From 64332ca22ca4328acfcd81b003319eb9ae6496fc Mon Sep 17 00:00:00 2001 From: Tim Wojtulewicz Date: Wed, 24 Jun 2020 16:55:28 -0400 Subject: [PATCH] Move all Val classes to the zeek namespaces --- auxil/bifcl | 2 +- auxil/binpac | 2 +- src/Anon.cc | 16 +- src/BifReturnVal.cc | 2 +- src/BifReturnVal.h | 11 +- src/BroList.h | 4 +- src/BroString.cc | 8 +- src/BroString.h | 8 +- src/CompHash.cc | 82 +-- src/CompHash.h | 28 +- src/Conn.cc | 38 +- src/Conn.h | 19 +- src/DNS_Mgr.cc | 64 +- src/DNS_Mgr.h | 31 +- src/Debug.cc | 6 +- src/Debug.h | 12 +- src/Discard.cc | 4 +- src/Discard.h | 5 +- src/Event.h | 6 +- src/EventHandler.cc | 14 +- src/Expr.cc | 76 +-- src/Expr.h | 5 +- src/File.cc | 8 +- src/File.h | 5 +- src/Frame.cc | 12 +- src/Frame.h | 24 +- src/Func.cc | 18 +- src/Func.h | 19 +- src/Hash.h | 7 +- src/ID.cc | 8 +- src/ID.h | 22 +- src/IP.cc | 100 +-- src/IP.h | 29 +- src/Net.cc | 2 +- src/NetVar.cc | 42 +- src/NetVar.h | 42 +- src/OpaqueVal.cc | 4 + src/OpaqueVal.h | 33 +- src/PacketFilter.cc | 8 +- src/PacketFilter.h | 10 +- src/PrefixTable.cc | 8 +- src/PrefixTable.h | 12 +- src/RandTest.h | 33 +- src/Reporter.cc | 22 +- src/Reporter.h | 11 +- src/RuleAction.cc | 4 +- src/RuleCondition.cc | 2 +- src/RuleMatcher.cc | 18 +- src/RuleMatcher.h | 7 +- src/Scope.h | 3 +- src/Sessions.cc | 10 +- src/Sessions.h | 2 +- src/SmithWaterman.cc | 20 +- src/SmithWaterman.h | 6 +- src/Stats.cc | 10 +- src/Stats.h | 7 +- src/Stmt.cc | 20 +- src/Tag.cc | 8 +- src/Tag.h | 16 +- src/Trigger.h | 2 +- src/TunnelEncapsulation.cc | 12 +- src/TunnelEncapsulation.h | 10 +- src/Type.cc | 12 +- src/Type.h | 27 +- src/Val.cc | 608 +++++++++--------- src/Val.h | 49 +- src/Var.cc | 40 +- src/Var.h | 20 +- src/ZeekArgs.h | 4 +- src/analyzer/Analyzer.cc | 20 +- src/analyzer/Analyzer.h | 18 +- src/analyzer/Manager.cc | 26 +- src/analyzer/Manager.h | 25 +- src/analyzer/Tag.cc | 8 +- src/analyzer/Tag.h | 11 +- src/analyzer/analyzer.bif | 2 +- src/analyzer/protocol/arp/ARP.cc | 14 +- src/analyzer/protocol/arp/ARP.h | 8 +- src/analyzer/protocol/asn1/asn1.pac | 28 +- .../protocol/bittorrent/BitTorrent.cc | 7 +- .../protocol/bittorrent/BitTorrentTracker.cc | 38 +- .../protocol/bittorrent/BitTorrentTracker.h | 12 +- src/analyzer/protocol/conn-size/ConnSize.cc | 8 +- src/analyzer/protocol/conn-size/ConnSize.h | 4 +- src/analyzer/protocol/conn-size/functions.bif | 6 +- .../protocol/dce-rpc/dce_rpc-analyzer.pac | 6 +- src/analyzer/protocol/dhcp/dhcp-analyzer.pac | 26 +- src/analyzer/protocol/dhcp/dhcp-options.pac | 72 +-- src/analyzer/protocol/dns/DNS.cc | 124 ++-- src/analyzer/protocol/dns/DNS.h | 20 +- src/analyzer/protocol/file/File.cc | 6 +- src/analyzer/protocol/finger/Finger.cc | 6 +- src/analyzer/protocol/ftp/FTP.cc | 14 +- src/analyzer/protocol/ftp/functions.bif | 22 +- src/analyzer/protocol/gnutella/Gnutella.cc | 37 +- .../protocol/gtpv1/gtpv1-analyzer.pac | 110 ++-- src/analyzer/protocol/http/HTTP.cc | 46 +- src/analyzer/protocol/http/HTTP.h | 18 +- src/analyzer/protocol/http/functions.bif | 2 +- src/analyzer/protocol/icmp/ICMP.cc | 71 +- src/analyzer/protocol/icmp/ICMP.h | 32 +- src/analyzer/protocol/ident/Ident.cc | 6 +- src/analyzer/protocol/imap/imap-analyzer.pac | 4 +- src/analyzer/protocol/irc/IRC.cc | 348 +++++----- src/analyzer/protocol/krb/KRB.cc | 8 +- src/analyzer/protocol/krb/KRB.h | 6 +- src/analyzer/protocol/krb/KRB_TCP.h | 6 +- src/analyzer/protocol/krb/krb-analyzer.pac | 26 +- src/analyzer/protocol/krb/krb-asn1.pac | 10 +- src/analyzer/protocol/krb/krb-padata.pac | 14 +- src/analyzer/protocol/krb/krb-types.pac | 46 +- src/analyzer/protocol/login/Login.cc | 48 +- src/analyzer/protocol/login/Login.h | 6 +- src/analyzer/protocol/login/NVT.cc | 2 +- src/analyzer/protocol/login/RSH.cc | 10 +- src/analyzer/protocol/login/Rlogin.cc | 4 +- src/analyzer/protocol/mime/MIME.cc | 48 +- src/analyzer/protocol/mime/MIME.h | 39 +- .../protocol/modbus/modbus-analyzer.pac | 28 +- .../protocol/mqtt/commands/connack.pac | 2 +- .../protocol/mqtt/commands/connect.pac | 16 +- .../protocol/mqtt/commands/publish.pac | 6 +- .../protocol/mqtt/commands/subscribe.pac | 6 +- .../protocol/mqtt/commands/unsubscribe.pac | 4 +- .../protocol/mysql/mysql-analyzer.pac | 14 +- src/analyzer/protocol/netbios/NetbiosSSN.cc | 12 +- src/analyzer/protocol/netbios/functions.bif | 2 +- src/analyzer/protocol/ntlm/ntlm-analyzer.pac | 26 +- src/analyzer/protocol/ntp/ntp-analyzer.pac | 42 +- src/analyzer/protocol/pop3/POP3.cc | 4 +- .../protocol/radius/radius-analyzer.pac | 10 +- src/analyzer/protocol/rdp/rdp-analyzer.pac | 12 +- src/analyzer/protocol/rfb/rfb-analyzer.pac | 2 +- src/analyzer/protocol/rpc/MOUNT.cc | 40 +- src/analyzer/protocol/rpc/MOUNT.h | 10 +- src/analyzer/protocol/rpc/NFS.cc | 148 ++--- src/analyzer/protocol/rpc/NFS.h | 74 +-- src/analyzer/protocol/rpc/Portmap.cc | 20 +- src/analyzer/protocol/rpc/Portmap.h | 8 +- src/analyzer/protocol/rpc/RPC.cc | 2 +- src/analyzer/protocol/rpc/RPC.h | 8 +- src/analyzer/protocol/sip/sip-analyzer.pac | 10 +- src/analyzer/protocol/smb/smb-strings.pac | 18 +- src/analyzer/protocol/smb/smb-time.pac | 22 +- .../protocol/smb/smb1-com-negotiate.pac | 18 +- .../smb/smb1-com-session-setup-andx.pac | 8 +- .../smb/smb1-com-transaction-secondary.pac | 12 +- .../protocol/smb/smb1-com-transaction.pac | 12 +- .../smb/smb1-com-transaction2-secondary.pac | 6 +- .../protocol/smb/smb1-com-transaction2.pac | 10 +- src/analyzer/protocol/smb/smb1-protocol.pac | 6 +- src/analyzer/protocol/smb/smb2-com-close.pac | 2 +- src/analyzer/protocol/smb/smb2-com-create.pac | 6 +- .../protocol/smb/smb2-com-negotiate.pac | 10 +- .../protocol/smb/smb2-com-session-setup.pac | 6 +- .../protocol/smb/smb2-com-set-info.pac | 6 +- .../smb/smb2-com-transform-header.pac | 2 +- .../protocol/smb/smb2-com-tree-connect.pac | 4 +- src/analyzer/protocol/smb/smb2-protocol.pac | 36 +- src/analyzer/protocol/smtp/SMTP.cc | 14 +- src/analyzer/protocol/snmp/snmp-analyzer.pac | 64 +- .../protocol/socks/socks-analyzer.pac | 34 +- src/analyzer/protocol/ssh/ssh-analyzer.pac | 20 +- .../protocol/ssl/proc-client-hello.pac | 8 +- .../protocol/ssl/proc-server-hello.pac | 4 +- src/analyzer/protocol/ssl/ssl-defs.pac | 4 +- .../protocol/ssl/ssl-dtls-analyzer.pac | 2 +- .../protocol/ssl/tls-handshake-analyzer.pac | 80 +-- .../protocol/syslog/syslog-analyzer.pac | 4 +- src/analyzer/protocol/tcp/TCP.cc | 32 +- src/analyzer/protocol/tcp/TCP.h | 4 +- src/analyzer/protocol/tcp/TCP_Endpoint.cc | 2 +- src/analyzer/protocol/tcp/TCP_Reassembler.cc | 16 +- src/analyzer/protocol/tcp/functions.bif | 4 +- src/analyzer/protocol/teredo/Teredo.cc | 16 +- src/analyzer/protocol/teredo/Teredo.h | 2 +- src/analyzer/protocol/udp/UDP.cc | 23 +- src/analyzer/protocol/udp/UDP.h | 4 +- src/binpac_bro-lib.pac | 6 +- src/binpac_bro.h | 28 +- src/broker/Data.cc | 56 +- src/broker/Data.h | 50 +- src/broker/Manager.cc | 45 +- src/broker/Manager.h | 15 +- src/broker/Store.cc | 4 +- src/broker/Store.h | 22 +- src/broker/comm.bif | 16 +- src/broker/data.bif | 34 +- src/broker/messaging.bif | 4 +- src/broker/store.bif | 2 +- src/file_analysis/Analyzer.cc | 8 +- src/file_analysis/Analyzer.h | 18 +- src/file_analysis/AnalyzerSet.cc | 16 +- src/file_analysis/AnalyzerSet.h | 18 +- src/file_analysis/Component.h | 8 +- src/file_analysis/File.cc | 50 +- src/file_analysis/File.h | 23 +- src/file_analysis/Manager.cc | 24 +- src/file_analysis/Manager.h | 24 +- src/file_analysis/Tag.cc | 8 +- src/file_analysis/Tag.h | 10 +- .../analyzer/data_event/DataEvent.cc | 14 +- .../analyzer/data_event/DataEvent.h | 4 +- src/file_analysis/analyzer/entropy/Entropy.cc | 18 +- src/file_analysis/analyzer/entropy/Entropy.h | 6 +- src/file_analysis/analyzer/extract/Extract.cc | 8 +- src/file_analysis/analyzer/extract/Extract.h | 4 +- src/file_analysis/analyzer/hash/Hash.cc | 8 +- src/file_analysis/analyzer/hash/Hash.h | 22 +- src/file_analysis/analyzer/pe/PE.cc | 2 +- src/file_analysis/analyzer/pe/PE.h | 4 +- src/file_analysis/analyzer/pe/pe-analyzer.pac | 28 +- .../analyzer/unified2/Unified2.cc | 5 +- .../analyzer/unified2/Unified2.h | 4 +- .../analyzer/unified2/unified2-analyzer.pac | 26 +- src/file_analysis/analyzer/x509/OCSP.cc | 58 +- src/file_analysis/analyzer/x509/OCSP.h | 6 +- src/file_analysis/analyzer/x509/X509.cc | 70 +- src/file_analysis/analyzer/x509/X509.h | 20 +- src/file_analysis/analyzer/x509/X509Common.cc | 16 +- src/file_analysis/analyzer/x509/X509Common.h | 10 +- src/file_analysis/analyzer/x509/functions.bif | 22 +- .../analyzer/x509/x509-extension.pac | 4 +- src/file_analysis/file_analysis.bif | 2 +- src/input/Manager.cc | 132 ++-- src/input/Manager.h | 26 +- src/input/ReaderFrontend.cc | 2 +- src/input/ReaderFrontend.h | 4 +- src/input/Tag.cc | 8 +- src/input/Tag.h | 10 +- src/iosource/Packet.cc | 12 +- src/iosource/Packet.h | 19 +- src/iosource/pcap/Source.cc | 2 +- src/iosource/pcap/pcap.bif | 4 +- src/logging/Manager.cc | 105 +-- src/logging/Manager.h | 56 +- src/logging/Tag.cc | 8 +- src/logging/Tag.h | 10 +- src/logging/WriterFrontend.cc | 3 +- src/logging/WriterFrontend.h | 7 +- src/option.bif | 6 +- src/parse.y | 8 +- src/plugin/Manager.cc | 4 +- src/plugin/Plugin.cc | 6 +- src/plugin/Plugin.h | 3 +- src/probabilistic/Hasher.cc | 3 +- src/probabilistic/Topk.cc | 8 +- src/probabilistic/Topk.h | 12 +- src/probabilistic/bloom-filter.bif | 8 +- src/probabilistic/cardinality-counter.bif | 6 +- src/reporter.bif | 6 +- src/scan.l | 30 +- src/stats.bif | 38 +- src/strings.bif | 76 +-- src/supervisor/Supervisor.cc | 46 +- src/supervisor/supervisor.bif | 10 +- src/threading/Manager.cc | 2 +- src/threading/SerialTypes.cc | 24 +- src/threading/SerialTypes.h | 2 +- src/util.cc | 10 +- src/util.h | 4 +- src/zeek-setup.cc | 12 +- src/zeek.bif | 306 ++++----- src/zeekygen/IdentifierInfo.h | 4 +- src/zeekygen/zeekygen.bif | 4 +- 265 files changed, 3154 insertions(+), 3086 deletions(-) diff --git a/auxil/bifcl b/auxil/bifcl index 10a4c00735..6c07de1324 160000 --- a/auxil/bifcl +++ b/auxil/bifcl @@ -1 +1 @@ -Subproject commit 10a4c007351ab7d16e5cbef0006a5ad9002ea3de +Subproject commit 6c07de13247f16490c25a2066c77db1678ccd128 diff --git a/auxil/binpac b/auxil/binpac index 9c3211ff12..4bf3508143 160000 --- a/auxil/binpac +++ b/auxil/binpac @@ -1 +1 @@ -Subproject commit 9c3211ff121ddc677d0ed8bd3a85783f87921cce +Subproject commit 4bf3508143994b49b72b77c29a47efc8efc7f1b7 diff --git a/src/Anon.cc b/src/Anon.cc index 9c53b40cec..98d98a9f99 100644 --- a/src/Anon.cc +++ b/src/Anon.cc @@ -358,9 +358,9 @@ AnonymizeIPAddr_A50::Node* AnonymizeIPAddr_A50::find_node(ipaddr32_t a) return nullptr; } -static TableValPtr anon_preserve_orig_addr; -static TableValPtr anon_preserve_resp_addr; -static TableValPtr anon_preserve_other_addr; +static zeek::TableValPtr anon_preserve_orig_addr; +static zeek::TableValPtr anon_preserve_resp_addr; +static zeek::TableValPtr anon_preserve_other_addr; void zeek::detail::init_ip_addr_anonymizers() { @@ -373,23 +373,23 @@ void zeek::detail::init_ip_addr_anonymizers() auto id = global_scope()->Find("preserve_orig_addr"); if ( id ) - anon_preserve_orig_addr = zeek::cast_intrusive(id->GetVal()); + anon_preserve_orig_addr = zeek::cast_intrusive(id->GetVal()); id = global_scope()->Find("preserve_resp_addr"); if ( id ) - anon_preserve_resp_addr = zeek::cast_intrusive(id->GetVal()); + anon_preserve_resp_addr = zeek::cast_intrusive(id->GetVal()); id = global_scope()->Find("preserve_other_addr"); if ( id ) - anon_preserve_other_addr = zeek::cast_intrusive(id->GetVal()); + anon_preserve_other_addr = zeek::cast_intrusive(id->GetVal()); } ipaddr32_t zeek::detail::anonymize_ip(ipaddr32_t ip, enum ip_addr_anonymization_class_t cl) { TableVal* preserve_addr = nullptr; - auto addr = zeek::make_intrusive(ip); + auto addr = zeek::make_intrusive(ip); int method = -1; @@ -445,7 +445,7 @@ void zeek::detail::log_anonymization_mapping(ipaddr32_t input, ipaddr32_t output { if ( anonymization_mapping ) mgr.Enqueue(anonymization_mapping, - zeek::make_intrusive(input), + zeek::make_intrusive(input), zeek::make_intrusive(output) ); } diff --git a/src/BifReturnVal.cc b/src/BifReturnVal.cc index 5140e07035..51f066d977 100644 --- a/src/BifReturnVal.cc +++ b/src/BifReturnVal.cc @@ -6,6 +6,6 @@ BifReturnVal::BifReturnVal(std::nullptr_t) noexcept {} -BifReturnVal::BifReturnVal(Val* v) noexcept +BifReturnVal::BifReturnVal(zeek::Val* v) noexcept : rval(zeek::AdoptRef{}, v) {} diff --git a/src/BifReturnVal.h b/src/BifReturnVal.h index 6398093d6d..47bc6bbc7a 100644 --- a/src/BifReturnVal.h +++ b/src/BifReturnVal.h @@ -2,10 +2,13 @@ #pragma once +#include "zeek-config.h" #include "IntrusivePtr.h" -class Val; -using ValPtr = zeek::IntrusivePtr; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +namespace zeek { +using ValPtr = zeek::IntrusivePtr; +} /** * A simple wrapper class to use for the return value of BIFs so that @@ -23,7 +26,7 @@ public: BifReturnVal(std::nullptr_t) noexcept; [[deprecated("Remove in v4.1. Return an IntrusivePtr instead.")]] - BifReturnVal(Val* v) noexcept; + BifReturnVal(zeek::Val* v) noexcept; - ValPtr rval; + zeek::ValPtr rval; }; diff --git a/src/BroList.h b/src/BroList.h index a1463603eb..2a76b6999d 100644 --- a/src/BroList.h +++ b/src/BroList.h @@ -4,8 +4,8 @@ #include "List.h" -class Val; -using val_list = PList; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +using val_list = PList; ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail); using expr_list = PList; diff --git a/src/BroString.cc b/src/BroString.cc index 0b72851510..425a9d843f 100644 --- a/src/BroString.cc +++ b/src/BroString.cc @@ -338,14 +338,14 @@ BroString::Vec* BroString::Split(const BroString::IdxVec& indices) const return result; } -VectorVal* BroString:: VecToPolicy(Vec* vec) +zeek::VectorVal* BroString:: VecToPolicy(Vec* vec) { - auto result = zeek::make_intrusive(zeek::id::string_vec); + auto result = zeek::make_intrusive(zeek::id::string_vec); for ( unsigned int i = 0; i < vec->size(); ++i ) { BroString* string = (*vec)[i]; - auto val = zeek::make_intrusive(string->Len(), + auto val = zeek::make_intrusive(string->Len(), (const char*) string->Bytes()); result->Assign(i+1, std::move(val)); } @@ -353,7 +353,7 @@ VectorVal* BroString:: VecToPolicy(Vec* vec) return result.release(); } -BroString::Vec* BroString::VecFromPolicy(VectorVal* vec) +BroString::Vec* BroString::VecFromPolicy(zeek::VectorVal* vec) { Vec* result = new Vec(); diff --git a/src/BroString.h b/src/BroString.h index 66c3bce4b7..de4c0f0689 100644 --- a/src/BroString.h +++ b/src/BroString.h @@ -2,6 +2,8 @@ #pragma once +#include "zeek-config.h" + #include #include #include @@ -13,7 +15,7 @@ typedef u_char* byte_vec; // Forward declaration, for helper functions that convert (sub)string vectors // to and from policy-level representations. // -class VectorVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek); class BroString { public: @@ -134,8 +136,8 @@ public: Vec* Split(const IdxVec& indices) const; // Helper functions for vectors: - static VectorVal* VecToPolicy(Vec* vec); - static Vec* VecFromPolicy(VectorVal* vec); + static zeek::VectorVal* VecToPolicy(Vec* vec); + static Vec* VecFromPolicy(zeek::VectorVal* vec); static char* VecToString(const Vec* vec); protected: diff --git a/src/CompHash.cc b/src/CompHash.cc index f64bb801ed..1ec5fb5359 100644 --- a/src/CompHash.cc +++ b/src/CompHash.cc @@ -72,7 +72,7 @@ CompositeHash::~CompositeHash() // Computes the piece of the hash for Val*, returning the new kp. char* CompositeHash::SingleValHash(bool type_check, char* kp0, - zeek::Type* bt, Val* v, bool optional) const + zeek::Type* bt, zeek::Val* v, bool optional) const { char* kp1 = nullptr; zeek::InternalTypeTag t = bt->InternalType(); @@ -176,7 +176,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0, case zeek::TYPE_RECORD: { char* kp = kp0; - RecordVal* rv = v->AsRecordVal(); + zeek::RecordVal* rv = v->AsRecordVal(); zeek::RecordType* rt = bt->AsRecordType(); int num_fields = rt->NumFields(); @@ -203,13 +203,13 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0, case zeek::TYPE_TABLE: { int* kp = AlignAndPadType(kp0); - TableVal* tv = v->AsTableVal(); + zeek::TableVal* tv = v->AsTableVal(); *kp = tv->Size(); kp1 = reinterpret_cast(kp+1); auto tbl = tv->AsTable(); auto it = tbl->InitForIteration(); - auto lv = zeek::make_intrusive(zeek::TYPE_ANY); + auto lv = zeek::make_intrusive(zeek::TYPE_ANY); struct HashKeyComparer { bool operator()(const HashKey* a, const HashKey* b) const @@ -262,7 +262,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0, case zeek::TYPE_VECTOR: { unsigned int* kp = AlignAndPadType(kp0); - VectorVal* vv = v->AsVectorVal(); + zeek::VectorVal* vv = v->AsVectorVal(); zeek::VectorType* vt = v->GetType()->AsVectorType(); *kp = vv->Size(); kp1 = reinterpret_cast(kp+1); @@ -290,12 +290,12 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0, case zeek::TYPE_LIST: { int* kp = AlignAndPadType(kp0); - ListVal* lv = v->AsListVal(); + zeek::ListVal* lv = v->AsListVal(); *kp = lv->Length(); kp1 = reinterpret_cast(kp+1); for ( int i = 0; i < lv->Length(); ++i ) { - Val* v = lv->Idx(i).get(); + zeek::Val* v = lv->Idx(i).get(); if ( ! (kp1 = SingleValHash(type_check, kp1, v->GetType().get(), v, false)) ) return nullptr; @@ -336,7 +336,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0, } -std::unique_ptr CompositeHash::MakeHashKey(const Val& argv, bool type_check) const +std::unique_ptr CompositeHash::MakeHashKey(const zeek::Val& argv, bool type_check) const { auto v = &argv; @@ -345,12 +345,12 @@ std::unique_ptr CompositeHash::MakeHashKey(const Val& argv, bool type_c if ( is_complex_type && v->GetType()->Tag() != zeek::TYPE_LIST ) { - ListVal lv(zeek::TYPE_ANY); + zeek::ListVal lv(zeek::TYPE_ANY); // Cast away const to use ListVal - but since we // re-introduce const on the recursive call, it should // be okay; the only thing is that the ListVal unref's it. - Val* ncv = (Val*) v; + zeek::Val* ncv = (zeek::Val*) v; lv.Append({zeek::NewRef{}, ncv}); return MakeHashKey(lv, type_check); } @@ -388,7 +388,7 @@ std::unique_ptr CompositeHash::MakeHashKey(const Val& argv, bool type_c return std::make_unique((k == key), (void*) k, kp - k); } -std::unique_ptr CompositeHash::ComputeSingletonHash(const Val* v, bool type_check) const +std::unique_ptr CompositeHash::ComputeSingletonHash(const zeek::Val* v, bool type_check) const { if ( v->GetType()->Tag() == zeek::TYPE_LIST ) { @@ -450,9 +450,9 @@ std::unique_ptr CompositeHash::ComputeSingletonHash(const Val* v, bool } } -int CompositeHash::SingleTypeKeySize(zeek::Type* bt, const Val* v, - bool type_check, int sz, bool optional, - bool calc_static_size) const +int CompositeHash::SingleTypeKeySize(zeek::Type* bt, const zeek::Val* v, + bool type_check, int sz, bool optional, + bool calc_static_size) const { zeek::InternalTypeTag t = bt->InternalType(); @@ -509,7 +509,7 @@ int CompositeHash::SingleTypeKeySize(zeek::Type* bt, const Val* v, case zeek::TYPE_RECORD: { - const RecordVal* rv = v ? v->AsRecordVal() : nullptr; + const zeek::RecordVal* rv = v ? v->AsRecordVal() : nullptr; zeek::RecordType* rt = bt->AsRecordType(); int num_fields = rt->NumFields(); @@ -535,7 +535,7 @@ int CompositeHash::SingleTypeKeySize(zeek::Type* bt, const Val* v, return (optional && ! calc_static_size) ? sz : 0; sz = SizeAlign(sz, sizeof(int)); - TableVal* tv = const_cast(v->AsTableVal()); + zeek::TableVal* tv = const_cast(v->AsTableVal()); auto lv = tv->ToListVal(); for ( int i = 0; i < tv->Size(); ++i ) { @@ -564,7 +564,7 @@ int CompositeHash::SingleTypeKeySize(zeek::Type* bt, const Val* v, return (optional && ! calc_static_size) ? sz : 0; sz = SizeAlign(sz, sizeof(unsigned int)); - VectorVal* vv = const_cast(v->AsVectorVal()); + zeek::VectorVal* vv = const_cast(v->AsVectorVal()); for ( unsigned int i = 0; i < vv->Size(); ++i ) { const auto& val = vv->At(i); @@ -586,7 +586,7 @@ int CompositeHash::SingleTypeKeySize(zeek::Type* bt, const Val* v, return (optional && ! calc_static_size) ? sz : 0; sz = SizeAlign(sz, sizeof(int)); - ListVal* lv = const_cast(v->AsListVal()); + zeek::ListVal* lv = const_cast(v->AsListVal()); for ( int i = 0; i < lv->Length(); ++i ) { sz = SingleTypeKeySize(lv->Idx(i)->GetType().get(), lv->Idx(i).get(), @@ -623,7 +623,7 @@ int CompositeHash::SingleTypeKeySize(zeek::Type* bt, const Val* v, return sz; } -int CompositeHash::ComputeKeySize(const Val* v, bool type_check, bool calc_static_size) const +int CompositeHash::ComputeKeySize(const zeek::Val* v, bool type_check, bool calc_static_size) const { const auto& tl = type->GetTypes(); @@ -709,16 +709,16 @@ int CompositeHash::SizeAlign(int offset, unsigned int size) const return offset; } -ListValPtr CompositeHash::RecoverVals(const HashKey& k) const +zeek::ListValPtr CompositeHash::RecoverVals(const HashKey& k) const { - auto l = zeek::make_intrusive(zeek::TYPE_ANY); + auto l = zeek::make_intrusive(zeek::TYPE_ANY); const auto& tl = type->GetTypes(); const char* kp = (const char*) k.Key(); const char* const k_end = kp + k.Size(); for ( const auto& type : tl ) { - ValPtr v; + zeek::ValPtr v; kp = RecoverOneVal(k, kp, k_end, type.get(), &v, false); ASSERT(v); l->Append(std::move(v)); @@ -733,7 +733,7 @@ ListValPtr CompositeHash::RecoverVals(const HashKey& k) const const char* CompositeHash::RecoverOneVal( const HashKey& k, const char* kp0, const char* const k_end, zeek::Type* t, - ValPtr* pval, bool optional) const + zeek::ValPtr* pval, bool optional) const { // k->Size() == 0 for a single empty string. if ( kp0 >= k_end && k.Size() > 0 ) @@ -804,11 +804,11 @@ const char* CompositeHash::RecoverOneVal( kp1 = reinterpret_cast(kp+1); if ( tag == zeek::TYPE_INTERVAL ) - *pval = zeek::make_intrusive(*kp, 1.0); + *pval = zeek::make_intrusive(*kp, 1.0); else if ( tag == zeek::TYPE_TIME ) - *pval = zeek::make_intrusive(*kp); + *pval = zeek::make_intrusive(*kp); else - *pval = zeek::make_intrusive(*kp); + *pval = zeek::make_intrusive(*kp); } break; @@ -821,7 +821,7 @@ const char* CompositeHash::RecoverOneVal( switch ( tag ) { case zeek::TYPE_ADDR: - *pval = zeek::make_intrusive(addr); + *pval = zeek::make_intrusive(addr); break; default: @@ -836,7 +836,7 @@ const char* CompositeHash::RecoverOneVal( { const uint32_t* const kp = AlignType(kp0); kp1 = reinterpret_cast(kp+5); - *pval = zeek::make_intrusive(kp, kp[4]); + *pval = zeek::make_intrusive(kp, kp[4]); } break; @@ -854,7 +854,7 @@ const char* CompositeHash::RecoverOneVal( if ( ! f ) reporter->InternalError("failed to look up unique function id %" PRIu32 " in CompositeHash::RecoverOneVal()", *kp); - *pval = zeek::make_intrusive(f); + *pval = zeek::make_intrusive(f); const auto& pvt = (*pval)->GetType(); if ( ! pvt ) @@ -894,7 +894,7 @@ const char* CompositeHash::RecoverOneVal( reporter->InternalError("failed compiling table/set key pattern: %s", re->PatternText()); - *pval = zeek::make_intrusive(re); + *pval = zeek::make_intrusive(re); } break; @@ -904,11 +904,11 @@ const char* CompositeHash::RecoverOneVal( zeek::RecordType* rt = t->AsRecordType(); int num_fields = rt->NumFields(); - std::vector values; + std::vector values; int i; for ( i = 0; i < num_fields; ++i ) { - ValPtr v; + zeek::ValPtr v; zeek::detail::Attributes* a = rt->FieldDecl(i)->attrs.get(); bool optional = (a && a->Find(zeek::detail::ATTR_OPTIONAL)); @@ -931,7 +931,7 @@ const char* CompositeHash::RecoverOneVal( ASSERT(int(values.size()) == num_fields); - auto rv = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, rt}); + auto rv = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, rt}); for ( int i = 0; i < num_fields; ++i ) rv->Assign(i, std::move(values[i])); @@ -948,18 +948,18 @@ const char* CompositeHash::RecoverOneVal( n = *kp; kp1 = reinterpret_cast(kp+1); zeek::TableType* tt = t->AsTableType(); - auto tv = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, tt}); + auto tv = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, tt}); for ( int i = 0; i < n; ++i ) { - ValPtr key; + zeek::ValPtr key; kp1 = RecoverOneVal(k, kp1, k_end, tt->GetIndices().get(), &key, false); if ( t->IsSet() ) tv->Assign(std::move(key), nullptr); else { - ValPtr value; + zeek::ValPtr value; kp1 = RecoverOneVal(k, kp1, k_end, tt->Yield().get(), &value, false); tv->Assign(std::move(key), std::move(value)); @@ -977,7 +977,7 @@ const char* CompositeHash::RecoverOneVal( n = *kp; kp1 = reinterpret_cast(kp+1); zeek::VectorType* vt = t->AsVectorType(); - auto vv = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, vt}); + auto vv = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, vt}); for ( unsigned int i = 0; i < n; ++i ) { @@ -987,7 +987,7 @@ const char* CompositeHash::RecoverOneVal( kp = AlignType(kp1); unsigned int have_val = *kp; kp1 = reinterpret_cast(kp+1); - ValPtr value; + zeek::ValPtr value; if ( have_val ) kp1 = RecoverOneVal(k, kp1, k_end, vt->Yield().get(), &value, @@ -1007,11 +1007,11 @@ const char* CompositeHash::RecoverOneVal( n = *kp; kp1 = reinterpret_cast(kp+1); zeek::TypeList* tl = t->AsTypeList(); - auto lv = zeek::make_intrusive(zeek::TYPE_ANY); + auto lv = zeek::make_intrusive(zeek::TYPE_ANY); for ( int i = 0; i < n; ++i ) { - ValPtr v; + zeek::ValPtr v; zeek::Type* it = tl->GetTypes()[i].get(); kp1 = RecoverOneVal(k, kp1, k_end, it, &v, false); lv->Append(std::move(v)); @@ -1047,7 +1047,7 @@ const char* CompositeHash::RecoverOneVal( kp1 = reinterpret_cast(kp+1); } - *pval = zeek::make_intrusive(new BroString((const byte_vec) kp1, n, true)); + *pval = zeek::make_intrusive(new BroString((const byte_vec) kp1, n, true)); kp1 += n; } break; diff --git a/src/CompHash.h b/src/CompHash.h index c2103e0cb3..a779c6bf2c 100644 --- a/src/CompHash.h +++ b/src/CompHash.h @@ -7,10 +7,12 @@ #include "Type.h" #include "IntrusivePtr.h" -class ListVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek); class HashKey; +namespace zeek { using ListValPtr = zeek::IntrusivePtr; +} class CompositeHash { public: @@ -19,27 +21,27 @@ public: // Compute the hash corresponding to the given index val, // or nullptr if it fails to typecheck. - std::unique_ptr MakeHashKey(const Val& v, bool type_check) const; + std::unique_ptr MakeHashKey(const zeek::Val& v, bool type_check) const; [[deprecated("Remove in v4.1. Use MakeHashKey().")]] - HashKey* ComputeHash(const Val* v, bool type_check) const + HashKey* ComputeHash(const zeek::Val* v, bool type_check) const { return MakeHashKey(*v, type_check).release(); } // Given a hash key, recover the values used to create it. - ListValPtr RecoverVals(const HashKey& k) const; + zeek::ListValPtr RecoverVals(const HashKey& k) const; [[deprecated("Remove in v4.1. Pass in HashKey& instead.")]] - ListValPtr RecoverVals(const HashKey* k) const + zeek::ListValPtr RecoverVals(const HashKey* k) const { return RecoverVals(*k); } unsigned int MemoryAllocation() const { return padded_sizeof(*this) + pad_size(size); } protected: - std::unique_ptr ComputeSingletonHash(const Val* v, bool type_check) const; + std::unique_ptr ComputeSingletonHash(const zeek::Val* v, bool type_check) const; // Computes the piece of the hash for Val*, returning the new kp. // Used as a helper for ComputeHash in the non-singleton case. - char* SingleValHash(bool type_check, char* kp, zeek::Type* bt, Val* v, + char* SingleValHash(bool type_check, char* kp, zeek::Type* bt, zeek::Val* v, bool optional) const; // Recovers just one Val of possibly many; called from RecoverVals. @@ -48,7 +50,7 @@ protected: // upon errors, so there is no return value for invalid input. const char* RecoverOneVal( const HashKey& k, const char* kp, const char* const k_end, - zeek::Type* t, ValPtr* pval, bool optional) const; + zeek::Type* t, zeek::ValPtr* pval, bool optional) const; // Rounds the given pointer up to the nearest multiple of the // given size, if not already a multiple. @@ -84,12 +86,12 @@ protected: // the value is computed for the particular list of values. // Returns 0 if the key has an indeterminant size (if v not given), // or if v doesn't match the index type (if given). - int ComputeKeySize(const Val* v, bool type_check, - bool calc_static_size) const; + int ComputeKeySize(const zeek::Val* v, bool type_check, + bool calc_static_size) const; - int SingleTypeKeySize(zeek::Type*, const Val*, - bool type_check, int sz, bool optional, - bool calc_static_size) const; + int SingleTypeKeySize(zeek::Type*, const zeek::Val*, + bool type_check, int sz, bool optional, + bool calc_static_size) const; zeek::TypeListPtr type; char* key; // space for composite key diff --git a/src/Conn.cc b/src/Conn.cc index 7b393c5e9a..4eaf0e3371 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -337,26 +337,26 @@ void Connection::StatusUpdateTimer(double t) TIMER_CONN_STATUS_UPDATE); } -RecordVal* Connection::BuildConnVal() +zeek::RecordVal* Connection::BuildConnVal() { return ConnVal()->Ref()->AsRecordVal(); } -const RecordValPtr& Connection::ConnVal() +const zeek::RecordValPtr& Connection::ConnVal() { if ( ! conn_val ) { - conn_val = zeek::make_intrusive(zeek::id::connection); + conn_val = zeek::make_intrusive(zeek::id::connection); TransportProto prot_type = ConnTransport(); - auto id_val = zeek::make_intrusive(zeek::id::conn_id); - id_val->Assign(0, zeek::make_intrusive(orig_addr)); + auto id_val = zeek::make_intrusive(zeek::id::conn_id); + id_val->Assign(0, zeek::make_intrusive(orig_addr)); id_val->Assign(1, val_mgr->Port(ntohs(orig_port), prot_type)); - id_val->Assign(2, zeek::make_intrusive(resp_addr)); + id_val->Assign(2, zeek::make_intrusive(resp_addr)); id_val->Assign(3, val_mgr->Port(ntohs(resp_port), prot_type)); - auto orig_endp = zeek::make_intrusive(zeek::id::endpoint); + auto orig_endp = zeek::make_intrusive(zeek::id::endpoint); orig_endp->Assign(0, val_mgr->Count(0)); orig_endp->Assign(1, val_mgr->Count(0)); orig_endp->Assign(4, val_mgr->Count(orig_flow_label)); @@ -365,27 +365,27 @@ const RecordValPtr& Connection::ConnVal() char null[l2_len]{}; if ( memcmp(&orig_l2_addr, &null, l2_len) != 0 ) - orig_endp->Assign(5, zeek::make_intrusive(fmt_mac(orig_l2_addr, l2_len))); + orig_endp->Assign(5, zeek::make_intrusive(fmt_mac(orig_l2_addr, l2_len))); - auto resp_endp = zeek::make_intrusive(zeek::id::endpoint); + auto resp_endp = zeek::make_intrusive(zeek::id::endpoint); resp_endp->Assign(0, val_mgr->Count(0)); resp_endp->Assign(1, val_mgr->Count(0)); resp_endp->Assign(4, val_mgr->Count(resp_flow_label)); if ( memcmp(&resp_l2_addr, &null, l2_len) != 0 ) - resp_endp->Assign(5, zeek::make_intrusive(fmt_mac(resp_l2_addr, l2_len))); + resp_endp->Assign(5, zeek::make_intrusive(fmt_mac(resp_l2_addr, l2_len))); conn_val->Assign(0, std::move(id_val)); conn_val->Assign(1, std::move(orig_endp)); conn_val->Assign(2, std::move(resp_endp)); // 3 and 4 are set below. - conn_val->Assign(5, zeek::make_intrusive(zeek::id::string_set)); // service + conn_val->Assign(5, zeek::make_intrusive(zeek::id::string_set)); // service conn_val->Assign(6, val_mgr->EmptyString()); // history if ( ! uid ) uid.Set(bits_per_uid); - conn_val->Assign(7, zeek::make_intrusive(uid.Base62("C").c_str())); + conn_val->Assign(7, zeek::make_intrusive(uid.Base62("C").c_str())); if ( encapsulation && encapsulation->Depth() > 0 ) conn_val->Assign(8, encapsulation->ToVal()); @@ -401,9 +401,9 @@ const RecordValPtr& Connection::ConnVal() if ( root_analyzer ) root_analyzer->UpdateConnVal(conn_val.get()); - conn_val->Assign(3, zeek::make_intrusive(start_time)); // ### - conn_val->Assign(4, zeek::make_intrusive(last_time - start_time)); - conn_val->Assign(6, zeek::make_intrusive(history.c_str())); + conn_val->Assign(3, zeek::make_intrusive(start_time)); // ### + conn_val->Assign(4, zeek::make_intrusive(last_time - start_time)); + conn_val->Assign(6, zeek::make_intrusive(history.c_str())); conn_val->Assign(11, val_mgr->Bool(is_successful)); conn_val->SetOrigin(this); @@ -433,7 +433,7 @@ void Connection::AppendAddl(const char* str) const char* old = cv->GetField(6)->AsString()->CheckString(); const char* format = *old ? "%s %s" : "%s%s"; - cv->Assign(6, zeek::make_intrusive(fmt(format, old, str))); + cv->Assign(6, zeek::make_intrusive(fmt(format, old, str))); } // Returns true if the character at s separates a version number. @@ -470,12 +470,12 @@ void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, const ch return; if ( name ) - EnqueueEvent(f, analyzer, zeek::make_intrusive(name), ConnVal()); + EnqueueEvent(f, analyzer, zeek::make_intrusive(name), ConnVal()); else EnqueueEvent(f, analyzer, ConnVal()); } -void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, Val* v1, Val* v2) +void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, zeek::Val* v1, zeek::Val* v2) { if ( ! f ) { @@ -697,7 +697,7 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label) { if ( conn_val ) { - RecordVal* endp = conn_val->GetField(is_orig ? 