +54,17 @@ refine connection SMB_Conn += { case 13: // NT LM 0.12 without extended security { auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities); - capabilities->Assign(0, zeek::val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.unicode})); - capabilities->Assign(1, zeek::val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.large_files})); - capabilities->Assign(2, zeek::val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_smbs})); - capabilities->Assign(3, zeek::val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.status32})); - capabilities->Assign(4, zeek::val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks})); - capabilities->Assign(5, zeek::val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_find})); + capabilities->Assign(0, bool(${val.ntlm_nonextended_security.capabilities.unicode})); + capabilities->Assign(1, bool(${val.ntlm_nonextended_security.capabilities.large_files})); + capabilities->Assign(2, bool(${val.ntlm_nonextended_security.capabilities.nt_smbs})); + capabilities->Assign(3, bool(${val.ntlm_nonextended_security.capabilities.status32})); + capabilities->Assign(4, bool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks})); + capabilities->Assign(5, bool(${val.ntlm_nonextended_security.capabilities.nt_find})); - request->Assign(1, zeek::val_mgr->Count(${val.ntlm_nonextended_security.max_buffer_size})); - request->Assign(2, zeek::val_mgr->Count(${val.ntlm_nonextended_security.max_mpx_count})); - request->Assign(3, zeek::val_mgr->Count(${val.ntlm_nonextended_security.vc_number})); - request->Assign(4, zeek::val_mgr->Count(${val.ntlm_nonextended_security.session_key})); + request->Assign(1, ${val.ntlm_nonextended_security.max_buffer_size}); + request->Assign(2, ${val.ntlm_nonextended_security.max_mpx_count}); + request->Assign(3, ${val.ntlm_nonextended_security.vc_number}); + request->Assign(4, ${val.ntlm_nonextended_security.session_key}); request->Assign(5, smb_string2stringval(${val.ntlm_nonextended_security.native_os})); request->Assign(6, smb_string2stringval(${val.ntlm_nonextended_security.native_lanman})); @@ -91,18 +91,18 @@ refine connection SMB_Conn += { if ( smb1_session_setup_andx_response ) { auto response = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXResponse); - response->Assign(0, zeek::val_mgr->Count(${val.word_count})); + response->Assign(0, ${val.word_count}); switch ( ${val.word_count} ) { case 3: // pre NT LM 0.12 - response->Assign(1, zeek::val_mgr->Bool(${val.lanman.is_guest})); + response->Assign(1, bool(${val.lanman.is_guest})); response->Assign(2, ${val.lanman.byte_count} == 0 ? zeek::val_mgr->EmptyString() : smb_string2stringval(${val.lanman.native_os[0]})); response->Assign(3, ${val.lanman.byte_count} == 0 ? zeek::val_mgr->EmptyString() : smb_string2stringval(${val.lanman.native_lanman[0]})); response->Assign(4, ${val.lanman.byte_count} == 0 ? zeek::val_mgr->EmptyString() : smb_string2stringval(${val.lanman.primary_domain[0]})); break; case 4: // NT LM 0.12 - response->Assign(1, zeek::val_mgr->Bool(${val.ntlm.is_guest})); + response->Assign(1, bool(${val.ntlm.is_guest})); response->Assign(2, smb_string2stringval(${val.ntlm.native_os})); response->Assign(3, smb_string2stringval(${val.ntlm.native_lanman})); //response->Assign(4, smb_string2stringval(${val.ntlm.primary_domain})); diff --git a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac index 0bb7c4f1e7..c4a102a2b7 100644 --- a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac +++ b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac @@ -6,14 +6,14 @@ refine connection SMB_Conn += { return false; auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans_Sec_Args); - args->Assign(0, zeek::val_mgr->Count(${val.total_param_count})); - args->Assign(1, zeek::val_mgr->Count(${val.total_data_count})); - args->Assign(2, zeek::val_mgr->Count(${val.param_count})); - args->Assign(3, zeek::val_mgr->Count(${val.param_offset})); - args->Assign(4, zeek::val_mgr->Count(${val.param_displacement})); - args->Assign(5, zeek::val_mgr->Count(${val.data_count})); - args->Assign(6, zeek::val_mgr->Count(${val.data_offset})); - args->Assign(7, zeek::val_mgr->Count(${val.data_displacement})); + args->Assign(0, ${val.total_param_count}); + args->Assign(1, ${val.total_data_count}); + args->Assign(2, ${val.param_count}); + args->Assign(3, ${val.param_offset}); + args->Assign(4, ${val.param_displacement}); + args->Assign(5, ${val.data_count}); + args->Assign(6, ${val.data_offset}); + args->Assign(7, ${val.data_displacement}); auto parameters = zeek::make_intrusive(${val.parameters}.length(), (const char*)${val.parameters}.data()); diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac index 3571579cfb..b559d428c2 100644 --- a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac +++ b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac @@ -6,15 +6,15 @@ refine connection SMB_Conn += { return false; auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans2_Sec_Args); - args->Assign(0, zeek::val_mgr->Count(${val.total_param_count})); - args->Assign(1, zeek::val_mgr->Count(${val.total_data_count})); - args->Assign(2, zeek::val_mgr->Count(${val.param_count})); - args->Assign(3, zeek::val_mgr->Count(${val.param_offset})); - args->Assign(4, zeek::val_mgr->Count(${val.param_displacement})); - args->Assign(5, zeek::val_mgr->Count(${val.data_count})); - args->Assign(6, zeek::val_mgr->Count(${val.data_offset})); - args->Assign(7, zeek::val_mgr->Count(${val.data_displacement})); - args->Assign(8, zeek::val_mgr->Count(${val.FID})); + args->Assign(0, ${val.total_param_count}); + args->Assign(1, ${val.total_data_count}); + args->Assign(2, ${val.param_count}); + args->Assign(3, ${val.param_offset}); + args->Assign(4, ${val.param_displacement}); + args->Assign(5, ${val.data_count}); + args->Assign(6, ${val.data_offset}); + args->Assign(7, ${val.data_displacement}); + args->Assign(8, ${val.FID}); auto parameters = zeek::make_intrusive(${val.parameters}.length(), (const char*)${val.parameters}.data()); auto payload = zeek::make_intrusive(${val.data}.length(), (const char*)${val.data}.data()); diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2.pac b/src/analyzer/protocol/smb/smb1-com-transaction2.pac index 4dced3ddba..f83485dc70 100644 --- a/src/analyzer/protocol/smb/smb1-com-transaction2.pac +++ b/src/analyzer/protocol/smb/smb1-com-transaction2.pac @@ -25,18 +25,18 @@ refine connection SMB_Conn += { if ( smb1_transaction2_request ) { auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans2_Args); - args->Assign(0, zeek::val_mgr->Count(${val.total_param_count})); - args->Assign(1, zeek::val_mgr->Count(${val.total_data_count})); - args->Assign(2, zeek::val_mgr->Count(${val.max_param_count})); - args->Assign(3, zeek::val_mgr->Count(${val.max_data_count})); - args->Assign(4, zeek::val_mgr->Count(${val.max_setup_count})); - args->Assign(5, zeek::val_mgr->Count(${val.flags})); - args->Assign(6, zeek::val_mgr->Count(${val.timeout})); - args->Assign(7, zeek::val_mgr->Count(${val.param_count})); - args->Assign(8, zeek::val_mgr->Count(${val.param_offset})); - args->Assign(9, zeek::val_mgr->Count(${val.data_count})); - args->Assign(10, zeek::val_mgr->Count(${val.data_offset})); - args->Assign(11, zeek::val_mgr->Count(${val.setup_count})); + args->Assign(0, ${val.total_param_count}); + args->Assign(1, ${val.total_data_count}); + args->Assign(2, ${val.max_param_count}); + args->Assign(3, ${val.max_data_count}); + args->Assign(4, ${val.max_setup_count}); + args->Assign(5, ${val.flags}); + args->Assign(6, ${val.timeout}); + args->Assign(7, ${val.param_count}); + args->Assign(8, ${val.param_offset}); + args->Assign(9, ${val.data_count}); + args->Assign(10, ${val.data_offset}); + args->Assign(11, ${val.setup_count}); zeek::BifEvent::enqueue_smb1_transaction2_request(zeek_analyzer(), zeek_analyzer()->Conn(), @@ -132,11 +132,11 @@ refine connection SMB_Conn += { if ( smb1_trans2_find_first2_request ) { auto result = zeek::make_intrusive(zeek::BifType::Record::SMB1::Find_First2_Request_Args); - result->Assign(0, zeek::val_mgr->Count(${val.search_attrs})); - result->Assign(1, zeek::val_mgr->Count(${val.search_count})); - result->Assign(2, zeek::val_mgr->Count(${val.flags})); - result->Assign(3, zeek::val_mgr->Count(${val.info_level})); - result->Assign(4, zeek::val_mgr->Count(${val.search_storage_type})); + result->Assign(0, ${val.search_attrs}); + result->Assign(1, ${val.search_count}); + result->Assign(2, ${val.flags}); + result->Assign(3, ${val.info_level}); + result->Assign(4, ${val.search_storage_type}); result->Assign(5, smb_string2stringval(${val.file_name})); zeek::BifEvent::enqueue_smb1_trans2_find_first2_request(zeek_analyzer(), zeek_analyzer()->Conn(), diff --git a/src/analyzer/protocol/smb/smb1-protocol.pac b/src/analyzer/protocol/smb/smb1-protocol.pac index ea3b7f3340..1ea508d0dd 100644 --- a/src/analyzer/protocol/smb/smb1-protocol.pac +++ b/src/analyzer/protocol/smb/smb1-protocol.pac @@ -25,14 +25,14 @@ // { // do nothing // } - r->Assign(0, zeek::val_mgr->Count(${hdr.command})); - r->Assign(1, zeek::val_mgr->Count(${hdr.status})); - r->Assign(2, zeek::val_mgr->Count(${hdr.flags})); - r->Assign(3, zeek::val_mgr->Count(${hdr.flags2})); - r->Assign(4, zeek::val_mgr->Count(${hdr.tid})); - r->Assign(5, zeek::val_mgr->Count(${hdr.pid})); - r->Assign(6, zeek::val_mgr->Count(${hdr.uid})); - r->Assign(7, zeek::val_mgr->Count(${hdr.mid})); + r->Assign(0, ${hdr.command}); + r->Assign(1, ${hdr.status}); + r->Assign(2, ${hdr.flags}); + r->Assign(3, ${hdr.flags2}); + r->Assign(4, ${hdr.tid}); + r->Assign(5, ${hdr.pid}); + r->Assign(6, ${hdr.uid}); + r->Assign(7, ${hdr.mid}); return r; } diff --git a/src/analyzer/protocol/smb/smb2-com-close.pac b/src/analyzer/protocol/smb/smb2-com-close.pac index 13d34f0663..1efc7ec4e7 