1 : 2)->AsRecordVal(); + zeek::RecordVal* endp = conn_val->GetField(is_orig ? 1 : 2)->AsRecordVal(); endp->Assign(4, val_mgr->Count(flow_label)); } diff --git a/src/Conn.h b/src/Conn.h index 9182868c7d..9221f563b2 100644 --- a/src/Conn.h +++ b/src/Conn.h @@ -29,11 +29,14 @@ class RuleHdrTest; class Specific_RE_Matcher; class RuleEndpointState; class EncapsulationStack; -class Val; -class RecordVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(RecorVal, zeek); + +namespace zeek { using ValPtr = zeek::IntrusivePtr; using RecordValPtr = zeek::IntrusivePtr; +} namespace analyzer { class TransportLayerAnalyzer; } @@ -167,12 +170,12 @@ public: void EnableStatusUpdateTimer(); [[deprecated("Remove in v4.1. Use ConnVal() instead.")]] - RecordVal* BuildConnVal(); + zeek::RecordVal* BuildConnVal(); /** * Returns the associated "connection" record. */ - const RecordValPtr& ConnVal(); + const zeek::RecordValPtr& ConnVal(); void AppendAddl(const char* str); @@ -197,7 +200,7 @@ public: // argument is the connection value, second argument is 'v1', and if 'v2' // is given that will be it's third argument. [[deprecated("Remove in v4.1. Use EnqueueEvent() instead (note it doesn't automatically add the connection argument).")]] - void Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, Val* v1, Val* v2 = nullptr); + void Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, zeek::Val* v1, zeek::Val* v2 = nullptr); // If a handler exists for 'f', an event will be generated. In any case, // reference count for each element in the 'vl' list are decremented. The @@ -237,8 +240,8 @@ public: */ template std::enable_if_t< - std::is_convertible_v< - std::tuple_element_t<0, std::tuple>, ValPtr>> + std::is_convertible_v< + std::tuple_element_t<0, std::tuple>, zeek::ValPtr>> EnqueueEvent(EventHandlerPtr h, analyzer::Analyzer* analyzer, Args&&... args) { return EnqueueEvent(h, analyzer, zeek::Args{std::forward(args)...}); } @@ -358,7 +361,7 @@ protected: u_char resp_l2_addr[Packet::l2_addr_len]; // Link-layer responder address, if available double start_time, last_time; double inactivity_timeout; - RecordValPtr conn_val; + zeek::RecordValPtr conn_val; LoginConn* login_conn; // either nil, or this const EncapsulationStack* encapsulation; // tunnels int suppress_event; // suppress certain events to once per conn. diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc index 54599e2747..97d3f52b42 100644 --- a/src/DNS_Mgr.cc +++ b/src/DNS_Mgr.cc @@ -122,9 +122,9 @@ public: return req_host ? req_host : req_addr.AsString(); } - ListValPtr Addrs(); - TableValPtr AddrsSet(); // addresses returned as a set - StringValPtr Host(); + zeek::ListValPtr Addrs(); + zeek::TableValPtr AddrsSet(); // addresses returned as a set + zeek::StringValPtr Host(); double CreationTime() const { return creation_time; } @@ -155,11 +155,11 @@ protected: int num_names; char** names; - StringValPtr host_val; + zeek::StringValPtr host_val; int num_addrs; IPAddr* addrs; - ListValPtr addrs_val; + zeek::ListValPtr addrs_val; double creation_time; int map_type; @@ -173,13 +173,13 @@ void DNS_Mgr_mapping_delete_func(void* v) delete (DNS_Mapping*) v; } -static TableValPtr empty_addr_set() +static zeek::TableValPtr empty_addr_set() { auto addr_t = zeek::base_type(zeek::TYPE_ADDR); auto set_index = zeek::make_intrusive(addr_t); set_index->Append(std::move(addr_t)); auto s = zeek::make_intrusive(std::move(set_index), nullptr); - return zeek::make_intrusive(std::move(s)); + return zeek::make_intrusive(std::move(s)); } DNS_Mapping::DNS_Mapping(const char* host, struct hostent* h, uint32_t ttl) @@ -276,23 +276,23 @@ DNS_Mapping::~DNS_Mapping() delete [] addrs; } -ListValPtr DNS_Mapping::Addrs() +zeek::ListValPtr DNS_Mapping::Addrs() { if ( failed ) return nullptr; if ( ! addrs_val ) { - addrs_val = zeek::make_intrusive(zeek::TYPE_ADDR); + addrs_val = zeek::make_intrusive(zeek::TYPE_ADDR); for ( int i = 0; i < num_addrs; ++i ) - addrs_val->Append(zeek::make_intrusive(addrs[i])); + addrs_val->Append(zeek::make_intrusive(addrs[i])); } return addrs_val; } -TableValPtr DNS_Mapping::AddrsSet() { +zeek::TableValPtr DNS_Mapping::AddrsSet() { auto l = Addrs(); if ( ! l ) @@ -301,13 +301,13 @@ TableValPtr DNS_Mapping::AddrsSet() { return l->ToSetVal(); } -StringValPtr DNS_Mapping::Host() +zeek::StringValPtr DNS_Mapping::Host() { if ( failed || num_names == 0 || ! names[0] ) return nullptr; if ( ! host_val ) - host_val = zeek::make_intrusive(names[0]); + host_val = zeek::make_intrusive(names[0]); return host_val; } @@ -461,12 +461,12 @@ void DNS_Mgr::InitPostScript() LoadCache(fopen(cache_name, "r")); } -static TableValPtr fake_name_lookup_result(const char* name) +static zeek::TableValPtr fake_name_lookup_result(const char* name) { hash128_t hash; KeyedHash::StaticHash128(name, strlen(name), &hash); - auto hv = zeek::make_intrusive(zeek::TYPE_ADDR); - hv->Append(zeek::make_intrusive(reinterpret_cast(&hash))); + auto hv = zeek::make_intrusive(zeek::TYPE_ADDR); + hv->Append(zeek::make_intrusive(reinterpret_cast(&hash))); return hv->ToSetVal(); } @@ -485,7 +485,7 @@ static const char* fake_addr_lookup_result(const IPAddr& addr) return tmp; } -TableValPtr DNS_Mgr::LookupHost(const char* name) +zeek::TableValPtr DNS_Mgr::LookupHost(const char* name) { if ( mode == DNS_FAKE ) return fake_name_lookup_result(name); @@ -542,7 +542,7 @@ TableValPtr DNS_Mgr::LookupHost(const char* name) } } -ValPtr DNS_Mgr::LookupAddr(const IPAddr& addr) +zeek::ValPtr DNS_Mgr::LookupAddr(const IPAddr& addr) { InitSource(); @@ -559,7 +559,7 @@ ValPtr DNS_Mgr::LookupAddr(const IPAddr& addr) { string s(addr); reporter->Warning("can't resolve IP address: %s", s.c_str()); - return zeek::make_intrusive(s.c_str()); + return zeek::make_intrusive(s.c_str()); } } } @@ -568,7 +568,7 @@ ValPtr DNS_Mgr::LookupAddr(const IPAddr& addr) switch ( mode ) { case DNS_PRIME: requests.push_back(new DNS_Mgr_Request(addr)); - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); case DNS_FORCE: reporter->FatalError("can't find DNS entry for %s in cache", @@ -698,7 +698,7 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm) } void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm, - ListValPtr l1, ListValPtr l2) + zeek::ListValPtr l1, zeek::ListValPtr l2) { if ( ! e ) return; @@ -714,17 +714,17 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm) mgr.Enqueue(e, BuildMappingVal(old_dm), BuildMappingVal(new_dm)); } -ValPtr DNS_Mgr::BuildMappingVal(DNS_Mapping* dm) +zeek::ValPtr DNS_Mgr::BuildMappingVal(DNS_Mapping* dm) { - auto r = zeek::make_intrusive(dm_rec); + auto r = zeek::make_intrusive(dm_rec); - r->Assign(0, zeek::make_intrusive(dm->CreationTime())); - r->Assign(1, zeek::make_intrusive(dm->ReqHost() ? dm->ReqHost() : "")); - r->Assign(2, zeek::make_intrusive(dm->ReqAddr())); + r->Assign(0, zeek::make_intrusive(dm->CreationTime())); + r->Assign(1, zeek::make_intrusive(dm->ReqHost() ? dm->ReqHost() : "")); + r->Assign(2, zeek::make_intrusive(dm->ReqAddr())); r->Assign(3, val_mgr->Bool(dm->Valid())); auto h = dm->Host(); - r->Assign(4, h ? std::move(h) : zeek::make_intrusive("")); + r->Assign(4, h ? std::move(h) : zeek::make_intrusive("")); r->Assign(5, dm->AddrsSet()); return r; @@ -870,9 +870,9 @@ void DNS_Mgr::CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm) Event(dns_mapping_altered, new_dm, std::move(prev_delta), std::move(new_delta)); } -ListValPtr DNS_Mgr::AddrListDelta(ListVal* al1, ListVal* al2) +zeek::ListValPtr DNS_Mgr::AddrListDelta(zeek::ListVal* al1, zeek::ListVal* al2) { - auto delta = zeek::make_intrusive(zeek::TYPE_ADDR); + auto delta = zeek::make_intrusive(zeek::TYPE_ADDR); for ( int i = 0; i < al1->Length(); ++i ) { @@ -894,7 +894,7 @@ ListValPtr DNS_Mgr::AddrListDelta(ListVal* al1, ListVal* al2) return delta; } -void DNS_Mgr::DumpAddrList(FILE* f, ListVal* al) +void DNS_Mgr::DumpAddrList(FILE* f, zeek::ListVal* al) { for ( int i = 0; i < al->Length(); ++i ) { @@ -980,7 +980,7 @@ const char* DNS_Mgr::LookupAddrInCache(const IPAddr& addr) return d->names ? d->names[0] : "<\?\?\?>"; } -TableValPtr DNS_Mgr::LookupNameInCache(const string& name) +zeek::TableValPtr DNS_Mgr::LookupNameInCache(const string& name) { HostMap::iterator it = host_mappings.find(name); if ( it == host_mappings.end() ) @@ -1030,7 +1030,7 @@ const char* DNS_Mgr::LookupTextInCache(const string& name) } static void resolve_lookup_cb(DNS_Mgr::LookupCallback* callback, - TableValPtr result) + zeek::TableValPtr result) { callback->Resolved(result.get()); delete callback; diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h index 2669d2c2b7..8c09740bea 100644 --- a/src/DNS_Mgr.h +++ b/src/DNS_Mgr.h @@ -13,19 +13,22 @@ #include "IPAddr.h" #include "util.h" -template class IntrusivePtr; -class Val; -class ListVal; -class TableVal; class Func; class EventHandler; class DNS_Mgr_Request; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek); + +namespace zeek { +template class IntrusivePtr; using ValPtr = zeek::IntrusivePtr; using ListValPtr = zeek::IntrusivePtr; using TableValPtr = zeek::IntrusivePtr; +} -ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek); typedef PList DNS_mgr_request_list; @@ -54,9 +57,9 @@ public: // Looks up the address or addresses of the given host, and returns // a set of addr. - TableValPtr LookupHost(const char* host); + zeek::TableValPtr LookupHost(const char* host); - ValPtr LookupAddr(const IPAddr& addr); + zeek::ValPtr LookupAddr(const IPAddr& addr); // Define the directory where to store the data. void SetDir(const char* arg_dir) { dir = copy_string(arg_dir); } @@ -66,7 +69,7 @@ public: bool Save(); const char* LookupAddrInCache(const IPAddr& addr); - TableValPtr LookupNameInCache(const std::string& name); + zeek::TableValPtr LookupNameInCache(const std::string& name); const char* LookupTextInCache(const std::string& name); // Support for async lookups. @@ -76,7 +79,7 @@ public: virtual ~LookupCallback() { } virtual void Resolved(const char* name) { }; - virtual void Resolved(TableVal* addrs) { }; + virtual void Resolved(zeek::TableVal* addrs) { }; virtual void Timeout() = 0; }; @@ -104,15 +107,15 @@ protected: void Event(EventHandlerPtr e, DNS_Mapping* dm); void Event(EventHandlerPtr e, DNS_Mapping* dm, - ListValPtr l1, ListValPtr l2); + zeek::ListValPtr l1, zeek::ListValPtr l2); void Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm); - ValPtr BuildMappingVal(DNS_Mapping* dm); + zeek::ValPtr BuildMappingVal(DNS_Mapping* dm); void AddResult(DNS_Mgr_Request* dr, struct nb_dns_result* r); void CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm); - ListValPtr AddrListDelta(ListVal* al1, ListVal* al2); - void DumpAddrList(FILE* f, ListVal* al); + zeek::ListValPtr AddrListDelta(zeek::ListVal* al1, zeek::ListVal* al2); + void DumpAddrList(FILE* f, zeek::ListVal* al); typedef std::map > HostMap; typedef std::map AddrMap; @@ -183,7 +186,7 @@ protected: processed = true; } - void Resolved(TableVal* addrs) + void Resolved(zeek::TableVal* addrs) { for ( CallbackList::iterator i = callbacks.begin(); i != callbacks.end(); ++i ) diff --git a/src/Debug.cc b/src/Debug.cc index 90fbdf3e7c..b3b4523da1 100644 --- a/src/Debug.cc +++ b/src/Debug.cc @@ -905,7 +905,7 @@ bool pre_execute_stmt(zeek::detail::Stmt* stmt, Frame* f) return true; } -bool post_execute_stmt(zeek::detail::Stmt* stmt, Frame* f, Val* result, stmt_flow_type* flow) +bool post_execute_stmt(zeek::detail::Stmt* stmt, Frame* f, zeek::Val* result, stmt_flow_type* flow) { // Handle the case where someone issues a "next" debugger command, // but we're at a return statement, so the next statement is in @@ -948,7 +948,7 @@ extern YYLTYPE yylloc; // holds start line and column of token extern int line_number; extern const char* filename; -ValPtr dbg_eval_expr(const char* expr) +zeek::ValPtr dbg_eval_expr(const char* expr) { // Push the current frame's associated scope. // Note: g_debugger_state.curr_frame_idx is the user-visible number, @@ -983,7 +983,7 @@ ValPtr dbg_eval_expr(const char* expr) yylloc.first_line = yylloc.last_line = line_number = 1; // Parse the thing into an expr. - ValPtr result; + zeek::ValPtr result; if ( yyparse() ) { if ( g_curr_debug_error ) diff --git a/src/Debug.h b/src/Debug.h index 8e885d9fc2..9fb016d9c0 100644 --- a/src/Debug.h +++ b/src/Debug.h @@ -11,14 +11,12 @@ #include #include +ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail); +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); namespace zeek { template class IntrusivePtr; -} - -class Val; using ValPtr = zeek::IntrusivePtr; - -ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail); +} // This needs to be defined before we do the includes that come after it. enum ParseLocationRecType { plrUnknown, plrFileAndLine, plrFunction }; @@ -150,7 +148,7 @@ std::vector parse_location_string(const std::string& s); // Return true to continue execution, false to abort. bool pre_execute_stmt(zeek::detail::Stmt* stmt, Frame* f); -bool post_execute_stmt(zeek::detail::Stmt* stmt, Frame* f, Val* result, stmt_flow_type* flow); +bool post_execute_stmt(zeek::detail::Stmt* stmt, Frame* f, zeek::Val* result, stmt_flow_type* flow); // Returns 1 if successful, 0 otherwise. // If cmdfile is non-nil, it contains the location of a file of commands @@ -166,7 +164,7 @@ int dbg_handle_debug_input(); // read a line and then have it executed int dbg_execute_command(const char* cmd); // Interactive expression evaluation. -ValPtr dbg_eval_expr(const char* expr); +zeek::ValPtr dbg_eval_expr(const char* expr); // Extra debugging facilities. // TODO: current connections, memory allocated, other internal data structures. diff --git a/src/Discard.cc b/src/Discard.cc index 604205f982..359b080fa4 100644 --- a/src/Discard.cc +++ b/src/Discard.cc @@ -155,7 +155,7 @@ bool Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen) return discard_packet; } -Val* Discarder::BuildData(const u_char* data, int hdrlen, int len, int caplen) +zeek::Val* Discarder::BuildData(const u_char* data, int hdrlen, int len, int caplen) { len -= hdrlen; caplen -= hdrlen; @@ -163,5 +163,5 @@ Val* Discarder::BuildData(const u_char* data, int hdrlen, int len, int caplen) len = std::max(std::min(std::min(len, caplen), discarder_maxlen), 0); - return new StringVal(new BroString(data, len, true)); + return new zeek::StringVal(new BroString(data, len, true)); } diff --git a/src/Discard.h b/src/Discard.h index df29df2175..848753795e 100644 --- a/src/Discard.h +++ b/src/Discard.h @@ -7,10 +7,11 @@ #include "IntrusivePtr.h" class IP_Hdr; -class Val; class Func; using FuncPtr = zeek::IntrusivePtr; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); + class Discarder { public: Discarder(); @@ -21,7 +22,7 @@ public: bool NextPacket(const IP_Hdr* ip, int len, int caplen); protected: - Val* BuildData(const u_char* data, int hdrlen, int len, int caplen); + zeek::Val* BuildData(const u_char* data, int hdrlen, int len, int caplen); FuncPtr check_ip; FuncPtr check_tcp; diff --git a/src/Event.h b/src/Event.h index c8f9083d2f..5849bc53ee 100644 --- a/src/Event.h +++ b/src/Event.h @@ -107,8 +107,8 @@ public: */ template std::enable_if_t< - std::is_convertible_v< - std::tuple_element_t<0, std::tuple>, ValPtr>> + std::is_convertible_v< + std::tuple_element_t<0, std::tuple>, zeek::ValPtr>> Enqueue(const EventHandlerPtr& h, Args&&... args) { return Enqueue(h, zeek::Args{std::forward(args)...}); } @@ -143,7 +143,7 @@ protected: Event* tail; SourceID current_src; analyzer::ID current_aid; - RecordVal* src_val; + zeek::RecordVal* src_val; bool draining; zeek::detail::Flare queue_flare; }; diff --git a/src/EventHandler.cc b/src/EventHandler.cc index a5a238529e..12038c58df 100644 --- a/src/EventHandler.cc +++ b/src/EventHandler.cc @@ -118,7 +118,7 @@ void EventHandler::NewEvent(zeek::Args* vl) const auto& args = GetType()->Params(); static auto call_argument_vector = zeek::id::find_type("call_argument_vector"); - auto vargs = zeek::make_intrusive(call_argument_vector); + auto vargs = zeek::make_intrusive(call_argument_vector); for ( int i = 0; i < args->NumFields(); i++ ) { @@ -127,13 +127,13 @@ void EventHandler::NewEvent(zeek::Args* vl) auto fdefault = args->FieldDefault(i); static auto call_argument = zeek::id::find_type("call_argument"); - auto rec = zeek::make_intrusive(call_argument); - rec->Assign(0, zeek::make_intrusive(fname)); + auto rec = zeek::make_intrusive(call_argument); + rec->Assign(0, zeek::make_intrusive(fname)); ODesc d; d.SetShort(); ftype->Describe(&d); - rec->Assign(1, zeek::make_intrusive(d.Description())); + rec->Assign(1, zeek::make_intrusive(d.Description())); if ( fdefault ) rec->Assign(2, std::move(fdefault)); @@ -145,8 +145,8 @@ void EventHandler::NewEvent(zeek::Args* vl) } Event* ev = new Event(new_event, { - zeek::make_intrusive(name), - std::move(vargs), - }); + zeek::make_intrusive(name), + std::move(vargs), + }); mgr.Dispatch(ev); } diff --git a/src/Expr.cc b/src/Expr.cc index b94f2d161c..4041dcff90 100644 --- a/src/Expr.cc +++ b/src/Expr.cc @@ -235,7 +235,7 @@ ValPtr NameExpr::Eval(Frame* f) const ValPtr v; if ( id->IsType() ) - return zeek::make_intrusive(id->GetType(), true); + return zeek::make_intrusive(id->GetType(), true); if ( id->IsGlobal() ) v = id->GetVal(); @@ -364,7 +364,7 @@ ValPtr UnaryExpr::Eval(Frame* f) const else out_t = GetType(); - auto result = zeek::make_intrusive(std::move(out_t)); + auto result = zeek::make_intrusive(std::move(out_t)); for ( unsigned int i = 0; i < v_op->Size(); ++i ) { @@ -455,7 +455,7 @@ ValPtr BinaryExpr::Eval(Frame* f) const return nullptr; } - auto v_result = zeek::make_intrusive(GetType()); + auto v_result = zeek::make_intrusive(GetType()); for ( unsigned int i = 0; i < v_op1->Size(); ++i ) { @@ -472,7 +472,7 @@ ValPtr BinaryExpr::Eval(Frame* f) const if ( IsVector(GetType()->Tag()) && (is_vec1 || is_vec2) ) { // fold vector against scalar VectorVal* vv = (is_vec1 ? v1 : v2)->AsVectorVal(); - auto v_result = zeek::make_intrusive(GetType()); + auto v_result = zeek::make_intrusive(GetType()); for ( unsigned int i = 0; i < vv->Size(); ++i ) { @@ -677,11 +677,11 @@ ValPtr BinaryExpr::Fold(Val* v1, Val* v2) const const auto& ret_type = IsVector(GetType()->Tag()) ? GetType()->Yield() : GetType(); if ( ret_type->Tag() == zeek::TYPE_INTERVAL ) - return zeek::make_intrusive(d3); + return zeek::make_intrusive(d3); else if ( ret_type->Tag() == zeek::TYPE_TIME ) - return zeek::make_intrusive(d3); + return zeek::make_intrusive(d3); else if ( ret_type->Tag() == zeek::TYPE_DOUBLE ) - return zeek::make_intrusive(d3); + return zeek::make_intrusive(d3); else if ( ret_type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) return val_mgr->Count(u3); else if ( ret_type->Tag() == zeek::TYPE_BOOL ) @@ -714,7 +714,7 @@ ValPtr BinaryExpr::StringFold(Val* v1, Val* v2) const strings.push_back(s1); strings.push_back(s2); - return zeek::make_intrusive(concatenate(strings)); + return zeek::make_intrusive(concatenate(strings)); } default: @@ -737,7 +737,7 @@ ValPtr BinaryExpr::PatternFold(Val* v1, Val* v2) const RE_Matcher_conjunction(re1, re2) : RE_Matcher_disjunction(re1, re2); - return zeek::make_intrusive(res); + return zeek::make_intrusive(res); } ValPtr BinaryExpr::SetFold(Val* v1, Val* v2) const @@ -1101,9 +1101,9 @@ NegExpr::NegExpr(ExprPtr arg_op) ValPtr NegExpr::Fold(Val* v) const { if ( v->GetType()->Tag() == zeek::TYPE_DOUBLE ) - return zeek::make_intrusive(- v->InternalDouble()); + return zeek::make_intrusive(- v->InternalDouble()); else if ( v->GetType()->Tag() == zeek::TYPE_INTERVAL ) - return zeek::make_intrusive(- v->InternalDouble()); + return zeek::make_intrusive(- v->InternalDouble()); else return val_mgr->Int(- v->CoerceToInt()); } @@ -1447,7 +1447,7 @@ ValPtr DivideExpr::AddrFold(Val* v1, Val* v2) const RuntimeError(fmt("bad IPv6 subnet prefix length: %" PRIu32, mask)); } - return zeek::make_intrusive(a, mask); + return zeek::make_intrusive(a, mask); } ModExpr::ModExpr(ExprPtr arg_op1, ExprPtr arg_op2) @@ -1571,7 +1571,7 @@ ValPtr BoolExpr::Eval(Frame* f) const if ( scalar_v->IsZero() == is_and ) { - result = zeek::make_intrusive(GetType()); + result = zeek::make_intrusive(GetType()); result->Resize(vector_v->Size()); result->AssignRepeat(0, result->Size(), std::move(scalar_v)); } @@ -1596,7 +1596,7 @@ ValPtr BoolExpr::Eval(Frame* f) const return nullptr; } - auto result = zeek::make_intrusive(GetType()); + auto result = zeek::make_intrusive(GetType()); result->Resize(vec_v1->Size()); for ( unsigned int i = 0; i < vec_v1->Size(); ++i ) @@ -1924,7 +1924,7 @@ ValPtr CondExpr::Eval(Frame* f) const return nullptr; } - auto result = zeek::make_intrusive(GetType()); + auto result = zeek::make_intrusive(GetType()); result->Resize(cond->Size()); for ( unsigned int i = 0; i < cond->Size(); ++i ) @@ -2377,7 +2377,7 @@ ValPtr AssignExpr::InitVal(const zeek::Type* t, ValPtr aggr) const if ( aggr->GetType()->Tag() != zeek::TYPE_TABLE ) Internal("bad aggregate in AssignExpr::InitVal"); - auto tv = zeek::cast_intrusive(std::move(aggr)); + auto tv = zeek::cast_intrusive(std::move(aggr)); const TableType* tt = tv->GetType()->AsTableType(); const auto& yt = tv->GetType()->Yield(); @@ -2574,7 +2574,7 @@ ValPtr IndexExpr::Eval(Frame* f) const { VectorVal* v_v1 = v1->AsVectorVal(); VectorVal* v_v2 = indv->AsVectorVal(); - auto v_result = zeek::make_intrusive(GetType()); + auto v_result = zeek::make_intrusive(GetType()); // Booleans select each element (or not). if ( IsBool(v_v2->GetType()->Yield()->Tag()) ) @@ -2635,7 +2635,7 @@ ValPtr IndexExpr::Fold(Val* v1, Val* v2) const else { size_t len = vect->Size(); - auto result = zeek::make_intrusive(vect->GetType()); + auto result = zeek::make_intrusive(vect->GetType()); bro_int_t first = get_slice_index(lv->Idx(0)->CoerceToInt(), len); bro_int_t last = get_slice_index(lv->Idx(1)->CoerceToInt(), len); @@ -2687,7 +2687,7 @@ ValPtr IndexExpr::Fold(Val* v1, Val* v2) const substring = s->GetSubstring(first, substring_len); } - return zeek::make_intrusive(substring ? substring : new BroString("")); + return zeek::make_intrusive(substring ? substring : new BroString("")); } default: @@ -3005,7 +3005,7 @@ ValPtr RecordConstructorExpr::InitVal(const zeek::Type* t, ValPtr aggr) const RecordVal* rv = v->AsRecordVal(); auto bt = const_cast(t); RecordTypePtr rt{zeek::NewRef{}, bt->AsRecordType()}; - auto aggr_rec = zeek::cast_intrusive(std::move(aggr)); + auto aggr_rec = zeek::cast_intrusive(std::move(aggr)); auto ar = rv->CoerceTo(std::move(rt), std::move(aggr_rec)); if ( ar ) @@ -3024,7 +3024,7 @@ ValPtr RecordConstructorExpr::Fold(Val* v) const if ( lv->Length() != rt->NumFields() ) RuntimeErrorWithCallStack("inconsistency evaluating record constructor"); - auto rv = zeek::make_intrusive(std::move(rt)); + auto rv = zeek::make_intrusive(std::move(rt)); for ( int i = 0; i < lv->Length(); ++i ) rv->Assign(i, lv->Idx(i)); @@ -3124,7 +3124,7 @@ ValPtr TableConstructorExpr::Eval(Frame* f) const if ( IsError() ) return nullptr; - auto aggr = zeek::make_intrusive(GetType(), attrs); + auto aggr = zeek::make_intrusive(GetType(), attrs); const expr_list& exprs = op->AsListExpr()->Exprs(); for ( const auto& expr : exprs ) @@ -3144,7 +3144,7 @@ ValPtr TableConstructorExpr::InitVal(const zeek::Type* t, ValPtr aggr) const auto tval = aggr ? TableValPtr{zeek::AdoptRef{}, aggr.release()->AsTableVal()} : - zeek::make_intrusive(std::move(tt), attrs); + zeek::make_intrusive(std::move(tt), attrs); const expr_list& exprs = op->AsListExpr()->Exprs(); for ( const auto& expr : exprs ) @@ -3233,7 +3233,7 @@ ValPtr SetConstructorExpr::Eval(Frame* f) const if ( IsError() ) return nullptr; - auto aggr = zeek::make_intrusive(IntrusivePtr{zeek::NewRef{}, type->AsTableType()}, + auto aggr = zeek::make_intrusive(IntrusivePtr{zeek::NewRef{}, type->AsTableType()}, attrs); const expr_list& exprs = op->AsListExpr()->Exprs(); @@ -3255,7 +3255,7 @@ ValPtr SetConstructorExpr::InitVal(const zeek::Type* t, ValPtr aggr) const auto tt = GetType(); auto tval = aggr ? TableValPtr{zeek::AdoptRef{}, aggr.release()->AsTableVal()} : - zeek::make_intrusive(std::move(tt), attrs); + zeek::make_intrusive(std::move(tt), attrs); const expr_list& exprs = op->AsListExpr()->Exprs(); for ( const auto& e : exprs ) @@ -3327,7 +3327,7 @@ ValPtr VectorConstructorExpr::Eval(Frame* f) const if ( IsError() ) return nullptr; - auto vec = zeek::make_intrusive(GetType()); + auto vec = zeek::make_intrusive(GetType()); const expr_list& exprs = op->AsListExpr()->Exprs(); loop_over_list(exprs, i) @@ -3352,7 +3352,7 @@ ValPtr VectorConstructorExpr::InitVal(const zeek::Type* t, ValPtr aggr) const auto vt = GetType(); auto vec = aggr ? VectorValPtr{zeek::AdoptRef{}, aggr.release()->AsVectorVal()} : - zeek::make_intrusive(std::move(vt)); + zeek::make_intrusive(std::move(vt)); const expr_list& exprs = op->AsListExpr()->Exprs(); loop_over_list(exprs, i) @@ -3456,7 +3456,7 @@ ValPtr ArithCoerceExpr::FoldSingleVal(Val* v, InternalTypeTag t) const { switch ( t ) { case zeek::TYPE_INTERNAL_DOUBLE: - return zeek::make_intrusive(v->CoerceToDouble()); + return zeek::make_intrusive(v->CoerceToDouble()); case zeek::TYPE_INTERNAL_INT: return val_mgr->Int(v->CoerceToInt()); @@ -3488,7 +3488,7 @@ ValPtr ArithCoerceExpr::Fold(Val* v) const t = GetType()->AsVectorType()->Yield()->InternalType(); VectorVal* vv = v->AsVectorVal(); - auto result = zeek::make_intrusive(GetType()); + auto result = zeek::make_intrusive(GetType()); for ( unsigned int i = 0; i < vv->Size(); ++i ) { @@ -3620,7 +3620,7 @@ ValPtr RecordCoerceExpr::InitVal(const zeek::Type* t, ValPtr aggr) const RecordVal* rv = v->AsRecordVal(); auto bt = const_cast(t); zeek::RecordTypePtr rt{zeek::NewRef{}, bt->AsRecordType()}; - auto aggr_rec = zeek::cast_intrusive(std::move(aggr)); + auto aggr_rec = zeek::cast_intrusive(std::move(aggr)); if ( auto ar = rv->CoerceTo(std::move(rt), std::move(aggr_rec)) ) return ar; @@ -3632,7 +3632,7 @@ ValPtr RecordCoerceExpr::InitVal(const zeek::Type* t, ValPtr aggr) const ValPtr RecordCoerceExpr::Fold(Val* v) const { - auto val = zeek::make_intrusive(GetType()); + auto val = zeek::make_intrusive(GetType()); RecordType* val_type = val->GetType()->AsRecordType(); RecordVal* rv = v->AsRecordVal(); @@ -3738,7 +3738,7 @@ ValPtr TableCoerceExpr::Fold(Val* v) const if ( tv->Size() > 0 ) RuntimeErrorWithCallStack("coercion of non-empty table/set"); - return zeek::make_intrusive(GetType(), tv->GetAttrs()); + return zeek::make_intrusive(GetType(), tv->GetAttrs()); } VectorCoerceExpr::VectorCoerceExpr(ExprPtr arg_op, zeek::VectorTypePtr v) @@ -3768,7 +3768,7 @@ ValPtr VectorCoerceExpr::Fold(Val* v) const if ( vv->Size() > 0 ) RuntimeErrorWithCallStack("coercion of non-empty vector"); - return zeek::make_intrusive(GetType()); + return zeek::make_intrusive(GetType()); } ScheduleTimer::ScheduleTimer(const EventHandlerPtr& arg_event, zeek::Args arg_args, @@ -4206,7 +4206,7 @@ LambdaExpr::LambdaExpr(std::unique_ptr arg_ing, // Update lamb's name dummy_func->SetName(my_name.c_str()); - auto v = zeek::make_intrusive(std::move(dummy_func)); + auto v = zeek::make_intrusive(std::move(dummy_func)); id->SetVal(std::move(v)); id->SetType(ingredients->id->GetType()); id->SetConst(); @@ -4232,7 +4232,7 @@ ValPtr LambdaExpr::Eval(Frame* f) const // Allows for lookups by the receiver. lamb->SetName(my_name.c_str()); - return zeek::make_intrusive(std::move(lamb)); + return zeek::make_intrusive(std::move(lamb)); } void LambdaExpr::ExprDescribe(ODesc* d) const @@ -4367,7 +4367,7 @@ bool ListExpr::IsPure() const ValPtr ListExpr::Eval(Frame* f) const { - auto v = zeek::make_intrusive(zeek::TYPE_ANY); + auto v = zeek::make_intrusive(zeek::TYPE_ANY); for ( const auto& expr : exprs ) { @@ -4456,7 +4456,7 @@ ValPtr ListExpr::InitVal(const zeek::Type* t, ValPtr aggr) const // in which case we should expand as a ListVal. if ( ! aggr && type->AsTypeList()->AllMatch(t, true) ) { - auto v = zeek::make_intrusive(zeek::TYPE_ANY); + auto v = zeek::make_intrusive(zeek::TYPE_ANY); const auto& tl = type->AsTypeList()->GetTypes(); if ( exprs.length() != static_cast(tl.size()) ) @@ -4493,7 +4493,7 @@ ValPtr ListExpr::InitVal(const zeek::Type* t, ValPtr aggr) const return nullptr; } - auto v = zeek::make_intrusive(zeek::TYPE_ANY); + auto v = zeek::make_intrusive(zeek::TYPE_ANY); loop_over_list(exprs, i) { diff --git a/src/Expr.h b/src/Expr.h index f7599c3a65..dc6642de6b 100644 --- a/src/Expr.h +++ b/src/Expr.h @@ -17,11 +17,14 @@ #include "Val.h" #include "ZeekArgs.h" -template class IntrusivePtr; class Frame; class Scope; struct function_ingredients; +namespace zeek { +template class IntrusivePtr; +} + namespace zeek::detail { using IDPtr = zeek::IntrusivePtr; diff --git a/src/File.cc b/src/File.cc index f7c04a0a2c..3917267a35 100644 --- a/src/File.cc +++ b/src/File.cc @@ -269,7 +269,7 @@ void BroFile::SetAttrs(zeek::detail::Attributes* arg_attrs) EnableRawOutput(); } -RecordVal* BroFile::Rotate() +zeek::RecordVal* BroFile::Rotate() { if ( ! is_open ) return nullptr; @@ -279,7 +279,7 @@ RecordVal* BroFile::Rotate() return nullptr; static auto rotate_info = zeek::id::find_type("rotate_info"); - RecordVal* info = new RecordVal(rotate_info); + auto* info = new zeek::RecordVal(rotate_info); FILE* newf = rotate_file(name, info); if ( ! newf ) @@ -288,7 +288,7 @@ RecordVal* BroFile::Rotate() return nullptr; } - info->Assign(2, open_time); + info->Assign(2, open_time); Unlink(); @@ -329,7 +329,7 @@ void BroFile::RaiseOpenEvent() return; BroFilePtr bf{zeek::NewRef{}, this}; - Event* event = new ::Event(::file_opened, {zeek::make_intrusive(std::move(bf))}); + Event* event = new ::Event(::file_opened, {zeek::make_intrusive(std::move(bf))}); mgr.Dispatch(event, true); } diff --git a/src/File.h b/src/File.h index 8a7017a250..d11d7c03d6 100644 --- a/src/File.h +++ b/src/File.h @@ -16,8 +16,6 @@ #include "IntrusivePtr.h" #include "util.h" -class RecordVal; - namespace zeek { class Type; using TypePtr = zeek::IntrusivePtr; @@ -26,6 +24,7 @@ using BroType [[deprecated("Remove in v4.1. Use zeek::Type instead.")]] = zeek:: ZEEK_FORWARD_DECLARE_NAMESPACED(PrintStmt, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(Attributes, zeek::detail); +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); class BroFile; using BroFilePtr = zeek::IntrusivePtr; @@ -66,7 +65,7 @@ public: void Describe(ODesc* d) const override; // Rotates the logfile. Returns rotate_info. - RecordVal* Rotate(); + zeek::RecordVal* Rotate(); // Set &raw_output attribute. void SetAttrs(zeek::detail::Attributes* attrs); diff --git a/src/Frame.cc b/src/Frame.cc index c79ac6abda..a31e4a7f6c 100644 --- a/src/Frame.cc +++ b/src/Frame.cc @@ -61,22 +61,22 @@ void Frame::AddFunctionWithClosureRef(BroFunc* func) functions_with_closure_frame_reference->emplace_back(func); } -void Frame::SetElement(int n, Val* v) +void Frame::SetElement(int n, zeek::Val* v) { SetElement(n, {zeek::AdoptRef{}, v}); } -void Frame::SetElement(int n, ValPtr v) +void Frame::SetElement(int n, zeek::ValPtr v) { ClearElement(n); frame[n] = {std::move(v), false}; } -void Frame::SetElementWeak(int n, Val* v) +void Frame::SetElementWeak(int n, zeek::Val* v) { ClearElement(n); frame[n] = {{zeek::AdoptRef{}, v}, true}; } -void Frame::SetElement(const zeek::detail::ID* id, ValPtr v) +void Frame::SetElement(const zeek::detail::ID* id, zeek::ValPtr v) { if ( closure ) { @@ -105,7 +105,7 @@ void Frame::SetElement(const zeek::detail::ID* id, ValPtr v) SetElement(id->Offset(), std::move(v)); } -const ValPtr& Frame::GetElementByID(const zeek::detail::ID* id) const +const zeek::ValPtr& Frame::GetElementByID(const zeek::detail::ID* id) const { if ( closure ) { @@ -172,7 +172,7 @@ Frame* Frame::Clone() const return other; } -static bool val_is_func(const ValPtr& v, BroFunc* func) +static bool val_is_func(const zeek::ValPtr& v, BroFunc* func) { if ( v->GetType()->Tag() != zeek::TYPE_FUNC ) return false; diff --git a/src/Frame.h b/src/Frame.h index 7f8cba9dad..6449236e11 100644 --- a/src/Frame.h +++ b/src/Frame.h @@ -29,7 +29,9 @@ namespace trigger { } } +namespace zeek { using ValPtr = zeek::IntrusivePtr; +} class Frame; using FramePtr = zeek::IntrusivePtr; @@ -56,21 +58,21 @@ public: * @param n the index to get. * @return the value at index *n* of the underlying array. */ - const ValPtr& GetElement(int n) const + const zeek::ValPtr& GetElement(int n) const { return frame[n].val; } [[deprecated("Remove in v4.1. Use GetElement(int).")]] - Val* NthElement(int n) const { return frame[n].val.get(); } + zeek::Val* NthElement(int n) const { return frame[n].val.get(); } /** * Sets the element at index *n* of the underlying array to *v*. * @param n the index to set * @param v the value to set it to */ - void SetElement(int n, ValPtr v); + void SetElement(int n, zeek::ValPtr v); [[deprecated("Remove in v4.1. Pass IntrusivePtr instead.")]] - void SetElement(int n, Val* v); + void SetElement(int n, zeek::Val* v); /** * Associates *id* and *v* in the frame. Future lookups of @@ -79,8 +81,8 @@ public: * @param id the ID to associate * @param v the value to associate it with */ - void SetElement(const zeek::detail::ID* id, ValPtr v); - void SetElement(const zeek::detail::IDPtr& id, ValPtr v) + void SetElement(const zeek::detail::ID* id, zeek::ValPtr v); + void SetElement(const zeek::detail::IDPtr& id, zeek::ValPtr v) { SetElement(id.get(), std::move(v)); } /** @@ -90,11 +92,11 @@ public: * @param id the id who's value to retreive * @return the value associated with *id* */ - const ValPtr& GetElementByID(const zeek::detail::IDPtr& id) const + const zeek::ValPtr& GetElementByID(const zeek::detail::IDPtr& id) const { return GetElementByID(id.get()); } [[deprecated("Remove in v4.1. Use GetElementByID().")]] - Val* GetElement(const zeek::detail::ID* id) const + zeek::Val* GetElement(const zeek::detail::ID* id) const { return GetElementByID(id).get(); } /** @@ -254,13 +256,13 @@ private: using OffsetMap = std::unordered_map; struct Element { - ValPtr val; + zeek::ValPtr val; // Weak reference is used to prevent circular reference memory leaks // in lambdas/closures. bool weak_ref; }; - const ValPtr& GetElementByID(const zeek::detail::ID* id) const; + const zeek::ValPtr& GetElementByID(const zeek::detail::ID* id) const; /** * Sets the element at index *n* of the underlying array to *v*, but does @@ -270,7 +272,7 @@ private: * @param v the value to set it to (caller has not Ref'd and Frame will * not Unref it) */ - void SetElementWeak(int n, Val* v); + void SetElementWeak(int n, zeek::Val* v); /** * Clone an element at an offset into other frame if not equal to a given diff --git a/src/Func.cc b/src/Func.cc index f50e8fdaa4..d778d880c5 100644 --- a/src/Func.cc +++ b/src/Func.cc @@ -60,7 +60,7 @@ extern RETSIGTYPE sig_handler(int signo); std::vector call_stack; bool did_builtin_init = false; -static const std::pair empty_hook_result(false, nullptr); +static const std::pair empty_hook_result(false, nullptr); std::string render_call_stack() { @@ -216,7 +216,7 @@ void Func::CopyStateInto(Func* other) const other->unique_id = unique_id; } -void Func::CheckPluginResult(bool handled, const ValPtr& hook_result, +void Func::CheckPluginResult(bool handled, const zeek::ValPtr& hook_result, zeek::FunctionFlavor flavor) const { // Helper function factoring out this code from BroFunc:Call() for @@ -299,13 +299,13 @@ bool BroFunc::IsPure() const [](const Body& b) { return b.stmts->IsPure(); }); } -Val* Func::Call(val_list* args, Frame* parent) const +zeek::Val* Func::Call(val_list* args, Frame* parent) const { auto zargs = zeek::val_list_to_args(*args); return Invoke(&zargs, parent).release(); }; -ValPtr BroFunc::Invoke(zeek::Args* args, Frame* parent) const +zeek::ValPtr BroFunc::Invoke(zeek::Args* args, Frame* parent) const { #ifdef PROFILE_BRO_FUNCTIONS DEBUG_MSG("Function: %s\n", Name()); @@ -357,7 +357,7 @@ ValPtr BroFunc::Invoke(zeek::Args* args, Frame* parent) const } stmt_flow_type flow = FLOW_NEXT; - ValPtr result; + zeek::ValPtr result; for ( const auto& body : bodies ) { @@ -604,7 +604,7 @@ BuiltinFunc::BuiltinFunc(built_in_func arg_func, const char* arg_name, reporter->InternalError("built-in function %s multiply defined", Name()); type = id->GetType(); - id->SetVal(zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, this})); + id->SetVal(zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, this})); } BuiltinFunc::~BuiltinFunc() @@ -616,7 +616,7 @@ bool BuiltinFunc::IsPure() const return is_pure; } -ValPtr BuiltinFunc::Invoke(zeek::Args* args, Frame* parent) const +zeek::ValPtr BuiltinFunc::Invoke(zeek::Args* args, Frame* parent) const { #ifdef PROFILE_BRO_FUNCTIONS DEBUG_MSG("Function: %s\n", Name()); @@ -667,10 +667,10 @@ void BuiltinFunc::Describe(ODesc* d) const void builtin_error(const char* msg) { - builtin_error(msg, ValPtr{}); + builtin_error(msg, zeek::ValPtr{}); } -void builtin_error(const char* msg, ValPtr arg) +void builtin_error(const char* msg, zeek::ValPtr arg) { builtin_error(msg, arg.get()); } diff --git a/src/Func.h b/src/Func.h index b116d3418c..6081344a93 100644 --- a/src/Func.h +++ b/src/Func.h @@ -17,11 +17,11 @@ #include "ZeekArgs.h" #include "BifReturnVal.h" -class Val; class Frame; class Scope; using ScopePtr = zeek::IntrusivePtr; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(CallExpr, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(ID, zeek::detail); @@ -69,7 +69,7 @@ public: bool HasBodies() const { return bodies.size(); } [[deprecated("Remove in v4.1. Use Invoke() instead.")]] - Val* Call(val_list* args, Frame* parent = nullptr) const; + zeek::Val* Call(val_list* args, Frame* parent = nullptr) const; /** * Calls a Zeek function. @@ -77,7 +77,7 @@ public: * @param parent the frame from which the function is being called. * @return the return value of the function call. */ - virtual ValPtr Invoke( + virtual zeek::ValPtr Invoke( zeek::Args* args, Frame* parent = nullptr) const = 0; /** @@ -85,9 +85,8 @@ public: */ template std::enable_if_t< - std::is_convertible_v>, - ValPtr>, - ValPtr> + std::is_convertible_v>, zeek::ValPtr>, + zeek::ValPtr> Invoke(Args&&... args) const { auto zargs = zeek::Args{std::forward(args)...}; @@ -131,7 +130,7 @@ protected: void CopyStateInto(Func* other) const; // Helper function for checking result of plugin hook. - void CheckPluginResult(bool handled, const ValPtr& hook_result, + void CheckPluginResult(bool handled, const zeek::ValPtr& hook_result, zeek::FunctionFlavor flavor) const; std::vector bodies; @@ -153,7 +152,7 @@ public: ~BroFunc() override; bool IsPure() const override; - ValPtr Invoke(zeek::Args* args, Frame* parent) const override; + zeek::ValPtr Invoke(zeek::Args* args, Frame* parent) const override; /** * Adds adds a closure to the function. Closures are cloned and @@ -231,7 +230,7 @@ public: ~BuiltinFunc() override; bool IsPure() const override; - ValPtr Invoke(zeek::Args* args, Frame* parent) const override; + zeek::ValPtr Invoke(zeek::Args* args, Frame* parent) const override; built_in_func TheFunc() const { return func; } void Describe(ODesc* d) const override; @@ -245,7 +244,7 @@ protected: extern void builtin_error(const char* msg); -extern void builtin_error(const char* msg, ValPtr); +extern void builtin_error(const char* msg, zeek::ValPtr); extern void builtin_error(const char* msg, BroObj* arg); extern void init_builtin_funcs(); extern void init_builtin_funcs_subdirs(); diff --git a/src/Hash.h b/src/Hash.h index 0bc4daeec0..dbb6802943 100644 --- a/src/Hash.h +++ b/src/Hash.h @@ -23,15 +23,16 @@ #include -class BroString; // to allow bro_md5_hmac access to the hmac seed #include "ZeekArgs.h" -class Val; + +//ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +class BroString; class Frame; class BifReturnVal; namespace zeek::BifFunc { - extern BifReturnVal md5_hmac_bif(Frame* frame, const zeek::Args*); + extern BifReturnVal md5_hmac_bif(::Frame* frame, const zeek::Args*); } typedef uint64_t hash_t; diff --git a/src/ID.cc b/src/ID.cc index 7e82d300c3..c0c8c2f094 100644 --- a/src/ID.cc +++ b/src/ID.cc @@ -48,7 +48,7 @@ const zeek::TypePtr& zeek::id::find_type(std::string_view name) return id->GetType(); } -const ValPtr& zeek::id::find_val(std::string_view name) +const zeek::ValPtr& zeek::id::find_val(std::string_view name) { auto id = global_scope()->Find(name); @@ -59,7 +59,7 @@ const ValPtr& zeek::id::find_val(std::string_view name) return id->GetVal(); } -const ValPtr& zeek::id::find_const(std::string_view name) +const zeek::ValPtr& zeek::id::find_const(std::string_view name) { auto id = global_scope()->Find(name); @@ -141,7 +141,7 @@ void ID::ClearVal() val = nullptr; } -void ID::SetVal(ValPtr v) +void ID::SetVal(zeek::ValPtr v) { val = std::move(v); Modified(); @@ -170,7 +170,7 @@ void ID::SetVal(ValPtr v) } } -void ID::SetVal(ValPtr v, InitClass c) +void ID::SetVal(zeek::ValPtr v, InitClass c) { if ( c == INIT_NONE || c == INIT_FULL ) { diff --git a/src/ID.h b/src/ID.h index 632abf64cb..c652bdaa10 100644 --- a/src/ID.h +++ b/src/ID.h @@ -13,25 +13,25 @@ #include #include -class Val; -using ValPtr = zeek::IntrusivePtr; - class Func; using FuncPtr = zeek::IntrusivePtr; -namespace zeek { class Type; } -using BroType [[deprecated("Remove in v4.1. Use zeek::Type instead.")]] = zeek::Type; - +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(TableType, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(VectorType, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(EnumType, zeek); -using TypePtr = zeek::IntrusivePtr; -using RecordTypePtr = zeek::IntrusivePtr; -using TableTypePtr = zeek::IntrusivePtr; -using VectorTypePtr = zeek::IntrusivePtr; -using EnumTypePtr = zeek::IntrusivePtr; +namespace zeek { + class Type; + using TypePtr = zeek::IntrusivePtr; + using RecordTypePtr = zeek::IntrusivePtr; + using TableTypePtr = zeek::IntrusivePtr; + using VectorTypePtr = zeek::IntrusivePtr; + using EnumTypePtr = zeek::IntrusivePtr; + using ValPtr = zeek::IntrusivePtr; +} +using BroType [[deprecated("Remove in v4.1. Use zeek::Type instead.")]] = zeek::Type; namespace zeek::detail { diff --git a/src/IP.cc b/src/IP.cc index bd0b5237ac..a03d128556 100644 --- a/src/IP.cc +++ b/src/IP.cc @@ -13,15 +13,15 @@ #include "BroString.h" #include "Reporter.h" -static VectorValPtr BuildOptionsVal(const u_char* data, int len) +static zeek::VectorValPtr BuildOptionsVal(const u_char* data, int len) { - auto vv = zeek::make_intrusive(zeek::id::find_type("ip6_options")); + auto vv = zeek::make_intrusive(zeek::id::find_type("ip6_options")); while ( len > 0 ) { static auto ip6_option_type = zeek::id::find_type("ip6_option"); const struct ip6_opt* opt = (const struct ip6_opt*) data; - auto rv = zeek::make_intrusive(ip6_option_type); + auto rv = zeek::make_intrusive(ip6_option_type); rv->Assign(0, val_mgr->Count(opt->ip6o_type)); if ( opt->ip6o_type == 0 ) @@ -37,7 +37,7 @@ static VectorValPtr BuildOptionsVal(const u_char* data, int len) // PadN or other option uint16_t off = 2 * sizeof(uint8_t); rv->Assign(1, val_mgr->Count(opt->ip6o_len)); - rv->Assign(2, zeek::make_intrusive( + rv->Assign(2, zeek::make_intrusive( new BroString(data + off, opt->ip6o_len, true))); data += opt->ip6o_len + off; len -= opt->ip6o_len + off; @@ -49,25 +49,25 @@ static VectorValPtr BuildOptionsVal(const u_char* data, int len) return vv; } -RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const +zeek::RecordValPtr IPv6_Hdr::ToVal(zeek::VectorValPtr chain) const { - RecordValPtr rv; + zeek::RecordValPtr rv; switch ( type ) { case IPPROTO_IPV6: { static auto ip6_hdr_type = zeek::id::find_type("ip6_hdr"); - rv = zeek::make_intrusive(ip6_hdr_type); + rv = zeek::make_intrusive(ip6_hdr_type); const struct ip6_hdr* ip6 = (const struct ip6_hdr*)data; rv->Assign(0, val_mgr->Count((ntohl(ip6->ip6_flow) & 0x0ff00000)>>20)); rv->Assign(1, val_mgr->Count(ntohl(ip6->ip6_flow) & 0x000fffff)); rv->Assign(2, val_mgr->Count(ntohs(ip6->ip6_plen))); rv->Assign(3, val_mgr->Count(ip6->ip6_nxt)); rv->Assign(4, val_mgr->Count(ip6->ip6_hlim)); - rv->Assign(5, zeek::make_intrusive(IPAddr(ip6->ip6_src))); - rv->Assign(6, zeek::make_intrusive(IPAddr(ip6->ip6_dst))); + rv->Assign(5, zeek::make_intrusive(IPAddr(ip6->ip6_src))); + rv->Assign(6, zeek::make_intrusive(IPAddr(ip6->ip6_dst))); if ( ! chain ) - chain = zeek::make_intrusive( + chain = zeek::make_intrusive( zeek::id::find_type("ip6_ext_hdr_chain")); rv->Assign(7, std::move(chain)); } @@ -76,7 +76,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case IPPROTO_HOPOPTS: { static auto ip6_hopopts_type = zeek::id::find_type("ip6_hopopts"); - rv = zeek::make_intrusive(ip6_hopopts_type); + rv = zeek::make_intrusive(ip6_hopopts_type); const struct ip6_hbh* hbh = (const struct ip6_hbh*)data; rv->Assign(0, val_mgr->Count(hbh->ip6h_nxt)); rv->Assign(1, val_mgr->Count(hbh->ip6h_len)); @@ -89,7 +89,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case IPPROTO_DSTOPTS: { static auto ip6_dstopts_type = zeek::id::find_type("ip6_dstopts"); - rv = zeek::make_intrusive(ip6_dstopts_type); + rv = zeek::make_intrusive(ip6_dstopts_type); const struct ip6_dest* dst = (const struct ip6_dest*)data; rv->Assign(0, val_mgr->Count(dst->ip6d_nxt)); rv->Assign(1, val_mgr->Count(dst->ip6d_len)); @@ -101,21 +101,21 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case IPPROTO_ROUTING: { static auto ip6_routing_type = zeek::id::find_type("ip6_routing"); - rv = zeek::make_intrusive(ip6_routing_type); + rv = zeek::make_intrusive(ip6_routing_type); const struct ip6_rthdr* rt = (const struct ip6_rthdr*)data; rv->Assign(0, val_mgr->Count(rt->ip6r_nxt)); rv->Assign(1, val_mgr->Count(rt->ip6r_len)); rv->Assign(2, val_mgr->Count(rt->ip6r_type)); rv->Assign(3, val_mgr->Count(rt->ip6r_segleft)); uint16_t off = 4 * sizeof(uint8_t); - rv->Assign(4, zeek::make_intrusive(new BroString(data + off, Length() - off, true))); + rv->Assign(4, zeek::make_intrusive(new BroString(data + off, Length() - off, true))); } break; case IPPROTO_FRAGMENT: { static auto ip6_fragment_type = zeek::id::find_type("ip6_fragment"); - rv = zeek::make_intrusive(ip6_fragment_type); + rv = zeek::make_intrusive(ip6_fragment_type); const struct ip6_frag* frag = (const struct ip6_frag*)data; rv->Assign(0, val_mgr->Count(frag->ip6f_nxt)); rv->Assign(1, val_mgr->Count(frag->ip6f_reserved)); @@ -129,7 +129,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case IPPROTO_AH: { static auto ip6_ah_type = zeek::id::find_type("ip6_ah"); - rv = zeek::make_intrusive(ip6_ah_type); + rv = zeek::make_intrusive(ip6_ah_type); rv->Assign(0, val_mgr->Count(((ip6_ext*)data)->ip6e_nxt)); rv->Assign(1, val_mgr->Count(((ip6_ext*)data)->ip6e_len)); rv->Assign(2, val_mgr->Count(ntohs(((uint16_t*)data)[1]))); @@ -141,7 +141,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const // Payload Len was non-zero for this header. rv->Assign(4, val_mgr->Count(ntohl(((uint32_t*)data)[2]))); uint16_t off = 3 * sizeof(uint32_t); - rv->Assign(5, zeek::make_intrusive(new BroString(data + off, Length() - off, true))); + rv->Assign(5, zeek::make_intrusive(new BroString(data + off, Length() - off, true))); } } break; @@ -149,7 +149,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case IPPROTO_ESP: { static auto ip6_esp_type = zeek::id::find_type("ip6_esp"); - rv = zeek::make_intrusive(ip6_esp_type); + rv = zeek::make_intrusive(ip6_esp_type); const uint32_t* esp = (const uint32_t*)data; rv->Assign(0, val_mgr->Count(ntohl(esp[0]))); rv->Assign(1, val_mgr->Count(ntohl(esp[1]))); @@ -160,7 +160,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case IPPROTO_MOBILITY: { static auto ip6_mob_type = zeek::id::find_type("ip6_mobility_hdr"); - rv = zeek::make_intrusive(ip6_mob_type); + rv = zeek::make_intrusive(ip6_mob_type); const struct ip6_mobility* mob = (const struct ip6_mobility*) data; rv->Assign(0, val_mgr->Count(mob->ip6mob_payload)); rv->Assign(1, val_mgr->Count(mob->ip6mob_len)); @@ -169,7 +169,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const rv->Assign(4, val_mgr->Count(ntohs(mob->ip6mob_chksum))); static auto ip6_mob_msg_type = zeek::id::find_type("ip6_mobility_msg"); - auto msg = zeek::make_intrusive(ip6_mob_msg_type); + auto msg = zeek::make_intrusive(ip6_mob_msg_type); msg->Assign(0, val_mgr->Count(mob->ip6mob_type)); uint16_t off = sizeof(ip6_mobility); @@ -187,7 +187,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const switch ( mob->ip6mob_type ) { case 0: { - auto m = zeek::make_intrusive(ip6_mob_brr_type); + auto m = zeek::make_intrusive(ip6_mob_brr_type); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); off += sizeof(uint16_t); m->Assign(1, BuildOptionsVal(data + off, Length() - off)); @@ -197,7 +197,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 1: { - auto m = zeek::make_intrusive(ip6_mobility_hoti_type); + auto m = zeek::make_intrusive(ip6_mobility_hoti_type); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); off += sizeof(uint16_t) + sizeof(uint64_t); @@ -208,7 +208,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 2: { - auto m = zeek::make_intrusive(ip6_mobility_coti_type); + auto m = zeek::make_intrusive(ip6_mobility_coti_type); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); off += sizeof(uint16_t) + sizeof(uint64_t); @@ -219,7 +219,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 3: { - auto m = zeek::make_intrusive(ip6_mobility_hot_type); + auto m = zeek::make_intrusive(ip6_mobility_hot_type); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t)))))); @@ -231,7 +231,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 4: { - auto m = zeek::make_intrusive(ip6_mobility_cot_type); + auto m = zeek::make_intrusive(ip6_mobility_cot_type); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t)))))); @@ -243,7 +243,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 5: { - auto m = zeek::make_intrusive(ip6_mobility_bu_type); + auto m = zeek::make_intrusive(ip6_mobility_bu_type); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data)))); m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000)); m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000)); @@ -258,7 +258,7 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 6: { - auto m = zeek::make_intrusive(ip6_mobility_back_type); + auto m = zeek::make_intrusive(ip6_mobility_back_type); m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data))); m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80)); m->Assign(2, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))))); @@ -271,10 +271,10 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const case 7: { - auto m = zeek::make_intrusive(ip6_mobility_be_type); + auto m = zeek::make_intrusive(ip6_mobility_be_type); m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data))); const in6_addr* hoa = (const in6_addr*)(msg_data + sizeof(uint16_t)); - m->Assign(1, zeek::make_intrusive(IPAddr(*hoa))); + m->Assign(1, zeek::make_intrusive(IPAddr(*hoa))); off += sizeof(uint16_t) + sizeof(in6_addr); m->Assign(2, BuildOptionsVal(data + off, Length() - off)); msg->Assign(8, std::move(m)); @@ -298,10 +298,10 @@ RecordValPtr IPv6_Hdr::ToVal(VectorValPtr chain) const return rv; } -RecordValPtr IPv6_Hdr::ToVal() const +zeek::RecordValPtr IPv6_Hdr::ToVal() const { return ToVal(nullptr); } -RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const +zeek::RecordVal* IPv6_Hdr::BuildRecordVal(zeek::VectorVal* chain) const { return ToVal({zeek::AdoptRef{}, chain}).release(); } @@ -326,22 +326,22 @@ IPAddr IP_Hdr::DstAddr() const return ip4 ? IPAddr(ip4->ip_dst) : ip6_hdrs->DstAddr(); } -RecordValPtr IP_Hdr::ToIPHdrVal() const +zeek::RecordValPtr IP_Hdr::ToIPHdrVal() const { - RecordValPtr rval; + zeek::RecordValPtr rval; if ( ip4 ) { static auto ip4_hdr_type = zeek::id::find_type("ip4_hdr"); - rval = zeek::make_intrusive(ip4_hdr_type); + rval = zeek::make_intrusive(ip4_hdr_type); rval->Assign(0, val_mgr->Count(ip4->ip_hl * 4)); rval->Assign(1, val_mgr->Count(ip4->ip_tos)); rval->Assign(2, val_mgr->Count(ntohs(ip4->ip_len))); rval->Assign(3, val_mgr->Count(ntohs(ip4->ip_id))); rval->Assign(4, val_mgr->Count(ip4->ip_ttl)); rval->Assign(5, val_mgr->Count(ip4->ip_p)); - rval->Assign(6, zeek::make_intrusive(ip4->ip_src.s_addr)); - rval->Assign(7, zeek::make_intrusive(ip4->ip_dst.s_addr)); + rval->Assign(6, zeek::make_intrusive(ip4->ip_src.s_addr)); + rval->Assign(7, zeek::make_intrusive(ip4->ip_dst.s_addr)); } else { @@ -351,23 +351,23 @@ RecordValPtr IP_Hdr::ToIPHdrVal() const return rval; } -RecordVal* IP_Hdr::BuildIPHdrVal() const +zeek::RecordVal* IP_Hdr::BuildIPHdrVal() const { return ToIPHdrVal().release(); } -RecordValPtr IP_Hdr::ToPktHdrVal() const +zeek::RecordValPtr IP_Hdr::ToPktHdrVal() const { static auto pkt_hdr_type = zeek::id::find_type("pkt_hdr"); - return ToPktHdrVal(zeek::make_intrusive(pkt_hdr_type), 0); + return ToPktHdrVal(zeek::make_intrusive(pkt_hdr_type), 0); } -RecordVal* IP_Hdr::BuildPktHdrVal() const +zeek::RecordVal* IP_Hdr::BuildPktHdrVal() const { return ToPktHdrVal().release(); } -RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const +zeek::RecordValPtr IP_Hdr::ToPktHdrVal(zeek::RecordValPtr pkt_hdr, int sindex) const { static auto tcp_hdr_type = zeek::id::find_type("tcp_hdr"); static auto udp_hdr_type = zeek::id::find_type("udp_hdr"); @@ -386,7 +386,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const case IPPROTO_TCP: { const struct tcphdr* tp = (const struct tcphdr*) data; - auto tcp_hdr = zeek::make_intrusive(tcp_hdr_type); + auto tcp_hdr = zeek::make_intrusive(tcp_hdr_type); int tcp_hdr_len = tp->th_off * 4; int data_len = PayloadLen() - tcp_hdr_len; @@ -408,7 +408,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const case IPPROTO_UDP: { const struct udphdr* up = (const struct udphdr*) data; - auto udp_hdr = zeek::make_intrusive(udp_hdr_type); + auto udp_hdr = zeek::make_intrusive(udp_hdr_type); udp_hdr->Assign(0, val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP)); udp_hdr->Assign(1, val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP)); @@ -421,7 +421,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const case IPPROTO_ICMP: { const struct icmp* icmpp = (const struct icmp *) data; - auto icmp_hdr = zeek::make_intrusive(icmp_hdr_type); + auto icmp_hdr = zeek::make_intrusive(icmp_hdr_type); icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp_type)); @@ -432,7 +432,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const case IPPROTO_ICMPV6: { const struct icmp6_hdr* icmpp = (const struct icmp6_hdr*) data; - auto icmp_hdr = zeek::make_intrusive(icmp_hdr_type); + auto icmp_hdr = zeek::make_intrusive(icmp_hdr_type); icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp6_type)); @@ -450,7 +450,7 @@ RecordValPtr IP_Hdr::ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const return pkt_hdr; } -RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const +zeek::RecordVal* IP_Hdr::BuildPktHdrVal(zeek::RecordVal* pkt_hdr, int sindex) const { return ToPktHdrVal({zeek::AdoptRef{}, pkt_hdr}, sindex).release(); } @@ -676,7 +676,7 @@ void IPv6_Hdr_Chain::ProcessDstOpts(const struct ip6_dest* d, uint16_t len) } #endif -VectorValPtr IPv6_Hdr_Chain::ToVal() const +zeek::VectorValPtr IPv6_Hdr_Chain::ToVal() const { static auto ip6_ext_hdr_type = zeek::id::find_type("ip6_ext_hdr"); static auto ip6_hopopts_type = zeek::id::find_type("ip6_hopopts"); @@ -686,12 +686,12 @@ VectorValPtr IPv6_Hdr_Chain::ToVal() const static auto ip6_ah_type = zeek::id::find_type("ip6_ah"); static auto ip6_esp_type = zeek::id::find_type("ip6_esp"); static auto ip6_ext_hdr_chain_type = zeek::id::find_type("ip6_ext_hdr_chain"); - auto rval = zeek::make_intrusive(ip6_ext_hdr_chain_type); + auto rval = zeek::make_intrusive(ip6_ext_hdr_chain_type); for ( size_t i = 1; i < chain.size(); ++i ) { auto v = chain[i]->ToVal(); - auto ext_hdr = zeek::make_intrusive(ip6_ext_hdr_type); + auto ext_hdr = zeek::make_intrusive(ip6_ext_hdr_type); uint8_t type = chain[i]->Type(); ext_hdr->Assign(0, val_mgr->Count(type)); @@ -730,7 +730,7 @@ VectorValPtr IPv6_Hdr_Chain::ToVal() const return rval; } -VectorVal* IPv6_Hdr_Chain::BuildVal() const +zeek::VectorVal* IPv6_Hdr_Chain::BuildVal() const { return ToVal().release(); } diff --git a/src/IP.h b/src/IP.h index 639994013a..717225f541 100644 --- a/src/IP.h +++ b/src/IP.h @@ -17,11 +17,14 @@ #include "IntrusivePtr.h" class IPAddr; -class RecordVal; -class VectorVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek); + +namespace zeek { using RecordValPtr = zeek::IntrusivePtr; using VectorValPtr = zeek::IntrusivePtr; +} #ifdef ENABLE_MOBILE_IPV6 @@ -139,11 +142,11 @@ public: /** * Returns the script-layer record representation of the header. */ - RecordValPtr ToVal(VectorValPtr chain) const; - RecordValPtr ToVal() const; + zeek::RecordValPtr ToVal(zeek::VectorValPtr chain) const; + zeek::RecordValPtr ToVal() const; [[deprecated("Remove in v4.1. Use ToVal() instead.")]] - RecordVal* BuildRecordVal(VectorVal* chain = nullptr) const; + zeek::RecordVal* BuildRecordVal(zeek::VectorVal* chain = nullptr) const; protected: uint8_t type; @@ -232,10 +235,10 @@ public: * Returns a vector of ip6_ext_hdr RecordVals that includes script-layer * representation of all extension headers in the chain. */ - VectorValPtr ToVal() const; + zeek::VectorValPtr ToVal() const; [[deprecated("Remove in v4.1. Use ToVal() instead.")]] - VectorVal* BuildVal() const; + zeek::VectorVal* BuildVal() const; protected: // for access to protected ctor that changes next header values that @@ -529,28 +532,28 @@ public: /** * Returns an ip_hdr or ip6_hdr_chain RecordVal. */ - RecordValPtr ToIPHdrVal() const; + zeek::RecordValPtr ToIPHdrVal() const; [[deprecated("Remove in v4.1. Use ToIPHdrVal() instead.")]] - RecordVal* BuildIPHdrVal() const; + zeek::RecordVal* BuildIPHdrVal() const; /** * Returns a pkt_hdr RecordVal, which includes not only the IP header, but * also upper-layer (tcp/udp/icmp) headers. */ - RecordValPtr ToPktHdrVal() const; + zeek::RecordValPtr ToPktHdrVal() const; [[deprecated("Remove in v4.1. Use ToPktHdrVal() instead.")]] - RecordVal* BuildPktHdrVal() const; + zeek::RecordVal* BuildPktHdrVal() const; /** * Same as above, but simply add our values into the record at the * specified starting index. */ - RecordValPtr ToPktHdrVal(RecordValPtr pkt_hdr, int sindex) const; + zeek::RecordValPtr ToPktHdrVal(zeek::RecordValPtr pkt_hdr, int sindex) const; [[deprecated("Remove in v4.1. Use ToPktHdrVal() instead.")]] - RecordVal* BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const; + zeek::RecordVal* BuildPktHdrVal(zeek::RecordVal* pkt_hdr, int sindex) const; private: const struct ip* ip4 = nullptr; diff --git a/src/Net.cc b/src/Net.cc index 2e56c3df63..d419ba485e 100644 --- a/src/Net.cc +++ b/src/Net.cc @@ -194,7 +194,7 @@ void net_init(const std::optional& interface, writefile, pkt_dumper->ErrorMsg()); if ( const auto& id = global_scope()->Find("trace_output_file") ) - id->SetVal(zeek::make_intrusive(writefile)); + id->SetVal(zeek::make_intrusive(writefile)); else reporter->Error("trace_output_file not defined in bro.init"); } diff --git a/src/NetVar.cc b/src/NetVar.cc index 27a8f98340..44d5950d27 100644 --- a/src/NetVar.cc +++ b/src/NetVar.cc @@ -66,17 +66,17 @@ double icmp_inactivity_timeout; int tcp_storm_thresh; double tcp_storm_interarrival_thresh; -TableVal* tcp_reassembler_ports_orig; -TableVal* tcp_reassembler_ports_resp; +zeek::TableVal* tcp_reassembler_ports_orig; +zeek::TableVal* tcp_reassembler_ports_resp; -TableVal* tcp_content_delivery_ports_orig; -TableVal* tcp_content_delivery_ports_resp; +zeek::TableVal* tcp_content_delivery_ports_orig; +zeek::TableVal* tcp_content_delivery_ports_resp; bool tcp_content_deliver_all_orig; bool tcp_content_deliver_all_resp; -TableVal* udp_content_delivery_ports_orig; -TableVal* udp_content_delivery_ports_resp; -TableVal* udp_content_ports; +zeek::TableVal* udp_content_delivery_ports_orig; +zeek::TableVal* udp_content_delivery_ports_resp; +zeek::TableVal* udp_content_ports; bool udp_content_deliver_all_orig; bool udp_content_deliver_all_resp; bool udp_content_delivery_ports_use_resp; @@ -112,15 +112,15 @@ zeek::RecordType* dns_rrsig_rr; zeek::RecordType* dns_dnskey_rr; zeek::RecordType* dns_nsec3_rr; zeek::RecordType* dns_ds_rr; -TableVal* dns_skip_auth; -TableVal* dns_skip_addl; +zeek::TableVal* dns_skip_auth; +zeek::TableVal* dns_skip_addl; int dns_skip_all_auth; int dns_skip_all_addl; int dns_max_queries; double stp_delta; double stp_idle_min; -TableVal* stp_skip_src; +zeek::TableVal* stp_skip_src; double table_expire_interval; double table_expire_delay; @@ -130,22 +130,22 @@ double connection_status_update_interval; int orig_addr_anonymization, resp_addr_anonymization; int other_addr_anonymization; -TableVal* preserve_orig_addr; -TableVal* preserve_resp_addr; -TableVal* preserve_other_addr; +zeek::TableVal* preserve_orig_addr; +zeek::TableVal* preserve_resp_addr; +zeek::TableVal* preserve_other_addr; zeek::RecordType* rotate_info; -StringVal* log_rotate_base_time; +zeek::StringVal* log_rotate_base_time; -StringVal* peer_description; +zeek::StringVal* peer_description; -Val* profiling_file; +zeek::Val* profiling_file; double profiling_interval; int expensive_profiling_multiple; int segment_profiling; int pkt_profile_mode; double pkt_profile_freq; -Val* pkt_profile_file; +zeek::Val* pkt_profile_file; int load_sample_freq; @@ -162,13 +162,13 @@ int dpd_match_only_beginning; int dpd_late_match_stop; int dpd_ignore_ports; -TableVal* likely_server_ports; +zeek::TableVal* likely_server_ports; int check_for_unused_event_handlers; double timer_mgr_inactivity_timeout; -StringVal* trace_output_file; +zeek::StringVal* trace_output_file; int record_all_packets; @@ -179,9 +179,9 @@ zeek::TableType* record_field_table; zeek::RecordType* call_argument; zeek::VectorType* call_argument_vector; -StringVal* cmd_line_bpf_filter; +zeek::StringVal* cmd_line_bpf_filter; -StringVal* global_hash_seed; +zeek::StringVal* global_hash_seed; bro_uint_t bits_per_uid; diff --git a/src/NetVar.h b/src/NetVar.h index 86116228af..3192007a4a 100644 --- a/src/NetVar.h +++ b/src/NetVar.h @@ -87,23 +87,23 @@ extern int tcp_storm_thresh; extern double tcp_storm_interarrival_thresh; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* tcp_reassembler_ports_orig; +extern zeek::TableVal* tcp_reassembler_ports_orig; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* tcp_reassembler_ports_resp; +extern zeek::TableVal* tcp_reassembler_ports_resp; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* tcp_content_delivery_ports_orig; +extern zeek::TableVal* tcp_content_delivery_ports_orig; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* tcp_content_delivery_ports_resp; +extern zeek::TableVal* tcp_content_delivery_ports_resp; extern bool tcp_content_deliver_all_orig; extern bool tcp_content_deliver_all_resp; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* udp_content_delivery_ports_orig; +extern zeek::TableVal* udp_content_delivery_ports_orig; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* udp_content_delivery_ports_resp; +extern zeek::TableVal* udp_content_delivery_ports_resp; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* udp_content_ports; +extern zeek::TableVal* udp_content_ports; extern bool udp_content_deliver_all_orig; extern bool udp_content_deliver_all_resp; extern bool udp_content_delivery_ports_use_resp; @@ -159,9 +159,9 @@ extern zeek::RecordType* dns_nsec3_rr; [[deprecated("Remove in v4.1. Perform