100644 --- a/src/analyzer/protocol/smb/smb2-com-close.pac +++ b/src/analyzer/protocol/smb/smb2-com-close.pac @@ -22,8 +22,8 @@ refine connection SMB_Conn += { { auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::CloseResponse); - resp->Assign(0, zeek::val_mgr->Count(${val.alloc_size})); - resp->Assign(1, zeek::val_mgr->Count(${val.eof})); + resp->Assign(0, ${val.alloc_size}); + resp->Assign(1, ${val.eof}); resp->Assign(2, SMB_BuildMACTimes(${val.last_write_time}, ${val.last_access_time}, ${val.creation_time}, diff --git a/src/analyzer/protocol/smb/smb2-com-create.pac b/src/analyzer/protocol/smb/smb2-com-create.pac index 97e55791e0..d10296b1cb 100644 --- a/src/analyzer/protocol/smb/smb2-com-create.pac +++ b/src/analyzer/protocol/smb/smb2-com-create.pac @@ -18,8 +18,8 @@ refine connection SMB_Conn += { { auto requestinfo = zeek::make_intrusive(zeek::BifType::Record::SMB2::CreateRequest); requestinfo->Assign(0, std::move(filename)); - requestinfo->Assign(1, zeek::val_mgr->Count(${val.disposition})); - requestinfo->Assign(2, zeek::val_mgr->Count(${val.create_options})); + requestinfo->Assign(1, ${val.disposition}); + requestinfo->Assign(2, ${val.create_options}); zeek::BifEvent::enqueue_smb2_create_request(zeek_analyzer(), zeek_analyzer()->Conn(), BuildSMB2HeaderVal(h), @@ -35,13 +35,13 @@ refine connection SMB_Conn += { { auto responseinfo = zeek::make_intrusive(zeek::BifType::Record::SMB2::CreateResponse); responseinfo->Assign(0, BuildSMB2GUID(${val.file_id})); - responseinfo->Assign(1, zeek::val_mgr->Count(${val.eof})); + responseinfo->Assign(1, ${val.eof}); responseinfo->Assign(2, SMB_BuildMACTimes(${val.last_write_time}, ${val.last_access_time}, ${val.creation_time}, ${val.change_time})); responseinfo->Assign(3, smb2_file_attrs_to_zeek(${val.file_attrs})); - responseinfo->Assign(4, zeek::val_mgr->Count(${val.create_action})); + responseinfo->Assign(4, ${val.create_action}); zeek::BifEvent::enqueue_smb2_create_response(zeek_analyzer(), zeek_analyzer()->Conn(), BuildSMB2HeaderVal(h), diff --git a/src/analyzer/protocol/smb/smb2-com-negotiate.pac b/src/analyzer/protocol/smb/smb2-com-negotiate.pac index 68012fc588..d9c1a5dde4 100644 --- a/src/analyzer/protocol/smb/smb2-com-negotiate.pac +++ b/src/analyzer/protocol/smb/smb2-com-negotiate.pac @@ -41,12 +41,12 @@ refine connection SMB_Conn += { { auto nr = zeek::make_intrusive(zeek::BifType::Record::SMB2::NegotiateResponse); - nr->Assign(0, zeek::val_mgr->Count(${val.dialect_revision})); - nr->Assign(1, zeek::val_mgr->Count(${val.security_mode})); + nr->Assign(0, ${val.dialect_revision}); + nr->Assign(1, ${val.security_mode}); nr->Assign(2, BuildSMB2GUID(${val.server_guid})); nr->Assign(3, filetime2zeektime(${val.system_time})); nr->Assign(4, filetime2zeektime(${val.server_start_time})); - nr->Assign(5, zeek::val_mgr->Count(${val.negotiate_context_count})); + nr->Assign(5, ${val.negotiate_context_count}); auto cv = zeek::make_intrusive(zeek::BifType::Vector::SMB2::NegotiateContextValues); diff --git a/src/analyzer/protocol/smb/smb2-com-session-setup.pac b/src/analyzer/protocol/smb/smb2-com-session-setup.pac index b8132184a5..365d10bbdf 100644 --- a/src/analyzer/protocol/smb/smb2-com-session-setup.pac +++ b/src/analyzer/protocol/smb/smb2-com-session-setup.pac @@ -5,7 +5,7 @@ refine connection SMB_Conn += { if ( smb2_session_setup_request ) { auto req = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupRequest); - req->Assign(0, zeek::val_mgr->Count(${val.security_mode})); + req->Assign(0, ${val.security_mode}); zeek::BifEvent::enqueue_smb2_session_setup_request(zeek_analyzer(), zeek_analyzer()->Conn(), @@ -21,9 +21,9 @@ refine connection SMB_Conn += { if ( smb2_session_setup_response ) { auto flags = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupFlags); - flags->Assign(0, zeek::val_mgr->Bool(${val.flag_guest})); - flags->Assign(1, zeek::val_mgr->Bool(${val.flag_anonymous})); - flags->Assign(2, zeek::val_mgr->Bool(${val.flag_encrypt})); + flags->Assign(0, bool(${val.flag_guest})); + flags->Assign(1, bool(${val.flag_anonymous})); + flags->Assign(2, bool(${val.flag_encrypt})); auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupResponse); resp->Assign(0, std::move(flags)); diff --git a/src/analyzer/protocol/smb/smb2-com-set-info.pac b/src/analyzer/protocol/smb/smb2-com-set-info.pac index c76ce00781..9f109debe7 100644 --- a/src/analyzer/protocol/smb/smb2-com-set-info.pac +++ b/src/analyzer/protocol/smb/smb2-com-set-info.pac @@ -193,12 +193,12 @@ refine connection SMB_Conn += { if ( smb2_file_fscontrol ) { auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Fscontrol); - r->Assign(0, zeek::val_mgr->Int(${val.free_space_start_filtering})); - r->Assign(1, zeek::val_mgr->Int(${val.free_space_start_threshold})); - r->Assign(2, zeek::val_mgr->Int(${val.free_space_stop_filtering})); - r->Assign(3, zeek::val_mgr->Count(${val.default_quota_threshold})); - r->Assign(4, zeek::val_mgr->Count(${val.default_quota_limit})); - r->Assign(5, zeek::val_mgr->Count(${val.file_system_control_flags})); + r->Assign(0, int(${val.free_space_start_filtering})); + r->Assign(1, int(${val.free_space_start_threshold})); + r->Assign(2, int(${val.free_space_stop_filtering})); + r->Assign(3, ${val.default_quota_threshold}); + r->Assign(4, ${val.default_quota_limit}); + r->Assign(5, ${val.file_system_control_flags}); zeek::BifEvent::enqueue_smb2_file_fscontrol(zeek_analyzer(), zeek_analyzer()->Conn(), diff --git a/src/analyzer/protocol/smb/smb2-com-transform-header.pac b/src/analyzer/protocol/smb/smb2-com-transform-header.pac index 1c28a91f6d..5c6da802ef 100644 --- a/src/analyzer/protocol/smb/smb2-com-transform-header.pac +++ b/src/analyzer/protocol/smb/smb2-com-transform-header.pac @@ -7,9 +7,9 @@ refine connection SMB_Conn += { auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Transform_header); r->Assign(0, to_stringval(${hdr.signature})); r->Assign(1, to_stringval(${hdr.nonce})); - r->Assign(2, zeek::val_mgr->Count(${hdr.orig_msg_size})); - r->Assign(3, zeek::val_mgr->Count(${hdr.flags})); - r->Assign(4, zeek::val_mgr->Count(${hdr.session_id})); + r->Assign(2, ${hdr.orig_msg_size}); + r->Assign(3, ${hdr.flags}); + r->Assign(4, ${hdr.session_id}); zeek::BifEvent::enqueue_smb2_transform_header(zeek_analyzer(), zeek_analyzer()->Conn(), diff --git a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac index cc7af36b4d..1ad93d0b73 100644 --- a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac +++ b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac @@ -19,7 +19,7 @@ refine connection SMB_Conn += { if ( smb2_tree_connect_response ) { auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::TreeConnectResponse); - resp->Assign(0, zeek::val_mgr->Count(${val.share_type})); + resp->Assign(0, ${val.share_type}); zeek::BifEvent::enqueue_smb2_tree_connect_response(zeek_analyzer(), zeek_analyzer()->Conn(), diff --git a/src/analyzer/protocol/smb/smb2-protocol.pac b/src/analyzer/protocol/smb/smb2-protocol.pac index 95d320fbbb..488ced44f0 100644 --- a/src/analyzer/protocol/smb/smb2-protocol.pac +++ b/src/analyzer/protocol/smb/smb2-protocol.pac @@ -12,15 +12,15 @@ zeek::RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv); zeek::RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr) { auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Header); - r->Assign(0, zeek::val_mgr->Count(${hdr.credit_charge})); - r->Assign(1, zeek::val_mgr->Count(${hdr.status})); - r->Assign(2, zeek::val_mgr->Count(${hdr.command})); - r->Assign(3, zeek::val_mgr->Count(${hdr.credits})); - r->Assign(4, zeek::val_mgr->Count(${hdr.flags})); - r->Assign(5, zeek::val_mgr->Count(${hdr.message_id})); - r->Assign(6, zeek::val_mgr->Count(${hdr.process_id})); - r->Assign(7, zeek::val_mgr->Count(${hdr.tree_id})); - r->Assign(8, zeek::val_mgr->Count(${hdr.session_id})); + r->Assign(0, ${hdr.credit_charge}); + r->Assign(1, ${hdr.status}); + r->Assign(2, ${hdr.command}); + r->Assign(3, ${hdr.credits}); + r->Assign(4, ${hdr.flags}); + r->Assign(5, ${hdr.message_id}); + r->Assign(6, ${hdr.process_id}); + r->Assign(7, ${hdr.tree_id}); + r->Assign(8, ${hdr.session_id}); r->Assign(9, to_stringval(${hdr.signature})); return r; } @@ -28,29 +28,29 @@ zeek::RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr) zeek::RecordValPtr BuildSMB2GUID(SMB2_guid* file_id) { auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::GUID); - r->Assign(0, zeek::val_mgr->Count(${file_id.persistent})); - r->Assign(1, zeek::val_mgr->Count(${file_id._volatile})); + r->Assign(0, ${file_id.persistent}); + r->Assign(1, ${file_id._volatile}); return r; } zeek::RecordValPtr smb2_file_attrs_to_zeek(SMB2_file_attributes* val) { auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::FileAttrs); - r->Assign(0, zeek::val_mgr->Bool(${val.read_only})); - r->Assign(1, zeek::val_mgr->Bool(${val.hidden})); - r->Assign(2, zeek::val_mgr->Bool(${val.system})); - r->Assign(3, zeek::val_mgr->Bool(${val.directory})); - r->Assign(4, zeek::val_mgr->Bool(${val.archive})); - r->Assign(5, zeek::val_mgr->Bool(${val.normal})); - r->Assign(6, zeek::val_mgr->Bool(${val.temporary})); - r->Assign(7, zeek::val_mgr->Bool(${val.sparse_file})); - r->Assign(8, zeek::val_mgr->Bool(${val.reparse_point})); - r->Assign(9, zeek::val_mgr->Bool(${val.compressed})); - r->Assign(10, zeek::val_mgr->Bool(${val.offline})); - r->Assign(11, zeek::val_mgr->Bool(${val.not_content_indexed})); - r->Assign(12, zeek::val_mgr->Bool(${val.encrypted})); - r->Assign(13, zeek::val_mgr->Bool(${val.integrity_stream})); - r->Assign(14, zeek::val_mgr->Bool(${val.no_scrub_data})); + r->Assign(0, bool(${val.read_only})); + r->Assign(1, bool(${val.hidden})); + r->Assign(2, bool(${val.system})); + r->Assign(3, bool(${val.directory})); + r->Assign(4, bool(${val.archive})); + r->Assign(5, bool(${val.normal})); + r->Assign(6, bool(${val.temporary})); + r->Assign(7, bool(${val.sparse_file})); + r->Assign(8, bool(${val.reparse_point})); + r->Assign(9, bool(${val.compressed})); + r->Assign(10, bool(${val.offline})); + r->Assign(11, bool(${val.not_content_indexed})); + r->Assign(12, bool(${val.encrypted})); + r->Assign(13, bool(${val.integrity_stream})); + r->Assign(14, bool(${val.no_scrub_data})); return