your own lookup.")]] extern zeek::RecordType* dns_ds_rr; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* dns_skip_auth; +extern zeek::TableVal* dns_skip_auth; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* dns_skip_addl; +extern zeek::TableVal* dns_skip_addl; extern int dns_skip_all_auth; extern int dns_skip_all_addl; extern int dns_max_queries; @@ -169,7 +169,7 @@ extern int dns_max_queries; extern double stp_delta; extern double stp_idle_min; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* stp_skip_src; +extern zeek::TableVal* stp_skip_src; extern double table_expire_interval; extern double table_expire_delay; @@ -178,24 +178,24 @@ extern int table_incremental_step; extern int orig_addr_anonymization, resp_addr_anonymization; extern int other_addr_anonymization; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* preserve_orig_addr; +extern zeek::TableVal* preserve_orig_addr; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* preserve_resp_addr; +extern zeek::TableVal* preserve_resp_addr; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* preserve_other_addr; +extern zeek::TableVal* preserve_other_addr; extern double connection_status_update_interval; [[deprecated("Remove in v4.1. Perform your own lookup.")]] extern zeek::RecordType* rotate_info; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern StringVal* log_rotate_base_time; +extern zeek::StringVal* log_rotate_base_time; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern StringVal* peer_description; +extern zeek::StringVal* peer_description; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern Val* profiling_file; +extern zeek::Val* profiling_file; extern double profiling_interval; extern int expensive_profiling_multiple; @@ -203,7 +203,7 @@ extern int segment_profiling; extern int pkt_profile_mode; extern double pkt_profile_freq; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern Val* pkt_profile_file; +extern zeek::Val* pkt_profile_file; extern int load_sample_freq; @@ -223,14 +223,14 @@ extern int dpd_late_match_stop; extern int dpd_ignore_ports; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern TableVal* likely_server_ports; +extern zeek::TableVal* likely_server_ports; extern int check_for_unused_event_handlers; extern double timer_mgr_inactivity_timeout; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern StringVal* trace_output_file; +extern zeek::StringVal* trace_output_file; extern int record_all_packets; @@ -248,10 +248,10 @@ extern zeek::RecordType* call_argument; extern zeek::VectorType* call_argument_vector; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern StringVal* cmd_line_bpf_filter; +extern zeek::StringVal* cmd_line_bpf_filter; [[deprecated("Remove in v4.1. Perform your own lookup.")]] -extern StringVal* global_hash_seed; +extern zeek::StringVal* global_hash_seed; extern bro_uint_t bits_per_uid; diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc index 1ce842cbed..5f29ce39a8 100644 --- a/src/OpaqueVal.cc +++ b/src/OpaqueVal.cc @@ -15,6 +15,8 @@ #include #include +namespace zeek { + // Helper to retrieve a broker value out of a broker::vector at a specified // index, and casted to the expected destination type. template @@ -1035,3 +1037,5 @@ ValPtr ParaglobVal::DoClone(CloneState* state) return nullptr; } } + +} diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h index 502769f429..edfa7b6714 100644 --- a/src/OpaqueVal.h +++ b/src/OpaqueVal.h @@ -14,6 +14,13 @@ namespace broker { class data; } +namespace probabilistic { + class BloomFilter; + class CardinalityCounter; +} + +namespace zeek { + class OpaqueVal; using OpaqueValPtr = zeek::IntrusivePtr; @@ -72,18 +79,18 @@ private: /** Macro to insert into an OpaqueVal-derived class's declaration. */ #define DECLARE_OPAQUE_VALUE(T) \ - friend class OpaqueMgr::Register; \ + friend class zeek::OpaqueMgr::Register; \ friend zeek::IntrusivePtr zeek::make_intrusive(); \ broker::expected DoSerialize() const override; \ bool DoUnserialize(const broker::data& data) override; \ const char* OpaqueName() const override { return #T; } \ - static OpaqueValPtr OpaqueInstantiate() { return zeek::make_intrusive(); } + static zeek::OpaqueValPtr OpaqueInstantiate() { return zeek::make_intrusive(); } #define __OPAQUE_MERGE(a, b) a ## b #define __OPAQUE_ID(x) __OPAQUE_MERGE(_opaque, x) /** Macro to insert into an OpaqueVal-derived class's implementation file. */ -#define IMPLEMENT_OPAQUE_VALUE(T) static OpaqueMgr::Register __OPAQUE_ID(__LINE__)(#T); +#define IMPLEMENT_OPAQUE_VALUE(T) static zeek::OpaqueMgr::Register __OPAQUE_ID(__LINE__)(#T); /** * Base class for all opaque values. Opaque values are types that are managed @@ -162,11 +169,6 @@ protected: static zeek::TypePtr UnserializeType(const broker::data& data); }; -namespace probabilistic { - class BloomFilter; - class CardinalityCounter; -} - class HashVal : public OpaqueVal { public: template @@ -339,7 +341,7 @@ private: }; -class CardinalityVal: public OpaqueVal { +class CardinalityVal : public OpaqueVal { public: explicit CardinalityVal(probabilistic::CardinalityCounter*); ~CardinalityVal() override; @@ -380,3 +382,16 @@ protected: private: std::unique_ptr internal_paraglob; }; + +} + +using OpaqueMgr [[deprecated("Remove in v4.1. Use zeek::OpaqueMgr instead.")]] = zeek::OpaqueMgr; +using OpaqueVal [[deprecated("Remove in v4.1. Use zeek::OpaqueVal instead.")]] = zeek::OpaqueVal; +using HashVal [[deprecated("Remove in v4.1. Use zeek::HashVal instead.")]] = zeek::HashVal; +using MD5Val [[deprecated("Remove in v4.1. Use zeek::MD5Val instead.")]] = zeek::MD5Val; +using SHA1Val [[deprecated("Remove in v4.1. Use zeek::SHA1Val instead.")]] = zeek::SHA1Val; +using SHA256Val [[deprecated("Remove in v4.1. Use zeek::SHA256Val instead.")]] = zeek::SHA256Val; +using EntropyVal [[deprecated("Remove in v4.1. Use zeek::EntropyVal instead.")]] = zeek::EntropyVal; +using BloomFilterVal [[deprecated("Remove in v4.1. Use zeek::BloomFilterVal instead.")]] = zeek::BloomFilterVal; +using CardinalityVal [[deprecated("Remove in v4.1. Use zeek::CardinalityVal instead.")]] = zeek::CardinalityVal; +using ParaglobVal [[deprecated("Remove in v4.1. Use zeek::ParaglobVal instead.")]] = zeek::ParaglobVal; diff --git a/src/PacketFilter.cc b/src/PacketFilter.cc index 480326d070..61afbe0afd 100644 --- a/src/PacketFilter.cc +++ b/src/PacketFilter.cc @@ -23,7 +23,7 @@ void PacketFilter::AddSrc(const IPAddr& src, uint32_t tcp_flags, double probabil delete prev; } -void PacketFilter::AddSrc(Val* src, uint32_t tcp_flags, double probability) +void PacketFilter::AddSrc(zeek::Val* src, uint32_t tcp_flags, double probability) { Filter* f = new Filter; f->tcp_flags = tcp_flags; @@ -41,7 +41,7 @@ void PacketFilter::AddDst(const IPAddr& dst, uint32_t tcp_flags, double probabil delete prev; } -void PacketFilter::AddDst(Val* dst, uint32_t tcp_flags, double probability) +void PacketFilter::AddDst(zeek::Val* dst, uint32_t tcp_flags, double probability) { Filter* f = new Filter; f->tcp_flags = tcp_flags; @@ -57,7 +57,7 @@ bool PacketFilter::RemoveSrc(const IPAddr& src) return f != nullptr; } -bool PacketFilter::RemoveSrc(Val* src) +bool PacketFilter::RemoveSrc(zeek::Val* src) { auto f = static_cast(src_filter.Remove(src)); delete f; @@ -71,7 +71,7 @@ bool PacketFilter::RemoveDst(const IPAddr& dst) return f != nullptr; } -bool PacketFilter::RemoveDst(Val* dst) +bool PacketFilter::RemoveDst(zeek::Val* dst) { auto f = static_cast(dst_filter.Remove(dst)); delete f; diff --git a/src/PacketFilter.h b/src/PacketFilter.h index 4729a4cd5e..a485b604e8 100644 --- a/src/PacketFilter.h +++ b/src/PacketFilter.h @@ -6,7 +6,7 @@ #include "PrefixTable.h" class IP_Hdr; -class Val; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); class PacketFilter { public: @@ -17,16 +17,16 @@ public: // as an AddrVal or a SubnetVal) which hasn't any of TCP flags set // (TH_*) with the given probability (from 0..MAX_PROB). void AddSrc(const IPAddr& src, uint32_t tcp_flags, double probability); - void AddSrc(Val* src, uint32_t tcp_flags, double probability); + void AddSrc(zeek::Val* src, uint32_t tcp_flags, double probability); void AddDst(const IPAddr& src, uint32_t tcp_flags, double probability); - void AddDst(Val* src, uint32_t tcp_flags, double probability); + void AddDst(zeek::Val* src, uint32_t tcp_flags, double probability); // Removes the filter entry for the given src/dst // Returns false if filter doesn not exist. bool RemoveSrc(const IPAddr& src); - bool RemoveSrc(Val* dst); + bool RemoveSrc(zeek::Val* dst); bool RemoveDst(const IPAddr& dst); - bool RemoveDst(Val* dst); + bool RemoveDst(zeek::Val* dst); // Returns true if packet matches a drop filter bool Match(const IP_Hdr* ip, int len, int caplen); diff --git a/src/PrefixTable.cc b/src/PrefixTable.cc index 2ee59a2bf0..d3a481352c 100644 --- a/src/PrefixTable.cc +++ b/src/PrefixTable.cc @@ -40,7 +40,7 @@ void* PrefixTable::Insert(const IPAddr& addr, int width, void* data) return old; } -void* PrefixTable::Insert(const Val* value, void* data) +void* PrefixTable::Insert(const zeek::Val* value, void* data) { // [elem] -> elem if ( value->GetType()->Tag() == zeek::TYPE_LIST && @@ -81,7 +81,7 @@ std::list> PrefixTable::FindAll(const IPAddr& addr, i return out; } -std::list> PrefixTable::FindAll(const SubNetVal* value) const +std::list> PrefixTable::FindAll(const zeek::SubNetVal* value) const { return FindAll(value->AsSubNet().Prefix(), value->AsSubNet().LengthIPv6()); } @@ -100,7 +100,7 @@ void* PrefixTable::Lookup(const IPAddr& addr, int width, bool exact) const return node ? node->data : nullptr; } -void* PrefixTable::Lookup(const Val* value, bool exact) const +void* PrefixTable::Lookup(const zeek::Val* value, bool exact) const { // [elem] -> elem if ( value->GetType()->Tag() == zeek::TYPE_LIST && @@ -139,7 +139,7 @@ void* PrefixTable::Remove(const IPAddr& addr, int width) return old; } -void* PrefixTable::Remove(const Val* value) +void* PrefixTable::Remove(const zeek::Val* value) { // [elem] -> elem if ( value->GetType()->Tag() == zeek::TYPE_LIST && diff --git a/src/PrefixTable.h b/src/PrefixTable.h index 7d1bb96645..51b75d5456 100644 --- a/src/PrefixTable.h +++ b/src/PrefixTable.h @@ -8,8 +8,8 @@ extern "C" { #include "IPAddr.h" -class Val; -class SubNetVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(SubNetVal, zeek); class PrefixTable { private: @@ -30,21 +30,21 @@ public: void* Insert(const IPAddr& addr, int width, void* data = nullptr); // Value may be addr or subnet. - void* Insert(const Val* value, void* data = nullptr); + void* Insert(const zeek::Val* value, void* data = nullptr); // Returns nil if not found, pointer to data otherwise. // For items without data, returns non-nil if found. // If exact is false, performs exact rather than longest-prefix match. void* Lookup(const IPAddr& addr, int width, bool exact = false) const; - void* Lookup(const Val* value, bool exact = false) const; + void* Lookup(const zeek::Val* value, bool exact = false) const; // Returns list of all found matches or empty list otherwise. std::list> FindAll(const IPAddr& addr, int width) const; - std::list> FindAll(const SubNetVal* value) const; + std::list> FindAll(const zeek::SubNetVal* value) const; // Returns pointer to data or nil if not found. void* Remove(const IPAddr& addr, int width); - void* Remove(const Val* value); + void* Remove(const zeek::Val* value); void Clear() { Clear_Patricia(tree, delete_function); } diff --git a/src/RandTest.h b/src/RandTest.h index a030008eeb..fe6b871327 100644 --- a/src/RandTest.h +++ b/src/RandTest.h @@ -1,30 +1,31 @@ #pragma once +#include "zeek-config.h" #include #define RT_MONTEN 6 /* Bytes used as Monte Carlo co-ordinates. This should be no more bits than the mantissa of your "double" floating point type. */ -class EntropyVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(EntropyVal, zeek); class RandTest { - public: - RandTest(); - void add(const void* buf, int bufl); - void end(double* r_ent, double* r_chisq, double* r_mean, - double* r_montepicalc, double* r_scc); +public: + RandTest(); + void add(const void* buf, int bufl); + void end(double* r_ent, double* r_chisq, double* r_mean, + double* r_montepicalc, double* r_scc); - private: - friend class EntropyVal; +private: + friend class zeek::EntropyVal; - int64_t ccount[256]; /* Bins to count occurrences of values */ - int64_t totalc; /* Total bytes counted */ - int mp; - int sccfirst; - unsigned int monte[RT_MONTEN]; - int64_t inmont, mcount; - double cexp, montex, montey, montepi, - sccu0, scclast, scct1, scct2, scct3; + int64_t ccount[256]; /* Bins to count occurrences of values */ + int64_t totalc; /* Total bytes counted */ + int mp; + int sccfirst; + unsigned int monte[RT_MONTEN]; + int64_t inmont, mcount; + double cexp, montex, montey, montepi, + sccu0, scclast, scct1, scct2, scct3; }; diff --git a/src/Reporter.cc b/src/Reporter.cc index 0cfdbb6e62..8511f6c02a 100644 --- a/src/Reporter.cc +++ b/src/Reporter.cc @@ -74,7 +74,7 @@ void Reporter::InitOptions() HashKey* k; IterCookie* c = wl_table->InitForIteration(); - TableEntryVal* v; + zeek::TableEntryVal* v; while ( (v = wl_table->NextEntry(k, c)) ) { @@ -345,7 +345,7 @@ bool Reporter::PermitFlowWeird(const char* name, return false; } -bool Reporter::PermitExpiredConnWeird(const char* name, const RecordVal& conn_id) +bool Reporter::PermitExpiredConnWeird(const char* name, const zeek::RecordVal& conn_id) { auto conn_tuple = std::make_tuple(conn_id.GetField("orig_h")->AsAddr(), conn_id.GetField("resp_h")->AsAddr(), @@ -384,7 +384,7 @@ void Reporter::Weird(const char* name, const char* addl) return; } - WeirdHelper(net_weird, {new StringVal(addl)}, "%s", name); + WeirdHelper(net_weird, {new zeek::StringVal(addl)}, "%s", name); } void Reporter::Weird(file_analysis::File* f, const char* name, const char* addl) @@ -398,7 +398,7 @@ void Reporter::Weird(file_analysis::File* f, const char* name, const char* addl) return; } - WeirdHelper(file_weird, {f->ToVal()->Ref(), new StringVal(addl)}, + WeirdHelper(file_weird, {f->ToVal()->Ref(), new zeek::StringVal(addl)}, "%s", name); } @@ -413,11 +413,11 @@ void Reporter::Weird(Connection* conn, const char* name, const char* addl) return; } - WeirdHelper(conn_weird, {conn->ConnVal()->Ref(), new StringVal(addl)}, + WeirdHelper(conn_weird, {conn->ConnVal()->Ref(), new zeek::StringVal(addl)}, "%s", name); } -void Reporter::Weird(RecordValPtr conn_id, StringValPtr uid, +void Reporter::Weird(zeek::RecordValPtr conn_id, zeek::StringValPtr uid, const char* name, const char* addl) { UpdateWeirdStats(name); @@ -429,7 +429,7 @@ void Reporter::Weird(RecordValPtr conn_id, StringValPtr uid, } WeirdHelper(expired_conn_weird, - {conn_id.release(), uid.release(), new StringVal(addl)}, + {conn_id.release(), uid.release(), new zeek::StringVal(addl)}, "%s", name); } @@ -444,7 +444,7 @@ void Reporter::Weird(const IPAddr& orig, const IPAddr& resp, const char* name, c } WeirdHelper(flow_weird, - {new AddrVal(orig), new AddrVal(resp), new StringVal(addl)}, + {new zeek::AddrVal(orig), new zeek::AddrVal(resp), new zeek::StringVal(addl)}, "%s", name); } @@ -558,12 +558,12 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out, vl.reserve(vl_size); if ( time ) - vl.emplace_back(zeek::make_intrusive(network_time ? network_time : current_time())); + vl.emplace_back(zeek::make_intrusive(network_time ? network_time : current_time())); - vl.emplace_back(zeek::make_intrusive(buffer)); + vl.emplace_back(zeek::make_intrusive(buffer)); if ( location ) - vl.emplace_back(zeek::make_intrusive(loc_str.c_str())); + vl.emplace_back(zeek::make_intrusive(loc_str.c_str())); if ( conn ) vl.emplace_back(conn->ConnVal()); diff --git a/src/Reporter.h b/src/Reporter.h index 080b96ba74..4aab22604f 100644 --- a/src/Reporter.h +++ b/src/Reporter.h @@ -21,15 +21,14 @@ class Connection; class Location; class Reporter; class EventHandlerPtr; -class RecordVal; -class StringVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek); namespace zeek { template class IntrusivePtr; -} - using RecordValPtr = zeek::IntrusivePtr; using StringValPtr = zeek::IntrusivePtr; +} // One cannot raise this exception directly, go through the // Reporter's methods instead. @@ -102,7 +101,7 @@ public: void Weird(const char* name, const char* addl = ""); // Raises net_weird(). void Weird(file_analysis::File* f, const char* name, const char* addl = ""); // Raises file_weird(). void Weird(Connection* conn, const char* name, const char* addl = ""); // Raises conn_weird(). - void Weird(RecordValPtr conn_id, StringValPtr uid, + void Weird(zeek::RecordValPtr conn_id, zeek::StringValPtr uid, const char* name, const char* addl = ""); // Raises expired_conn_weird(). void Weird(const IPAddr& orig, const IPAddr& resp, const char* name, const char* addl = ""); // Raises flow_weird(). @@ -275,7 +274,7 @@ private: { return weird_sampling_whitelist.find(name) != weird_sampling_whitelist.end(); } bool PermitNetWeird(const char* name); bool PermitFlowWeird(const char* name, const IPAddr& o, const IPAddr& r); - bool PermitExpiredConnWeird(const char* name, const RecordVal& conn_id); + bool PermitExpiredConnWeird(const char* name, const zeek::RecordVal& conn_id); bool EmitToStderr(bool flag) { return flag || ! after_zeek_init; } diff --git a/src/RuleAction.cc b/src/RuleAction.cc index fdca6f3472..680e5843e2 100644 --- a/src/RuleAction.cc +++ b/src/RuleAction.cc @@ -23,8 +23,8 @@ void RuleActionEvent::DoAction(const Rule* parent, RuleEndpointState* state, if ( signature_match ) mgr.Enqueue(signature_match, zeek::IntrusivePtr{zeek::AdoptRef{}, rule_matcher->BuildRuleStateValue(parent, state)}, - zeek::make_intrusive(msg), - data ? zeek::make_intrusive(len, (const char*)data) : val_mgr->EmptyString() + zeek::make_intrusive(msg), + data ? zeek::make_intrusive(len, (const char*)data) : val_mgr->EmptyString() ); } diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc index a0f86194e4..f961620deb 100644 --- a/src/RuleCondition.cc +++ b/src/RuleCondition.cc @@ -173,7 +173,7 @@ bool RuleConditionEval::DoMatch(Rule* rule, RuleEndpointState* state, args.emplace_back(zeek::AdoptRef{}, rule_matcher->BuildRuleStateValue(rule, state)); if ( data ) - args.emplace_back(zeek::make_intrusive(len, (const char*) data)); + args.emplace_back(zeek::make_intrusive(len, (const char*) data)); else args.emplace_back(val_mgr->EmptyString()); diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc index ef0d9218d0..eec90eb769 100644 --- a/src/RuleMatcher.cc +++ b/src/RuleMatcher.cc @@ -78,12 +78,12 @@ RuleHdrTest::RuleHdrTest(Prot arg_prot, Comp arg_comp, vector arg_v) level = 0; } -Val* RuleMatcher::BuildRuleStateValue(const Rule* rule, - const RuleEndpointState* state) const +zeek::Val* RuleMatcher::BuildRuleStateValue(const Rule* rule, + const RuleEndpointState* state) const { static auto signature_state = zeek::id::find_type("signature_state"); - RecordVal* val = new RecordVal(signature_state); - val->Assign(0, zeek::make_intrusive(rule->ID())); + auto* val = new zeek::RecordVal(signature_state); + val->Assign(0, zeek::make_intrusive(rule->ID())); val->Assign(1, state->GetAnalyzer()->ConnVal()); val->Assign(2, val_mgr->Bool(state->is_orig)); val->Assign(3, val_mgr->Count(state->payload_size)); @@ -1272,7 +1272,7 @@ void RuleMatcher::DumpStateStats(BroFile* f, RuleHdrTest* hdr_test) DumpStateStats(f, h); } -static Val* get_bro_val(const char* label) +static zeek::Val* get_bro_val(const char* label) { auto id = lookup_ID(label, GLOBAL_MODULE_NAME, false); if ( ! id ) @@ -1288,7 +1288,7 @@ static Val* get_bro_val(const char* label) // Converts an atomic Val and appends it to the list. For subnet types, // if the prefix_vector param isn't null, appending to that is preferred // over appending to the masked val list. -static bool val_to_maskedval(Val* v, maskedvalue_list* append_to, +static bool val_to_maskedval(zeek::Val* v, maskedvalue_list* append_to, vector* prefix_vector) { MaskedValue* mval = new MaskedValue; @@ -1358,7 +1358,7 @@ static bool val_to_maskedval(Val* v, maskedvalue_list* append_to, void id_to_maskedvallist(const char* id, maskedvalue_list* append_to, vector* prefix_vector) { - Val* v = get_bro_val(id); + zeek::Val* v = get_bro_val(id); if ( ! v ) return; @@ -1380,7 +1380,7 @@ char* id_to_str(const char* id) const BroString* src; char* dst; - Val* v = get_bro_val(id); + zeek::Val* v = get_bro_val(id); if ( ! v ) goto error; @@ -1403,7 +1403,7 @@ error: uint32_t id_to_uint(const char* id) { - Val* v = get_bro_val(id); + zeek::Val* v = get_bro_val(id); if ( ! v ) return 0; diff --git a/src/RuleMatcher.h b/src/RuleMatcher.h index 8e644a2aa0..7c5e062cae 100644 --- a/src/RuleMatcher.h +++ b/src/RuleMatcher.h @@ -27,7 +27,6 @@ extern FILE* rules_in; extern int rules_line_number; extern const char* current_rule_file; -class Val; class BroFile; class IntSet; class IP_Hdr; @@ -37,6 +36,8 @@ class Specific_RE_Matcher; class RuleMatcher; extern RuleMatcher* rule_matcher; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); + namespace analyzer { namespace pia { class PIA; } class Analyzer; @@ -304,8 +305,8 @@ public: unsigned int misses; // # cache misses }; - Val* BuildRuleStateValue(const Rule* rule, - const RuleEndpointState* state) const; + zeek::Val* BuildRuleStateValue(const Rule* rule, + const RuleEndpointState* state) const; void GetStats(Stats* stats, RuleHdrTest* hdr_test = nullptr); void DumpStats(BroFile* f); diff --git a/src/Scope.h b/src/Scope.h index 8fb5c9bff7..cdd7175aa1 100644 --- a/src/Scope.h +++ b/src/Scope.h @@ -12,9 +12,10 @@ #include "IntrusivePtr.h" #include "TraverseTypes.h" -template class IntrusivePtr; namespace zeek { + template class IntrusivePtr; + class Type; using TypePtr = zeek::IntrusivePtr; } diff --git a/src/Sessions.cc b/src/Sessions.cc index f55bf4452f..ec571f4bff 100644 --- a/src/Sessions.cc +++ b/src/Sessions.cc @@ -703,7 +703,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr conn->CheckFlowLabel(is_orig, ip_hdr->FlowLabel()); - ValPtr pkt_hdr_val; + zeek::ValPtr pkt_hdr_val; if ( ipv6_ext_headers && ip_hdr->NumHeaders() > 1 ) { @@ -920,7 +920,7 @@ FragReassembler* NetSessions::NextFragment(double t, const IP_Hdr* ip, return f; } -Connection* NetSessions::FindConnection(Val* v) +Connection* NetSessions::FindConnection(zeek::Val* v) { const auto& vt = v->GetType(); if ( ! zeek::IsRecord(vt->Tag()) ) @@ -958,8 +958,8 @@ Connection* NetSessions::FindConnection(Val* v) const IPAddr& orig_addr = (*vl)[orig_h]->AsAddr(); const IPAddr& resp_addr = (*vl)[resp_h]->AsAddr(); - PortVal* orig_portv = (*vl)[orig_p]->AsPortVal(); - PortVal* resp_portv = (*vl)[resp_p]->AsPortVal(); + zeek::PortVal* orig_portv = (*vl)[orig_p]->AsPortVal(); + zeek::PortVal* resp_portv = (*vl)[resp_p]->AsPortVal(); ConnID id; @@ -1236,7 +1236,7 @@ bool NetSessions::IsLikelyServerPort(uint32_t port, TransportProto proto) const if ( ! have_cache ) { - auto likely_server_ports = zeek::id::find_val("likely_server_ports"); + auto likely_server_ports = zeek::id::find_val("likely_server_ports"); auto lv = likely_server_ports->ToPureListVal(); for ( int i = 0; i < lv->Length(); i++ ) port_cache.insert(lv->Idx(i)->InternalUnsigned()); diff --git a/src/Sessions.h b/src/Sessions.h index d5edf62291..e128a1719a 100644 --- a/src/Sessions.h +++ b/src/Sessions.h @@ -61,7 +61,7 @@ public: // Looks up the connection referred to by the given Val, // which should be a conn_id record. Returns nil if there's // no such connection or the Val is ill-formed. - Connection* FindConnection(Val* v); + Connection* FindConnection(zeek::Val* v); void Remove(Connection* c); void Remove(FragReassembler* f); diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc index 0157c28470..950339ad63 100644 --- a/src/SmithWaterman.cc +++ b/src/SmithWaterman.cc @@ -56,14 +56,14 @@ bool BroSubstring::DoesCover(const BroSubstring* bst) const return true; } -VectorVal* BroSubstring::VecToPolicy(Vec* vec) +zeek::VectorVal* BroSubstring::VecToPolicy(Vec* vec) { static auto sw_substring_type = zeek::id::find_type("sw_substring"); static auto sw_align_type = zeek::id::find_type("sw_align"); static auto sw_align_vec_type = zeek::id::find_type("sw_align_vec"); static auto sw_substring_vec_type = zeek::id::find_type("sw_substring_vec"); - auto result = zeek::make_intrusive(sw_substring_vec_type); + auto result = zeek::make_intrusive(sw_substring_vec_type); if ( vec ) { @@ -71,17 +71,17 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec) { BroSubstring* bst = (*vec)[i]; - auto st_val = zeek::make_intrusive(sw_substring_type); - st_val->Assign(0, zeek::make_intrusive(new BroString(*bst))); + auto st_val = zeek::make_intrusive(sw_substring_type); + st_val->Assign(0, zeek::make_intrusive(new BroString(*bst))); - auto aligns = zeek::make_intrusive(sw_align_vec_type); + auto aligns = zeek::make_intrusive(sw_align_vec_type); for ( unsigned int j = 0; j < bst->GetNumAlignments(); ++j ) { const BSSAlign& align = (bst->GetAlignments())[j]; - auto align_val = zeek::make_intrusive(sw_align_type); - align_val->Assign(0, zeek::make_intrusive(new BroString(*align.string))); + auto align_val = zeek::make_intrusive(sw_align_type); + align_val->Assign(0, zeek::make_intrusive(new BroString(*align.string))); align_val->Assign(1, val_mgr->Count(align.index)); aligns->Assign(j + 1, std::move(align_val)); @@ -96,7 +96,7 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec) return result.release(); } -BroSubstring::Vec* BroSubstring::VecFromPolicy(VectorVal* vec) +BroSubstring::Vec* BroSubstring::VecFromPolicy(zeek::VectorVal* vec) { Vec* result = new Vec(); @@ -110,10 +110,10 @@ BroSubstring::Vec* BroSubstring::VecFromPolicy(VectorVal* vec) const BroString* str = v->AsRecordVal()->GetField(0)->AsString(); BroSubstring* substr = new BroSubstring(*str); - const VectorVal* aligns = v->AsRecordVal()->GetField(1)->AsVectorVal(); + const zeek::VectorVal* aligns = v->AsRecordVal()->GetField(1)->AsVectorVal(); for ( unsigned int j = 1; j <= aligns->Size(); ++j ) { - const RecordVal* align = aligns->AsVectorVal()->At(j)->AsRecordVal(); + const zeek::RecordVal* align = aligns->AsVectorVal()->At(j)->AsRecordVal(); const BroString* str = align->GetField(0)->AsString(); int index = align->GetField(1)->AsCount(); substr->AddAlignment(str, index); diff --git a/src/SmithWaterman.h b/src/SmithWaterman.h index 3d29eb15a3..5df26d62e2 100644 --- a/src/SmithWaterman.h +++ b/src/SmithWaterman.h @@ -68,11 +68,11 @@ public: // Helper methods for vectors: // - static VectorVal* VecToPolicy(Vec* vec); - static Vec* VecFromPolicy(VectorVal* vec); + static zeek::VectorVal* VecToPolicy(Vec* vec); + static Vec* VecFromPolicy(zeek::VectorVal* vec); static char* VecToString(Vec* vec); static BroString::IdxVec* GetOffsetsVec(const Vec* vec, - unsigned int index); + unsigned int index); private: typedef std::map DataMap; diff --git a/src/Stats.cc b/src/Stats.cc index c9dfa5918b..599f3bc4d9 100644 --- a/src/Stats.cc +++ b/src/Stats.cc @@ -313,7 +313,7 @@ void ProfileLogger::Log() if ( profiling_update ) { mgr.Dispatch(new Event(profiling_update, { - zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, file}), + zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, file}), val_mgr->Bool(expensive), })); } @@ -344,7 +344,7 @@ SampleLogger::SampleLogger() if ( ! load_sample_info ) load_sample_info = zeek::id::find_type("load_sample_info")->AsTableType(); - load_samples = new TableVal({zeek::NewRef{}, load_sample_info}); + load_samples = new zeek::TableVal({zeek::NewRef{}, load_sample_info}); } SampleLogger::~SampleLogger() @@ -354,13 +354,13 @@ SampleLogger::~SampleLogger() void SampleLogger::FunctionSeen(const Func* func) { - auto idx = zeek::make_intrusive(func->Name()); + auto idx = zeek::make_intrusive(func->Name()); load_samples->Assign(std::move(idx), nullptr); } void SampleLogger::LocationSeen(const Location* loc) { - auto idx = zeek::make_intrusive(loc->filename); + auto idx = zeek::make_intrusive(loc->filename); load_samples->Assign(std::move(idx), nullptr); } @@ -371,7 +371,7 @@ void SampleLogger::SegmentProfile(const char* /* name */, if ( load_sample ) mgr.Enqueue(load_sample, zeek::IntrusivePtr{zeek::NewRef{}, load_samples}, - zeek::make_intrusive(dtime, Seconds), + zeek::make_intrusive(dtime, Seconds), val_mgr->Int(dmem) ); } diff --git a/src/Stats.h b/src/Stats.h index e2691968de..0eb52c934e 100644 --- a/src/Stats.h +++ b/src/Stats.h @@ -2,16 +2,19 @@ #pragma once +#include "zeek-config.h" + #include #include #include #include class Func; -class TableVal; class Location; class BroFile; +ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek); + // Object called by SegmentProfiler when it is done and reports its // cumulative CPU/memory statistics. class SegmentStatsReporter { @@ -98,7 +101,7 @@ protected: void SegmentProfile(const char* name, const Location* loc, double dtime, int dmem) override; - TableVal* load_samples; + zeek::TableVal* load_samples; }; diff --git a/src/Stmt.cc b/src/Stmt.cc index 42fc8f4db8..ec6771ceb1 100644 --- a/src/Stmt.cc +++ b/src/Stmt.cc @@ -205,17 +205,17 @@ static void print_log(const std::vector& vals) { static auto plval = lookup_enum_val("Log", "PRINTLOG"); static auto lpli = zeek::id::find_type("Log::PrintLogInfo"); - auto record = zeek::make_intrusive(lpli); - auto vec = zeek::make_intrusive(zeek::id::string_vec); + auto record = zeek::make_intrusive(lpli); + auto vec = zeek::make_intrusive(zeek::id::string_vec); for ( const auto& val : vals ) { ODesc d(DESC_READABLE); val->Describe(&d); - vec->Assign(vec->Size(), zeek::make_intrusive(d.Description())); + vec->Assign(vec->Size(), zeek::make_intrusive(d.Description())); } - record->Assign(0, zeek::make_intrusive(network_time)); + record->Assign(0, zeek::make_intrusive(network_time)); record->Assign(1, std::move(vec)); log_mgr->Write(plval.get(), record.get()); } @@ -1181,7 +1181,7 @@ ValPtr ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const if ( v->GetType()->Tag() == TYPE_TABLE ) { TableVal* tv = v->AsTableVal(); - const PDict* loop_vals = tv->AsTable(); + const PDict* loop_vals = tv->AsTable(); if ( ! loop_vals->Length() ) return nullptr; @@ -1248,7 +1248,7 @@ ValPtr ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const for ( int i = 0; i < sval->Len(); ++i ) { - auto sv = zeek::make_intrusive(1, (const char*) sval->Bytes() + i); + auto sv = zeek::make_intrusive(1, (const char*) sval->Bytes() + i); f->SetElement((*loop_vars)[0], std::move(sv)); flow = FLOW_NEXT; ret = body->Exec(f, flow); @@ -1654,14 +1654,14 @@ ValPtr InitStmt::Exec(Frame* f, stmt_flow_type& flow) const switch ( t->Tag() ) { case TYPE_RECORD: - v = zeek::make_intrusive(zeek::cast_intrusive(t)); + v = zeek::make_intrusive(zeek::cast_intrusive(t)); break; case TYPE_VECTOR: - v = zeek::make_intrusive(zeek::cast_intrusive(t)); + v = zeek::make_intrusive(zeek::cast_intrusive(t)); break; case TYPE_TABLE: - v = zeek::make_intrusive(zeek::cast_intrusive(t), - aggr->GetAttrs()); + v = zeek::make_intrusive(zeek::cast_intrusive(t), + aggr->GetAttrs()); break; default: break; diff --git a/src/Tag.cc b/src/Tag.cc index aa3d977831..315c7fc558 100644 --- a/src/Tag.cc +++ b/src/Tag.cc @@ -17,7 +17,7 @@ Tag::Tag(zeek::EnumType* etype, type_t arg_type, subtype_t arg_subtype) : Tag({zeek::NewRef{}, etype}, arg_type, arg_subtype) { } -Tag::Tag(EnumValPtr arg_val) +Tag::Tag(zeek::EnumValPtr arg_val) { assert(arg_val); @@ -28,7 +28,7 @@ Tag::Tag(EnumValPtr arg_val) subtype = (i >> 31) & 0xffffffff; } -Tag::Tag(EnumVal* arg_val) +Tag::Tag(zeek::EnumVal* arg_val) : Tag({zeek::NewRef{}, arg_val}) { } @@ -72,7 +72,7 @@ Tag& Tag::operator=(const Tag&& other) noexcept return *this; } -const EnumValPtr& Tag::AsVal(const zeek::EnumTypePtr& etype) const +const zeek::EnumValPtr& Tag::AsVal(const zeek::EnumTypePtr& etype) const { if ( ! val ) { @@ -83,7 +83,7 @@ const EnumValPtr& Tag::AsVal(const zeek::EnumTypePtr& etype) const return val; } -EnumVal* Tag::AsEnumVal(zeek::EnumType* etype) const +zeek::EnumVal* Tag::AsEnumVal(zeek::EnumType* etype) const { return AsVal({zeek::NewRef{}, etype}).get(); } diff --git a/src/Tag.h b/src/Tag.h index 31064c8aaf..bccc85a6cd 100644 --- a/src/Tag.h +++ b/src/Tag.h @@ -10,12 +10,12 @@ #include "IntrusivePtr.h" #include "util.h" -class EnumVal; -using EnumValPtr = zeek::IntrusivePtr; - +ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(EnumType, zeek); + namespace zeek { using EnumTypePtr = zeek::IntrusivePtr; +using EnumValPtr = zeek::IntrusivePtr; } /** @@ -121,10 +121,10 @@ protected: * * @param etype the script-layer enum type associated with the tag. */ - const EnumValPtr& AsVal(const zeek::EnumTypePtr& etype) const; + const zeek::EnumValPtr& AsVal(const zeek::EnumTypePtr& etype) const; [[deprecated("Remove in v4.1. Use AsVal() instead.")]] - EnumVal* AsEnumVal(zeek::EnumType* etype) const; + zeek::EnumVal* AsEnumVal(zeek::EnumType* etype) const; /** * Constructor. @@ -147,13 +147,13 @@ protected: * * @param val An enum value of script type \c Analyzer::Tag. */ - explicit Tag(EnumValPtr val); + explicit Tag(zeek::EnumValPtr val); [[deprecated("Remove in v4.1. Construct from zeek::IntrusivePtr instead.")]] - explicit Tag(EnumVal* val); + explicit Tag(zeek::EnumVal* val); private: type_t type; // Main type. subtype_t subtype; // Subtype. - mutable EnumValPtr val; // Script-layer value. + mutable zeek::EnumValPtr val; // Script-layer value. }; diff --git a/src/Trigger.h b/src/Trigger.h index cc24c3a6d5..a904832e83 100644 --- a/src/Trigger.h +++ b/src/Trigger.h @@ -11,9 +11,9 @@ #include "IntrusivePtr.h" class Frame; -class Val; class ODesc; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(CallExpr, zeek::detail); diff --git a/src/TunnelEncapsulation.cc b/src/TunnelEncapsulation.cc index dc86ba890c..16e19d7f48 100644 --- a/src/TunnelEncapsulation.cc +++ b/src/TunnelEncapsulation.cc @@ -16,19 +16,19 @@ EncapsulatingConn::EncapsulatingConn(Connection* c, BifEnum::Tunnel::Type t) } } -RecordValPtr EncapsulatingConn::ToVal() const +zeek::RecordValPtr EncapsulatingConn::ToVal() const { - auto rv = zeek::make_intrusive(zeek::BifType::Record::Tunnel::EncapsulatingConn); + auto rv = zeek::make_intrusive(zeek::BifType::Record::Tunnel::EncapsulatingConn); - auto id_val = zeek::make_intrusive(zeek::id::conn_id); - id_val->Assign(0, zeek::make_intrusive(src_addr)); + auto id_val = zeek::make_intrusive(zeek::id::conn_id); + id_val->Assign(0, zeek::make_intrusive(src_addr)); id_val->Assign(1, val_mgr->Port(ntohs(src_port), proto)); - id_val->Assign(2, zeek::make_intrusive(dst_addr)); + id_val->Assign(2, zeek::make_intrusive(dst_addr)); id_val->Assign(3, val_mgr->Port(ntohs(dst_port), proto)); rv->Assign(0, std::move(id_val)); rv->Assign(1, zeek::BifType::Enum::Tunnel::Type->GetVal(type)); - rv->Assign(2, zeek::make_intrusive(uid.Base62("C").c_str())); + rv->Assign(2, zeek::make_intrusive(uid.Base62("C").c_str())); return rv; } diff --git a/src/TunnelEncapsulation.h b/src/TunnelEncapsulation.h index 7375b7490d..13f6da8ef4 100644 --- a/src/TunnelEncapsulation.h +++ b/src/TunnelEncapsulation.h @@ -80,10 +80,10 @@ public: /** * Returns record value of type "EncapsulatingConn" representing the tunnel. */ - RecordValPtr ToVal() const; + zeek::RecordValPtr ToVal() const; [[deprecated("Remove in v4.1. Use ToVal() instead.")]] - RecordVal* GetRecordVal() const + zeek::RecordVal* GetRecordVal() const { return ToVal().release(); } friend bool operator==(const EncapsulatingConn& ec1, @@ -195,9 +195,9 @@ public: * Get the value of type "EncapsulatingConnVector" represented by the * entire encapsulation chain. */ - VectorValPtr ToVal() const + zeek::VectorValPtr ToVal() const { - auto vv = zeek::make_intrusive( + auto vv = zeek::make_intrusive( zeek::id::find_type("EncapsulatingConnVector")); if ( conns ) @@ -210,7 +210,7 @@ public: } [[deprecated("Remove in v4.1. Use ToVal() instead.")]] - VectorVal* GetVectorVal() const + zeek::VectorVal* GetVectorVal() const { return ToVal().release(); } friend bool operator==(const EncapsulationStack& e1, diff --git a/src/Type.cc b/src/Type.cc index 0ebc558fd0..ad8a9186e4 100644 --- a/src/Type.cc +++ b/src/Type.cc @@ -797,7 +797,7 @@ TableValPtr RecordType::GetRecordFieldsVal(const RecordVal* rv) const { static auto record_field = zeek::id::find_type("record_field"); static auto record_field_table = zeek::id::find_type("record_field_table"); - auto rval = zeek::make_intrusive(record_field_table); + auto rval = zeek::make_intrusive(record_field_table); for ( int i = 0; i < NumFields(); ++i ) { @@ -810,14 +810,14 @@ TableValPtr RecordType::GetRecordFieldsVal(const RecordVal* rv) const bool logged = (fd->attrs && fd->GetAttr(zeek::detail::ATTR_LOG) != nullptr); - auto nr = zeek::make_intrusive(record_field); + auto nr = zeek::make_intrusive(record_field); string s = container_type_name(ft.get()); - nr->Assign(0, zeek::make_intrusive(s)); + nr->Assign(0, zeek::make_intrusive(s)); nr->Assign(1, val_mgr->Bool(logged)); nr->Assign(2, std::move(fv)); nr->Assign(3, FieldDefault(i)); - auto field_name = zeek::make_intrusive(FieldName(i)); + auto field_name = zeek::make_intrusive(FieldName(i)); rval->Assign(std::move(field_name), std::move(nr)); } @@ -1163,7 +1163,7 @@ void EnumType::CheckAndAddName(const string& module_name, const char* name, AddNameInternal(module_name, name, val, is_export); if ( vals.find(val) == vals.end() ) - vals[val] = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, this}, val); + vals[val] = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, this}, val); set types = Type::GetAliases(GetName()); set::const_iterator it; @@ -1218,7 +1218,7 @@ const EnumValPtr& EnumType::GetVal(bro_int_t i) if ( it == vals.end() ) { - auto ev = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, this}, i); + auto ev = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, this}, i); return vals.emplace(i, std::move(ev)).first->second; } diff --git a/src/Type.h b/src/Type.h index d6da7b9b38..6fa0d5816a 100644 --- a/src/Type.h +++ b/src/Type.h @@ -14,21 +14,22 @@ #include #include -class Val; -class EnumVal; -class TableVal; - -using ValPtr = zeek::IntrusivePtr; -using EnumValPtr = zeek::IntrusivePtr; -using TableValPtr = zeek::IntrusivePtr; - +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(ListExpr, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(Attributes, zeek::detail); -namespace zeek::detail { +namespace zeek { +using ValPtr = zeek::IntrusivePtr; +using EnumValPtr = zeek::IntrusivePtr; +using TableValPtr = zeek::IntrusivePtr; + +namespace detail { using ListExprPtr = zeek::IntrusivePtr; } +} namespace zeek { @@ -671,7 +672,7 @@ public: zeek::IntrusivePtr GetFieldType(int field_index) const { return zeek::cast_intrusive((*types)[field_index]->type); } - ValPtr FieldDefault(int field) const; + zeek::ValPtr FieldDefault(int field) const; // A field's offset is its position in the type_decl_list, // starting at 0. Returns negative if the field doesn't exist. @@ -693,7 +694,7 @@ public: * @param rv an optional record value, if given the values of * all fields will be provided in the returned table. */ - TableValPtr GetRecordFieldsVal(const RecordVal* rv = nullptr) const; + zeek::TableValPtr GetRecordFieldsVal(const zeek::RecordVal* rv = nullptr) const; // Returns null if all is ok, otherwise a pointer to an error message. const char* AddFields(const type_decl_list& types, @@ -791,7 +792,7 @@ public: void DescribeReST(ODesc* d, bool roles_only = false) const override; - const EnumValPtr& GetVal(bro_int_t i); + const zeek::EnumValPtr& GetVal(bro_int_t i); protected: void AddNameInternal(const std::string& module_name, @@ -804,7 +805,7 @@ protected: typedef std::map NameMap; NameMap names; - using ValMap = std::unordered_map; + using ValMap = std::unordered_map; ValMap vals; // The counter is initialized to 0 and incremented on every implicit diff --git a/src/Val.cc b/src/Val.cc index f30fe361b0..8dce7fd022 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -42,39 +42,41 @@ using namespace std; -Val::Val(Func* f) : Val({zeek::NewRef{}, f}) +namespace zeek { + +Val::Val(Func* f) : Val({NewRef{}, f}) {} Val::Val(FuncPtr f) : val(f.release()), type(val.func_val->GetType()) {} -static const zeek::FileTypePtr& GetStringFileType() noexcept +static const FileTypePtr& GetStringFileType() noexcept { static auto string_file_type - = zeek::make_intrusive(zeek::base_type(zeek::TYPE_STRING)); + = make_intrusive(base_type(TYPE_STRING)); return string_file_type; } -Val::Val(BroFile* f) : Val({zeek::AdoptRef{}, f}) +Val::Val(BroFile* f) : Val({AdoptRef{}, f}) {} Val::Val(BroFilePtr f) : val(f.release()), type(GetStringFileType()) { - assert(val.file_val->GetType()->Tag() == zeek::TYPE_STRING); + assert(val.file_val->GetType()->Tag() == TYPE_STRING); } Val::~Val() { - if ( type->InternalType() == zeek::TYPE_INTERNAL_STRING ) + if ( type->InternalType() == TYPE_INTERNAL_STRING ) delete val.string_val; - else if ( type->Tag() == zeek::TYPE_FUNC ) + else if ( type->Tag() == TYPE_FUNC ) Unref(val.func_val); - else if ( type->Tag() == zeek::TYPE_FILE ) + else if ( type->Tag() == TYPE_FILE ) Unref(val.file_val); #ifdef DEBUG @@ -99,7 +101,7 @@ ValPtr Val::Clone(CloneState* state) auto i = state->clones.find(this); if ( i != state->clones.end() ) - return {zeek::NewRef{}, i->second}; + return {NewRef{}, i->second}; auto c = DoClone(state); @@ -112,19 +114,19 @@ ValPtr Val::Clone(CloneState* state) ValPtr Val::DoClone(CloneState* state) { switch ( type->InternalType() ) { - case zeek::TYPE_INTERNAL_INT: - case zeek::TYPE_INTERNAL_UNSIGNED: - case zeek::TYPE_INTERNAL_DOUBLE: + case TYPE_INTERNAL_INT: + case TYPE_INTERNAL_UNSIGNED: + case TYPE_INTERNAL_DOUBLE: // Immutable. - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; - case zeek::TYPE_INTERNAL_OTHER: + case TYPE_INTERNAL_OTHER: // Derived classes are responsible for this. Exception: // Functions and files. There aren't any derived classes. - if ( type->Tag() == zeek::TYPE_FUNC ) - return zeek::make_intrusive(AsFunc()->DoClone()); + if ( type->Tag() == TYPE_FUNC ) + return make_intrusive(AsFunc()->DoClone()); - if ( type->Tag() == zeek::TYPE_FILE ) + if ( type->Tag() == TYPE_FILE ) { // I think we can just ref the file here - it is unclear what else // to do. In the case of cached files, I think this is equivalent @@ -136,12 +138,12 @@ ValPtr Val::DoClone(CloneState* state) // automatically opened. This does not happen anymore - instead you // get the non-cached pointer back which is brought back into the // cache when written too. - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; } - if ( type->Tag() == zeek::TYPE_TYPE ) + if ( type->Tag() == TYPE_TYPE ) // These are immutable, essentially. - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; // Fall-through. @@ -155,16 +157,16 @@ ValPtr Val::DoClone(CloneState* state) FuncPtr Val::AsFuncPtr() const { - CHECK_TAG(type->Tag(), zeek::TYPE_FUNC, "Val::Func", zeek::type_name) - return {zeek::NewRef{}, val.func_val}; + CHECK_TAG(type->Tag(), TYPE_FUNC, "Val::Func", type_name) + return {NewRef{}, val.func_val}; } bool Val::IsZero() const { switch ( type->InternalType() ) { - case zeek::TYPE_INTERNAL_INT: return val.int_val == 0; - case zeek::TYPE_INTERNAL_UNSIGNED: return val.uint_val == 0; - case zeek::TYPE_INTERNAL_DOUBLE: return val.double_val == 0.0; + case TYPE_INTERNAL_INT: return val.int_val == 0; + case TYPE_INTERNAL_UNSIGNED: return val.uint_val == 0; + case TYPE_INTERNAL_DOUBLE: return val.double_val == 0.0; default: return false; } @@ -173,9 +175,9 @@ bool Val::IsZero() const bool Val::IsOne() const { switch ( type->InternalType() ) { - case zeek::TYPE_INTERNAL_INT: return val.int_val == 1; - case zeek::TYPE_INTERNAL_UNSIGNED: return val.uint_val == 1; - case zeek::TYPE_INTERNAL_DOUBLE: return val.double_val == 1.0; + case TYPE_INTERNAL_INT: return val.int_val == 1; + case TYPE_INTERNAL_UNSIGNED: return val.uint_val == 1; + case TYPE_INTERNAL_DOUBLE: return val.double_val == 1.0; default: return false; } @@ -183,9 +185,9 @@ bool Val::IsOne() const bro_int_t Val::InternalInt() const { - if ( type->InternalType() == zeek::TYPE_INTERNAL_INT ) + if ( type->InternalType() == TYPE_INTERNAL_INT ) return val.int_val; - else if ( type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) + else if ( type->InternalType() == TYPE_INTERNAL_UNSIGNED ) // ### should check here for overflow return static_cast(val.uint_val); else @@ -196,7 +198,7 @@ bro_int_t Val::InternalInt() const bro_uint_t Val::InternalUnsigned() const { - if ( type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) + if ( type->InternalType() == TYPE_INTERNAL_UNSIGNED ) return val.uint_val; else InternalWarning("bad request for InternalUnsigned"); @@ -206,7 +208,7 @@ bro_uint_t Val::InternalUnsigned() const double Val::InternalDouble() const { - if ( type->InternalType() == zeek::TYPE_INTERNAL_DOUBLE ) + if ( type->InternalType() == TYPE_INTERNAL_DOUBLE ) return val.double_val; else InternalWarning("bad request for InternalDouble"); @@ -216,11 +218,11 @@ double Val::InternalDouble() const bro_int_t Val::CoerceToInt() const { - if ( type->InternalType() == zeek::TYPE_INTERNAL_INT ) + if ( type->InternalType() == TYPE_INTERNAL_INT ) return val.int_val; - else if ( type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) + else if ( type->InternalType() == TYPE_INTERNAL_UNSIGNED ) return static_cast(val.uint_val); - else if ( type->InternalType() == zeek::TYPE_INTERNAL_DOUBLE ) + else if ( type->InternalType() == TYPE_INTERNAL_DOUBLE ) return static_cast(val.double_val); else InternalWarning("bad request for CoerceToInt"); @@ -230,11 +232,11 @@ bro_int_t Val::CoerceToInt() const bro_uint_t Val::CoerceToUnsigned() const { - if ( type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) + if ( type->InternalType() == TYPE_INTERNAL_UNSIGNED ) return val.uint_val; - else if ( type->InternalType() == zeek::TYPE_INTERNAL_INT ) + else if ( type->InternalType() == TYPE_INTERNAL_INT ) return static_cast(val.int_val); - else if ( type->InternalType() == zeek::TYPE_INTERNAL_DOUBLE ) + else if ( type->InternalType() == TYPE_INTERNAL_DOUBLE ) return static_cast(val.double_val); else InternalWarning("bad request for CoerceToUnsigned"); @@ -244,11 +246,11 @@ bro_uint_t Val::CoerceToUnsigned() const double Val::CoerceToDouble() const { - if ( type->InternalType() == zeek::TYPE_INTERNAL_DOUBLE ) + if ( type->InternalType() == TYPE_INTERNAL_DOUBLE ) return val.double_val; - else if ( type->InternalType() == zeek::TYPE_INTERNAL_INT ) + else if ( type->InternalType() == TYPE_INTERNAL_INT ) return static_cast(val.int_val); - else if ( type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) + else if ( type->InternalType() == TYPE_INTERNAL_UNSIGNED ) return static_cast(val.uint_val); else InternalWarning("bad request for CoerceToDouble"); @@ -259,7 +261,7 @@ double Val::CoerceToDouble() const ValPtr Val::SizeVal() const { switch ( type->InternalType() ) { - case zeek::TYPE_INTERNAL_INT: + case TYPE_INTERNAL_INT: // Return abs value. However abs() only works on ints and llabs // doesn't work on Mac OS X 10.5. So we do it by hand if ( val.int_val < 0 ) @@ -267,18 +269,18 @@ ValPtr Val::SizeVal() const else return val_mgr->Count(val.int_val); - case zeek::TYPE_INTERNAL_UNSIGNED: + case TYPE_INTERNAL_UNSIGNED: return val_mgr->Count(val.uint_val); - case zeek::TYPE_INTERNAL_DOUBLE: - return zeek::make_intrusive(fabs(val.double_val)); + case TYPE_INTERNAL_DOUBLE: + return make_intrusive(fabs(val.double_val)); - case zeek::TYPE_INTERNAL_OTHER: - if ( type->Tag() == zeek::TYPE_FUNC ) + case TYPE_INTERNAL_OTHER: + if ( type->Tag() == TYPE_FUNC ) return val_mgr->Count(val.func_val->GetType()->ParamList()->GetTypes().size()); - if ( type->Tag() == zeek::TYPE_FILE ) - return zeek::make_intrusive(val.file_val->Size()); + if ( type->Tag() == TYPE_FILE ) + return make_intrusive(val.file_val->Size()); break; default: @@ -323,36 +325,36 @@ void Val::DescribeReST(ODesc* d) const void Val::ValDescribe(ODesc* d) const { - if ( d->IsReadable() && type->Tag() == zeek::TYPE_BOOL ) + if ( d->IsReadable() && type->Tag() == TYPE_BOOL ) { d->Add(CoerceToInt() ? "T" : "F"); return; } switch ( type->InternalType() ) { - case zeek::TYPE_INTERNAL_INT: d->Add(val.int_val); break; - case zeek::TYPE_INTERNAL_UNSIGNED: d->Add(val.uint_val); break; - case zeek::TYPE_INTERNAL_DOUBLE: d->Add(val.double_val); break; - case zeek::TYPE_INTERNAL_STRING: d->AddBytes(val.string_val); break; - case zeek::TYPE_INTERNAL_ADDR: d->Add(val.addr_val->AsString().c_str()); break; + case TYPE_INTERNAL_INT: d->Add(val.int_val); break; + case TYPE_INTERNAL_UNSIGNED: d->Add(val.uint_val); break; + case TYPE_INTERNAL_DOUBLE: d->Add(val.double_val); break; + case TYPE_INTERNAL_STRING: d->AddBytes(val.string_val); break; + case TYPE_INTERNAL_ADDR: d->Add(val.addr_val->AsString().c_str()); break; - case zeek::TYPE_INTERNAL_SUBNET: + case TYPE_INTERNAL_SUBNET: d->Add(val.subnet_val->AsString().c_str()); break; - case zeek::TYPE_INTERNAL_ERROR: d->AddCS("error"); break; - case zeek::TYPE_INTERNAL_OTHER: - if ( type->Tag() == zeek::TYPE_FUNC ) + case TYPE_INTERNAL_ERROR: d->AddCS("error"); break; + case TYPE_INTERNAL_OTHER: + if ( type->Tag() == TYPE_FUNC ) AsFunc()->Describe(d); - else if ( type->Tag() == zeek::TYPE_FILE ) + else if ( type->Tag() == TYPE_FILE ) AsFile()->Describe(d); - else if ( type->Tag() == zeek::TYPE_TYPE ) + else if ( type->Tag() == TYPE_TYPE ) d->Add(type->AsTypeType()->GetType()->GetName()); else d->Add(""); break; - case zeek::TYPE_INTERNAL_VOID: + case TYPE_INTERNAL_VOID: d->Add(""); break; @@ -366,7 +368,7 @@ void Val::ValDescribe(ODesc* d) const void Val::ValDescribeReST(ODesc* d) const { switch ( type->InternalType() ) { - case zeek::TYPE_INTERNAL_OTHER: + case TYPE_INTERNAL_OTHER: Describe(d); break; @@ -379,40 +381,40 @@ void Val::ValDescribeReST(ODesc* d) const #ifdef DEBUG -zeek::detail::ID* Val::GetID() const +detail::ID* Val::GetID() const { return bound_id ? global_scope()->Find(bound_id).get() : nullptr; } -void Val::SetID(zeek::detail::ID* id) +void Val::SetID(detail::ID* id) { delete [] bound_id; bound_id = id ? copy_string(id->Name()) : nullptr; } #endif -bool Val::WouldOverflow(const zeek::Type* from_type, const zeek::Type* to_type, const Val* val) +bool Val::WouldOverflow(const ::zeek::Type* from_type, const ::zeek::Type* to_type, const Val* val) { if ( !to_type || !from_type ) return true; else if ( same_type(to_type, from_type) ) return false; - if ( to_type->InternalType() == zeek::TYPE_INTERNAL_DOUBLE ) + if ( to_type->InternalType() == TYPE_INTERNAL_DOUBLE ) return false; - else if ( to_type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) + else if ( to_type->InternalType() == TYPE_INTERNAL_UNSIGNED ) { - if ( from_type->InternalType() == zeek::TYPE_INTERNAL_DOUBLE ) + if ( from_type->InternalType() == TYPE_INTERNAL_DOUBLE ) return (val->InternalDouble() < 0.0 || val->InternalDouble() > static_cast(UINT64_MAX)); - else if ( from_type->InternalType() == zeek::TYPE_INTERNAL_INT ) + else if ( from_type->InternalType() == TYPE_INTERNAL_INT ) return (val->InternalInt() < 0); } - else if ( to_type->InternalType() == zeek::TYPE_INTERNAL_INT ) + else if ( to_type->InternalType() == TYPE_INTERNAL_INT ) { - if ( from_type->InternalType() == zeek::TYPE_INTERNAL_DOUBLE ) + if ( from_type->InternalType() == TYPE_INTERNAL_DOUBLE ) return (val->InternalDouble() < static_cast(INT64_MIN) || val->InternalDouble() > static_cast(INT64_MAX)); - else if ( from_type->InternalType() == zeek::TYPE_INTERNAL_UNSIGNED ) + else if ( from_type->InternalType() == TYPE_INTERNAL_UNSIGNED ) return (val->InternalUnsigned() > INT64_MAX); } @@ -421,19 +423,19 @@ bool Val::WouldOverflow(const zeek::Type* from_type, const zeek::Type* to_type, TableValPtr Val::GetRecordFields() { - static auto record_field_table = zeek::id::find_type("record_field_table"); + static auto record_field_table = id::find_type("record_field_table"); auto t = GetType().get(); - if ( t->Tag() != zeek::TYPE_RECORD && t->Tag() != zeek::TYPE_TYPE ) + if ( t->Tag() != TYPE_RECORD && t->Tag() != TYPE_TYPE ) { reporter->Error("non-record value/type passed to record_fields"); - return zeek::make_intrusive(record_field_table); + return make_intrusive(record_field_table); } - zeek::RecordType* rt = nullptr; + RecordType* rt = nullptr; RecordVal* rv = nullptr; - if ( t->Tag() == zeek::TYPE_RECORD ) + if ( t->Tag() == TYPE_RECORD ) { rt = t->AsRecordType(); rv = AsRecordVal(); @@ -442,10 +444,10 @@ TableValPtr Val::GetRecordFields() { t = t->AsTypeType()->GetType().get(); - if ( t->Tag() != zeek::TYPE_RECORD ) + if ( t->Tag() != TYPE_RECORD ) { reporter->Error("non-record value/type passed to record_fields"); - return zeek::make_intrusive(record_field_table); + return make_intrusive(record_field_table); } rt = t->AsRecordType(); @@ -471,31 +473,31 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* switch ( val->GetType()->Tag() ) { - case zeek::TYPE_BOOL: + case TYPE_BOOL: writer.Bool(val->AsBool()); break; - case zeek::TYPE_INT: + case TYPE_INT: writer.Int64(val->AsInt()); break; - case zeek::TYPE_COUNT: + case TYPE_COUNT: writer.Uint64(val->AsCount()); break; - case zeek::TYPE_COUNTER: + case TYPE_COUNTER: writer.Uint64(val->AsCounter()); break; - case zeek::TYPE_TIME: + case TYPE_TIME: writer.Double(val->AsTime()); break; - case zeek::TYPE_DOUBLE: + case TYPE_DOUBLE: writer.Double(val->AsDouble()); break; - case zeek::TYPE_PORT: + case TYPE_PORT: { auto* pval = val->AsPortVal(); writer.StartObject(); @@ -507,10 +509,10 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* break; } - case zeek::TYPE_PATTERN: - case zeek::TYPE_INTERVAL: - case zeek::TYPE_ADDR: - case zeek::TYPE_SUBNET: + case TYPE_PATTERN: + case TYPE_INTERVAL: + case TYPE_ADDR: + case TYPE_SUBNET: { ODesc d; d.SetStyle(RAW_STYLE); @@ -519,10 +521,10 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* break; } - case zeek::TYPE_FILE: - case zeek::TYPE_FUNC: - case zeek::TYPE_ENUM: - case zeek::TYPE_STRING: + case TYPE_FILE: + case TYPE_FUNC: + case TYPE_ENUM: + case TYPE_STRING: { ODesc d; d.SetStyle(RAW_STYLE); @@ -531,7 +533,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* break; } - case zeek::TYPE_TABLE: + case TYPE_TABLE: { auto* table = val->AsTable(); auto* tval = val->AsTableVal(); @@ -577,7 +579,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* break; } - case zeek::TYPE_RECORD: + case TYPE_RECORD: { writer.StartObject(); @@ -588,15 +590,15 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* { auto value = rval->GetFieldOrDefault(i); - if ( value && ( ! only_loggable || rt->FieldHasAttr(i, zeek::detail::ATTR_LOG) ) ) + if ( value && ( ! only_loggable || rt->FieldHasAttr(i, detail::ATTR_LOG) ) ) { string key_str; auto field_name = rt->FieldName(i); if ( re && re->MatchAnywhere(field_name) != 0 ) { - auto blank = zeek::make_intrusive(""); - auto fn_val = zeek::make_intrusive(field_name); + auto blank = make_intrusive(""); + auto fn_val = make_intrusive(field_name); const auto& bs = *blank->AsString(); auto key_val = fn_val->Replace(re, bs, false); key_str = key_val->ToStdString(); @@ -612,7 +614,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* break; } - case zeek::TYPE_LIST: + case TYPE_LIST: { writer.StartArray(); @@ -625,7 +627,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* break; } - case zeek::TYPE_VECTOR: + case TYPE_VECTOR: { writer.StartArray(); @@ -638,7 +640,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* break; } - case zeek::TYPE_OPAQUE: + case TYPE_OPAQUE: { writer.StartObject(); @@ -663,7 +665,7 @@ StringValPtr Val::ToJSON(bool only_loggable, RE_Matcher* re) BuildJSON(writer, this, only_loggable, re, ""); - return zeek::make_intrusive(buffer.GetString()); + return make_intrusive(buffer.GetString()); } void IntervalVal::ValDescribe(ODesc* d) const @@ -775,7 +777,7 @@ uint32_t PortVal::Mask(uint32_t port_num, TransportProto port_type) return port_num; } -PortVal::PortVal(uint32_t p) : Val(bro_uint_t(p), zeek::TYPE_PORT) +PortVal::PortVal(uint32_t p) : Val(bro_uint_t(p), TYPE_PORT) { } @@ -823,10 +825,10 @@ void PortVal::ValDescribe(ODesc* d) const ValPtr PortVal::DoClone(CloneState* state) { // Immutable. - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; } -AddrVal::AddrVal(const char* text) : Val(new IPAddr(text), zeek::TYPE_ADDR) +AddrVal::AddrVal(const char* text) : Val(new IPAddr(text), TYPE_ADDR) { } @@ -834,16 +836,16 @@ AddrVal::AddrVal(const std::string& text) : AddrVal(text.c_str()) { } -AddrVal::AddrVal(uint32_t addr) : Val(new IPAddr(IPv4, &addr, IPAddr::Network), zeek::TYPE_ADDR) +AddrVal::AddrVal(uint32_t addr) : Val(new IPAddr(IPv4, &addr, IPAddr::Network), TYPE_ADDR) { // ### perhaps do gethostbyaddr here? } -AddrVal::AddrVal(const uint32_t addr[4]) : Val(new IPAddr(IPv6, addr, IPAddr::Network), zeek::TYPE_ADDR) +AddrVal::AddrVal(const uint32_t addr[4]) : Val(new IPAddr(IPv6, addr, IPAddr::Network), TYPE_ADDR) { } -AddrVal::AddrVal(const IPAddr& addr) : Val(new IPAddr(addr), zeek::TYPE_ADDR) +AddrVal::AddrVal(const IPAddr& addr) : Val(new IPAddr(addr), TYPE_ADDR) { } @@ -868,16 +870,16 @@ ValPtr AddrVal::SizeVal() const ValPtr AddrVal::DoClone(CloneState* state) { // Immutable. - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; } -SubNetVal::SubNetVal(const char* text) : Val(new IPPrefix(), zeek::TYPE_SUBNET) +SubNetVal::SubNetVal(const char* text) : Val(new IPPrefix(), TYPE_SUBNET) { if ( ! IPPrefix::ConvertString(text, val.subnet_val) ) reporter->Error("Bad string in SubNetVal ctor: %s", text); } -SubNetVal::SubNetVal(const char* text, int width) : Val(new IPPrefix(text, width), zeek::TYPE_SUBNET) +SubNetVal::SubNetVal(const char* text, int width) : Val(new IPPrefix(text, width), TYPE_SUBNET) { } @@ -889,11 +891,11 @@ SubNetVal::SubNetVal(const uint32_t* addr, int width) : SubNetVal(IPAddr{IPv6, a { } -SubNetVal::SubNetVal(const IPAddr& addr, int width) : Val(new IPPrefix(addr, width), zeek::TYPE_SUBNET) +SubNetVal::SubNetVal(const IPAddr& addr, int width) : Val(new IPPrefix(addr, width), TYPE_SUBNET) { } -SubNetVal::SubNetVal(const IPPrefix& prefix) : Val(new IPPrefix(prefix), zeek::TYPE_SUBNET) +SubNetVal::SubNetVal(const IPPrefix& prefix) : Val(new IPPrefix(prefix), TYPE_SUBNET) { } @@ -920,7 +922,7 @@ unsigned int SubNetVal::MemoryAllocation() const ValPtr SubNetVal::SizeVal() const { int retained = 128 - val.subnet_val->LengthIPv6(); - return zeek::make_intrusive(pow(2.0, double(retained))); + return make_intrusive(pow(2.0, double(retained))); } void SubNetVal::ValDescribe(ODesc* d) const @@ -965,10 +967,10 @@ bool SubNetVal::Contains(const IPAddr& addr) const ValPtr SubNetVal::DoClone(CloneState* state) { // Immutable. - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; } -StringVal::StringVal(BroString* s) : Val(s, zeek::TYPE_STRING) +StringVal::StringVal(BroString* s) : Val(s, TYPE_STRING) { } @@ -1115,7 +1117,7 @@ StringValPtr StringVal::Replace( // the NUL. r[0] = '\0'; - return zeek::make_intrusive(new BroString(true, result, r - result)); + return make_intrusive(new BroString(true, result, r - result)); } ValPtr StringVal::DoClone(CloneState* state) @@ -1123,13 +1125,13 @@ ValPtr StringVal::DoClone(CloneState* state) // We could likely treat this type as immutable and return a reference // instead of creating a new copy, but we first need to be careful and // audit whether anything internal actually does mutate it. - return state->NewClone(this, zeek::make_intrusive( + return state->NewClone(this, make_intrusive( new BroString((u_char*) val.string_val->Bytes(), val.string_val->Len(), true))); } PatternVal::PatternVal(RE_Matcher* re) - : Val(zeek::base_type(zeek::TYPE_PATTERN)) + : Val(base_type(TYPE_PATTERN)) { val.re_val = re; } @@ -1141,7 +1143,7 @@ PatternVal::~PatternVal() bool PatternVal::AddTo(Val* v, bool /* is_first_init */) const { - if ( v->GetType()->Tag() != zeek::TYPE_PATTERN ) + if ( v->GetType()->Tag() != TYPE_PATTERN ) { v->Error("not a pattern"); return false; @@ -1184,11 +1186,11 @@ ValPtr PatternVal::DoClone(CloneState* state) auto re = new RE_Matcher(val.re_val->PatternText(), val.re_val->AnywherePatternText()); re->Compile(); - return state->NewClone(this, zeek::make_intrusive(re)); + return state->NewClone(this, make_intrusive(re)); } -ListVal::ListVal(zeek::TypeTag t) - : Val(zeek::make_intrusive(t == zeek::TYPE_ANY ? nullptr : zeek::base_type(t))) +ListVal::ListVal(TypeTag t) + : Val(make_intrusive(t == TYPE_ANY ? nullptr : base_type(t))) { tag = t; } @@ -1204,7 +1206,7 @@ ValPtr ListVal::SizeVal() const RE_Matcher* ListVal::BuildRE() const { - if ( tag != zeek::TYPE_STRING ) + if ( tag != TYPE_STRING ) Internal("non-string list in ListVal::IncludedInString"); RE_Matcher* re = new RE_Matcher(); @@ -1232,19 +1234,19 @@ void ListVal::Append(ValPtr v) void ListVal::Append(Val* v) { - Append({zeek::AdoptRef{}, v}); + Append({AdoptRef{}, v}); } TableValPtr ListVal::ToSetVal() const { - if ( tag == zeek::TYPE_ANY ) + if ( tag == TYPE_ANY ) Internal("conversion of heterogeneous list to set"); const auto& pt = type->AsTypeList()->GetPureType(); - auto set_index = zeek::make_intrusive(pt); - set_index->Append(zeek::base_type(tag)); - auto s = zeek::make_intrusive(std::move(set_index), nullptr); - auto t = zeek::make_intrusive(std::move(s)); + auto set_index = make_intrusive(pt); + set_index->Append(base_type(tag)); + auto s = make_intrusive(std::move(set_index), nullptr); + auto t = make_intrusive(std::move(s)); for ( const auto& val : vals ) t->Assign(val, nullptr); @@ -1284,7 +1286,7 @@ void ListVal::Describe(ODesc* d) const ValPtr ListVal::DoClone(CloneState* state) { - auto lv = zeek::make_intrusive(tag); + auto lv = make_intrusive(tag); lv->vals.reserve(vals.size()); state->NewClone(this, lv); @@ -1336,13 +1338,13 @@ static void table_entry_val_delete_func(void* val) delete tv; } -static void find_nested_record_types(const zeek::TypePtr& t, std::set* found) +static void find_nested_record_types(const TypePtr& t, std::set* found) { if ( ! t ) return; switch ( t->Tag() ) { - case zeek::TYPE_RECORD: + case TYPE_RECORD: { auto rt = t->AsRecordType(); found->emplace(rt); @@ -1351,24 +1353,24 @@ static void find_nested_record_types(const zeek::TypePtr& t, std::setFieldDecl(i)->type, found); } return; - case zeek::TYPE_TABLE: + case TYPE_TABLE: find_nested_record_types(t->AsTableType()->GetIndices(), found); find_nested_record_types(t->AsTableType()->Yield(), found); return; - case zeek::TYPE_LIST: + case TYPE_LIST: { for ( const auto& type : t->AsTypeList()->GetTypes() ) find_nested_record_types(type, found); } return; - case zeek::TYPE_FUNC: + case TYPE_FUNC: find_nested_record_types(t->AsFuncType()->Params(), found); find_nested_record_types(t->AsFuncType()->Yield(), found); return; - case zeek::TYPE_VECTOR: + case TYPE_VECTOR: find_nested_record_types(t->AsVectorType()->Yield(), found); return; - case zeek::TYPE_TYPE: + case TYPE_TYPE: find_nested_record_types(t->AsTypeType()->GetType(), found); return; default: @@ -1376,7 +1378,7 @@ static void find_nested_record_types(const zeek::TypePtr& t, std::setGetIndexTypes() ) { - std::set found; + std::set found; // TODO: this likely doesn't have to be repeated for each new TableVal, // can remember the resulting dependencies per TableType find_nested_record_types(t, &found); for ( auto rt : found ) - parse_time_table_record_dependencies[rt].emplace_back(zeek::NewRef{}, this); + parse_time_table_record_dependencies[rt].emplace_back(NewRef{}, this); } } -void TableVal::Init(zeek::TableTypePtr t) +void TableVal::Init(TableTypePtr t) { table_type = std::move(t); expire_func = nullptr; @@ -1411,7 +1413,7 @@ void TableVal::Init(zeek::TableTypePtr t) subnets = nullptr; table_hash = new CompositeHash(table_type->GetIndices()); - val.table_val = new PDict; + val.table_val = new PDict; val.table_val->SetDeleteFunc(table_entry_val_delete_func); } @@ -1429,7 +1431,7 @@ void TableVal::RemoveAll() { // Here we take the brute force approach. delete AsTable(); - val.table_val = new PDict; + val.table_val = new