r; } @@ -58,15 +58,15 @@ zeek::RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) { auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::NegotiateContextValue); - r->Assign(0, zeek::val_mgr->Count(${ncv.context_type})); - r->Assign(1, zeek::val_mgr->Count(${ncv.data_length})); + r->Assign(0, ${ncv.context_type}); + r->Assign(1, ${ncv.data_length}); switch ( ${ncv.context_type} ) { case SMB2_PREAUTH_INTEGRITY_CAPABILITIES: { auto rpreauth = zeek::make_intrusive(zeek::BifType::Record::SMB2::PreAuthIntegrityCapabilities); - rpreauth->Assign(0, zeek::val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg_count})); - rpreauth->Assign(1, zeek::val_mgr->Count(${ncv.preauth_integrity_capabilities.salt_length})); + rpreauth->Assign(0, ${ncv.preauth_integrity_capabilities.hash_alg_count}); + rpreauth->Assign(1, ${ncv.preauth_integrity_capabilities.salt_length}); auto ha = zeek::make_intrusive(zeek::id::index_vec); @@ -85,7 +85,7 @@ zeek::RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) case SMB2_ENCRYPTION_CAPABILITIES: { auto rencr = zeek::make_intrusive(zeek::BifType::Record::SMB2::EncryptionCapabilities); - rencr->Assign(0, zeek::val_mgr->Count(${ncv.encryption_capabilities.cipher_count})); + rencr->Assign(0, ${ncv.encryption_capabilities.cipher_count}); auto c = zeek::make_intrusive(zeek::id::index_vec); @@ -103,7 +103,7 @@ zeek::RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) case SMB2_COMPRESSION_CAPABILITIES: { auto rcomp = zeek::make_intrusive(zeek::BifType::Record::SMB2::CompressionCapabilities); - rcomp->Assign(0, zeek::val_mgr->Count(${ncv.compression_capabilities.alg_count})); + rcomp->Assign(0, ${ncv.compression_capabilities.alg_count}); auto c = zeek::make_intrusive(zeek::id::index_vec); diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac index f719e25163..56a65cdc1c 100644 --- a/src/analyzer/protocol/snmp/snmp-analyzer.pac +++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac @@ -47,7 +47,7 @@ zeek::ValPtr asn1_obj_to_val(const ASN1Encoding* obj) zeek::RecordValPtr rval = zeek::make_intrusive(zeek::BifType::Record::SNMP::ObjectValue); uint8 tag = obj->meta()->tag(); - rval->Assign(0, zeek::val_mgr->Count(tag)); + rval->Assign(0, tag); switch ( tag ) { case VARBIND_UNSPECIFIED_TAG: @@ -93,7 +93,7 @@ zeek::ValPtr time_ticks_to_val(const TimeTicks* tt) zeek::RecordValPtr build_hdr(const Header* header) { auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::Header); - rv->Assign(0, zeek::val_mgr->Count(header->version())); + rv->Assign(0, uint64_t(header->version())); switch ( header->version() ) { case SNMPV1_TAG: @@ -132,10 +132,10 @@ zeek::RecordValPtr build_hdrV3(const Header* header) v3->Assign(0, asn1_integer_to_val(global_data->id(), zeek::TYPE_COUNT)); v3->Assign(1, asn1_integer_to_val(global_data->max_size(), zeek::TYPE_COUNT)); - v3->Assign(2, zeek::val_mgr->Count(flags_byte)); - v3->Assign(3, zeek::val_mgr->Bool(flags_byte & 0x01)); - v3->Assign(4, zeek::val_mgr->Bool(flags_byte & 0x02)); - v3->Assign(5, zeek::val_mgr->Bool(flags_byte & 0x04)); + v3->Assign(2, flags_byte); + v3->Assign(3, bool(flags_byte & 0x01)); + v3->Assign(4, bool(flags_byte & 0x02)); + v3->Assign(5, bool(flags_byte & 0x04)); v3->Assign(6, asn1_integer_to_val(global_data->security_model(), zeek::TYPE_COUNT)); v3->Assign(7, asn1_octet_string_to_val(v3hdr->security_parameters())); diff --git a/src/analyzer/protocol/ssh/ssh-analyzer.pac b/src/analyzer/protocol/ssh/ssh-analyzer.pac index 71e8bcd423..6e917e0612 100644 --- a/src/analyzer/protocol/ssh/ssh-analyzer.pac +++ b/src/analyzer/protocol/ssh/ssh-analyzer.pac @@ -111,7 +111,7 @@ refine flow SSH_Flow += { } - result->Assign(6, zeek::val_mgr->Bool(!${msg.is_orig})); + result->Assign(6, bool(!${msg.is_orig})); zeek::BifEvent::enqueue_ssh_capabilities(connection()->zeek_analyzer(), connection()->zeek_analyzer()->Conn(), to_stringval(${msg.cookie}), diff --git a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac index 9806fe31f1..961eb8eaf3 100644 --- a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac +++ b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac @@ -161,8 +161,8 @@ refine connection Handshake_Conn += { for ( unsigned int i = 0; i < supported_signature_algorithms->size(); ++i ) { auto el = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); - el->Assign(0, zeek::val_mgr->Count((*supported_signature_algorithms)[i]->HashAlgorithm())); - el->Assign(1, zeek::val_mgr->Count((*supported_signature_algorithms)[i]->SignatureAlgorithm())); + el->Assign(0, (*supported_signature_algorithms)[i]->HashAlgorithm()); + el->Assign(1, (*supported_signature_algorithms)[i]->SignatureAlgorithm()); slist->Assign(i, std::move(el)); } } @@ -345,14 +345,14 @@ refine connection Handshake_Conn += { if ( ${kex.signed_params.uses_signature_and_hashalgorithm} ) { - ha->Assign(0, zeek::val_mgr->Count(${kex.signed_params.algorithm.HashAlgorithm})); - ha->Assign(1, zeek::val_mgr->Count(${kex.signed_params.algorithm.SignatureAlgorithm})); + ha->Assign(0, ${kex.signed_params.algorithm.HashAlgorithm}); + ha->Assign(1, ${kex.signed_params.algorithm.SignatureAlgorithm}); } else { // set to impossible value - ha->Assign(0, zeek::val_mgr->Count(256)); - ha->Assign(1, zeek::val_mgr->Count(256)); + ha->Assign(0, 256); + ha->Assign(1, 256); } zeek::BifEvent::enqueue_ssl_server_signature(zeek_analyzer(), @@ -414,8 +414,8 @@ refine connection Handshake_Conn += { return true; auto ha = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); - ha->Assign(0, zeek::val_mgr->Count(digitally_signed_algorithms->HashAlgorithm())); - ha->Assign(1, zeek::val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm())); + ha->Assign(0, digitally_signed_algorithms->HashAlgorithm()); + ha->Assign(1, digitally_signed_algorithms->SignatureAlgorithm()); zeek::BifEvent::enqueue_ssl_extension_signed_certificate_timestamp(zeek_analyzer(), zeek_analyzer()->Conn(), ${rec.is_orig}, @@ -445,14 +445,14 @@ refine connection Handshake_Conn += { if ( ${signed_params.uses_signature_and_hashalgorithm} ) { - ha->Assign(0, zeek::val_mgr->Count(${signed_params.algorithm.HashAlgorithm})); - ha->Assign(1, zeek::val_mgr->Count(${signed_params.algorithm.SignatureAlgorithm})); + ha->Assign(0, ${signed_params.algorithm.HashAlgorithm}); + ha->Assign(1, ${signed_params.algorithm.SignatureAlgorithm}); } else { // set to impossible value - ha->Assign(0, zeek::val_mgr->Count(256)); - ha->Assign(1, zeek::val_mgr->Count(256)); + ha->Assign(0, 256); + ha->Assign(1, 256); } zeek::BifEvent::enqueue_ssl_server_signature(zeek_analyzer(), @@ -499,7 +499,7 @@ refine connection Handshake_Conn += { { auto el = zeek::make_intrusive(zeek::BifType::Record::SSL::PSKIdentity); el->Assign(0, zeek::make_intrusive(identity->identity().length(), (const char*) identity->identity().data())); - el->Assign(1, zeek::val_mgr->Count(identity->obfuscated_ticket_age())); + el->Assign(1, identity->obfuscated_ticket_age()); slist->Assign(slist->Size(), std::move(el)); } } diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc index e6b29a000c..09708a21ad 100644 --- a/src/analyzer/protocol/tcp/TCP.cc +++ b/src/analyzer/protocol/tcp/TCP.cc @@ -109,14 +109,14 @@ static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip, static auto SYN_packet = id::find_type("SYN_packet"); auto* v = new RecordVal(SYN_packet); - v->Assign(0, val_mgr->Bool(is_orig)); - v->Assign(1, val_mgr->Bool(int(ip->DF()))); - v->Assign(2, val_mgr->Count((ip->TTL()))); - v->Assign(3, val_mgr->Count((ip->TotalLen()))); - v->Assign(4, val_mgr->Count(ntohs(tcp->th_win))); - v->Assign(5, val_mgr->Int(winscale)); - v->Assign(6, val_mgr->Count(MSS)); - v->Assign(7, val_mgr->Bool(SACK)); + v->Assign(0, bool(is_orig)); + v->Assign(1, bool(int(ip->DF()))); + v->Assign(2, uint32_t(ip->TTL())); + v->Assign(3, uint32_t((ip->TotalLen()))); + v->Assign(4, uint32_t(ntohs(tcp->th_win))); + v->Assign(5, int(winscale)); + v->Assign(6, uint32_t(MSS)); + v->Assign(7, bool(SACK)); return v; } @@ -1285,10 +1285,10 @@ void TCP_Analyzer::UpdateConnVal(RecordVal *conn_val) auto orig_endp_val = conn_val->GetFieldAs("orig"); auto resp_endp_val = conn_val->GetFieldAs("resp"); - orig_endp_val->Assign(0, val_mgr->Count(orig->Size())); - orig_endp_val->Assign(1, val_mgr->Count(int(orig->state))); - resp_endp_val->Assign(0, val_mgr->Count(resp->Size())); - resp_endp_val->Assign(1, val_mgr->Count(int(resp->state))); + orig_endp_val->Assign(0, orig->Size()); + orig_endp_val->Assign(1, int(orig->state)); + resp_endp_val->Assign(0, resp->Size()); + resp_endp_val->Assign(1, int(resp->state)); // Call children's UpdateConnVal Analyzer::UpdateConnVal(conn_val); @@ -1369,8 +1369,8 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) auto length = kind < 2 ? 