PDict; val.table_val->SetDeleteFunc(table_entry_val_delete_func); } @@ -1443,10 +1445,10 @@ int TableVal::RecursiveSize() const int n = AsTable()->Length(); if ( GetType()->IsSet() || - GetType()->AsTableType()->Yield()->Tag() != zeek::TYPE_TABLE ) + GetType()->AsTableType()->Yield()->Tag() != TYPE_TABLE ) return n; - PDict* v = val.table_val; + PDict* v = val.table_val; IterCookie* c = v->InitForIteration(); TableEntryVal* tv; @@ -1459,29 +1461,29 @@ int TableVal::RecursiveSize() const return n; } -void TableVal::SetAttrs(zeek::detail::AttributesPtr a) +void TableVal::SetAttrs(detail::AttributesPtr a) { attrs = std::move(a); if ( ! attrs ) return; - CheckExpireAttr(zeek::detail::ATTR_EXPIRE_READ); - CheckExpireAttr(zeek::detail::ATTR_EXPIRE_WRITE); - CheckExpireAttr(zeek::detail::ATTR_EXPIRE_CREATE); + CheckExpireAttr(detail::ATTR_EXPIRE_READ); + CheckExpireAttr(detail::ATTR_EXPIRE_WRITE); + CheckExpireAttr(detail::ATTR_EXPIRE_CREATE); - const auto& ef = attrs->Find(zeek::detail::ATTR_EXPIRE_FUNC); + const auto& ef = attrs->Find(detail::ATTR_EXPIRE_FUNC); if ( ef ) expire_func = ef->GetExpr(); - const auto& cf = attrs->Find(zeek::detail::ATTR_ON_CHANGE); + const auto& cf = attrs->Find(detail::ATTR_ON_CHANGE); if ( cf ) change_func = cf->GetExpr(); } -void TableVal::CheckExpireAttr(zeek::detail::AttrTag at) +void TableVal::CheckExpireAttr(detail::AttrTag at) { const auto& a = attrs->Find(at); @@ -1489,7 +1491,7 @@ void TableVal::CheckExpireAttr(zeek::detail::AttrTag at) { expire_time = a->GetExpr(); - if ( expire_time->GetType()->Tag() != zeek::TYPE_INTERVAL ) + if ( expire_time->GetType()->Tag() != TYPE_INTERVAL ) { if ( ! expire_time->IsError() ) expire_time->SetError("expiration interval has wrong type"); @@ -1522,7 +1524,7 @@ bool TableVal::Assign(ValPtr index, ValPtr new_val) bool TableVal::Assign(Val* index, Val* new_val) { - return Assign({zeek::NewRef{}, index}, {zeek::AdoptRef{}, new_val}); + return Assign({NewRef{}, index}, {AdoptRef{}, new_val}); } bool TableVal::Assign(ValPtr index, std::unique_ptr k, @@ -1554,7 +1556,7 @@ bool TableVal::Assign(ValPtr index, std::unique_ptr k, } // Keep old expiration time if necessary. - if ( old_entry_val && attrs && attrs->Find(zeek::detail::ATTR_EXPIRE_CREATE) ) + if ( old_entry_val && attrs && attrs->Find(detail::ATTR_EXPIRE_CREATE) ) new_entry_val->SetExpireAccess(old_entry_val->ExpireAccessTime()); Modified(); @@ -1573,7 +1575,7 @@ bool TableVal::Assign(ValPtr index, std::unique_ptr k, bool TableVal::Assign(Val* index, HashKey* k, Val* new_val) { - return Assign({zeek::NewRef{}, index}, std::unique_ptr{k}, {zeek::AdoptRef{}, new_val}); + return Assign({NewRef{}, index}, std::unique_ptr{k}, {AdoptRef{}, new_val}); } ValPtr TableVal::SizeVal() const @@ -1588,7 +1590,7 @@ bool TableVal::AddTo(Val* val, bool is_first_init) const bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const { - if ( val->GetType()->Tag() != zeek::TYPE_TABLE ) + if ( val->GetType()->Tag() != TYPE_TABLE ) { val->Error("not a table"); return false; @@ -1602,7 +1604,7 @@ bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const return false; } - const PDict* tbl = AsTable(); + const PDict* tbl = AsTable(); IterCookie* c = tbl->InitForIteration(); HashKey* k; @@ -1636,7 +1638,7 @@ bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const bool TableVal::RemoveFrom(Val* val) const { - if ( val->GetType()->Tag() != zeek::TYPE_TABLE ) + if ( val->GetType()->Tag() != TYPE_TABLE ) { val->Error("not a table"); return false; @@ -1650,7 +1652,7 @@ bool TableVal::RemoveFrom(Val* val) const return false; } - const PDict* tbl = AsTable(); + const PDict* tbl = AsTable(); IterCookie* c = tbl->InitForIteration(); HashKey* k; @@ -1670,16 +1672,16 @@ bool TableVal::RemoveFrom(Val* val) const TableValPtr TableVal::Intersection(const TableVal& tv) const { - auto result = zeek::make_intrusive(table_type); + auto result = make_intrusive(table_type); - const PDict* t0 = AsTable(); - const PDict* t1 = tv.AsTable(); - PDict* t2 = result->AsNonConstTable(); + const PDict* t0 = AsTable(); + const PDict* t1 = tv.AsTable(); + PDict* t2 = result->AsNonConstTable(); // Figure out which is smaller; assign it to t1. if ( t1->Length() > t0->Length() ) { // Swap. - const PDict* tmp = t1; + const PDict* tmp = t1; t1 = t0; t0 = tmp; } @@ -1701,8 +1703,8 @@ TableValPtr TableVal::Intersection(const TableVal& tv) const bool TableVal::EqualTo(const TableVal& tv) const { - const PDict* t0 = AsTable(); - const PDict* t1 = tv.AsTable(); + const PDict* t0 = AsTable(); + const PDict* t1 = tv.AsTable(); if ( t0->Length() != t1->Length() ) return false; @@ -1728,8 +1730,8 @@ bool TableVal::EqualTo(const TableVal& tv) const bool TableVal::IsSubsetOf(const TableVal& tv) const { - const PDict* t0 = AsTable(); - const PDict* t1 = tv.AsTable(); + const PDict* t0 = AsTable(); + const PDict* t1 = tv.AsTable(); if ( t0->Length() > t1->Length() ) return false; @@ -1763,12 +1765,12 @@ bool TableVal::ExpandAndInit(ValPtr index, ValPtr new_val) return ExpandAndInit(std::move(index), std::move(new_val)); } - if ( index_type->Tag() != zeek::TYPE_LIST ) + if ( index_type->Tag() != TYPE_LIST ) // Nothing to expand. return CheckAndAssign(std::move(index), std::move(new_val)); ListVal* iv = index->AsListVal(); - if ( iv->BaseTag() != zeek::TYPE_ANY ) + if ( iv->BaseTag() != TYPE_ANY ) { if ( table_type->GetIndices()->GetTypes().size() != 1 ) reporter->InternalError("bad singleton list index"); @@ -1792,7 +1794,7 @@ bool TableVal::ExpandAndInit(ValPtr index, ValPtr new_val) // then we could optimize here. const auto& t = v->GetType(); - if ( t->IsSet() || t->Tag() == zeek::TYPE_LIST ) + if ( t->IsSet() || t->Tag() == TYPE_LIST ) break; } @@ -1807,7 +1809,7 @@ bool TableVal::ExpandAndInit(ValPtr index, ValPtr new_val) ValPtr TableVal::Default(const ValPtr& index) { - const auto& def_attr = GetAttr(zeek::detail::ATTR_DEFAULT); + const auto& def_attr = GetAttr(detail::ATTR_DEFAULT); if ( ! def_attr ) return nullptr; @@ -1817,13 +1819,13 @@ ValPtr TableVal::Default(const ValPtr& index) const auto& ytype = GetType()->Yield(); const auto& dtype = def_attr->GetExpr()->GetType(); - if ( dtype->Tag() == zeek::TYPE_RECORD && ytype->Tag() == zeek::TYPE_RECORD && + if ( dtype->Tag() == TYPE_RECORD && ytype->Tag() == TYPE_RECORD && ! same_type(dtype, ytype) && record_promotion_compatible(dtype->AsRecordType(), ytype->AsRecordType()) ) { - auto rt = zeek::cast_intrusive(ytype); - auto coerce = zeek::make_intrusive( + auto rt = cast_intrusive(ytype); + auto coerce = make_intrusive( def_attr->GetExpr(), std::move(rt)); def_val = coerce->Eval(nullptr); @@ -1839,7 +1841,7 @@ ValPtr TableVal::Default(const ValPtr& index) return nullptr; } - if ( def_val->GetType()->Tag() != zeek::TYPE_FUNC || + if ( def_val->GetType()->Tag() != TYPE_FUNC || same_type(def_val->GetType(), GetType()->Yield()) ) { if ( def_attr->GetExpr()->IsConst() ) @@ -1857,9 +1859,9 @@ ValPtr TableVal::Default(const ValPtr& index) } const Func* f = def_val->AsFunc(); - zeek::Args vl; + Args vl; - if ( index->GetType()->Tag() == zeek::TYPE_LIST ) + if ( index->GetType()->Tag() == TYPE_LIST ) { auto lv = index->AsListVal(); vl.reserve(lv->Length()); @@ -1896,7 +1898,7 @@ const ValPtr& TableVal::Find(const ValPtr& index) TableEntryVal* v = (TableEntryVal*) subnets->Lookup(index.get()); if ( v ) { - if ( attrs && attrs->Find(zeek::detail::ATTR_EXPIRE_READ) ) + if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) ) v->SetExpireAccess(network_time); if ( v->GetVal() ) @@ -1908,7 +1910,7 @@ const ValPtr& TableVal::Find(const ValPtr& index) return Val::nil; } - const PDict* tbl = AsTable(); + const PDict* tbl = AsTable(); if ( tbl->Length() > 0 ) { @@ -1920,7 +1922,7 @@ const ValPtr& TableVal::Find(const ValPtr& index) if ( v ) { - if ( attrs && attrs->Find(zeek::detail::ATTR_EXPIRE_READ) ) + if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) ) v->SetExpireAccess(network_time); if ( v->GetVal() ) @@ -1946,7 +1948,7 @@ Val* TableVal::Lookup(Val* index, bool use_default_val) { static ValPtr last_default; last_default = nullptr; - ValPtr idx{zeek::NewRef{}, index}; + ValPtr idx{NewRef{}, index}; if ( const auto& rval = Find(idx) ) return rval.get(); @@ -1963,11 +1965,11 @@ VectorValPtr TableVal::LookupSubnets(const SubNetVal* search) if ( ! subnets ) reporter->InternalError("LookupSubnets called on wrong table type"); - auto result = zeek::make_intrusive(zeek::id::find_type("subnet_vec")); + auto result = make_intrusive(id::find_type("subnet_vec")); auto matches = subnets->FindAll(search); for ( auto element : matches ) - result->Assign(result->Size(), zeek::make_intrusive(get<0>(element))); + result->Assign(result->Size(), make_intrusive(get<0>(element))); return result; } @@ -1977,12 +1979,12 @@ TableValPtr TableVal::LookupSubnetValues(const SubNetVal* search) if ( ! subnets ) reporter->InternalError("LookupSubnetValues called on wrong table type"); - auto nt = zeek::make_intrusive(this->GetType()); + auto nt = make_intrusive(this->GetType()); auto matches = subnets->FindAll(search); for ( auto element : matches ) { - auto s = zeek::make_intrusive(get<0>(element)); + auto s = make_intrusive(get<0>(element)); TableEntryVal* entry = reinterpret_cast(get<1>(element)); if ( entry && entry->GetVal() ) @@ -1992,7 +1994,7 @@ TableValPtr TableVal::LookupSubnetValues(const SubNetVal* search) if ( entry ) { - if ( attrs && attrs->Find(zeek::detail::ATTR_EXPIRE_READ) ) + if ( attrs && attrs->Find(detail::ATTR_EXPIRE_READ) ) entry->SetExpireAccess(network_time); } } @@ -2048,7 +2050,7 @@ void TableVal::CallChangeFunc(const Val* index, return; } - if ( thefunc->GetType()->Tag() != zeek::TYPE_FUNC ) + if ( thefunc->GetType()->Tag() != TYPE_FUNC ) { thefunc->Error("not a function"); return; @@ -2057,23 +2059,23 @@ void TableVal::CallChangeFunc(const Val* index, const Func* f = thefunc->AsFunc(); auto lv = index->AsListVal(); - zeek::Args vl; + Args vl; vl.reserve(2 + lv->Length() + table_type->IsTable()); - vl.emplace_back(zeek::NewRef{}, this); + vl.emplace_back(NewRef{}, this); switch ( tpe ) { case ELEMENT_NEW: - vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_NEW)); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_NEW)); break; case ELEMENT_CHANGED: - vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_CHANGED)); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_CHANGED)); break; case ELEMENT_REMOVED: - vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_REMOVED)); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_REMOVED)); break; case ELEMENT_EXPIRED: - vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_EXPIRED)); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_EXPIRED)); } for ( const auto& v : lv->Vals() ) @@ -2099,7 +2101,7 @@ ValPtr TableVal::Remove(const Val& index) ValPtr va; if ( v ) - va = v->GetVal() ? v->GetVal() : zeek::IntrusivePtr{zeek::NewRef{}, this}; + va = v->GetVal() ? v->GetVal() : IntrusivePtr{NewRef{}, this}; if ( subnets && ! subnets->Remove(&index) ) reporter->InternalWarning("index not in prefix table"); @@ -2120,7 +2122,7 @@ ValPtr TableVal::Remove(const HashKey& k) ValPtr va; if ( v ) - va = v->GetVal() ? v->GetVal() : zeek::IntrusivePtr{zeek::NewRef{}, this}; + va = v->GetVal() ? v->GetVal() : IntrusivePtr{NewRef{}, this}; if ( subnets ) { @@ -2143,11 +2145,11 @@ ValPtr TableVal::Remove(const HashKey& k) return va; } -ListValPtr TableVal::ToListVal(zeek::TypeTag t) const +ListValPtr TableVal::ToListVal(TypeTag t) const { - auto l = zeek::make_intrusive(t); + auto l = make_intrusive(t); - const PDict* tbl = AsTable(); + const PDict* tbl = AsTable(); IterCookie* c = tbl->InitForIteration(); HashKey* k; @@ -2155,7 +2157,7 @@ ListValPtr TableVal::ToListVal(zeek::TypeTag t) const { auto index = table_hash->RecoverVals(*k); - if ( t == zeek::TYPE_ANY ) + if ( t == TYPE_ANY ) l->Append(std::move(index)); else { @@ -2172,7 +2174,7 @@ ListValPtr TableVal::ToListVal(zeek::TypeTag t) const return l; } -ListVal* TableVal::ConvertToList(zeek::TypeTag t) const +ListVal* TableVal::ConvertToList(TypeTag t) const { return ToListVal().release(); } @@ -2194,14 +2196,14 @@ ListVal* TableVal::ConvertToPureList() const return ToPureListVal().release(); } -const zeek::detail::AttrPtr& TableVal::GetAttr(zeek::detail::AttrTag t) const +const detail::AttrPtr& TableVal::GetAttr(detail::AttrTag t) const { - return attrs ? attrs->Find(t) : zeek::detail::Attr::nil; + return attrs ? attrs->Find(t) : detail::Attr::nil; } void TableVal::Describe(ODesc* d) const { - const PDict* tbl = AsTable(); + const PDict* tbl = AsTable(); int n = tbl->Length(); if ( d->IsBinary() || d->IsPortable() ) @@ -2290,12 +2292,12 @@ bool TableVal::ExpandCompoundAndInit(ListVal* lv, int k, ValPtr new_val) Val* ind_k_v = lv->Idx(k).get(); auto ind_k = ind_k_v->GetType()->IsSet() ? ind_k_v->AsTableVal()->ToListVal() : - ListValPtr{zeek::NewRef{}, ind_k_v->AsListVal()}; + ListValPtr{NewRef{}, ind_k_v->AsListVal()}; for ( int i = 0; i < ind_k->Length(); ++i ) { const auto& ind_k_i = ind_k->Idx(i); - auto expd = zeek::make_intrusive(zeek::TYPE_ANY); + auto expd = make_intrusive(TYPE_ANY); for ( auto j = 0; j < lv->Length(); ++j ) { @@ -2335,7 +2337,7 @@ void TableVal::InitDefaultFunc(Frame* f) if ( def_val ) return; - const auto& def_attr = GetAttr(zeek::detail::ATTR_DEFAULT); + const auto& def_attr = GetAttr(detail::ATTR_DEFAULT); if ( ! def_attr ) return; @@ -2343,7 +2345,7 @@ void TableVal::InitDefaultFunc(Frame* f) const auto& ytype = GetType()->Yield(); const auto& dtype = def_attr->GetExpr()->GetType(); - if ( dtype->Tag() == zeek::TYPE_RECORD && ytype->Tag() == zeek::TYPE_RECORD && + if ( dtype->Tag() == TYPE_RECORD && ytype->Tag() == TYPE_RECORD && ! same_type(dtype, ytype) && record_promotion_compatible(dtype->AsRecordType(), ytype->AsRecordType()) ) @@ -2363,7 +2365,7 @@ void TableVal::DoExpire(double t) if ( ! type ) return; // FIX ME ### - PDict* tbl = AsNonConstTable(); + PDict* tbl = AsNonConstTable(); double timeout = GetExpireTime(); @@ -2506,24 +2508,24 @@ double TableVal::CallExpireFunc(ListValPtr idx) // Will have been reported already. return 0; - if ( vf->GetType()->Tag() != zeek::TYPE_FUNC ) + if ( vf->GetType()->Tag() != TYPE_FUNC ) { vf->Error("not a function"); return 0; } const Func* f = vf->AsFunc(); - zeek::Args vl; + Args vl; const auto& func_args = f->GetType()->ParamList()->GetTypes(); // backwards compatibility with idx: any idiom - bool any_idiom = func_args.size() == 2 && func_args.back()->Tag() == zeek::TYPE_ANY; + bool any_idiom = func_args.size() == 2 && func_args.back()->Tag() == TYPE_ANY; if ( ! any_idiom ) { auto lv = idx->AsListVal(); vl.reserve(1 + lv->Length()); - vl.emplace_back(zeek::NewRef{}, this); + vl.emplace_back(NewRef{}, this); for ( const auto& v : lv->Vals() ) vl.emplace_back(v); @@ -2531,7 +2533,7 @@ double TableVal::CallExpireFunc(ListValPtr idx) else { vl.reserve(2); - vl.emplace_back(zeek::NewRef{}, this); + vl.emplace_back(NewRef{}, this); ListVal* idx_list = idx->AsListVal(); // Flatten if only one element @@ -2556,10 +2558,10 @@ double TableVal::CallExpireFunc(ListValPtr idx) ValPtr TableVal::DoClone(CloneState* state) { - auto tv = zeek::make_intrusive(table_type); + auto tv = make_intrusive(table_type); state->NewClone(this, tv); - const PDict* tbl = AsTable(); + const PDict* tbl = AsTable(); IterCookie* cookie = tbl->InitForIteration(); HashKey* key; @@ -2603,7 +2605,7 @@ unsigned int TableVal::MemoryAllocation() const { unsigned int size = 0; - PDict* v = val.table_val; + PDict* v = val.table_val; IterCookie* c = v->InitForIteration(); TableEntryVal* tv; @@ -2626,7 +2628,7 @@ std::unique_ptr TableVal::MakeHashKey(const Val& index) const return table_hash->MakeHashKey(index, true); } -void TableVal::SaveParseTimeTableState(zeek::RecordType* rt) +void TableVal::SaveParseTimeTableState(RecordType* rt) { auto it = parse_time_table_record_dependencies.find(rt); @@ -2654,7 +2656,7 @@ void TableVal::DoneParsing() TableVal::ParseTimeTableState TableVal::DumpTableState() { - const PDict* tbl = AsTable(); + const PDict* tbl = AsTable(); IterCookie* cookie = tbl->InitForIteration(); HashKey* key; @@ -2687,11 +2689,11 @@ TableVal::TableRecordDependencies TableVal::parse_time_table_record_dependencies RecordVal::RecordTypeValMap RecordVal::parse_time_records; -RecordVal::RecordVal(zeek::RecordType* t, bool init_fields) - : RecordVal({zeek::NewRef{}, t}, init_fields) +RecordVal::RecordVal(RecordType* t, bool init_fields) + : RecordVal({NewRef{}, t}, init_fields) {} -RecordVal::RecordVal(zeek::RecordTypePtr t, bool init_fields) : Val(std::move(t)) +RecordVal::RecordVal(RecordTypePtr t, bool init_fields) : Val(std::move(t)) { origin = nullptr; auto rt = GetType()->AsRecordType(); @@ -2700,7 +2702,7 @@ RecordVal::RecordVal(zeek::RecordTypePtr t, bool init_fields) : Val(std::move(t) vl->reserve(n); if ( is_parsing ) - parse_time_records[rt].emplace_back(zeek::NewRef{}, this); + parse_time_records[rt].emplace_back(NewRef{}, this); if ( ! init_fields ) return; @@ -2709,34 +2711,34 @@ RecordVal::RecordVal(zeek::RecordTypePtr t, bool init_fields) : Val(std::move(t) // by default). for ( int i = 0; i < n; ++i ) { - zeek::detail::Attributes* a = rt->FieldDecl(i)->attrs.get(); - zeek::detail::Attr* def_attr = a ? a->Find(zeek::detail::ATTR_DEFAULT).get() : nullptr; + detail::Attributes* a = rt->FieldDecl(i)->attrs.get(); + detail::Attr* def_attr = a ? a->Find(detail::ATTR_DEFAULT).get() : nullptr; auto def = def_attr ? def_attr->GetExpr()->Eval(nullptr) : nullptr; const auto& type = rt->FieldDecl(i)->type; - if ( def && type->Tag() == zeek::TYPE_RECORD && - def->GetType()->Tag() == zeek::TYPE_RECORD && + if ( def && type->Tag() == TYPE_RECORD && + def->GetType()->Tag() == TYPE_RECORD && ! same_type(def->GetType(), type) ) { - auto tmp = def->AsRecordVal()->CoerceTo(zeek::cast_intrusive(type)); + auto tmp = def->AsRecordVal()->CoerceTo(cast_intrusive(type)); if ( tmp ) def = std::move(tmp); } - if ( ! def && ! (a && a->Find(zeek::detail::ATTR_OPTIONAL)) ) + if ( ! def && ! (a && a->Find(detail::ATTR_OPTIONAL)) ) { - zeek::TypeTag tag = type->Tag(); + TypeTag tag = type->Tag(); - if ( tag == zeek::TYPE_RECORD ) - def = zeek::make_intrusive(zeek::cast_intrusive(type)); + if ( tag == TYPE_RECORD ) + def = make_intrusive(cast_intrusive(type)); - else if ( tag == zeek::TYPE_TABLE ) - def = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, type->AsTableType()}, - zeek::IntrusivePtr{zeek::NewRef{}, a}); + else if ( tag == TYPE_TABLE ) + def = make_intrusive(IntrusivePtr{NewRef{}, type->AsTableType()}, + IntrusivePtr{NewRef{}, a}); - else if ( tag == zeek::TYPE_VECTOR ) - def = zeek::make_intrusive(zeek::cast_intrusive(type)); + else if ( tag == TYPE_VECTOR ) + def = make_intrusive(cast_intrusive(type)); } vl->emplace_back(std::move(def)); @@ -2761,7 +2763,7 @@ void RecordVal::Assign(int field, ValPtr new_val) void RecordVal::Assign(int field, Val* new_val) { - Assign(field, {zeek::AdoptRef{}, new_val}); + Assign(field, {AdoptRef{}, new_val}); } ValPtr RecordVal::GetFieldOrDefault(int field) const @@ -2774,7 +2776,7 @@ ValPtr RecordVal::GetFieldOrDefault(int field) const return GetType()->AsRecordType()->FieldDefault(field); } -void RecordVal::ResizeParseTimeRecords(zeek::RecordType* rt) +void RecordVal::ResizeParseTimeRecords(RecordType* rt) { auto it = parse_time_records.find(rt); @@ -2824,7 +2826,7 @@ ValPtr RecordVal::GetFieldOrDefault(const char* field) const return GetFieldOrDefault(idx); } -RecordValPtr RecordVal::CoerceTo(zeek::RecordTypePtr t, +RecordValPtr RecordVal::CoerceTo(RecordTypePtr t, RecordValPtr aggr, bool allow_orphaning) const { @@ -2832,10 +2834,10 @@ RecordValPtr RecordVal::CoerceTo(zeek::RecordTypePtr t, return nullptr; if ( ! aggr ) - aggr = zeek::make_intrusive(std::move(t)); + aggr = make_intrusive(std::move(t)); - zeek::RecordType* ar_t = aggr->GetType()->AsRecordType(); - const zeek::RecordType* rv_t = GetType()->AsRecordType(); + RecordType* ar_t = aggr->GetType()->AsRecordType(); + const RecordType* rv_t = GetType()->AsRecordType(); int i; for ( i = 0; i < rv_t->NumFields(); ++i ) @@ -2863,11 +2865,11 @@ RecordValPtr RecordVal::CoerceTo(zeek::RecordTypePtr t, const auto& ft = ar_t->GetFieldType(t_i); - if ( ft->Tag() == zeek::TYPE_RECORD && ! same_type(ft, v->GetType()) ) + if ( ft->Tag() == TYPE_RECORD && ! same_type(ft, v->GetType()) ) { - auto rhs = zeek::make_intrusive(v); - auto e = zeek::make_intrusive( - std::move(rhs), zeek::cast_intrusive(ft)); + auto rhs = make_intrusive(v); + auto e = make_intrusive( + std::move(rhs), cast_intrusive(ft)); aggr->Assign(t_i, e->Eval(nullptr)); continue; } @@ -2877,7 +2879,7 @@ RecordValPtr RecordVal::CoerceTo(zeek::RecordTypePtr t, for ( i = 0; i < ar_t->NumFields(); ++i ) if ( ! aggr->GetField(i) && - ! ar_t->FieldDecl(i)->GetAttr(zeek::detail::ATTR_OPTIONAL) ) + ! ar_t->FieldDecl(i)->GetAttr(detail::ATTR_OPTIONAL) ) { char buf[512]; snprintf(buf, sizeof(buf), @@ -2888,10 +2890,10 @@ RecordValPtr RecordVal::CoerceTo(zeek::RecordTypePtr t, return aggr; } -RecordValPtr RecordVal::CoerceTo(zeek::RecordTypePtr t, bool allow_orphaning) +RecordValPtr RecordVal::CoerceTo(RecordTypePtr t, bool allow_orphaning) { if ( same_type(GetType(), t) ) - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; return CoerceTo(std::move(t), nullptr, allow_orphaning); } @@ -2975,7 +2977,7 @@ ValPtr RecordVal::DoClone(CloneState* state) // record. As we cannot guarantee that it will ber zeroed out at the // approproate time (as it seems to be guaranteed for the original record) // we don't touch it. - auto rv = zeek::make_intrusive(GetType(), false); + auto rv = make_intrusive(GetType(), false); rv->origin = nullptr; state->NewClone(this, rv); @@ -3022,13 +3024,13 @@ void EnumVal::ValDescribe(ODesc* d) const ValPtr EnumVal::DoClone(CloneState* state) { // Immutable. - return {zeek::NewRef{}, this}; + return {NewRef{}, this}; } -VectorVal::VectorVal(zeek::VectorType* t) : VectorVal({zeek::NewRef{}, t}) +VectorVal::VectorVal(VectorType* t) : VectorVal({NewRef{}, t}) { } -VectorVal::VectorVal(zeek::VectorTypePtr t) : Val(std::move(t)) +VectorVal::VectorVal(VectorTypePtr t) : Val(std::move(t)) { val.vector_val = new vector(); } @@ -3105,7 +3107,7 @@ bool VectorVal::Remove(unsigned int index) bool VectorVal::AddTo(Val* val, bool /* is_first_init */) const { - if ( val->GetType()->Tag() != zeek::TYPE_VECTOR ) + if ( val->GetType()->Tag() != TYPE_VECTOR ) { val->Error("not a vector"); return false; @@ -3154,7 +3156,7 @@ unsigned int VectorVal::ResizeAtLeast(unsigned int new_num_elements) ValPtr VectorVal::DoClone(CloneState* state) { - auto vv = zeek::make_intrusive(GetType()); + auto vv = make_intrusive(GetType()); vv->val.vector_val->reserve(val.vector_val->size()); state->NewClone(this, vv); @@ -3187,26 +3189,26 @@ void VectorVal::ValDescribe(ODesc* d) const } ValPtr check_and_promote(ValPtr v, - const zeek::Type* t, + const Type* t, bool is_init, const Location* expr_location) { if ( ! v ) return nullptr; - zeek::Type* vt = flatten_type(v->GetType().get()); + Type* vt = flatten_type(v->GetType().get()); t = flatten_type(t); - zeek::TypeTag t_tag = t->Tag(); - zeek::TypeTag v_tag = vt->Tag(); + TypeTag t_tag = t->Tag(); + TypeTag v_tag = vt->Tag(); // More thought definitely needs to go into this. - if ( t_tag == zeek::TYPE_ANY || v_tag == zeek::TYPE_ANY ) + if ( t_tag == TYPE_ANY || v_tag == TYPE_ANY ) return v; - if ( ! zeek::EitherArithmetic(t_tag, v_tag) || + if ( ! EitherArithmetic(t_tag, v_tag) || /* allow sets as initializers */ - (is_init && v_tag == zeek::TYPE_TABLE) ) + (is_init && v_tag == TYPE_TABLE) ) { if ( same_type(t, vt, is_init) ) return v; @@ -3215,10 +3217,10 @@ ValPtr check_and_promote(ValPtr v, return nullptr; } - if ( ! zeek::BothArithmetic(t_tag, v_tag) && - (! zeek::IsArithmetic(v_tag) || t_tag != zeek::TYPE_TIME || ! v->IsZero()) ) + if ( ! BothArithmetic(t_tag, v_tag) && + (! IsArithmetic(v_tag) || t_tag != TYPE_TIME || ! v->IsZero()) ) { - if ( t_tag == zeek::TYPE_LIST || v_tag == zeek::TYPE_LIST ) + if ( t_tag == TYPE_LIST || v_tag == TYPE_LIST ) t->Error("list mixed with scalar", v.get(), false, expr_location); else t->Error("arithmetic mixed with non-arithmetic", v.get(), false, expr_location); @@ -3228,9 +3230,9 @@ ValPtr check_and_promote(ValPtr v, if ( v_tag == t_tag ) return v; - if ( t_tag != zeek::TYPE_TIME && ! zeek::BothArithmetic(t_tag, v_tag) ) + if ( t_tag != TYPE_TIME && ! BothArithmetic(t_tag, v_tag) ) { - zeek::TypeTag mt = zeek::max_type(t_tag, v_tag); + TypeTag mt = max_type(t_tag, v_tag); if ( mt != t_tag ) { t->Error("over-promotion of arithmetic value", v.get(), false, expr_location); @@ -3239,8 +3241,8 @@ ValPtr check_and_promote(ValPtr v, } // Need to promote v to type t. - zeek::InternalTypeTag it = t->InternalType(); - zeek::InternalTypeTag vit = vt->InternalType(); + InternalTypeTag it = t->InternalType(); + InternalTypeTag vit = vt->InternalType(); if ( it == vit ) // Already has the right internal type. @@ -3249,13 +3251,13 @@ ValPtr check_and_promote(ValPtr v, ValPtr promoted_v; switch ( it ) { - case zeek::TYPE_INTERNAL_INT: - if ( ( vit == zeek::TYPE_INTERNAL_UNSIGNED || vit == zeek::TYPE_INTERNAL_DOUBLE ) && Val::WouldOverflow(vt, t, v.get()) ) + case TYPE_INTERNAL_INT: + if ( ( vit == TYPE_INTERNAL_UNSIGNED || vit == TYPE_INTERNAL_DOUBLE ) && Val::WouldOverflow(vt, t, v.get()) ) { t->Error("overflow promoting from unsigned/double to signed arithmetic value", v.get(), false, expr_location); return nullptr; } - else if ( t_tag == zeek::TYPE_INT ) + else if ( t_tag == TYPE_INT ) promoted_v = val_mgr->Int(v->CoerceToInt()); else // enum { @@ -3265,13 +3267,13 @@ ValPtr check_and_promote(ValPtr v, break; - case zeek::TYPE_INTERNAL_UNSIGNED: - if ( ( vit == zeek::TYPE_INTERNAL_DOUBLE || vit == zeek::TYPE_INTERNAL_INT) && Val::WouldOverflow(vt, t, v.get()) ) + case TYPE_INTERNAL_UNSIGNED: + if ( ( vit == TYPE_INTERNAL_DOUBLE || vit == TYPE_INTERNAL_INT) && Val::WouldOverflow(vt, t, v.get()) ) { t->Error("overflow promoting from signed/double to unsigned arithmetic value", v.get(), false, expr_location); return nullptr; } - else if ( t_tag == zeek::TYPE_COUNT || t_tag == zeek::TYPE_COUNTER ) + else if ( t_tag == TYPE_COUNT || t_tag == TYPE_COUNTER ) promoted_v = val_mgr->Count(v->CoerceToUnsigned()); else // port { @@ -3281,16 +3283,16 @@ ValPtr check_and_promote(ValPtr v, break; - case zeek::TYPE_INTERNAL_DOUBLE: + case TYPE_INTERNAL_DOUBLE: switch ( t_tag ) { - case zeek::TYPE_DOUBLE: - promoted_v = zeek::make_intrusive(v->CoerceToDouble()); + case TYPE_DOUBLE: + promoted_v = make_intrusive(v->CoerceToDouble()); break; - case zeek::TYPE_INTERVAL: - promoted_v = zeek::make_intrusive(v->CoerceToDouble()); + case TYPE_INTERVAL: + promoted_v = make_intrusive(v->CoerceToDouble()); break; - case zeek::TYPE_TIME: - promoted_v = zeek::make_intrusive(v->CoerceToDouble()); + case TYPE_TIME: + promoted_v = make_intrusive(v->CoerceToDouble()); break; default: reporter->InternalError("bad internal type in check_and_promote()"); @@ -3325,17 +3327,17 @@ bool same_atomic_val(const Val* v1, const Val* v2) return false; switch ( v1->GetType()->InternalType() ) { - case zeek::TYPE_INTERNAL_INT: + case TYPE_INTERNAL_INT: return v1->InternalInt() == v2->InternalInt(); - case zeek::TYPE_INTERNAL_UNSIGNED: + case TYPE_INTERNAL_UNSIGNED: return v1->InternalUnsigned() == v2->InternalUnsigned(); - case zeek::TYPE_INTERNAL_DOUBLE: + case TYPE_INTERNAL_DOUBLE: return v1->InternalDouble() == v2->InternalDouble(); - case zeek::TYPE_INTERNAL_STRING: + case TYPE_INTERNAL_STRING: return Bstr_eq(v1->AsString(), v2->AsString()); - case zeek::TYPE_INTERNAL_ADDR: + case TYPE_INTERNAL_ADDR: return v1->AsAddr() == v2->AsAddr(); - case zeek::TYPE_INTERNAL_SUBNET: + case TYPE_INTERNAL_SUBNET: return v1->AsSubNet() == v2->AsSubNet(); default: @@ -3391,7 +3393,7 @@ void delete_vals(val_list* vals) } } -ValPtr cast_value_to_type(Val* v, zeek::Type* t) +ValPtr cast_value_to_type(Val* v, Type* t) { // Note: when changing this function, adapt all three of // cast_value_to_type()/can_cast_value_to_type()/can_cast_value_to_type(). @@ -3402,7 +3404,7 @@ ValPtr cast_value_to_type(Val* v, zeek::Type* t) // Always allow casting to same type. This also covers casting 'any' // to the actual type. if ( same_type(v->GetType(), t) ) - return {zeek::NewRef{}, v}; + return {NewRef{}, v}; if ( same_type(v->GetType(), bro_broker::DataVal::ScriptDataType()) ) { @@ -3417,7 +3419,7 @@ ValPtr cast_value_to_type(Val* v, zeek::Type* t) return nullptr; } -bool can_cast_value_to_type(const Val* v, zeek::Type* t) +bool can_cast_value_to_type(const Val* v, Type* t) { // Note: when changing this function, adapt all three of // cast_value_to_type()/can_cast_value_to_type()/can_cast_value_to_type(). @@ -3443,7 +3445,7 @@ bool can_cast_value_to_type(const Val* v, zeek::Type* t) return false; } -bool can_cast_value_to_type(const zeek::Type* s, zeek::Type* t) +bool can_cast_value_to_type(const Type* s, Type* t) { // Note: when changing this function, adapt all three of // cast_value_to_type()/can_cast_value_to_type()/can_cast_value_to_type(). @@ -3464,22 +3466,22 @@ bool can_cast_value_to_type(const zeek::Type* s, zeek::Type* t) ValPtr Val::MakeBool(bool b) { - return zeek::IntrusivePtr{zeek::AdoptRef{}, new Val(bro_int_t(b), zeek::TYPE_BOOL)}; + return IntrusivePtr{AdoptRef{}, new Val(bro_int_t(b), TYPE_BOOL)}; } ValPtr Val::MakeInt(bro_int_t i) { - return zeek::IntrusivePtr{zeek::AdoptRef{}, new Val(i, zeek::TYPE_INT)}; + return IntrusivePtr{AdoptRef{}, new Val(i, TYPE_INT)}; } ValPtr Val::MakeCount(bro_uint_t u) { - return zeek::IntrusivePtr{zeek::AdoptRef{}, new Val(u, zeek::TYPE_COUNT)}; + return IntrusivePtr{AdoptRef{}, new Val(u, TYPE_COUNT)}; } ValManager::ValManager() { - empty_string = zeek::make_intrusive(""); + empty_string = make_intrusive(""); b_false = Val::MakeBool(false); b_true = Val::MakeBool(true); @@ -3495,7 +3497,7 @@ ValManager::ValManager() auto port_type = (TransportProto)i; for ( auto j = 0u; j < arr.size(); ++j ) - arr[j] = zeek::IntrusivePtr{zeek::AdoptRef{}, new PortVal(PortVal::Mask(j, port_type))}; + arr[j] = IntrusivePtr{AdoptRef{}, new PortVal(PortVal::Mask(j, port_type))}; } } @@ -3539,3 +3541,5 @@ PortVal* ValManager::GetPort(uint32_t port_num) const { return Port(port_num)->Ref()->AsPortVal(); } + +} diff --git a/src/Val.h b/src/Val.h index e6deffa576..fb6428b093 100644 --- a/src/Val.h +++ b/src/Val.h @@ -26,6 +26,7 @@ #define ICMP_PORT_MASK 0x30000 template class PDict; + class IterCookie; class BroString; @@ -33,6 +34,18 @@ class BroFunc; class Func; class BroFile; class PrefixTable; +class IPAddr; +class IPPrefix; +class StateAccess; +class RE_Matcher; + +class CompositeHash; +class HashKey; +class Frame; + +extern double bro_start_network_time; + +namespace zeek { using BroFilePtr = zeek::IntrusivePtr; using FuncPtr = zeek::IntrusivePtr; @@ -62,13 +75,6 @@ using TableValPtr = zeek::IntrusivePtr; using ValPtr = zeek::IntrusivePtr; using VectorValPtr = zeek::IntrusivePtr; -class IPAddr; -class IPPrefix; - -class StateAccess; - -class RE_Matcher; - union BroValUnion { // Used for bool, int, enum. bro_int_t int_val; @@ -712,8 +718,6 @@ protected: zeek::TypeTag tag; }; -extern double bro_start_network_time; - class TableEntryVal { public: explicit TableEntryVal(ValPtr v) @@ -761,10 +765,6 @@ protected: TableVal* table; }; -class CompositeHash; -class HashKey; -class Frame; - class TableVal final : public Val, public notifier::Modifiable { public: explicit TableVal(zeek::TableTypePtr t, zeek::detail::AttributesPtr attrs = nullptr); @@ -1400,3 +1400,26 @@ extern bool can_cast_value_to_type(const Val* v, zeek::Type* t); // However, even this function returns true, casting may still fail for a // specific instance later. extern bool can_cast_value_to_type(const zeek::Type* s, zeek::Type* t); + +} + +using Val [[deprecated("Remove in v4.1. Use zeek::Val instead.")]] = zeek::Val; +using PortVal [[deprecated("Remove in v4.1. Use