1 : o[1]; auto option_record = make_intrusive(BifType::Record::TCP::Option); option_list->Assign(option_list->Size(), option_record); - option_record->Assign(0, val_mgr->Count(kind)); - option_record->Assign(1, val_mgr->Count(length)); + option_record->Assign(0, uint32_t(kind)); + option_record->Assign(1, uint32_t(length)); switch ( kind ) { case 2: @@ -1378,7 +1378,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) if ( length == 4 ) { auto mss = ntohs(*reinterpret_cast(o + 2)); - option_record->Assign(3, val_mgr->Count(mss)); + option_record->Assign(3, uint32_t(mss)); } else { @@ -1392,7 +1392,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) if ( length == 3 ) { auto scale = o[2]; - option_record->Assign(4, val_mgr->Count(scale)); + option_record->Assign(4, uint32_t(scale)); } else { @@ -1438,8 +1438,8 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) { auto send = ntohl(*reinterpret_cast(o + 2)); auto echo = ntohl(*reinterpret_cast(o + 6)); - option_record->Assign(6, val_mgr->Count(send)); - option_record->Assign(7, val_mgr->Count(echo)); + option_record->Assign(6, uint32_t(send)); + option_record->Assign(7, uint32_t(echo)); } else { @@ -2076,13 +2076,13 @@ RecordVal* TCPStats_Endpoint::BuildStats() static auto endpoint_stats = id::find_type("endpoint_stats"); auto* stats = new RecordVal(endpoint_stats); - stats->Assign(0, val_mgr->Count(num_pkts)); - stats->Assign(1, val_mgr->Count(num_rxmit)); - stats->Assign(2, val_mgr->Count(num_rxmit_bytes)); - stats->Assign(3, val_mgr->Count(num_in_order)); - stats->Assign(4, val_mgr->Count(num_OO)); - stats->Assign(5, val_mgr->Count(num_repl)); - stats->Assign(6, val_mgr->Count(endian_type)); + stats->Assign(0, num_pkts); + stats->Assign(1, num_rxmit); + stats->Assign(2, num_rxmit_bytes); + stats->Assign(3, num_in_order); + stats->Assign(4, num_OO); + stats->Assign(5, num_repl); + stats->Assign(6, endian_type); return stats; } diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc index ef18c39f73..53c9458d14 100644 --- a/src/analyzer/protocol/teredo/Teredo.cc +++ b/src/analyzer/protocol/teredo/Teredo.cc @@ -109,12 +109,10 @@ RecordValPtr TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const uint8_t au_len = *((uint8_t*)(auth + 3)); uint64_t nonce = ntohll(*((uint64_t*)(auth + 4 + id_len + au_len))); uint8_t conf = *((uint8_t*)(auth + 4 + id_len + au_len + 8)); - teredo_auth->Assign(0, make_intrusive( - new String(auth + 4, id_len, true))); - teredo_auth->Assign(1, make_intrusive( - new String(auth + 4 + id_len, au_len, true))); - teredo_auth->Assign(2, val_mgr->Count(nonce)); - teredo_auth->Assign(3, val_mgr->Count(conf)); + teredo_auth->Assign(0, new String(auth + 4, id_len, true)); + teredo_auth->Assign(1, new String(auth + 4 + id_len, au_len, true)); + teredo_auth->Assign(2, nonce); + teredo_auth->Assign(3, conf); teredo_hdr->Assign(0, std::move(teredo_auth)); } diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc index b24e30fb1b..577dd95810 100644 --- a/src/analyzer/protocol/udp/UDP.cc +++ b/src/analyzer/protocol/udp/UDP.cc @@ -235,14 +235,14 @@ void UDP_Analyzer::UpdateEndpointVal(RecordVal* endp, bool is_orig) bro_int_t size = is_orig ? request_len : reply_len; if ( size < 0 ) { - endp->Assign(0, val_mgr->Count(0)); - endp->Assign(1, val_mgr->Count(int(UDP_INACTIVE))); + endp->Assign(0, 0); + endp->Assign(1, int(UDP_INACTIVE)); } else { - endp->Assign(0, val_mgr->Count(size)); - endp->Assign(1, val_mgr->Count(int(UDP_ACTIVE))); + endp->Assign(0, uint64_t(size)); + endp->Assign(1, int(UDP_ACTIVE)); } } diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index 07bca256f6..f182f98350 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -784,7 +784,7 @@ RecordVal* Manager::MakeEvent(ValPList* args, zeek::detail::Frame* frame) return rval; } - rval->Assign(0, make_intrusive(func->Name())); + rval->Assign(0, func->Name()); continue; } @@ -1453,20 +1453,20 @@ void Manager::ProcessStatus(broker::status_view stat) if ( ctx ) { - endpoint_info->Assign(0, make_intrusive(to_string(ctx->node))); + endpoint_info->Assign(0, to_string(ctx->node)); static auto ni = id::find_type("Broker::NetworkInfo"); auto network_info = make_intrusive(ni); if ( ctx->network ) { - network_info->Assign(0, make_intrusive(ctx->network->address.data())); + network_info->Assign(0, ctx->network->address.data()); network_info->Assign(1, val_mgr->Port(ctx->network->port, TRANSPORT_TCP)); } else { // TODO: are there any status messages where the ctx->network // is not set and actually could be? - network_info->Assign(0, make_intrusive("")); + network_info->Assign(0, ""); network_info->Assign(1, val_mgr->Port(0, TRANSPORT_TCP)); } diff --git a/src/broker/comm.bif b/src/broker/comm.bif index 87f213361c..35cb69df87 100644 --- a/src/broker/comm.bif +++ b/src/broker/comm.bif @@ -126,7 +126,7 @@ function Broker::__peers%(%): PeerInfos network_info->Assign(1, zeek::val_mgr->Port(0, TRANSPORT_TCP)); } - endpoint_info->Assign(0, zeek::make_intrusive(to_string(p.peer.node))); + endpoint_info->Assign(0, to_string(p.peer.node)); endpoint_info->Assign(1, std::move(network_info)); auto ps = (BifEnum::Broker::PeerStatus)p.status; diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index 69f6e48517..16b5ac1e9f 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -92,12 +92,12 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Creating new File object", file_id.c_str()); val = make_intrusive(id::fa_file); - val->Assign(id_idx, make_intrusive(file_id.c_str())); + val->Assign(id_idx, file_id); SetSource(source_name); if ( conn ) { - val->Assign(is_orig_idx, val_mgr->Bool(is_orig)); + val->Assign(is_orig_idx, is_orig); UpdateConnectionFields(conn, is_orig); } @@ -115,7 +115,7 @@ File::~File() void File::UpdateLastActivityTime() { - val->Assign(last_active_idx, make_intrusive(run_state::network_time)); + val->AssignTime(last_active_idx, run_state::network_time); } double File::GetLastActivityTime() const @@ -190,7 +190,7 @@ std::string File::GetSource() const void File::SetSource(const std::string& source) { - val->Assign(source_idx, make_intrusive(source.c_str())); + val->Assign(source_idx, source); } double File::GetTimeoutInterval() const @@ -200,7 +200,7 @@ double File::GetTimeoutInterval() const void File::SetTimeoutInterval(double interval) { - val->Assign(timeout_interval_idx, make_intrusive(interval)); + val->AssignInterval(timeout_interval_idx, interval); } bool File::SetExtractionLimit(RecordValPtr args, uint64_t bytes) @@ -223,13 +223,13 @@ bool File::SetExtractionLimit(RecordValPtr args, uint64_t bytes) void File::IncrementByteCount(uint64_t size, int field_idx) { uint64_t old = LookupFieldDefaultCount(field_idx); - val->Assign(field_idx, val_mgr->Count(old + size)); + val->Assign(field_idx, old + size); } void File::SetTotalBytes(uint64_t size) { DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Total bytes %" PRIu64, id.c_str(), size); - val->Assign(total_bytes_idx, val_mgr->Count(size)); + val->Assign(total_bytes_idx, size); } bool File::IsComplete() const @@ -298,8 +298,8 @@ bool File::SetMime(const std::string& mime_type) return false; auto meta = make_intrusive(id::fa_metadata); - meta->Assign(meta_mime_type_idx, make_intrusive(mime_type)); - meta->Assign(meta_inferred_idx, val_mgr->False()); + meta->Assign(meta_mime_type_idx, mime_type); + meta->Assign(meta_inferred_idx, false); FileEvent(file_sniff, {val, std::move(meta)}); return true; @@ -317,7 +317,7 @@ void File::InferMetadata() return; String* bs = concatenate(bof_buffer.chunks); - val->Assign(bof_buffer_idx, bs); + val->Assign(bof_buffer_idx, bs); bof_buffer_val = val->GetField(bof_buffer_idx).get(); } @@ -334,7 +334,7 @@ void File::InferMetadata() if ( ! matches.empty() ) { - meta->Assign(meta_mime_type_idx, + meta->Assign(meta_mime_type_idx, *(matches.begin()->second.begin())); meta->Assign(meta_mime_types_idx, file_analysis::GenMIMEMatchesVal(matches)); @@ -361,7 +361,7 @@ bool File::BufferBOF(const u_char* data, uint64_t len) if ( bof_buffer.size > 0 ) { String* bs = concatenate(bof_buffer.chunks); - val->Assign(bof_buffer_idx, make_intrusive(bs)); + val->Assign(bof_buffer_idx, bs); } return false; diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc index 9300a9e2ea..30b3a9fe27 100644 --- a/src/file_analysis/Manager.cc +++ b/src/file_analysis/Manager.cc @@ -524,8 +524,8 @@ VectorValPtr GenMIMEMatchesVal(const zeek::detail::RuleMatcher::MIME_Matches& m) for ( set::const_iterator it2 = it->second.begin(); it2 != it->second.end(); ++it2 ) { - element->Assign(0, val_mgr->Int(it->first)); - element->Assign(1, make_intrusive(*it2)); + element->Assign(0, it->first); + element->Assign(1, *it2); } rval->Assign(rval->Size(), std::move(element)); diff --git a/src/file_analysis/analyzer/entropy/Entropy.cc b/src/file_analysis/analyzer/entropy/Entropy.cc index 22517e720d..849e907db0 100644 --- a/src/file_analysis/analyzer/entropy/Entropy.cc +++ b/src/file_analysis/analyzer/entropy/Entropy.cc @@ -63,11 +63,11 @@ void Entropy::Finalize() static auto entropy_test_result = id::find_type("entropy_test_result"); auto ent_result = make_intrusive(entropy_test_result); - ent_result->Assign(0, ent); - ent_result->Assign(1, chisq); - ent_result->Assign(2, mean); - ent_result->Assign(3, montepi); - ent_result->Assign(4, scc); + ent_result->Assign(0, ent); + ent_result->Assign(1, chisq); + ent_result->Assign(2, mean); + ent_result->Assign(3, montepi); + ent_result->Assign(4, scc); event_mgr.Enqueue(file_entropy, GetFile()->ToVal(), diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac index 0527a12189..6b34babe8c 100644 --- a/src/file_analysis/analyzer/pe/pe-analyzer.pac +++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac @@ -49,22 +49,22 @@ refine flow File += { { auto dh = zeek::make_intrusive(zeek::BifType::Record::PE::DOSHeader); dh->Assign(0, zeek::make_intrusive(${h.signature}.length(), (const char*) ${h.signature}.data())); - dh->Assign(1, zeek::val_mgr->Count(${h.UsedBytesInTheLastPage})); - dh->Assign(2, zeek::val_mgr->Count(${h.FileSizeInPages})); - dh->Assign(3, zeek::val_mgr->Count(${h.NumberOfRelocationItems})); - dh->Assign(4, zeek::val_mgr->Count(${h.HeaderSizeInParagraphs})); - dh->Assign(5, zeek::val_mgr->Count(${h.MinimumExtraParagraphs})); - dh->Assign(6, zeek::val_mgr->Count(${h.MaximumExtraParagraphs})); - dh->Assign(7, zeek::val_mgr->Count(${h.InitialRelativeSS})); - dh->Assign(8, zeek::val_mgr->Count(${h.InitialSP})); - dh->Assign(9, zeek::val_mgr->Count(${h.Checksum})); - dh->Assign(10, zeek::val_mgr->Count(${h.InitialIP})); - dh->Assign(11, zeek::val_mgr->Count(${h.InitialRelativeCS})); - dh->Assign(12, zeek::val_mgr->Count(${h.AddressOfRelocationTable})); - dh->Assign(13, zeek::val_mgr->Count(${h.OverlayNumber})); - dh->Assign(14, zeek::val_mgr->Count(${h.OEMid})); - dh->Assign(15, zeek::val_mgr->Count(${h.OEMinfo})); - dh->Assign(16, zeek::val_mgr->Count(${h.AddressOfNewExeHeader})); + dh->Assign(1, ${h.UsedBytesInTheLastPage}); + dh->Assign(2, ${h.FileSizeInPages}); + dh->Assign(3, ${h.NumberOfRelocationItems}); + dh->Assign(4, ${h.HeaderSizeInParagraphs}); + dh->Assign(5, ${h.MinimumExtraParagraphs}); + dh->Assign(6, ${h.MaximumExtraParagraphs}); + dh->Assign(7, ${h.InitialRelativeSS}); + dh->Assign(8, ${h.InitialSP}); + dh->Assign(9, ${h.Checksum}); + dh->Assign(10, ${h.InitialIP}); + dh->Assign(11, ${h.InitialRelativeCS}); + dh->Assign(12, ${h.AddressOfRelocationTable}); + dh->Assign(13, ${h.OverlayNumber}); + dh->Assign(14, ${h.OEMid}); + dh->Assign(15, ${h.OEMinfo}); + dh->Assign(16, ${h.AddressOfNewExeHeader}); zeek::event_mgr.Enqueue(pe_dos_header, connection()->zeek_analyzer()->GetFile()->ToVal(), @@ -98,11 +98,11 @@ refine flow File += { if ( pe_file_header ) { auto fh = zeek::make_intrusive(zeek::BifType::Record::PE::FileHeader); - fh->Assign(0, zeek::val_mgr->Count(${h.Machine})); - fh->Assign(1, zeek::make_intrusive(static_cast(${h.TimeDateStamp}))); - fh->Assign(2, zeek::val_mgr->Count(${h.PointerToSymbolTable})); - fh->Assign(3, zeek::val_mgr->Count(${h.NumberOfSymbols})); - fh->Assign(4, zeek::val_mgr->Count(${h.SizeOfOptionalHeader})); + fh->Assign(0, ${h.Machine}); + fh->AssignTime(1, double(${h.TimeDateStamp})); + fh->Assign(2, ${h.PointerToSymbolTable}); + fh->Assign(3, ${h.NumberOfSymbols}); + fh->Assign(4, ${h.SizeOfOptionalHeader}); fh->Assign(5, characteristics_to_zeek(${h.Characteristics}, 16)); zeek::event_mgr.Enqueue(pe_file_header, @@ -127,31 +127,31 @@ refine flow File += { { auto oh = zeek::make_intrusive(zeek::BifType::Record::PE::OptionalHeader); - oh->Assign(0, zeek::val_mgr->Count(${h.magic})); - oh->Assign(1, zeek::val_mgr->Count(${h.major_linker_version})); - oh->Assign(2, zeek::val_mgr->Count(${h.minor_linker_version})); - oh->Assign(3, zeek::val_mgr->Count(${h.size_of_code})); - oh->Assign(4, zeek::val_mgr->Count(${h.size_of_init_data})); - oh->Assign(5, zeek::val_mgr->Count(${h.size_of_uninit_data})); - oh->Assign(6, zeek::val_mgr->Count(${h.addr_of_entry_point})); - oh->Assign(7, zeek::val_mgr->Count(${h.base_of_code})); + oh->Assign(0, ${h.magic}); + oh->Assign(1, ${h.major_linker_version}); + oh->Assign(2, ${h.minor_linker_version}); + oh->Assign(3, ${h.size_of_code}); + oh->Assign(4, ${h.size_of_init_data}); + oh->Assign(5, ${h.size_of_uninit_data}); + oh->Assign(6, ${h.addr_of_entry_point}); + oh->Assign(7, ${h.base_of_code}); if ( ${h.pe_format} != PE32_PLUS ) - oh->Assign(8, zeek::val_mgr->Count(${h.base_of_data})); + oh->Assign(8, ${h.base_of_data}); - oh->Assign(9, zeek::val_mgr->Count(${h.image_base})); - oh->Assign(10, zeek::val_mgr->Count(${h.section_alignment})); - oh->Assign(11, zeek::val_mgr->Count(${h.file_alignment})); - oh->Assign(12, zeek::val_mgr->Count(${h.os_version_major})); - oh->Assign(13, zeek::val_mgr->Count(${h.os_version_minor})); - oh->Assign(14, zeek::val_mgr->Count(${h.major_image_version})); - oh->Assign(15, zeek::val_mgr->Count(${h.minor_image_version})); - oh->Assign(16, zeek::val_mgr->Count(${h.major_subsys_version})); - oh->Assign(17, zeek::val_mgr->Count(${h.minor_subsys_version})); - oh->Assign(18, zeek::val_mgr->Count(${h.size_of_image})); - oh->Assign(19, zeek::val_mgr->Count(${h.size_of_headers})); - oh->Assign(20, zeek::val_mgr->Count(${h.checksum})); - oh->Assign(21, zeek::val_mgr->Count(${h.subsystem})); + oh->Assign(9, ${h.image_base}); + oh->Assign(10, ${h.section_alignment}); + oh->Assign(11, ${h.file_alignment}); + oh->Assign(12, ${h.os_version_major}); + oh->Assign(13, ${h.os_version_minor}); + oh->Assign(14, ${h.major_image_version}); + oh->Assign(15, ${h.minor_image_version}); + oh->Assign(16, ${h.major_subsys_version}); + oh->Assign(17, ${h.minor_subsys_version}); + oh->Assign(18, ${h.size_of_image}); + oh->Assign(19, ${h.size_of_headers}); + oh->Assign(20, ${h.checksum}); + oh->Assign(21, ${h.subsystem}); oh->Assign(22, characteristics_to_zeek(${h.dll_characteristics}, 16)); oh->Assign(23, process_rvas(${h.rvas})); @@ -178,14 +178,14 @@ refine flow File += { name_len = first_null - ${h.name}.data(); section_header->Assign(0, zeek::make_intrusive(name_len, (const char*) ${h.name}.data())); - section_header->Assign(1, zeek::val_mgr->Count(${h.virtual_size})); - section_header->Assign(2, zeek::val_mgr->Count(${h.virtual_addr})); - section_header->Assign(3, zeek::val_mgr->Count(${h.size_of_raw_data})); - section_header->Assign(4, zeek::val_mgr->Count(${h.ptr_to_raw_data})); - section_header->Assign(5, zeek::val_mgr->Count(${h.non_used_ptr_to_relocs})); - section_header->Assign(6, zeek::val_mgr->Count(${h.non_used_ptr_to_line_nums})); - section_header->Assign(7, zeek::val_mgr->Count(${h.non_used_num_of_relocs})); - section_header->Assign(8, zeek::val_mgr->Count(${h.non_used_num_of_line_nums})); + section_header->Assign(1, ${h.virtual_size}); + section_header->Assign(2, ${h.virtual_addr}); + section_header->Assign(3, ${h.size_of_raw_data}); + section_header->Assign(4, ${h.ptr_to_raw_data}); + section_header->Assign(5, ${h.non_used_ptr_to_relocs}); + section_header->Assign(6, ${h.non_used_ptr_to_line_nums}); + section_header->Assign(7, ${h.non_used_num_of_relocs}); + section_header->Assign(8, ${h.non_used_num_of_line_nums}); section_header->Assign(9, characteristics_to_zeek(${h.characteristics}, 32)); zeek::event_mgr.Enqueue(pe_section_header, diff --git a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac index dbb7c88079..d30af665e2 100644 --- a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac +++ b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac @@ -73,19 +73,19 @@ refine flow Flow += { if ( ::unified2_event ) { auto ids_event = zeek::make_intrusive(zeek::BifType::Record::Unified2::IDSEvent); - ids_event->Assign(0, zeek::val_mgr->Count(${ev.sensor_id})); - ids_event->Assign(1, zeek::val_mgr->Count(${ev.event_id})); - ids_event->Assign(2, zeek::make_intrusive(ts_to_double(${ev.ts}))); - ids_event->Assign(3, zeek::val_mgr->Count(${ev.signature_id})); - ids_event->Assign(4, zeek::val_mgr->Count(${ev.generator_id})); - ids_event->Assign(5, zeek::val_mgr->Count(${ev.signature_revision})); - ids_event->Assign(6, zeek::val_mgr->Count(${ev.classification_id})); - ids_event->Assign(7, zeek::val_mgr->Count(${ev.priority_id})); + ids_event->Assign(0, ${ev.sensor_id}); + ids_event->Assign(1, ${ev.event_id}); + ids_event->AssignTime(2, ts_to_double(${ev.ts})); + ids_event->Assign(3, ${ev.signature_id}); + ids_event->Assign(4, ${ev.generator_id}); + ids_event->Assign(5, ${ev.signature_revision}); + ids_event->Assign(6, ${ev.classification_id}); + ids_event->Assign(7, ${ev.priority_id}); ids_event->Assign(8, unified2_addr_to_zeek_addr(${ev.src_ip})); ids_event->Assign(9, unified2_addr_to_zeek_addr(${ev.dst_ip})); ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol})); ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol})); - ids_event->Assign(17, zeek::val_mgr->Count(${ev.packet_action})); + ids_event->Assign(17, ${ev.packet_action}); zeek::event_mgr.Enqueue(::unified2_event, connection()->zeek_analyzer()->GetFile()->ToVal(), @@ -99,23 +99,23 @@ refine flow Flow += { if ( ::unified2_event ) { auto ids_event = zeek::make_intrusive(zeek::BifType::Record::Unified2::IDSEvent); - ids_event->Assign(0, zeek::val_mgr->Count(${ev.sensor_id})); - ids_event->Assign(1, zeek::val_mgr->Count(${ev.event_id})); - ids_event->Assign(2, zeek::make_intrusive(ts_to_double(${ev.ts}))); - ids_event->Assign(3, zeek::val_mgr->Count(${ev.signature_id})); - ids_event->Assign(4, zeek::val_mgr->Count(${ev.generator_id})); - ids_event->Assign(5, zeek::val_mgr->Count(${ev.signature_revision})); - ids_event->Assign(6, zeek::val_mgr->Count(${ev.classification_id})); - ids_event->Assign(7, zeek::val_mgr->Count(${ev.priority_id})); + ids_event->Assign(0, ${ev.sensor_id}); + ids_event->Assign(1, ${ev.event_id}); + ids_event->AssignTime(2, ts_to_double(${ev.ts})); + ids_event->Assign(3, ${ev.signature_id}); + ids_event->Assign(4, ${ev.generator_id}); + ids_event->Assign(5, ${ev.signature_revision}); + ids_event->Assign(6, ${ev.classification_id}); + ids_event->Assign(7, ${ev.priority_id}); ids_event->Assign(8, unified2_addr_to_zeek_addr(${ev.src_ip})); ids_event->Assign(9, unified2_addr_to_zeek_addr(${ev.dst_ip})); ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol})); ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol})); - ids_event->Assign(12, zeek::val_mgr->Count(${ev.impact_flag})); - ids_event->Assign(13, zeek::val_mgr->Count(${ev.impact})); - ids_event->Assign(14, zeek::val_mgr->Count(${ev.blocked})); - ids_event->Assign(15, zeek::val_mgr->Count(${ev.mpls_label})); - ids_event->Assign(16, zeek::val_mgr->Count(${ev.vlan_id})); + ids_event->Assign(12, ${ev.impact_flag}); + ids_event->Assign(13, ${ev.impact}); + ids_event->Assign(14, ${ev.blocked}); + ids_event->Assign(15, ${ev.mpls_label}); + ids_event->Assign(16, ${ev.vlan_id}); zeek::event_mgr.Enqueue(::unified2_event, connection()->zeek_analyzer()->GetFile()->ToVal(), @@ -130,11 +130,11 @@ refine flow Flow += { if ( ::unified2_packet ) { auto packet = zeek::make_intrusive(zeek::BifType::Record::Unified2::Packet); - packet->Assign(0, zeek::val_mgr->Count(${pkt.sensor_id})); - packet->Assign(1, zeek::val_mgr->Count(${pkt.event_id})); - packet->Assign(2, zeek::val_mgr->Count(${pkt.event_second})); - packet->Assign(3, zeek::make_intrusive(ts_to_double(${pkt.packet_ts}))); - packet->Assign(4, zeek::val_mgr->Count(${pkt.link_type})); + packet->Assign(0, ${pkt.sensor_id}); + packet->Assign(1, ${pkt.event_id}); + packet->Assign(2, ${pkt.event_second}); + packet->AssignTime(3, ts_to_double(${pkt.packet_ts})); + packet->Assign(4, ${pkt.link_type}); packet->Assign(5, to_stringval(${pkt.packet_data})); zeek::event_mgr.Enqueue(::unified2_packet, diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc index 2f2899b0aa..dc987f8220 100644 --- a/src/file_analysis/analyzer/x509/X509.cc +++ b/src/file_analysis/analyzer/x509/X509.cc @@ -124,7 +124,7 @@ RecordValPtr X509::ParseCertificate(X509Val* cert_val, auto pX509Cert = make_intrusive(BifType::Record::X509::Certificate); BIO *bio = BIO_new(BIO_s_mem()); - pX509Cert->Assign(0, val_mgr->Count((uint64_t) X509_get_version(ssl_cert) + 1)); + pX509Cert->Assign(0, uint64_t(X509_get_version(ssl_cert) + 1)); i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert)); int len = BIO_read(bio, buf, sizeof(buf)); pX509Cert->Assign(1, make_intrusive(len, buf)); @@ -161,8 +161,8 @@ RecordValPtr X509::ParseCertificate(X509Val* cert_val, pX509Cert->Assign(3, make_intrusive(len, buf)); BIO_free(bio); - pX509Cert->Assign(5, make_intrusive(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter))); - pX509Cert->Assign(6, make_intrusive(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter))); + pX509Cert->AssignTime(5, GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter)); + pX509Cert->AssignTime(6, GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter)); // we only read 255 bytes because byte 256 is always 0. // if the string is longer than 255, that will be our null-termination, @@ -172,7 +172,7 @@ RecordValPtr X509::ParseCertificate(X509Val* cert_val, if ( ! i2t_ASN1_OBJECT(buf, 255, algorithm) ) buf[0] = 0; - pX509Cert->Assign(7, make_intrusive(buf)); + pX509Cert->Assign(7, buf); // Special case for RDP server certificates. For some reason some (all?) RDP server // certificates like to specify their key algorithm as md5WithRSAEncryption, which @@ -194,25 +194,25 @@ RecordValPtr X509::ParseCertificate(X509Val* cert_val, if ( ! i2t_ASN1_OBJECT(buf, 255, OBJ_nid2obj(X509_get_signature_nid(ssl_cert))) ) buf[0] = 0; - pX509Cert->Assign(8, make_intrusive(buf)); + pX509Cert->Assign(8, buf); // Things we can do when we have the key... EVP_PKEY *pkey = X509_extract_key(ssl_cert); if ( pkey != NULL ) { if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA ) - pX509Cert->Assign(9, make_intrusive("dsa")); + pX509Cert->Assign(9, "dsa"); else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA ) { - pX509Cert->Assign(9, make_intrusive("rsa")); + pX509Cert->Assign(9, "rsa"); const BIGNUM *e; RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL); char *exponent = BN_bn2dec(e); if ( exponent != NULL ) { - pX509Cert->Assign(11, make_intrusive(exponent)); + pX509Cert->Assign(11, exponent); OPENSSL_free(exponent); exponent = NULL; } @@ -220,7 +220,7 @@ RecordValPtr X509::ParseCertificate(X509Val* cert_val, #ifndef OPENSSL_NO_EC else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_EC ) { - pX509Cert->Assign(9, make_intrusive("ecdsa")); + pX509Cert->Assign(9, "ecdsa"); pX509Cert->Assign(12, KeyCurve(pkey)); } #endif @@ -232,7 +232,7 @@ RecordValPtr X509::ParseCertificate(X509Val* cert_val, unsigned int length = KeyLength(pkey); if ( length > 0 ) - pX509Cert->Assign(10, val_mgr->Count(length)); + pX509Cert->Assign(10, length); EVP_PKEY_free(pkey); } @@ -292,10 +292,10 @@ void X509::ParseBasicConstraints(X509_EXTENSION* ex) if ( x509_ext_basic_constraints ) { auto pBasicConstraint = make_intrusive(BifType::Record::X509::BasicConstraints); - pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca)); + pBasicConstraint->Assign(0, constr->ca); if ( constr->pathlen ) - pBasicConstraint->Assign(1, val_mgr->Count((int32_t) ASN1_INTEGER_get(constr->pathlen))); + pBasicConstraint->Assign(1, int32_t(ASN1_INTEGER_get(constr->pathlen))); event_mgr.Enqueue(x509_ext_basic_constraints, GetFile()->ToVal(), @@ -436,7 +436,7 @@ void X509::ParseSAN(X509_EXTENSION* ext) if ( ips != nullptr ) sanExt->Assign(3, ips); - sanExt->Assign(4, val_mgr->Bool(otherfields)); + sanExt->Assign(4, otherfields); event_mgr.Enqueue(x509_ext_subject_alternative_name, GetFile()->ToVal(), diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc index cb78d1d48c..3ce48255f0 100644 --- a/src/file_analysis/analyzer/x509/X509Common.cc +++ b/src/file_analysis/analyzer/x509/X509Common.cc @@ -273,13 +273,13 @@ void X509Common::ParseExtension(X509_EXTENSION* ex, const EventHandlerPtr& h, bo ext_val = make_intrusive(0, ""); auto pX509Ext = make_intrusive(BifType::Record::X509::Extension); - pX509Ext->Assign(0, make_intrusive(name)); + pX509Ext->Assign(0, name); if ( short_name and strlen(short_name) > 0 ) - pX509Ext->Assign(1, make_intrusive(short_name)); + pX509Ext->Assign(1, short_name); - pX509Ext->Assign(2, make_intrusive(oid)); - pX509Ext->Assign(3, val_mgr->Bool(critical)); + pX509Ext->Assign(2, oid); + pX509Ext->Assign(3, critical); pX509Ext->Assign(4, ext_val); // send off generic extension event diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif index 3f18ed163f..847962850f 100644 --- a/src/file_analysis/analyzer/x509/functions.bif +++ b/src/file_analysis/analyzer/x509/functions.bif @@ -16,8 +16,8 @@ static zeek::RecordValPtr x509_result_record(uint64_t num, const char* reason, z { auto rrecord = zeek::make_intrusive(zeek::BifType::Record::X509::Result); - rrecord->Assign(0, zeek::val_mgr->Int(num)); - rrecord->Assign(1, zeek::make_intrusive(reason)); + rrecord->Assign(0, num); + rrecord->Assign(1, reason); if ( chainVector ) rrecord->Assign(2, std::move(chainVector)); diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc index f779ae2e79..64febf5f29 100644 --- a/src/iosource/Packet.cc +++ b/src/iosource/Packet.cc @@ -117,12 +117,12 @@ RecordValPtr Packet::ToRawPktHdrVal() const l2_hdr->Assign(4, FmtEUI48(data)); // dst if ( vlan ) - l2_hdr->Assign(5, val_mgr->Count(vlan)); + l2_hdr->Assign(5, vlan); if ( inner_vlan ) - l2_hdr->Assign(6, val_mgr->Count(inner_vlan)); + l2_hdr->Assign(6, inner_vlan); - l2_hdr->Assign(7, val_mgr->Count(eth_type)); + l2_hdr->Assign(7, eth_type); if ( eth_type == ETHERTYPE_ARP || eth_type == ETHERTYPE_REVARP ) // We also identify ARP for L3 over ethernet @@ -131,8 +131,8 @@ RecordValPtr Packet::ToRawPktHdrVal() const else l2_hdr->Assign(0, BifType::Enum::link_encap->GetEnumVal(BifEnum::LINK_UNKNOWN)); - l2_hdr->Assign(1, val_mgr->Count(len)); - l2_hdr->Assign(2, val_mgr->Count(cap_len)); + l2_hdr->Assign(1, len); + l2_hdr->Assign(2, cap_len); l2_hdr->Assign(8, BifType::Enum::layer3_proto->GetEnumVal(l3)); diff --git a/src/iosource/pcap/pcap.bif b/src/iosource/pcap/pcap.bif index bb2cf53633..0f0e6e47f7 100644 --- a/src/iosource/pcap/pcap.bif +++ b/src/iosource/pcap/pcap.bif @@ -127,9 +127,9 @@ function findalldevs%(%): Pcap::Interfaces { auto r = make_intrusive(iface_type); - r->Assign(0, make_intrusive(d->name)); + r->Assign(0, d->name); if ( d->description ) - r->Assign(1, make_intrusive(d->description)); + r->Assign(1, d->description); auto addrs = make_intrusive(TYPE_ADDR); for ( auto addr = d->addresses; addr != NULL; addr = addr->next ) @@ -146,11 +146,11 @@ function findalldevs%(%): Pcap::Interfaces } } r->Assign(2, addrs->ToSetVal()); - r->Assign(3, val_mgr->Bool(d->flags & PCAP_IF_LOOPBACK)); + r->Assign(3, bool(d->flags & PCAP_IF_LOOPBACK)); #ifdef PCAP_IF_UP // These didn't become available until libpcap 1.6.1 - r->Assign(4, val_mgr->Bool(d->flags & PCAP_IF_UP)); - r->Assign(5, val_mgr->Bool(d->flags & PCAP_IF_RUNNING)); + r->Assign(4, bool(d->flags & PCAP_IF_UP)); + r->Assign(5, bool(d->flags & PCAP_IF_RUNNING)); #endif pcap_interfaces->Assign(std::move(r), nullptr); diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc index 27b2216262..ea7040e3ff 100644 --- a/src/logging/Manager.cc +++ b/src/logging/Manager.cc @@ -1517,9 +1517,9 @@ std::string Manager::FormatRotationPath(EnumValPtr writer, auto ri = make_intrusive(BifType::Record::Log::RotationFmtInfo); ri->Assign(0, std::move(writer)); ri->Assign(1, path.size(), path.data()); - ri->Assign(2, open); - ri->Assign(3, close); - ri->Assign(4, val_mgr->Bool(terminating)); + ri->AssignTime(2, open); + ri->AssignTime(3, close); + ri->Assign(4, terminating); ri->Assign(5, std::move(postprocessor)); std::string rval; @@ -1608,11 +1608,11 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con auto info = make_intrusive(BifType::Record::Log::RotationInfo); info->Assign(0, {NewRef{}, winfo->type}); - info->Assign(1, make_intrusive(new_name)); - info->Assign(2, make_intrusive(winfo->writer->Info().path)); - info->Assign(3, make_intrusive(open)); - info->Assign(4, make_intrusive(close)); - info->Assign(5, val_mgr->Bool(terminating)); + info->Assign(1, new_name); + info->Assign(2, winfo->writer->Info().path); + info->AssignTime(3, open); + info->AssignTime(4, close); + info->Assign(5, terminating); static auto default_ppf = id::find_func("Log::__default_rotation_postprocessor"); diff --git a/src/logging/writers/ascii/Ascii.cc b/src/logging/writers/ascii/Ascii.cc index 23d4c2833d..942aa5125b 100644 --- a/src/logging/writers/ascii/Ascii.cc +++ b/src/logging/writers/ascii/Ascii.cc @@ -818,11 +818,11 @@ void Ascii::RotateLeftoverLogs() auto rot_info = make_intrusive(rot_info_type); rot_info->Assign(0, writer_val); - rot_info->Assign(1, rotation_path); - rot_info->Assign(2, ll.Path()); - rot_info->Assign(3, ll.open_time); - rot_info->Assign(4, ll.close_time); - rot_info->Assign(5, val_mgr->False()); + rot_info->Assign(1, rotation_path); + rot_info->Assign(2, ll.Path()); + rot_info->AssignTime(3, double(ll.open_time)); + rot_info->AssignTime(4, double(ll.close_time)); + rot_info->Assign(5, false); if ( rename(ll.filename.data(), rotation_path.data()) != 0 ) reporter->FatalError("Found leftover/unprocessed log '%s', but " diff --git a/src/stats.bif b/src/stats.bif index a1dcedce7c..f2d9a2c4cc 100644 --- a/src/stats.bif +++ b/src/stats.bif @@ -57,10 +57,10 @@ function get_net_stats%(%): NetStats auto r = zeek::make_intrusive(NetStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(recv)); - r->Assign(n++, zeek::val_mgr->Count(drop)); - r->Assign(n++, zeek::val_mgr->Count(link)); - r->Assign(n++, zeek::val_mgr->Count(bytes_recv)); + r->Assign(n++, recv); + r->Assign(n++, drop); + r->Assign(n++, link); + r->Assign(n++, bytes_recv); return r; %} @@ -86,16 +86,16 @@ function get_conn_stats%(%): ConnStats auto r = zeek::make_intrusive(ConnStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(Connection::TotalConnections())); - r->Assign(n++, zeek::val_mgr->Count(Connection::CurrentConnections())); - r->Assign(n++, zeek::val_mgr->Count(sessions->CurrentConnections())); + r->Assign(n++, Connection::TotalConnections()); + r->Assign(n++, Connection::CurrentConnections()); + r->Assign(n++, sessions->CurrentConnections()); SessionStats s; if ( sessions ) sessions->GetStats(s); #define ADD_STAT(x) \ - r->Assign(n++, zeek::val_mgr->Count(unsigned(sessions ? x : 0))); + r->Assign(n++, unsigned(sessions ? x : 0)); ADD_STAT(s.num_packets); ADD_STAT(s.num_fragments); @@ -110,7 +110,7 @@ function get_conn_stats%(%): ConnStats ADD_STAT(s.max_ICMP_conns); ADD_STAT(s.cumulative_ICMP_conns); - r->Assign(n++, zeek::val_mgr->Count(zeek::detail::killed_by_inactivity)); + r->Assign(n++, zeek::detail::killed_by_inactivity); return r; %} @@ -147,27 +147,27 @@ function get_proc_stats%(%): ProcStats double(ru.ru_stime.tv_sec) + double(ru.ru_stime.tv_usec) / 1e6; #ifdef DEBUG - r->Assign(n++, zeek::val_mgr->Count(1)); + r->Assign(n++, true); #else - r->Assign(n++, zeek::val_mgr->Count(0)); + r->Assign(n++, false); #endif - r->Assign(n++, zeek::make_intrusive(zeek::run_state::zeek_start_time)); + r->AssignTime(n++, zeek::run_state::zeek_start_time); - r->Assign(n++, zeek::make_intrusive(elapsed_time, Seconds)); - r->Assign(n++, zeek::make_intrusive(user_time, Seconds)); - r->Assign(n++, zeek::make_intrusive(system_time, Seconds)); + r->AssignInterval(n++, elapsed_time); + r->AssignInterval(n++, user_time); + r->AssignInterval(n++, system_time); uint64_t total_mem; zeek::util::get_memory_usage(&total_mem, NULL); - r->Assign(n++, zeek::val_mgr->Count(unsigned(total_mem))); + r->Assign(n++, unsigned(total_mem)); - r->Assign(n++, zeek::val_mgr->Count(unsigned(ru.ru_minflt))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(ru.ru_majflt))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(ru.ru_nswap))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(ru.ru_inblock))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(ru.ru_oublock))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(ru.ru_nivcsw))); + r->Assign(n++, unsigned(ru.ru_minflt)); + r->Assign(n++, unsigned(ru.ru_majflt)); + r->Assign(n++, unsigned(ru.ru_nswap)); + r->Assign(n++, unsigned(ru.ru_inblock)); + r->Assign(n++, unsigned(ru.ru_oublock)); + r->Assign(n++, unsigned(ru.ru_nivcsw)); return r; %} @@ -193,8 +193,8 @@ function get_event_stats%(%): EventStats auto r = zeek::make_intrusive(EventStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(event_mgr.num_events_queued)); - r->Assign(n++, zeek::val_mgr->Count(event_mgr.num_events_dispatched)); + r->Assign(n++, event_mgr.num_events_queued); + r->Assign(n++, event_mgr.num_events_dispatched); return r; %} @@ -220,10 +220,10 @@ function get_reassembler_stats%(%): ReassemblerStats auto r = zeek::make_intrusive(ReassemblerStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(Reassembler::MemoryAllocation(zeek::REASSEM_FILE))); - r->Assign(n++, zeek::val_mgr->Count(Reassembler::MemoryAllocation(zeek::REASSEM_FRAG))); - r->Assign(n++, zeek::val_mgr->Count(Reassembler::MemoryAllocation(zeek::REASSEM_TCP))); - r->Assign(n++, zeek::val_mgr->Count(Reassembler::MemoryAllocation(zeek::REASSEM_UNKNOWN))); + r->Assign(n++, Reassembler::MemoryAllocation(zeek::REASSEM_FILE)); + r->Assign(n++, Reassembler::MemoryAllocation(zeek::REASSEM_FRAG)); + r->Assign(n++, Reassembler::MemoryAllocation(zeek::REASSEM_TCP)); + r->Assign(n++, Reassembler::MemoryAllocation(zeek::REASSEM_UNKNOWN)); return r; %} @@ -252,12 +252,12 @@ function get_dns_stats%(%): DNSStats zeek::detail::DNS_Mgr::Stats dstats; zeek::detail::dns_mgr->GetStats(&dstats); - r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.requests))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.successful))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.failed))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.pending))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.cached_hosts))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(dstats.cached_addresses))); + r->Assign(n++, unsigned(dstats.requests)); + r->Assign(n++, unsigned(dstats.successful)); + r->Assign(n++, unsigned(dstats.failed)); + r->Assign(n++, unsigned(dstats.pending)); + r->Assign(n++, unsigned(dstats.cached_hosts)); + r->Assign(n++, unsigned(dstats.cached_addresses)); return r; %} @@ -283,9 +283,9 @@ function get_timer_stats%(%): TimerStats auto r = zeek::make_intrusive(TimerStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(unsigned(zeek::detail::timer_mgr->Size()))); - r->Assign(n++, zeek::val_mgr->Count(unsigned(zeek::detail::timer_mgr->PeakSize()))); - r->Assign(n++, zeek::val_mgr->Count(zeek::detail::timer_mgr->CumulativeNum())); + r->Assign(n++, unsigned(zeek::detail::timer_mgr->Size())); + r->Assign(n++, unsigned(zeek::detail::timer_mgr->PeakSize())); + r->Assign(n++, zeek::detail::timer_mgr->CumulativeNum()); return r; %} @@ -311,9 +311,9 @@ function get_file_analysis_stats%(%): FileAnalysisStats auto r = zeek::make_intrusive(FileAnalysisStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(zeek::file_mgr->CurrentFiles())); - r->Assign(n++, zeek::val_mgr->Count(zeek::file_mgr->MaxFiles())); - r->Assign(n++, zeek::val_mgr->Count(zeek::file_mgr->CumulativeFiles())); + r->Assign(n++, zeek::file_mgr->CurrentFiles()); + r->Assign(n++, zeek::file_mgr->MaxFiles()); + r->Assign(n++, zeek::file_mgr->CumulativeFiles()); return r; %} @@ -339,7 +339,7 @@ function get_thread_stats%(%): ThreadStats auto r = zeek::make_intrusive(ThreadStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(zeek::thread_mgr->NumThreads())); + r->Assign(n++, zeek::thread_mgr->NumThreads()); return r; %} @@ -365,10 +365,10 @@ function get_gap_stats%(%): GapStats auto r = zeek::make_intrusive(GapStats); int n = 0; - r->Assign(n++, zeek::val_mgr->Count(zeek::detail::tot_ack_events)); - r->Assign(n++, zeek::val_mgr->Count(zeek::detail::tot_ack_bytes)); - r->Assign(n++, zeek::val_mgr->Count(zeek::detail::tot_gap_events)); - r->Assign(n++, zeek::val_mgr->Count(zeek::detail::tot_gap_bytes)); + r->Assign(n++, zeek::detail::tot_ack_events); + r->Assign(n++, zeek::detail::tot_ack_bytes); + r->Assign(n++, zeek::detail::tot_gap_events); + r->Assign(n++, zeek::detail::tot_gap_bytes); return r; %} @@ -402,13 +402,13 @@ function get_matcher_stats%(%): MatcherStats if ( zeek::detail::rule_matcher ) zeek::detail::rule_matcher->GetStats(&s); - r->Assign(n++, zeek::val_mgr->Count(s.matchers)); - r->Assign(n++, zeek::val_mgr->Count(s.nfa_states)); - r->Assign(n++, zeek::val_mgr->Count(s.dfa_states)); - r->Assign(n++, zeek::val_mgr->Count(s.computed)); - r->Assign(n++, zeek::val_mgr->Count(s.mem)); - r->Assign(n++, zeek::val_mgr->Count(s.hits)); - r->Assign(n++, zeek::val_mgr->Count(s.misses)); + r->Assign(n++, s.matchers); + r->Assign(n++, s.nfa_states); + r->Assign(n++, s.dfa_states); + r->Assign(n++, s.computed); + r->Assign(n++, s.mem); + r->Assign(n++, s.hits); + r->Assign(n++, s.misses); return r; %} @@ -436,15 +436,15 @@ function get_broker_stats%(%): BrokerStats int n = 0; auto cs = broker_mgr->GetStatistics(); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_peers))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_stores))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_pending_queries))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_events_incoming))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_events_outgoing))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_logs_incoming))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_logs_outgoing))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_ids_incoming))); - r->Assign(n++, zeek::val_mgr->Count(static_cast(cs.num_ids_outgoing))); + r->Assign(n++, static_cast(cs.num_peers)); + r->Assign(n++, static_cast(cs.num_stores)); + r->Assign(n++, static_cast(cs.num_pending_queries)); + r->Assign(n++, static_cast(cs.num_events_incoming)); + r->Assign(n++, static_cast(cs.num_events_outgoing)); + r->Assign(n++, static_cast(cs.num_logs_incoming)); + r->Assign(n++, static_cast(cs.num_logs_outgoing)); + r->Assign(n++, static_cast(cs.num_ids_incoming)); + r->Assign(n++, static_cast(cs.num_ids_outgoing)); return r; %} @@ -478,7 +478,7 @@ function get_reporter_stats%(%): ReporterStats weirds_by_type->Assign(std::move(weird), zeek::val_mgr->Count(kv.second)); } - r->Assign(n++, zeek::val_mgr->Count(reporter->GetWeirdCount())); + r->Assign(n++, reporter->GetWeirdCount()); r->Assign(n++, std::move(weirds_by_type)); return r; diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc index f8d957c482..ce3fe8d220 100644 --- a/src/supervisor/Supervisor.cc +++ b/src/supervisor/Supervisor.cc @@ -1348,22 +1348,22 @@ RecordValPtr Supervisor::NodeConfig::ToRecord() const { const auto& rt = BifType::Record::Supervisor::NodeConfig; auto rval = make_intrusive(rt); - rval->Assign(rt->FieldOffset("name"), make_intrusive(name)); + rval->Assign(rt->FieldOffset("name"), name); if ( interface ) - rval->Assign(rt->FieldOffset("interface"), make_intrusive(*interface)); + rval->Assign(rt->FieldOffset("interface"), *interface); if ( directory ) - rval->Assign(rt->FieldOffset("directory"), make_intrusive(*directory)); + rval->Assign(rt->FieldOffset("directory"), *directory); if ( stdout_file ) - rval->Assign(rt->FieldOffset("stdout_file"), make_intrusive(*stdout_file)); + rval->Assign(rt->FieldOffset("stdout_file"), *stdout_file); if ( stderr_file ) - rval->Assign(rt->FieldOffset("stderr_file"), make_intrusive(*stderr_file)); + rval->Assign(rt->FieldOffset("stderr_file"), *stderr_file); if ( cpu_affinity ) - rval->Assign(rt->FieldOffset("cpu_affinity"), val_mgr->Int(*cpu_affinity)); + rval->Assign(rt->FieldOffset("cpu_affinity"), *cpu_affinity); auto st = rt->GetFieldType("scripts"); auto scripts_val = make_intrusive(std::move(st)); @@ -1390,7 +1390,7 @@ RecordValPtr Supervisor::NodeConfig::ToRecord() const val->Assign(ept->FieldOffset("p"), val_mgr->Port(ep.port, TRANSPORT_TCP)); if ( ep.interface ) - val->Assign(ept->FieldOffset("interface"), make_intrusive(*ep.interface)); + val->Assign(ept->FieldOffset("interface"), *ep.interface); cluster_val->Assign(std::move(key), std::move(val)); } @@ -1406,7 +1406,7 @@ RecordValPtr SupervisorNode::ToRecord() const rval->Assign(rt->FieldOffset("node"), config.ToRecord()); if ( pid ) - rval->Assign(rt->FieldOffset("pid"), val_mgr->Int(pid)); + rval->Assign(rt->FieldOffset("pid"), pid); return rval; } @@ -1464,11 +1464,11 @@ bool SupervisedNode::InitCluster() const if ( ep.interface ) val->Assign(cluster_node_type->FieldOffset("interface"), - make_intrusive(*ep.interface)); + *ep.interface); if ( manager_name && ep.role != BifEnum::Supervisor::MANAGER ) val->Assign(cluster_node_type->FieldOffset("manager"), - make_intrusive(*manager_name)); + *manager_name); cluster_nodes->Assign(std::move(key), std::move(val)); } diff --git a/src/supervisor/supervisor.bif b/src/supervisor/supervisor.bif index 4dd1909519..c143bc1dcf 100644 --- a/src/supervisor/supervisor.bif +++ b/src/supervisor/supervisor.bif @@ -86,7 +86,7 @@ function Supervisor::__node%(%): Supervisor::NodeConfig zeek::emit_builtin_error("not a supervised process"); const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig; auto rval = zeek::make_intrusive(rt); - rval->Assign(rt->FieldOffset("name"), ""); + rval->Assign(rt->FieldOffset("name"), ""); return rval; } diff --git a/src/util.cc b/src/util.cc index e18e758cd8..f00e3d646a 100644 --- a/src/util.cc +++ b/src/util.cc @@ -865,10 +865,10 @@ FILE* rotate_file(const char* name, RecordVal* rotate_info) // Init rotate_info. if ( rotate_info ) { - rotate_info->Assign(0, name); - rotate_info->Assign(1, newname); - rotate_info->Assign(2, run_state::network_time); - rotate_info->Assign(3, run_state::network_time); + rotate_info->Assign(0, name); + rotate_info->Assign(1, newname); + rotate_info->AssignTime(2, run_state::network_time); + rotate_info->AssignTime(3, run_state::network_time); } return newf; diff --git a/src/zeek.bif b/src/zeek.bif index 91e0120ba7..a0e63d6ecd 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -1053,11 +1053,11 @@ function find_entropy%(data: string%): entropy_test_result static auto entropy_test_result = zeek::id::find_type("entropy_test_result"); auto ent_result = zeek::make_intrusive(entropy_test_result); - ent_result->Assign(0, zeek::make_intrusive(ent)); - ent_result->Assign(1, zeek::make_intrusive(chisq)); - ent_result->Assign(2, zeek::make_intrusive(mean)); - ent_result->Assign(3, zeek::make_intrusive(montepi)); - ent_result->Assign(4, zeek::make_intrusive(scc)); + ent_result->Assign(0, ent); + ent_result->Assign(1, chisq); + ent_result->Assign(2, mean); + ent_result->Assign(3, montepi); + ent_result->Assign(4, scc); return ent_result; %} @@ -1105,11 +1105,11 @@ function entropy_test_finish%(handle: opaque of entropy%): entropy_test_result static auto entropy_test_result = zeek::id::find_type("entropy_test_result"); auto ent_result = zeek::make_intrusive(entropy_test_result); - ent_result->Assign(0, zeek::make_intrusive(ent)); - ent_result->Assign(1, zeek::make_intrusive(chisq)); - ent_result->Assign(2, zeek::make_intrusive(mean)); - ent_result->Assign(3, zeek::make_intrusive(montepi)); - ent_result->Assign(4, zeek::make_intrusive(scc)); + ent_result->Assign(0, ent); + ent_result->Assign(1, chisq); + ent_result->Assign(2, mean); + ent_result->Assign(3, montepi); + ent_result->Assign(4, scc); return ent_result; %} @@ -1926,10 +1926,10 @@ function packet_source%(%): PacketSource if ( ps ) { - r->Assign(0, zeek::val_mgr->Bool(ps->IsLive())); - r->Assign(1, zeek::make_intrusive(ps->Path())); - r->Assign(2, zeek::val_mgr->Int(ps->LinkType())); - r->Assign(3, zeek::val_mgr->Count(ps->Netmask())); + r->Assign(0, bool(ps->IsLive())); + r->Assign(1, ps->Path()); + r->Assign(2, ps->LinkType()); + r->Assign(3, ps->Netmask()); } return r; @@ -1979,13 +1979,13 @@ function global_ids%(%): id_table const auto& id = global.second; static auto script_id = zeek::id::find_type("script_id"); auto rec = zeek::make_intrusive(script_id); - rec->Assign(0, zeek::make_intrusive(type_name(id->GetType()->Tag()))); - rec->Assign(1, zeek::val_mgr->Bool(id->IsExport())); - rec->Assign(2, zeek::val_mgr->Bool(id->IsConst())); - rec->Assign(3, zeek::val_mgr->Bool(id->IsEnumConst())); - rec->Assign(4, zeek::val_mgr->Bool(id->IsOption())); - rec->Assign(5, zeek::val_mgr->Bool(id->IsRedefinable())); - rec->Assign(6, zeek::val_mgr->Bool(id->GetAttr(zeek::detail::ATTR_BACKEND) != zeek::detail::Attr::nil)); + rec->Assign(0, type_name(id->GetType()->Tag())); + rec->Assign(1, bool(id->IsExport())); + rec->Assign(2, bool(id->IsConst())); + rec->Assign(3, bool(id->IsEnumConst())); + rec->Assign(4, bool(id->IsOption())); + rec->Assign(5, bool(id->IsRedefinable())); + rec->Assign(6, bool(id->GetAttr(zeek::detail::ATTR_BACKEND) != zeek::detail::Attr::nil)); if ( id->HasVal() ) rec->Assign(7, id->GetVal()); @@ -2235,14 +2235,14 @@ function backtrace%(%): Backtrace const auto& params = ci.func->GetType()->Params(); auto args = MakeCallArgumentVector(ci.args, params); - elem->Assign(function_name_idx, ci.func->Name()); + elem->Assign(function_name_idx, ci.func->Name()); elem->Assign(function_args_idx, std::move(args)); if ( ci.call ) { auto loc = ci.call->GetLocationInfo(); - elem->Assign(file_location_idx, loc->filename); - elem->Assign(line_location_idx, val_mgr->Count(loc->first_line)); + elem->Assign(file_location_idx, loc->filename); + elem->Assign(line_location_idx, loc->first_line); } rval->Assign(rval->Size(), std::move(elem)); @@ -3414,18 +3414,18 @@ function lookup_connection%(cid: conn_id%): connection c->Assign(0, std::move(id_val)); auto orig_endp = zeek::make_intrusive(zeek::id::endpoint); - orig_endp->Assign(0, zeek::val_mgr->Count(0)); - orig_endp->Assign(1, zeek::val_mgr->Count(int(0))); + orig_endp->Assign(0, 0); + orig_endp->Assign(1, 0); auto resp_endp = zeek::make_intrusive(zeek::id::endpoint); - resp_endp->Assign(0, zeek::val_mgr->Count(0)); - resp_endp->Assign(1, zeek::val_mgr->Count(int(0))); + resp_endp->Assign(0, 0); + resp_endp->Assign(1, 0); c->Assign(1, std::move(orig_endp)); c->Assign(2, std::move(resp_endp)); - c->Assign(3, zeek::make_intrusive(zeek::run_state::network_time)); - c->Assign(4, zeek::make_intrusive(0.0)); + c->AssignTime(3, zeek::run_state::network_time); + c->AssignInterval(4, 0.0); c->Assign(5, zeek::make_intrusive(zeek::id::string_set)); // service c->Assign(6, zeek::val_mgr->EmptyString()); // history @@ -3494,19 +3494,19 @@ function get_current_packet%(%) : pcap_packet if ( ! pkt_src || ! pkt_src->GetCurrentPacket(&p) ) { - pkt->Assign(0, zeek::val_mgr->Count(0)); - pkt->Assign(1, zeek::val_mgr->Count(0)); - pkt->Assign(2, zeek::val_mgr->Count(0)); - pkt->Assign(3, zeek::val_mgr->Count(0)); + pkt->Assign(0, 0); + pkt->Assign(1, 0); + pkt->Assign(2, 0); + pkt->Assign(3, 0); pkt->Assign(4, zeek::val_mgr->EmptyString()); pkt->Assign(5, zeek::BifType::Enum::link_encap->GetEnumVal(BifEnum::LINK_UNKNOWN)); return pkt; } - pkt->Assign(0, zeek::val_mgr->Count(uint32_t(p->ts.tv_sec))); - pkt->Assign(1, zeek::val_mgr->Count(uint32_t(p->ts.tv_usec))); - pkt->Assign(2, zeek::val_mgr->Count(p->cap_len)); - pkt->Assign(3, zeek::val_mgr->Count(p->len)); + pkt->Assign(0, uint32_t(p->ts.tv_sec)); + pkt->Assign(1, uint32_t(p->ts.tv_usec)); + pkt->Assign(2, p->cap_len); + pkt->Assign(3, p->len); pkt->Assign(4, zeek::make_intrusive(p->cap_len, (const char*)p->data)); pkt->Assign(5, zeek::BifType::Enum::link_encap->GetEnumVal(p->link_type)); @@ -4736,8 +4736,8 @@ function rotate_file%(f: file%): rotate_info info = zeek::make_intrusive(rotate_info); info->Assign(0, zeek::val_mgr->EmptyString()); info->Assign(1, zeek::val_mgr->EmptyString()); - info->Assign(2, zeek::make_intrusive(0.0)); - info->Assign(3, zeek::make_intrusive(0.0)); + info->AssignTime(2, 0.0); + info->AssignTime(3, 0.0); return info; %} @@ -4779,8 +4779,8 @@ function rotate_file_by_name%(f: string%): rotate_info // Record indicating error. info->Assign(0, zeek::val_mgr->EmptyString()); info->Assign(1, zeek::val_mgr->EmptyString()); - info->Assign(2, zeek::make_intrusive(0.0)); - info->Assign(3, zeek::make_intrusive(0.0)); + info->AssignTime(2, 0.0); + info->AssignTime(3, 0.0); return info; } @@ -4788,12 +4788,12 @@ function rotate_file_by_name%(f: string%): rotate_info if ( is_pkt_dumper ) { - info->Assign(2, zeek::make_intrusive(zeek::run_state::detail::pkt_dumper->OpenTime())); + info->AssignTime(2, zeek::run_state::detail::pkt_dumper->OpenTime()); zeek::run_state::detail::pkt_dumper->Open(); } if ( is_addl_pkt_dumper ) - info->Assign(2, zeek::make_intrusive(addl_pkt_dumper->OpenTime())); + info->AssignTime(2, addl_pkt_dumper->OpenTime()); return info; %}