zeek::PortVal instead.")]] = zeek::PortVal; +using AddrVal [[deprecated("Remove in v4.1. Use zeek::AddrVal instead.")]] = zeek::AddrVal; +using SubNetVal [[deprecated("Remove in v4.1. Use zeek::SubNetVal instead.")]] = zeek::SubNetVal; +using PatternVal [[deprecated("Remove in v4.1. Use zeek::PatternVal instead.")]] = zeek::PatternVal; +using TableVal [[deprecated("Remove in v4.1. Use zeek::TableVal instead.")]] = zeek::TableVal; +using TableValTimer [[deprecated("Remove in v4.1. Use zeek::TableVal instead.")]] = zeek::TableValTimer; +using RecordVal [[deprecated("Remove in v4.1. Use zeek::RecordVal instead.")]] = zeek::RecordVal; +using ListVal [[deprecated("Remove in v4.1. Use zeek::ListVal instead.")]] = zeek::ListVal; +using StringVal [[deprecated("Remove in v4.1. Use zeek::StringVal instead.")]] = zeek::StringVal; +using EnumVal [[deprecated("Remove in v4.1. Use zeek::EnumVal instead.")]] = zeek::EnumVal; +using VectorVal [[deprecated("Remove in v4.1. Use zeek::VectorVal instead.")]] = zeek::VectorVal; +using TableEntryVal [[deprecated("Remove in v4.1. Use zeek::TableEntryVal instead.")]] = zeek::TableEntryVal; +using TimeVal [[deprecated("Remove in v4.1. Use zeek::TimeVal instead.")]] = zeek::TimeVal; +using DoubleVal [[deprecated("Remove in v4.1. Use zeek::DoubleVal instead.")]] = zeek::DoubleVal; +using IntervalVal [[deprecated("Remove in v4.1. Use zeek::IntervalVal instead.")]] = zeek::IntervalVal; +using ValManager [[deprecated("Remove in v4.1. Use zeek::ValManager instead.")]] = zeek::ValManager; + +// Alias for zeek::val_mgr. +extern zeek::ValManager*& val_mgr; diff --git a/src/Var.cc b/src/Var.cc index 4ec3c6b910..1c0daa6757 100644 --- a/src/Var.cc +++ b/src/Var.cc @@ -19,9 +19,9 @@ using namespace zeek::detail; -static ValPtr init_val(zeek::detail::Expr* init, - const zeek::Type* t, - ValPtr aggr) +static zeek::ValPtr init_val(zeek::detail::Expr* init, + const zeek::Type* t, + zeek::ValPtr aggr) { try { @@ -244,11 +244,11 @@ static void make_var(const zeek::detail::IDPtr& id, zeek::TypePtr t, else if ( dt != VAR_REDEF || init || ! attr ) { - ValPtr aggr; + zeek::ValPtr aggr; if ( t->Tag() == zeek::TYPE_RECORD ) { - aggr = zeek::make_intrusive(zeek::cast_intrusive(t)); + aggr = zeek::make_intrusive(zeek::cast_intrusive(t)); if ( init && t ) // Have an initialization and type is not deduced. @@ -258,13 +258,13 @@ static void make_var(const zeek::detail::IDPtr& id, zeek::TypePtr t, } else if ( t->Tag() == zeek::TYPE_TABLE ) - aggr = zeek::make_intrusive(zeek::cast_intrusive(t), + aggr = zeek::make_intrusive(zeek::cast_intrusive(t), id->GetAttrs()); else if ( t->Tag() == zeek::TYPE_VECTOR ) - aggr = zeek::make_intrusive(zeek::cast_intrusive(t)); + aggr = zeek::make_intrusive(zeek::cast_intrusive(t)); - ValPtr v; + zeek::ValPtr v; if ( init ) { @@ -308,7 +308,7 @@ static void make_var(const zeek::detail::IDPtr& id, zeek::TypePtr t, // defined. std::vector inits; auto f = zeek::make_intrusive(id, nullptr, inits, 0, 0); - id->SetVal(zeek::make_intrusive(std::move(f))); + id->SetVal(zeek::make_intrusive(std::move(f))); } } @@ -358,7 +358,7 @@ zeek::detail::StmtPtr add_local( extern zeek::detail::ExprPtr add_and_assign_local( zeek::detail::IDPtr id, zeek::detail::ExprPtr init, - ValPtr val) + zeek::ValPtr val) { make_var(id, nullptr, zeek::detail::INIT_FULL, init, nullptr, VAR_REGULAR, false); auto name_expr = zeek::make_intrusive(std::move(id)); @@ -661,7 +661,7 @@ void end_func(zeek::detail::StmtPtr body) ingredients->frame_size, ingredients->priority); - ingredients->id->SetVal(zeek::make_intrusive(std::move(f))); + ingredients->id->SetVal(zeek::make_intrusive(std::move(f))); ingredients->id->SetConst(); } @@ -672,7 +672,7 @@ void end_func(zeek::detail::StmtPtr body) ingredients.release(); } -Val* internal_val(const char* name) +zeek::Val* internal_val(const char* name) { return zeek::id::find_val(name).get(); } @@ -697,12 +697,12 @@ id_list gather_outer_ids(Scope* scope, zeek::detail::Stmt* body) return idl; } -Val* internal_const_val(const char* name) +zeek::Val* internal_const_val(const char* name) { return zeek::id::find_const(name).get(); } -Val* opt_internal_val(const char* name) +zeek::Val* opt_internal_val(const char* name) { const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME); return id ? id->GetVal().get() : nullptr; @@ -732,7 +732,7 @@ bro_uint_t opt_internal_unsigned(const char* name) return v ? v->InternalUnsigned() : 0; } -StringVal* opt_internal_string(const char* name) +zeek::StringVal* opt_internal_string(const char* name) { const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME); if ( ! id ) return nullptr; @@ -740,7 +740,7 @@ StringVal* opt_internal_string(const char* name) return v ? v->AsStringVal() : nullptr; } -TableVal* opt_internal_table(const char* name) +zeek::TableVal* opt_internal_table(const char* name) { const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME); if ( ! id ) return nullptr; @@ -748,22 +748,22 @@ TableVal* opt_internal_table(const char* name) return v ? v->AsTableVal() : nullptr; } -ListVal* internal_list_val(const char* name) +zeek::ListVal* internal_list_val(const char* name) { const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME); if ( ! id ) return nullptr; - Val* v = id->GetVal().get(); + zeek::Val* v = id->GetVal().get(); if ( v ) { if ( v->GetType()->Tag() == zeek::TYPE_LIST ) - return (ListVal*) v; + return (zeek::ListVal*) v; else if ( v->GetType()->IsSet() ) { - TableVal* tv = v->AsTableVal(); + zeek::TableVal* tv = v->AsTableVal(); auto lv = tv->ToPureListVal(); return lv.release(); } diff --git a/src/Var.h b/src/Var.h index 5af1fb2c2f..e2b6ae9bae 100644 --- a/src/Var.h +++ b/src/Var.h @@ -8,10 +8,10 @@ class Scope; class EventHandlerPtr; -class StringVal; -class TableVal; -class ListVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(FuncType, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail); ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail); @@ -40,7 +40,7 @@ extern zeek::detail::StmtPtr add_local( extern zeek::detail::ExprPtr add_and_assign_local( zeek::detail::IDPtr id, zeek::detail::ExprPtr init, - ValPtr val = nullptr); + zeek::ValPtr val = nullptr); extern void add_type(zeek::detail::ID* id, zeek::TypePtr t, std::unique_ptr> attr); @@ -56,13 +56,13 @@ extern void end_func(zeek::detail::StmtPtr body); extern id_list gather_outer_ids(Scope* scope, zeek::detail::Stmt* body); [[deprecated("Remove in v4.1. Use zeek::id::find_val().")]] -extern Val* internal_val(const char* name); +extern zeek::Val* internal_val(const char* name); [[deprecated("Remove in v4.1. Use zeek::id::find_const().")]] -extern Val* internal_const_val(const char* name); // internal error if not const +extern zeek::Val* internal_const_val(const char* name); // internal error if not const [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]] -extern Val* opt_internal_val(const char* name); // returns nil if not defined +extern zeek::Val* opt_internal_val(const char* name); // returns nil if not defined [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]] extern double opt_internal_double(const char* name); @@ -74,13 +74,13 @@ extern bro_int_t opt_internal_int(const char* name); extern bro_uint_t opt_internal_unsigned(const char* name); [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]] -extern StringVal* opt_internal_string(const char* name); +extern zeek::StringVal* opt_internal_string(const char* name); [[deprecated("Remove in v4.1. Use zeek::id::find() or zeek::id::find_val().")]] -extern TableVal* opt_internal_table(const char* name); // nil if not defined +extern zeek::TableVal* opt_internal_table(const char* name); // nil if not defined [[deprecated("Remove in v4.1. Use zeek::id::find(), zeek::id::find_val(), and/or TableVal::ToPureListVal().")]] -extern ListVal* internal_list_val(const char* name); +extern zeek::ListVal* internal_list_val(const char* name); [[deprecated("Remove in v4.1. Use zeek::id::find_type().")]] extern zeek::Type* internal_type(const char* name); diff --git a/src/ZeekArgs.h b/src/ZeekArgs.h index 8b311f4301..6c54947de8 100644 --- a/src/ZeekArgs.h +++ b/src/ZeekArgs.h @@ -5,12 +5,12 @@ #include #include "BroList.h" -class Val; +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); namespace zeek { template class IntrusivePtr; -using Args = std::vector>; +using Args = std::vector>; /** * Converts a legacy-style argument list for use in modern Zeek function diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc index 9ebc4ccd2b..1e3fba08b5 100644 --- a/src/analyzer/Analyzer.cc +++ b/src/analyzer/Analyzer.cc @@ -710,18 +710,18 @@ void Analyzer::ProtocolViolation(const char* reason, const char* data, int len) if ( ! protocol_violation ) return; - StringValPtr r; + zeek::StringValPtr r; if ( data && len ) { const char *tmp = copy_string(reason); - r = zeek::make_intrusive(fmt("%s [%s%s]", tmp, - fmt_bytes(data, min(40, len)), - len > 40 ? "..." : "")); + r = zeek::make_intrusive(fmt("%s [%s%s]", tmp, + fmt_bytes(data, min(40, len)), + len > 40 ? "..." : "")); delete [] tmp; } else - r = zeek::make_intrusive(reason); + r = zeek::make_intrusive(reason); const auto& tval = tag.AsVal(); mgr.Enqueue(protocol_violation, ConnVal(), tval, val_mgr->Count(id), std::move(r)); @@ -783,18 +783,18 @@ unsigned int Analyzer::MemoryAllocation() const return mem; } -void Analyzer::UpdateConnVal(RecordVal *conn_val) +void Analyzer::UpdateConnVal(zeek::RecordVal *conn_val) { LOOP_OVER_CHILDREN(i) (*i)->UpdateConnVal(conn_val); } -RecordVal* Analyzer::BuildConnVal() +zeek::RecordVal* Analyzer::BuildConnVal() { return conn->ConnVal()->Ref()->AsRecordVal(); } -const RecordValPtr& Analyzer::ConnVal() +const zeek::RecordValPtr& Analyzer::ConnVal() { return conn->ConnVal(); } @@ -804,7 +804,7 @@ void Analyzer::Event(EventHandlerPtr f, const char* name) conn->Event(f, this, name); } -void Analyzer::Event(EventHandlerPtr f, Val* v1, Val* v2) +void Analyzer::Event(EventHandlerPtr f, zeek::Val* v1, zeek::Val* v2) { zeek::IntrusivePtr val1{zeek::AdoptRef{}, v1}; zeek::IntrusivePtr val2{zeek::AdoptRef{}, v2}; @@ -942,7 +942,7 @@ void TransportLayerAnalyzer::PacketContents(const u_char* data, int len) if ( packet_contents && len > 0 ) { BroString* cbs = new BroString(data, len, true); - auto contents = zeek::make_intrusive(cbs); + auto contents = zeek::make_intrusive(cbs); EnqueueConnEvent(packet_contents, ConnVal(), std::move(contents)); } } diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h index 8aa1491bca..99ab5f3a20 100644 --- a/src/analyzer/Analyzer.h +++ b/src/analyzer/Analyzer.h @@ -23,6 +23,10 @@ class Rule; class Connection; class IP_Hdr; +namespace zeek { +using RecordValPtr = zeek::IntrusivePtr; +} + namespace analyzer { namespace tcp { class TCP_ApplicationAnalyzer; } @@ -37,8 +41,6 @@ using analyzer_list = std::list; typedef uint32_t ID; typedef void (Analyzer::*analyzer_timer_func)(double t); -using RecordValPtr = zeek::IntrusivePtr; - /** * Class to receive processed output from an anlyzer. */ @@ -547,20 +549,20 @@ public: * * @param conn_val The connenction value being updated. */ - virtual void UpdateConnVal(RecordVal *conn_val); + virtual void UpdateConnVal(zeek::RecordVal *conn_val); /** * Convenience function that forwards directly to * Connection::BuildConnVal(). */ [[deprecated("Remove in v4.1. Use ConnVal() instead.")]] - RecordVal* BuildConnVal(); + zeek::RecordVal* BuildConnVal(); /** * Convenience function that forwards directly to * Connection::ConnVal(). */ - const RecordValPtr& ConnVal(); + const zeek::RecordValPtr& ConnVal(); /** * Convenience function that forwards directly to the corresponding @@ -573,7 +575,7 @@ public: * Connection::Event(). */ [[deprecated("Remove in v4.1. Use EnqueueConnEvent() instead (note it doesn't automatically ad the connection argument).")]] - void Event(EventHandlerPtr f, Val* v1, Val* v2 = nullptr); + void Event(EventHandlerPtr f, zeek::Val* v1, zeek::Val* v2 = nullptr); /** * Convenience function that forwards directly to @@ -607,8 +609,8 @@ public: */ template std::enable_if_t< - std::is_convertible_v< - std::tuple_element_t<0, std::tuple>, ValPtr>> + std::is_convertible_v< + std::tuple_element_t<0, std::tuple>, zeek::ValPtr>> EnqueueConnEvent(EventHandlerPtr h, Args&&... args) { return EnqueueConnEvent(h, zeek::Args{std::forward(args)...}); } diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc index 88bf70eaf5..c3ab9101e8 100644 --- a/src/analyzer/Manager.cc +++ b/src/analyzer/Manager.cc @@ -154,7 +154,7 @@ bool Manager::EnableAnalyzer(const Tag& tag) return true; } -bool Manager::EnableAnalyzer(EnumVal* val) +bool Manager::EnableAnalyzer(zeek::EnumVal* val) { Component* p = Lookup(val); @@ -180,7 +180,7 @@ bool Manager::DisableAnalyzer(const Tag& tag) return true; } -bool Manager::DisableAnalyzer(EnumVal* val) +bool Manager::DisableAnalyzer(zeek::EnumVal* val) { Component* p = Lookup(val); @@ -220,7 +220,7 @@ bool Manager::IsEnabled(const Tag& tag) return p->Enabled(); } -bool Manager::IsEnabled(EnumVal* val) +bool Manager::IsEnabled(zeek::EnumVal* val) { Component* p = Lookup(val); @@ -231,7 +231,7 @@ bool Manager::IsEnabled(EnumVal* val) } -bool Manager::RegisterAnalyzerForPort(EnumVal* val, PortVal* port) +bool Manager::RegisterAnalyzerForPort(zeek::EnumVal* val, zeek::PortVal* port) { Component* p = Lookup(val); @@ -241,7 +241,7 @@ bool Manager::RegisterAnalyzerForPort(EnumVal* val, PortVal* port) return RegisterAnalyzerForPort(p->Tag(), port->PortType(), port->Port()); } -bool Manager::UnregisterAnalyzerForPort(EnumVal* val, PortVal* port) +bool Manager::UnregisterAnalyzerForPort(zeek::EnumVal* val, zeek::PortVal* port) { Component* p = Lookup(val); @@ -353,7 +353,7 @@ Manager::tag_set* Manager::LookupPort(TransportProto proto, uint32_t port, bool return l; } -Manager::tag_set* Manager::LookupPort(PortVal* val, bool add_if_not_found) +Manager::tag_set* Manager::LookupPort(zeek::PortVal* val, bool add_if_not_found) { return LookupPort(val->PortType(), val->Port(), add_if_not_found); } @@ -438,8 +438,8 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn) if ( tcp_contents && ! reass ) { - static auto tcp_content_delivery_ports_orig = zeek::id::find_val("tcp_content_delivery_ports_orig"); - static auto tcp_content_delivery_ports_resp = zeek::id::find_val("tcp_content_delivery_ports_resp"); + static auto tcp_content_delivery_ports_orig = zeek::id::find_val("tcp_content_delivery_ports_orig"); + static auto tcp_content_delivery_ports_resp = zeek::id::find_val("tcp_content_delivery_ports_resp"); const auto& dport = val_mgr->Port(ntohs(conn->RespPort()), TRANSPORT_TCP); if ( ! reass ) @@ -462,8 +462,8 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn) uint16_t resp_port = ntohs(conn->RespPort()); if ( resp_port == 22 || resp_port == 23 || resp_port == 513 ) { - static auto stp_skip_src = zeek::id::find_val("stp_skip_src"); - auto src = zeek::make_intrusive(conn->OrigAddr()); + static auto stp_skip_src = zeek::id::find_val("stp_skip_src"); + auto src = zeek::make_intrusive(conn->OrigAddr()); if ( ! stp_skip_src->FindOrDefault(src) ) tcp->AddChildAnalyzer(new stepping_stone::SteppingStone_Analyzer(conn), false); @@ -573,10 +573,10 @@ void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, ScheduleAnalyzer(orig, resp, resp_p, proto, tag, timeout); } -void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, PortVal* resp_p, - Val* analyzer, double timeout) +void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, zeek::PortVal* resp_p, + zeek::Val* analyzer, double timeout) { - EnumValPtr ev{zeek::NewRef{}, analyzer->AsEnumVal()}; + zeek::EnumValPtr ev{zeek::NewRef{}, analyzer->AsEnumVal()}; return ScheduleAnalyzer(orig, resp, resp_p->Port(), resp_p->PortType(), Tag(std::move(ev)), timeout); } diff --git a/src/analyzer/Manager.h b/src/analyzer/Manager.h index 123851016d..147534c692 100644 --- a/src/analyzer/Manager.h +++ b/src/analyzer/Manager.h @@ -101,7 +101,7 @@ public: * * @return True if successful. */ - bool EnableAnalyzer(EnumVal* tag); + bool EnableAnalyzer(zeek::EnumVal* tag); /** * Enables an analyzer type. Disabled analyzers will not be @@ -122,7 +122,7 @@ public: * * @return True if successful. */ - bool DisableAnalyzer(EnumVal* tag); + bool DisableAnalyzer(zeek::EnumVal* tag); /** * Disables all currently registered analyzers. @@ -150,7 +150,7 @@ public: * @param tag The analyzer's tag as an enum of script type \c * Analyzer::Tag. */ - bool IsEnabled(EnumVal* tag); + bool IsEnabled(zeek::EnumVal* tag); /** * Registers a well-known port for an analyzer. Once registered, @@ -164,7 +164,7 @@ public: * * @return True if successful. */ - bool RegisterAnalyzerForPort(EnumVal* tag, PortVal* port); + bool RegisterAnalyzerForPort(zeek::EnumVal* tag, zeek::PortVal* port); /** * Registers a well-known port for an analyzer. Once registered, @@ -193,7 +193,7 @@ public: * registered for the analyzer). * */ - bool UnregisterAnalyzerForPort(EnumVal* tag, PortVal* port); + bool UnregisterAnalyzerForPort(zeek::EnumVal* tag, zeek::PortVal* port); /** * Unregisters a well-known port for an anlyzers. @@ -269,7 +269,7 @@ public: * schedule this analyzer. Must be non-zero. */ void ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, uint16_t resp_p, - TransportProto proto, const Tag& analyzer, double timeout); + TransportProto proto, const Tag& analyzer, double timeout); /** * Schedules a particular analyzer for an upcoming connection. Once @@ -293,8 +293,8 @@ public: * schedule this analyzer. Must be non-zero. */ void ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, uint16_t resp_p, - TransportProto proto, const char* analyzer, - double timeout); + TransportProto proto, const char* analyzer, + double timeout); /** * Searched for analyzers scheduled to be attached to a given connection @@ -311,7 +311,8 @@ public: * * @return True if at least one scheduled analyzer was found. */ - bool ApplyScheduledAnalyzers(Connection* conn, bool init_and_event = true, TransportLayerAnalyzer* parent = nullptr); + bool ApplyScheduledAnalyzers(Connection* conn, bool init_and_event = true, + TransportLayerAnalyzer* parent = nullptr); /** * Schedules a particular analyzer for an upcoming connection. Once @@ -332,8 +333,8 @@ public: * @param timeout An interval after which to timeout the request to * schedule this analyzer. Must be non-zero. */ - void ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, PortVal* resp_p, - Val* analyzer, double timeout); + void ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, zeek::PortVal* resp_p, + zeek::Val* analyzer, double timeout); /** * @return the UDP port numbers to be associated with VXLAN traffic. @@ -346,7 +347,7 @@ private: using tag_set = std::set; using analyzer_map_by_port = std::map; - tag_set* LookupPort(PortVal* val, bool add_if_not_found); + tag_set* LookupPort(zeek::PortVal* val, bool add_if_not_found); tag_set* LookupPort(TransportProto proto, uint32_t port, bool add_if_not_found); tag_set GetScheduled(const Connection* conn); diff --git a/src/analyzer/Tag.cc b/src/analyzer/Tag.cc index bc6b71e3af..5af0adfaf7 100644 --- a/src/analyzer/Tag.cc +++ b/src/analyzer/Tag.cc @@ -16,20 +16,20 @@ analyzer::Tag& analyzer::Tag::operator=(const analyzer::Tag& other) return *this; } -const EnumValPtr& analyzer::Tag::AsVal() const +const zeek::EnumValPtr& analyzer::Tag::AsVal() const { return ::Tag::AsVal(analyzer_mgr->GetTagType()); } -EnumVal* analyzer::Tag::AsEnumVal() const +zeek::EnumVal* analyzer::Tag::AsEnumVal() const { return AsVal().get(); } -analyzer::Tag::Tag(EnumValPtr val) +analyzer::Tag::Tag(zeek::EnumValPtr val) : ::Tag(std::move(val)) { } -analyzer::Tag::Tag(EnumVal* val) +analyzer::Tag::Tag(zeek::EnumVal* val) : ::Tag({zeek::NewRef{}, val}) { } diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h index 2d757e16fa..ce968f1a06 100644 --- a/src/analyzer/Tag.h +++ b/src/analyzer/Tag.h @@ -1,3 +1,4 @@ + // See the file "COPYING" in the main distribution directory for copyright. #pragma once @@ -5,7 +6,7 @@ #include "zeek-config.h" #include "../Tag.h" -class EnumVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek); namespace zeek::plugin { template class TaggedComponent; @@ -89,10 +90,10 @@ public: * * @param etype the script-layer enum type associated with the tag. */ - const EnumValPtr& AsVal() const; + const zeek::EnumValPtr& AsVal() const; [[deprecated("Remove in v4.1. Use AsVal() instead.")]] - EnumVal* AsEnumVal() const; + zeek::EnumVal* AsEnumVal() const; static const Tag Error; @@ -118,10 +119,10 @@ protected: * * @param val An enum value of script type \c Analyzer::Tag. */ - explicit Tag(EnumValPtr val); + explicit Tag(zeek::EnumValPtr val); [[deprecated("Remove in v4.1. Construct from IntrusivePtr instead")]] - explicit Tag(EnumVal* val); + explicit Tag(zeek::EnumVal* val); }; } diff --git a/src/analyzer/analyzer.bif b/src/analyzer/analyzer.bif index 8a8ade4d5f..5a4e95d20d 100644 --- a/src/analyzer/analyzer.bif +++ b/src/analyzer/analyzer.bif @@ -42,7 +42,7 @@ function Analyzer::__schedule_analyzer%(orig: addr, resp: addr, resp_p: port, function __name%(atype: Analyzer::Tag%) : string %{ const auto& n = analyzer_mgr->GetComponentName(zeek::IntrusivePtr{zeek::NewRef{}, atype->AsEnumVal()}); - return zeek::make_intrusive(n); + return zeek::make_intrusive(n); %} function __tag%(name: string%) : Analyzer::Tag diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc index ea9b12a96d..73b7fe96a6 100644 --- a/src/analyzer/protocol/arp/ARP.cc +++ b/src/analyzer/protocol/arp/ARP.cc @@ -196,7 +196,7 @@ void ARP_Analyzer::BadARP(const struct arp_pkthdr* hdr, const char* msg) ToEthAddrStr((const u_char*) ar_sha(hdr)), ToAddrVal(ar_tpa(hdr)), ToEthAddrStr((const u_char*) ar_tha(hdr)), - zeek::make_intrusive(msg) + zeek::make_intrusive(msg) ); } @@ -223,22 +223,22 @@ void ARP_Analyzer::RREvent(EventHandlerPtr e, ); } -AddrVal* ARP_Analyzer::ConstructAddrVal(const void* addr) +zeek::AddrVal* ARP_Analyzer::ConstructAddrVal(const void* addr) { return ToAddrVal(addr).release(); } -AddrValPtr ARP_Analyzer::ToAddrVal(const void* addr) +zeek::AddrValPtr ARP_Analyzer::ToAddrVal(const void* addr) { // ### For now, we only handle IPv4 addresses. - return zeek::make_intrusive(*(const uint32_t*) addr); + return zeek::make_intrusive(*(const uint32_t*) addr); } -StringVal* ARP_Analyzer::EthAddrToStr(const u_char* addr) +zeek::StringVal* ARP_Analyzer::EthAddrToStr(const u_char* addr) { return ToEthAddrStr(addr).release(); } -StringValPtr ARP_Analyzer::ToEthAddrStr(const u_char* addr) +zeek::StringValPtr ARP_Analyzer::ToEthAddrStr(const u_char* addr) { char buf[1024]; snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x", addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); - return zeek::make_intrusive(buf); + return zeek::make_intrusive(buf); } diff --git a/src/analyzer/protocol/arp/ARP.h b/src/analyzer/protocol/arp/ARP.h index a7d933d1ed..36322ce8d2 100644 --- a/src/analyzer/protocol/arp/ARP.h +++ b/src/analyzer/protocol/arp/ARP.h @@ -47,12 +47,12 @@ public: protected: [[deprecated("Remove in v4.1. Use ToAddrVal().")]] - AddrVal* ConstructAddrVal(const void* addr); + zeek::AddrVal* ConstructAddrVal(const void* addr); [[deprecated("Remove in v4.1. Use ToEthAddrStr().")]] - StringVal* EthAddrToStr(const u_char* addr); + zeek::StringVal* EthAddrToStr(const u_char* addr); - AddrValPtr ToAddrVal(const void* addr); - StringValPtr ToEthAddrStr(const u_char* addr); + zeek::AddrValPtr ToAddrVal(const void* addr); + zeek::StringValPtr ToEthAddrStr(const u_char* addr); void BadARP(const struct arp_pkthdr* hdr, const char* string); void Corrupted(const char* string); }; diff --git a/src/analyzer/protocol/asn1/asn1.pac b/src/analyzer/protocol/asn1/asn1.pac index ceb43920ef..ef715b0b6f 100644 --- a/src/analyzer/protocol/asn1/asn1.pac +++ b/src/analyzer/protocol/asn1/asn1.pac @@ -3,12 +3,12 @@ %} %header{ - ValPtr asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t); - ValPtr asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t); - StringValPtr asn1_oid_to_val(const ASN1Encoding* oid); - StringValPtr asn1_oid_to_val(const ASN1ObjectIdentifier* oid); - StringValPtr asn1_octet_string_to_val(const ASN1Encoding* s); - StringValPtr asn1_octet_string_to_val(const ASN1OctetString* s); + zeek::ValPtr asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t); + zeek::ValPtr asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t); + zeek::StringValPtr asn1_oid_to_val(const ASN1Encoding* oid); + zeek::StringValPtr asn1_oid_to_val(const ASN1ObjectIdentifier* oid); + zeek::StringValPtr asn1_octet_string_to_val(const ASN1Encoding* s); + zeek::StringValPtr asn1_octet_string_to_val(const ASN1OctetString* s); %} ############################## ASN.1 Encodings @@ -102,12 +102,12 @@ function binary_to_int64(bs: bytestring): int64 %code{ -ValPtr asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t) +zeek::ValPtr asn1_integer_to_val(const ASN1Integer* i, zeek::TypeTag t) { return asn1_integer_to_val(i->encoding(), t); } -ValPtr asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t) +zeek::ValPtr asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t) { auto v = binary_to_int64(i->content()); @@ -125,12 +125,12 @@ ValPtr asn1_integer_to_val(const ASN1Encoding* i, zeek::TypeTag t) } } -StringValPtr asn1_oid_to_val(const ASN1ObjectIdentifier* oid) +zeek::StringValPtr asn1_oid_to_val(const ASN1ObjectIdentifier* oid) { return asn1_oid_to_val(oid->encoding()); } -StringValPtr asn1_oid_to_val(const ASN1Encoding* oid) +zeek::StringValPtr asn1_oid_to_val(const ASN1Encoding* oid) { vector oid_components; vector > subidentifiers; @@ -191,17 +191,17 @@ StringValPtr asn1_oid_to_val(const ASN1Encoding* oid) } } - return zeek::make_intrusive(rval); + return zeek::make_intrusive(rval); } -StringValPtr asn1_octet_string_to_val(const ASN1OctetString* s) +zeek::StringValPtr asn1_octet_string_to_val(const ASN1OctetString* s) { return asn1_octet_string_to_val(s->encoding()); } -StringValPtr asn1_octet_string_to_val(const ASN1Encoding* s) +zeek::StringValPtr asn1_octet_string_to_val(const ASN1Encoding* s) { bytestring const& bs = s->content(); - return zeek::make_intrusive(bs.length(), reinterpret_cast(bs.data())); + return zeek::make_intrusive(bs.length(), reinterpret_cast(bs.data())); } %} diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.cc b/src/analyzer/protocol/bittorrent/BitTorrent.cc index 84bca00c39..fd57281b1b 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrent.cc +++ b/src/analyzer/protocol/bittorrent/BitTorrent.cc @@ -120,8 +120,7 @@ void BitTorrent_Analyzer::DeliverWeird(const char* msg, bool orig) { if ( bittorrent_peer_weird ) EnqueueConnEvent(bittorrent_peer_weird, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(msg) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(msg)); } diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc index 4c1347ea50..46dc594732 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc +++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc @@ -45,7 +45,7 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c) req_buf_pos = req_buf; req_buf_len = 0; req_val_uri = nullptr; - req_val_headers = new TableVal(bt_tracker_headers); + req_val_headers = new zeek::TableVal(bt_tracker_headers); res_state = BTT_RES_STATUS; res_allow_blank_line = false; @@ -53,9 +53,9 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c) res_buf_pos = res_buf; res_buf_len = 0; res_status = 0; - res_val_headers = new TableVal(bt_tracker_headers); - res_val_peers = new TableVal(bittorrent_peer_set); - res_val_benc = new TableVal(bittorrent_benc_dir); + res_val_headers = new zeek::TableVal(bt_tracker_headers); + res_val_peers = new zeek::TableVal(bittorrent_peer_set); + res_val_benc = new zeek::TableVal(bittorrent_benc_dir); InitBencParser(); @@ -136,7 +136,7 @@ void BitTorrentTracker_Analyzer::ClientRequest(int len, const u_char* data) req_buf_len -= (req_buf_pos - req_buf); memmove(req_buf, req_buf_pos, req_buf_len); req_buf_pos = req_buf; - req_val_headers = new TableVal(bt_tracker_headers); + req_val_headers = new zeek::TableVal(bt_tracker_headers); } } } @@ -198,9 +198,9 @@ void BitTorrentTracker_Analyzer::ServerReply(int len, const u_char* data) res_buf_pos = res_buf; res_status = 0; - res_val_headers = new TableVal(bt_tracker_headers); - res_val_peers = new TableVal(bittorrent_peer_set); - res_val_benc = new TableVal(bittorrent_benc_dir); + res_val_headers = new zeek::TableVal(bt_tracker_headers); + res_val_peers = new zeek::TableVal(bittorrent_peer_set); + res_val_benc = new zeek::TableVal(bittorrent_benc_dir); InitBencParser(); } @@ -248,7 +248,7 @@ void BitTorrentTracker_Analyzer::DeliverWeird(const char* msg, bool orig) EnqueueConnEvent(bt_tracker_weird, ConnVal(), val_mgr->Bool(orig), - zeek::make_intrusive(msg) + zeek::make_intrusive(msg) ); } @@ -338,7 +338,7 @@ bool BitTorrentTracker_Analyzer::ParseRequest(char* line) void BitTorrentTracker_Analyzer::RequestGet(char* uri) { - req_val_uri = new StringVal(uri); + req_val_uri = new zeek::StringVal(uri); } void BitTorrentTracker_Analyzer::EmitRequest(void) @@ -456,8 +456,8 @@ void BitTorrentTracker_Analyzer::ParseHeader(char* name, char* value, } #ifdef BTTRACKER_STORE_HEADERS - StringVal* name_ = new StringVal(name); - StringVal* value_ = new StringVal(value); + zeek::StringVal* name_ = new zeek::StringVal(name); + zeek::StringVal* value_ = new zeek::StringVal(value); (is_request ? req_val_headers : res_val_headers)->Assign(name_, value_); Unref(name_); @@ -478,17 +478,17 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name, uint32_t ad = extract_uint32((u_char*) value); uint16_t pt = ntohs((value[4] << 8) | value[5]); - auto peer = zeek::make_intrusive(bittorrent_peer); - peer->Assign(0, zeek::make_intrusive(ad)); + auto peer = zeek::make_intrusive(bittorrent_peer); + peer->Assign(0, zeek::make_intrusive(ad)); peer->Assign(1, val_mgr->Port(pt, TRANSPORT_TCP)); res_val_peers->Assign(std::move(peer), nullptr); } } else { - auto name_ = zeek::make_intrusive(name_len, name); - auto benc_value = zeek::make_intrusive(bittorrent_benc_value); - benc_value->Assign(type, zeek::make_intrusive(value_len, value)); + auto name_ = zeek::make_intrusive(name_len, name); + auto benc_value = zeek::make_intrusive(bittorrent_benc_value); + benc_value->Assign(type, zeek::make_intrusive(value_len, value)); res_val_benc->Assign(std::move(name_), std::move(benc_value)); } } @@ -496,8 +496,8 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name, void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name, enum btt_benc_types type, bro_int_t value) { - auto benc_value = zeek::make_intrusive(bittorrent_benc_value); - auto name_ = zeek::make_intrusive(name_len, name); + auto benc_value = zeek::make_intrusive(bittorrent_benc_value); + auto name_ = zeek::make_intrusive(name_len, name); benc_value->Assign(type, val_mgr->Int(value)); res_val_benc->Assign(std::move(name_), std::move(benc_value)); diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h index 5fbaba7a15..f737a13c8a 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h +++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h @@ -6,7 +6,7 @@ #define BTTRACKER_BUF 2048 -class StringVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek); namespace analyzer { namespace bittorrent { @@ -92,8 +92,8 @@ protected: char req_buf[BTTRACKER_BUF]; char* req_buf_pos; unsigned int req_buf_len; - StringVal* req_val_uri; - TableVal* req_val_headers; + zeek::StringVal* req_val_uri; + zeek::TableVal* req_val_headers; // Response. enum btt_states res_state; @@ -102,9 +102,9 @@ protected: char* res_buf_pos; unsigned int res_buf_len; bro_uint_t res_status; - TableVal* res_val_headers; - TableVal* res_val_peers; - TableVal* res_val_benc; + zeek::TableVal* res_val_headers; + zeek::TableVal* res_val_peers; + zeek::TableVal* res_val_benc; std::vector benc_stack; std::vector benc_count; diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc index 0d40d41fd5..88943ba115 100644 --- a/src/analyzer/protocol/conn-size/ConnSize.cc +++ b/src/analyzer/protocol/conn-size/ConnSize.cc @@ -94,7 +94,7 @@ void ConnSize_Analyzer::CheckThresholds(bool is_orig) { EnqueueConnEvent(conn_duration_threshold_crossed, ConnVal(), - zeek::make_intrusive(duration_thresh), + zeek::make_intrusive(duration_thresh), val_mgr->Bool(is_orig) ); duration_thresh = 0; @@ -167,11 +167,11 @@ void ConnSize_Analyzer::SetDurationThreshold(double duration) CheckThresholds(true); } -void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val) +void ConnSize_Analyzer::UpdateConnVal(zeek::RecordVal *conn_val) { // RecordType *connection_type is decleared in NetVar.h - RecordVal* orig_endp = conn_val->GetField("orig")->AsRecordVal(); - RecordVal* resp_endp = conn_val->GetField("resp")->AsRecordVal(); + zeek::RecordVal* orig_endp = conn_val->GetField("orig")->AsRecordVal(); + zeek::RecordVal* resp_endp = conn_val->GetField("resp")->AsRecordVal(); // endpoint is the RecordType from NetVar.h int pktidx = zeek::id::endpoint->FieldOffset("num_pkts"); diff --git a/src/analyzer/protocol/conn-size/ConnSize.h b/src/analyzer/protocol/conn-size/ConnSize.h index 241e67877a..a6360440a4 100644 --- a/src/analyzer/protocol/conn-size/ConnSize.h +++ b/src/analyzer/protocol/conn-size/ConnSize.h @@ -17,7 +17,7 @@ public: void Done() override; // from Analyzer.h - void UpdateConnVal(RecordVal *conn_val) override; + void UpdateConnVal(zeek::RecordVal *conn_val) override; void FlipRoles() override; void SetByteAndPacketThreshold(uint64_t threshold, bool bytes, bool orig); @@ -50,4 +50,4 @@ protected: double duration_thresh; }; -} } // namespace analyzer::* +} } // namespace analyzer::* diff --git a/src/analyzer/protocol/conn-size/functions.bif b/src/analyzer/protocol/conn-size/functions.bif index 8753ae8a32..60471595b6 100644 --- a/src/analyzer/protocol/conn-size/functions.bif +++ b/src/analyzer/protocol/conn-size/functions.bif @@ -3,7 +3,7 @@ #include "Reporter.h" #include "Sessions.h" -static analyzer::Analyzer* GetConnsizeAnalyzer(Val* cid) +static analyzer::Analyzer* GetConnsizeAnalyzer(zeek::Val* cid) { Connection* c = sessions->FindConnection(cid); if ( ! c ) @@ -139,7 +139,7 @@ function get_current_conn_duration_threshold%(cid: conn_id%): interval %{ analyzer::Analyzer* a = GetConnsizeAnalyzer(cid); if ( ! a ) - return zeek::make_intrusive(0.0); + return zeek::make_intrusive(0.0); - return zeek::make_intrusive(static_cast(a)->GetDurationThreshold()); + return zeek::make_intrusive(static_cast(a)->GetDurationThreshold()); %} diff --git a/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac b/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac index 8862c58ab8..eaddc49381 100644 --- a/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac +++ b/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac @@ -83,14 +83,14 @@ refine connection DCE_RPC_Conn += { %{ if ( dce_rpc_bind_ack ) { - StringValPtr sec_addr; + zeek::StringValPtr sec_addr; // Remove the null from the end of the string if it's there. if ( ${bind.sec_addr}.length() > 0 && *(${bind.sec_addr}.begin() + ${bind.sec_addr}.length()) == 0 ) - sec_addr = zeek::make_intrusive(${bind.sec_addr}.length()-1, (const char*) ${bind.sec_addr}.begin()); + sec_addr = zeek::make_intrusive(${bind.sec_addr}.length()-1, (const char*) ${bind.sec_addr}.begin()); else - sec_addr = zeek::make_intrusive(${bind.sec_addr}.length(), (const char*) ${bind.sec_addr}.begin()); + sec_addr = zeek::make_intrusive(${bind.sec_addr}.length(), (const char*) ${bind.sec_addr}.begin()); zeek::BifEvent::enqueue_dce_rpc_bind_ack(bro_analyzer(), bro_analyzer()->Conn(), diff --git a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac index 7c4f88452e..4ffbc680ab 100644 --- a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac +++ b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac @@ -1,8 +1,8 @@ refine flow DHCP_Flow += { %member{ - RecordValPtr options; - VectorValPtr all_options; + zeek::RecordValPtr options; + zeek::VectorValPtr all_options; %} %init{ @@ -19,8 +19,8 @@ refine flow DHCP_Flow += { %{ if ( ! options ) { - options = zeek::make_intrusive(zeek::BifType::Record::DHCP::Options); - all_options = zeek::make_intrusive(zeek::id::index_vec); + options = zeek::make_intrusive(zeek::BifType::Record::DHCP::Options); + all_options = zeek::make_intrusive(zeek::id::index_vec); options->Assign(0, all_options); } @@ -53,17 +53,17 @@ refine flow DHCP_Flow += { std::string mac_str = fmt_mac(${msg.chaddr}.data(), ${msg.chaddr}.length()); double secs = static_cast(${msg.secs}); - auto dhcp_msg_val = zeek::make_intrusive(zeek::BifType::Record::DHCP::Msg); + auto dhcp_msg_val = zeek::make_intrusive(zeek::BifType::Record::DHCP::Msg); dhcp_msg_val->Assign(0, val_mgr->Count(${msg.op})); dhcp_msg_val->Assign(1, val_mgr->Count(${msg.type})); dhcp_msg_val->Assign(2, val_mgr->Count(${msg.xid})); - dhcp_msg_val->Assign(3, zeek::make_intrusive(secs)); + dhcp_msg_val->Assign(3, zeek::make_intrusive(secs)); dhcp_msg_val->Assign(4, val_mgr->Count(${msg.flags})); - dhcp_msg_val->Assign(5, zeek::make_intrusive(htonl(${msg.ciaddr}))); - dhcp_msg_val->Assign(6, zeek::make_intrusive(htonl(${msg.yiaddr}))); - dhcp_msg_val->Assign(7, zeek::make_intrusive(htonl(${msg.siaddr}))); - dhcp_msg_val->Assign(8, zeek::make_intrusive(htonl(${msg.giaddr}))); - dhcp_msg_val->Assign(9, zeek::make_intrusive(mac_str)); + dhcp_msg_val->Assign(5, zeek::make_intrusive(htonl(${msg.ciaddr}))); + dhcp_msg_val->Assign(6, zeek::make_intrusive(htonl(${msg.yiaddr}))); + dhcp_msg_val->Assign(7, zeek::make_intrusive(htonl(${msg.siaddr}))); + dhcp_msg_val->Assign(8, zeek::make_intrusive(htonl(${msg.giaddr}))); + dhcp_msg_val->Assign(9, zeek::make_intrusive(mac_str)); int last_non_null = 0; @@ -74,7 +74,7 @@ refine flow DHCP_Flow += { } if ( last_non_null > 0 ) - dhcp_msg_val->Assign(10, zeek::make_intrusive(last_non_null + 1, + dhcp_msg_val->Assign(10, zeek::make_intrusive(last_non_null + 1, reinterpret_cast(${msg.sname}.begin()))); last_non_null = 0; @@ -86,7 +86,7 @@ refine flow DHCP_Flow += { } if ( last_non_null > 0 ) - dhcp_msg_val->Assign(11, zeek::make_intrusive(last_non_null + 1, + dhcp_msg_val->Assign(11, zeek::make_intrusive(last_non_null + 1, reinterpret_cast(${msg.file_n}.begin()))); init_options(); diff --git a/src/analyzer/protocol/dhcp/dhcp-options.pac b/src/analyzer/protocol/dhcp/dhcp-options.pac index 3f5e0eb834..2f80ce4517 100644 --- a/src/analyzer/protocol/dhcp/dhcp-options.pac +++ b/src/analyzer/protocol/dhcp/dhcp-options.pac @@ -11,7 +11,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_subnet_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(1, zeek::make_intrusive(htonl(${v.subnet}))); + ${context.flow}->options->Assign(1, zeek::make_intrusive(htonl(${v.subnet}))); return true; %} }; @@ -57,14 +57,14 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_router_option(v: OptionValue): bool %{ - auto router_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); + auto router_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); int num_routers = ${v.router_list}->size(); vector* rlist = ${v.router_list}; for ( int i = 0; i < num_routers; ++i ) { uint32 raddr = (*rlist)[i]; - router_list->Assign(i, zeek::make_intrusive(htonl(raddr))); + router_list->Assign(i, zeek::make_intrusive(htonl(raddr))); } ${context.flow}->options->Assign(2, std::move(router_list)); @@ -91,14 +91,14 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_timeserver_option(v: OptionValue): bool %{ - auto timeserver_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); + auto timeserver_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); int num_servers = ${v.timeserver_list}->size(); vector* rlist = ${v.timeserver_list}; for ( int i = 0; i < num_servers; ++i ) { uint32 raddr = (*rlist)[i]; - timeserver_list->Assign(i, zeek::make_intrusive(htonl(raddr))); + timeserver_list->Assign(i, zeek::make_intrusive(htonl(raddr))); } ${context.flow}->options->Assign(26, std::move(timeserver_list)); @@ -125,14 +125,14 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_nameserver_option(v: OptionValue): bool %{ - auto nameserver_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); + auto nameserver_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); int num_servers = ${v.nameserver_list}->size(); vector* rlist = ${v.nameserver_list}; for ( int i = 0; i < num_servers; ++i ) { uint32 raddr = (*rlist)[i]; - nameserver_list->Assign(i, zeek::make_intrusive(htonl(raddr))); + nameserver_list->Assign(i, zeek::make_intrusive(htonl(raddr))); } ${context.flow}->options->Assign(27, std::move(nameserver_list)); @@ -159,14 +159,14 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_dns_server_option(v: OptionValue): bool %{ - auto server_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); + auto server_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); int num_servers = ${v.dns_server_list}->size(); vector* rlist = ${v.dns_server_list}; for ( int i = 0; i < num_servers; ++i ) { uint32 raddr = (*rlist)[i]; - server_list->Assign(i, zeek::make_intrusive(htonl(raddr))); + server_list->Assign(i, zeek::make_intrusive(htonl(raddr))); } ${context.flow}->options->Assign(3, std::move(server_list)); @@ -192,7 +192,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_host_name_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(4, zeek::make_intrusive(${v.host_name}.length(), + ${context.flow}->options->Assign(4, zeek::make_intrusive(${v.host_name}.length(), reinterpret_cast(${v.host_name}.begin()))); return true; @@ -225,7 +225,7 @@ refine flow DHCP_Flow += { last_non_null = i; } - ${context.flow}->options->Assign(5, zeek::make_intrusive(last_non_null == 0 ? 0 : last_non_null + 1, + ${context.flow}->options->Assign(5, zeek::make_intrusive(last_non_null == 0 ? 0 : last_non_null + 1, reinterpret_cast(${v.domain_name}.begin()))); return true; @@ -274,7 +274,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_broadcast_address_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(7, zeek::make_intrusive(htonl(${v.broadcast_address}))); + ${context.flow}->options->Assign(7, zeek::make_intrusive(htonl(${v.broadcast_address}))); return true; %} @@ -298,14 +298,14 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_ntpserver_option(v: OptionValue): bool %{ - auto ntpserver_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); + auto ntpserver_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); int num_servers = ${v.ntpserver_list}->size(); vector* rlist = ${v.ntpserver_list}; for ( int i = 0; i < num_servers; ++i ) { uint32 raddr = (*rlist)[i]; - ntpserver_list->Assign(i, zeek::make_intrusive(htonl(raddr))); + ntpserver_list->Assign(i, zeek::make_intrusive(htonl(raddr))); } ${context.flow}->options->Assign(28, std::move(ntpserver_list)); @@ -331,7 +331,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_vendor_specific_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(8, zeek::make_intrusive(${v.vendor_specific}.length(), + ${context.flow}->options->Assign(8, zeek::make_intrusive(${v.vendor_specific}.length(), reinterpret_cast(${v.vendor_specific}.begin()))); return true; @@ -356,14 +356,14 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_nbns_option(v: OptionValue): bool %{ - auto server_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); + auto server_list = zeek::make_intrusive(zeek::BifType::Vector::DHCP::Addrs); int num_servers = ${v.nbns}->size(); vector* rlist = ${v.nbns}; for ( int i = 0; i < num_servers; ++i ) { uint32 raddr = (*rlist)[i]; - server_list->Assign(i, zeek::make_intrusive(htonl(raddr))); + server_list->Assign(i, zeek::make_intrusive(htonl(raddr))); } ${context.flow}->options->Assign(9, std::move(server_list)); @@ -389,7 +389,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_addr_request_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(10, zeek::make_intrusive(htonl(${v.addr_request}))); + ${context.flow}->options->Assign(10, zeek::make_intrusive(htonl(${v.addr_request}))); return true; %} @@ -414,7 +414,7 @@ refine flow DHCP_Flow += { function process_lease_option(v: OptionValue): bool %{ double lease = static_cast(${v.lease}); - ${context.flow}->options->Assign(11, zeek::make_intrusive(lease)); + ${context.flow}->options->Assign(11, zeek::make_intrusive(lease)); return true; %} @@ -438,7 +438,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_serv_id_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(12, zeek::make_intrusive(htonl(${v.serv_addr}))); + ${context.flow}->options->Assign(12, zeek::make_intrusive(htonl(${v.serv_addr}))); return true; %} @@ -462,7 +462,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_par_req_list_option(v: OptionValue): bool %{ - auto params = zeek::make_intrusive(zeek::id::index_vec); + auto params = zeek::make_intrusive(zeek::id::index_vec); int num_parms = ${v.par_req_list}->size(); vector* plist = ${v.par_req_list}; @@ -496,7 +496,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_message_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(14, zeek::make_intrusive(${v.message}.length(), + ${context.flow}->options->Assign(14, zeek::make_intrusive(${v.message}.length(), reinterpret_cast(${v.message}.begin()))); return true; @@ -546,7 +546,7 @@ refine flow DHCP_Flow += { function process_renewal_time_option(v: OptionValue): bool %{ double renewal_time = static_cast(${v.renewal_time}); - ${context.flow}->options->Assign(16, zeek::make_intrusive(renewal_time)); + ${context.flow}->options->Assign(16, zeek::make_intrusive(renewal_time)); return true; %} @@ -571,7 +571,7 @@ refine flow DHCP_Flow += { function process_rebinding_time_option(v: OptionValue): bool %{ double rebinding_time = static_cast(${v.rebinding_time}); - ${context.flow}->options->Assign(17, zeek::make_intrusive(rebinding_time)); + ${context.flow}->options->Assign(17, zeek::make_intrusive(rebinding_time)); return true; %} @@ -595,7 +595,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_vendor_class_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(18, zeek::make_intrusive(${v.vendor_class}.length(), + ${context.flow}->options->Assign(18, zeek::make_intrusive(${v.vendor_class}.length(), reinterpret_cast(${v.vendor_class}.begin()))); return true; @@ -625,15 +625,15 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_client_id_option(v: OptionValue): bool %{ - auto client_id = zeek::make_intrusive(zeek::BifType::Record::DHCP::ClientID); + auto client_id = zeek::make_intrusive(zeek::BifType::Record::DHCP::ClientID); client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype})); - StringValPtr sv; + zeek::StringValPtr sv; if ( ${v.client_id.hwtype} == 0 ) - sv = zeek::make_intrusive(${v.client_id.hwaddr}.length(), + sv = zeek::make_intrusive(${v.client_id.hwaddr}.length(), (const char*)${v.client_id.hwaddr}.begin()); else - sv = zeek::make_intrusive(fmt_mac(${v.client_id.hwaddr}.begin(), + sv = zeek::make_intrusive(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length())); client_id->Assign(1, std::move(sv)); @@ -662,7 +662,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_user_class_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(20, zeek::make_intrusive(${v.user_class}.length(), + ${context.flow}->options->Assign(20, zeek::make_intrusive(${v.user_class}.length(), reinterpret_cast(${v.user_class}.begin()))); return true; @@ -694,12 +694,12 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_client_fqdn_option(v: OptionValue): bool %{ - auto client_fqdn = zeek::make_intrusive(zeek::BifType::Record::DHCP::ClientFQDN); + auto client_fqdn = zeek::make_intrusive(zeek::BifType::Record::DHCP::ClientFQDN); client_fqdn->Assign(0, val_mgr->Count(${v.client_fqdn.flags})); client_fqdn->Assign(1, val_mgr->Count(${v.client_fqdn.rcode1})); client_fqdn->Assign(2, val_mgr->Count(${v.client_fqdn.rcode2})); const char* domain_name = reinterpret_cast(${v.client_fqdn.domain_name}.begin()); - client_fqdn->Assign(3, zeek::make_intrusive(${v.client_fqdn.domain_name}.length(), domain_name)); + client_fqdn->Assign(3, zeek::make_intrusive(${v.client_fqdn.domain_name}.length(), domain_name)); ${context.flow}->options->Assign(21, std::move(client_fqdn)); @@ -752,14 +752,14 @@ refine flow DHCP_Flow += { function process_relay_agent_inf_option(v: OptionValue): bool %{ - auto relay_agent_sub_opt = zeek::make_intrusive(zeek::BifType::Vector::DHCP::SubOpts); + auto relay_agent_sub_opt = zeek::make_intrusive(zeek::BifType::Vector::DHCP::SubOpts); uint16 i = 0; for ( auto ptrsubopt = ${v.relay_agent_inf}->begin(); ptrsubopt != ${v.relay_agent_inf}->end(); ++ptrsubopt ) { - auto r = zeek::make_intrusive(zeek::BifType::Record::DHCP::SubOpt); + auto r = zeek::make_intrusive(zeek::BifType::Record::DHCP::SubOpt); r->Assign(0, val_mgr->Count((*ptrsubopt)->code())); r->Assign(1, to_stringval((*ptrsubopt)->value())); @@ -818,7 +818,7 @@ refine flow DHCP_Flow += { if ( string_len == 0 ) { - ${context.flow}->options->Assign(24, zeek::make_intrusive(0, "")); + ${context.flow}->options->Assign(24, zeek::make_intrusive(0, "")); return true; } @@ -830,7 +830,7 @@ refine flow DHCP_Flow += { if ( has_newline ) --string_len; - ${context.flow}->options->Assign(24, zeek::make_intrusive(string_len, + ${context.flow}->options->Assign(24, zeek::make_intrusive(string_len, reinterpret_cast(${v.auto_proxy_config}.begin()))); return true; diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc index fdf73e8537..45cc9b0b9d 100644 --- a/src/analyzer/protocol/dns/DNS.cc +++ b/src/analyzer/protocol/dns/DNS.cc @@ -89,9 +89,9 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query) int skip_addl = dns_skip_all_addl; if ( msg.ancount > 0 ) { // We did an answer, so can potentially skip auth/addl. - static auto dns_skip_auth = zeek::id::find_val("dns_skip_auth"); - static auto dns_skip_addl = zeek::id::find_val("dns_skip_addl"); - auto server = zeek::make_intrusive(analyzer->Conn()->RespAddr()); + static auto dns_skip_auth = zeek::id::find_val("dns_skip_auth"); + static auto dns_skip_addl = zeek::id::find_val("dns_skip_addl"); + auto server = zeek::make_intrusive(analyzer->Conn()->RespAddr()); skip_auth = skip_auth || msg.nscount == 0 || dns_skip_auth->FindOrDefault(server); @@ -238,7 +238,7 @@ bool DNS_Interpreter::ParseAnswer(DNS_MsgInfo* msg, // Note that the exact meaning of some of these fields will be // re-interpreted by other, more adventurous RR types. - msg->query_name = zeek::make_intrusive(new BroString(name, name_end - name, true)); + msg->query_name = zeek::make_intrusive(new BroString(name, name_end - name, true)); msg->atype = RR_Type(ExtractShort(data, len)); msg->aclass = ExtractShort(data, len); msg->ttl = ExtractLong(data, len); @@ -562,7 +562,7 @@ bool DNS_Interpreter::ParseRR_Name(DNS_MsgInfo* msg, analyzer->ConnVal(), msg->BuildHdrVal(), msg->BuildAnswerVal(), - zeek::make_intrusive(new BroString(name, name_end - name, true)) + zeek::make_intrusive(new BroString(name, name_end - name, true)) ); return true; @@ -603,14 +603,14 @@ bool DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg, if ( dns_SOA_reply && ! msg->skip_event ) { static auto dns_soa = zeek::id::find_type("dns_soa"); - auto r = zeek::make_intrusive(dns_soa); - r->Assign(0, zeek::make_intrusive(new BroString(mname, mname_end - mname, true))); - r->Assign(1, zeek::make_intrusive(new BroString(rname, rname_end - rname, true))); + auto r = zeek::make_intrusive(dns_soa); + r->Assign(0, zeek::make_intrusive(new BroString(mname, mname_end - mname, true))); + r->Assign(1, zeek::make_intrusive(new BroString(rname, rname_end - rname, true))); r->Assign(2, val_mgr->Count(serial)); - r->Assign(3, zeek::make_intrusive(double(refresh), Seconds)); - r->Assign(4, zeek::make_intrusive(double(retry), Seconds)); - r->Assign(5, zeek::make_intrusive(double(expire), Seconds)); - r->Assign(6, zeek::make_intrusive(double(minimum), Seconds)); + r->Assign(3, zeek::make_intrusive(double(refresh), Seconds)); + r->Assign(4, zeek::make_intrusive(double(retry), Seconds)); + r->Assign(5, zeek::make_intrusive(double(expire), Seconds)); + r->Assign(6, zeek::make_intrusive(double(minimum), Seconds)); analyzer->EnqueueConnEvent(dns_SOA_reply, analyzer->ConnVal(), @@ -646,7 +646,7 @@ bool DNS_Interpreter::ParseRR_MX(DNS_MsgInfo* msg, analyzer->ConnVal(), msg->BuildHdrVal(), msg->BuildAnswerVal(), - zeek::make_intrusive(new BroString(name, name_end - name, true)), + zeek::make_intrusive(new BroString(name, name_end - name, true)), val_mgr->Count(preference) ); @@ -687,7 +687,7 @@ bool DNS_Interpreter::ParseRR_SRV(DNS_MsgInfo* msg, analyzer->ConnVal(), msg->BuildHdrVal(), msg->BuildAnswerVal(), - zeek::make_intrusive(new BroString(name, name_end - name, true)), + zeek::make_intrusive(new BroString(name, name_end - name, true)), val_mgr->Count(priority), val_mgr->Count(weight), val_mgr->Count(port) @@ -1009,7 +1009,7 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg, int typebitmaps_len = rdlength - (data - data_start); - auto char_strings = zeek::make_intrusive(zeek::id::string_vec); + auto char_strings = zeek::make_intrusive(zeek::id::string_vec); while ( typebitmaps_len > 0 && len > 0 ) { @@ -1024,7 +1024,7 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg, } BroString* bitmap = ExtractStream(data, len, bmlen); - char_strings->Assign(char_strings->Size(), zeek::make_intrusive(bitmap)); + char_strings->Assign(char_strings->Size(), zeek::make_intrusive(bitmap)); typebitmaps_len = typebitmaps_len - (2 + bmlen); } @@ -1033,7 +1033,7 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg, analyzer->ConnVal(), msg->BuildHdrVal(), msg->BuildAnswerVal(), - zeek::make_intrusive(new BroString(name, name_end - name, true)), + zeek::make_intrusive(new BroString(name, name_end - name, true)), std::move(char_strings) ); @@ -1084,7 +1084,7 @@ bool DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg, int typebitmaps_len = rdlength - (data - data_start); - auto char_strings = zeek::make_intrusive(zeek::id::string_vec); + auto char_strings = zeek::make_intrusive(zeek::id::string_vec); while ( typebitmaps_len > 0 && len > 0 ) { @@ -1099,7 +1099,7 @@ bool DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg, } BroString* bitmap = ExtractStream(data, len, bmlen); - char_strings->Assign(char_strings->Size(), zeek::make_intrusive(bitmap)); + char_strings->Assign(char_strings->Size(), zeek::make_intrusive(bitmap)); typebitmaps_len = typebitmaps_len - (2 + bmlen); } @@ -1200,7 +1200,7 @@ bool DNS_Interpreter::ParseRR_A(DNS_MsgInfo* msg, analyzer->ConnVal(), msg->BuildHdrVal(), msg->BuildAnswerVal(), - zeek::make_intrusive(htonl(addr)) + zeek::make_intrusive(htonl(addr)) ); return true; @@ -1236,7 +1236,7 @@ bool DNS_Interpreter::ParseRR_AAAA(DNS_MsgInfo* msg, analyzer->ConnVal(), msg->BuildHdrVal(), msg->BuildAnswerVal(), - zeek::make_intrusive(addr) + zeek::make_intrusive(addr) ); return true; @@ -1260,7 +1260,7 @@ bool DNS_Interpreter::ParseRR_HINFO(DNS_MsgInfo* msg, return true; } -static StringValPtr +static zeek::StringValPtr extract_char_string(analyzer::Analyzer* analyzer, const u_char*& data, int& len, int& rdlen) { @@ -1279,7 +1279,7 @@ extract_char_string(analyzer::Analyzer* analyzer, return nullptr; } - auto rval = zeek::make_intrusive(str_size, reinterpret_cast(data)); + auto rval = zeek::make_intrusive(str_size, reinterpret_cast(data)); rdlen -= str_size; len -= str_size; @@ -1299,8 +1299,8 @@ bool DNS_Interpreter::ParseRR_TXT(DNS_MsgInfo* msg, return true; } - auto char_strings = zeek::make_intrusive(zeek::id::string_vec); - StringValPtr char_string; + auto char_strings = zeek::make_intrusive(zeek::id::string_vec); + zeek::StringValPtr char_string; while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) ) char_strings->Assign(char_strings->Size(), std::move(char_string)); @@ -1327,8 +1327,8 @@ bool DNS_Interpreter::ParseRR_SPF(DNS_MsgInfo* msg, return true; } - auto char_strings = zeek::make_intrusive(zeek::id::string_vec); - StringValPtr char_string; + auto char_strings = zeek::make_intrusive(zeek::id::string_vec); + zeek::StringValPtr char_string; while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) ) char_strings->Assign(char_strings->Size(), std::move(char_string)); @@ -1380,8 +1380,8 @@ bool DNS_Interpreter::ParseRR_CAA(DNS_MsgInfo* msg, msg->BuildHdrVal(), msg->BuildAnswerVal(), val_mgr->Count(flags), - zeek::make_intrusive(tag), - zeek::make_intrusive(value) + zeek::make_intrusive(tag), + zeek::make_intrusive(value) ); else { @@ -1407,10 +1407,10 @@ void DNS_Interpreter::SendReplyOrRejectEvent(DNS_MsgInfo* msg, analyzer->EnqueueConnEvent(event, analyzer->ConnVal(), msg->BuildHdrVal(), - zeek::make_intrusive(question_name), + zeek::make_intrusive(question_name), val_mgr->Count(qtype), val_mgr->Count(qclass), - zeek::make_intrusive(original_name) + zeek::make_intrusive(original_name) ); } @@ -1446,10 +1446,10 @@ DNS_MsgInfo::DNS_MsgInfo(DNS_RawMsgHdr* hdr, int arg_is_query) skip_event = 0; } -RecordValPtr DNS_MsgInfo::BuildHdrVal() +zeek::RecordValPtr DNS_MsgInfo::BuildHdrVal() { static auto dns_msg = zeek::id::find_type("dns_msg"); - auto r = zeek::make_intrusive(dns_msg); + auto r = zeek::make_intrusive(dns_msg); r->Assign(0, val_mgr->Count(id)); r->Assign(1, val_mgr->Count(opcode)); @@ -1468,26 +1468,26 @@ RecordValPtr DNS_MsgInfo::BuildHdrVal() return r; } -RecordValPtr DNS_MsgInfo::BuildAnswerVal() +zeek::RecordValPtr DNS_MsgInfo::BuildAnswerVal() { static auto dns_answer = zeek::id::find_type("dns_answer"); - auto r = zeek::make_intrusive(dns_answer); + auto r = zeek::make_intrusive(dns_answer); r->Assign(0, val_mgr->Count(int(answer_type))); r->Assign(1, query_name); r->Assign(2, val_mgr->Count(atype)); r->Assign(3, val_mgr->Count(aclass)); - r->Assign(4, zeek::make_intrusive(double(ttl), Seconds)); + r->Assign(4, zeek::make_intrusive(double(ttl), Seconds)); return r; } -RecordValPtr DNS_MsgInfo::BuildEDNS_Val() +zeek::RecordValPtr DNS_MsgInfo::BuildEDNS_Val() { // We have to treat the additional record type in EDNS differently // than a regular resource record. static auto dns_edns_additional = zeek::id::find_type("dns_edns_additional"); - auto r = zeek::make_intrusive(dns_edns_additional); + auto r = zeek::make_intrusive(dns_edns_additional); r->Assign(0, val_mgr->Count(int(answer_type))); r->Assign(1, query_name); @@ -1512,25 +1512,25 @@ RecordValPtr DNS_MsgInfo::BuildEDNS_Val() r->Assign(4, val_mgr->Count(return_error)); r->Assign(5, val_mgr->Count(version)); r->Assign(6, val_mgr->Count(z)); - r->Assign(7, zeek::make_intrusive(double(ttl), Seconds)); + r->Assign(7, zeek::make_intrusive(double(ttl), Seconds)); r->Assign(8, val_mgr->Count(is_query)); return r; } -RecordValPtr DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig) +zeek::RecordValPtr DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig) { static auto dns_tsig_additional = zeek::id::find_type("dns_tsig_additional"); - auto r = zeek::make_intrusive(dns_tsig_additional); + auto r = zeek::make_intrusive(dns_tsig_additional); double rtime = tsig->time_s + tsig->time_ms / 1000.0; // r->Assign(0, val_mgr->Count(int(answer_type))); r->Assign(0, query_name); r->Assign(1, val_mgr->Count(int(answer_type))); - r->Assign(2, zeek::make_intrusive(tsig->alg_name)); - r->Assign(3, zeek::make_intrusive(tsig->sig)); - r->Assign(4, zeek::make_intrusive(rtime)); - r->Assign(5, zeek::make_intrusive(double(tsig->fudge))); + r->Assign(2, zeek::make_intrusive(tsig->alg_name)); + r->Assign(3, zeek::make_intrusive(tsig->sig)); + r->Assign(4, zeek::make_intrusive(rtime)); + r->Assign(5, zeek::make_intrusive(double(tsig->fudge))); r->Assign(6, val_mgr->Count(tsig->orig_id)); r->Assign(7, val_mgr->Count(tsig->rr_error)); r->Assign(8, val_mgr->Count(is_query)); @@ -1538,47 +1538,47 @@ RecordValPtr DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig) return r; } -RecordValPtr DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig) +zeek::RecordValPtr DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig) { static auto dns_rrsig_rr = zeek::id::find_type("dns_rrsig_rr"); - auto r = zeek::make_intrusive(dns_rrsig_rr); + auto r = zeek::make_intrusive(dns_rrsig_rr); r->Assign(0, query_name); r->Assign(1, val_mgr->Count(int(answer_type))); r->Assign(2, val_mgr->Count(rrsig->type_covered)); r->Assign(3, val_mgr->Count(rrsig->algorithm)); r->Assign(4, val_mgr->Count(rrsig->labels)); - r->Assign(5, zeek::make_intrusive(double(rrsig->orig_ttl), Seconds)); - r->Assign(6, zeek::make_intrusive(double(rrsig->sig_exp))); - r->Assign(7, zeek::make_intrusive(double(rrsig->sig_incep))); + r->Assign(5, zeek::make_intrusive(double(rrsig->orig_ttl), Seconds)); + r->Assign(6, zeek::make_intrusive(double(rrsig->sig_exp))); + r->Assign(7, zeek::make_intrusive(double(rrsig->sig_incep))); r->Assign(8, val_mgr->Count(rrsig->key_tag)); - r->Assign(9, zeek::make_intrusive(rrsig->signer_name)); - r->Assign(10, zeek::make_intrusive(rrsig->signature)); + r->Assign(9, zeek::make_intrusive(rrsig->signer_name)); + r->Assign(10, zeek::make_intrusive(rrsig->signature)); r->Assign(11, val_mgr->Count(is_query)); return r; } -RecordValPtr DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey) +zeek::RecordValPtr DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey) { static auto dns_dnskey_rr = zeek::id::find_type("dns_dnskey_rr"); - auto r = zeek::make_intrusive(dns_dnskey_rr); + auto r = zeek::make_intrusive(dns_dnskey_rr); r->Assign(0, query_name); r->Assign(1, val_mgr->Count(int(answer_type))); r->Assign(2, val_mgr->Count(dnskey->dflags)); r->Assign(3, val_mgr->Count(dnskey->dprotocol)); r->Assign(4, val_mgr->Count(dnskey->dalgorithm)); - r->Assign(5, zeek::make_intrusive(dnskey->public_key)); + r->Assign(5, zeek::make_intrusive(dnskey->public_key)); r->Assign(6, val_mgr->Count(is_query)); return r; } -RecordValPtr DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3) +zeek::RecordValPtr DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3) { static auto dns_nsec3_rr = zeek::id::find_type("dns_nsec3_rr"); - auto r = zeek::make_intrusive(dns_nsec3_rr); + auto r = zeek::make_intrusive(dns_nsec3_rr); r->Assign(0, query_name); r->Assign(1, val_mgr->Count(int(answer_type))); @@ -1586,26 +1586,26 @@ RecordValPtr DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3) r->Assign(3, val_mgr->Count(nsec3->nsec_hash_algo)); r->Assign(4, val_mgr->Count(nsec3->nsec_iter)); r->Assign(5, val_mgr->Count(nsec3->nsec_salt_len)); - r->Assign(6, zeek::make_intrusive(nsec3->nsec_salt)); + r->Assign(6, zeek::make_intrusive(nsec3->nsec_salt)); r->Assign(7, val_mgr->Count(nsec3->nsec_hlen)); - r->Assign(8, zeek::make_intrusive(nsec3->nsec_hash)); + r->Assign(8, zeek::make_intrusive(nsec3->nsec_hash)); r->Assign(9, std::move(nsec3->bitmaps)); r->Assign(10, val_mgr->Count(is_query)); return r; } -RecordValPtr DNS_MsgInfo::BuildDS_Val(DS_DATA* ds) +zeek::RecordValPtr DNS_MsgInfo::BuildDS_Val(DS_DATA* ds) { static auto dns_ds_rr = zeek::id::find_type("dns_ds_rr"); - auto r = zeek::make_intrusive(dns_ds_rr); + auto r = zeek::make_intrusive(dns_ds_rr); r->Assign(0, query_name); r->Assign(1, val_mgr->Count(int(answer_type))); r->Assign(2, val_mgr->Count(ds->key_tag)); r->Assign(3, val_mgr->Count(ds->algorithm)); r->Assign(4, val_mgr->Count(ds->digest_type)); - r->Assign(5, zeek::make_intrusive(ds->digest_val)); + r->Assign(5, zeek::make_intrusive(ds->digest_val)); r->Assign(6, val_mgr->Count(is_query)); return r; diff --git a/src/analyzer/protocol/dns/DNS.h b/src/analyzer/protocol/dns/DNS.h index 51875dc08d..c9952e96ec 100644 --- a/src/analyzer/protocol/dns/DNS.h +++ b/src/analyzer/protocol/dns/DNS.h @@ -165,7 +165,7 @@ struct NSEC3_DATA { BroString* nsec_salt; unsigned short nsec_hlen; BroString* nsec_hash; - VectorValPtr bitmaps; + zeek::VectorValPtr bitmaps; }; struct DS_DATA { @@ -179,14 +179,14 @@ class DNS_MsgInfo { public: DNS_MsgInfo(DNS_RawMsgHdr* hdr, int is_query); - RecordValPtr BuildHdrVal(); - RecordValPtr BuildAnswerVal(); - RecordValPtr BuildEDNS_Val(); - RecordValPtr BuildTSIG_Val(struct TSIG_DATA*); - RecordValPtr BuildRRSIG_Val(struct RRSIG_DATA*); - RecordValPtr BuildDNSKEY_Val(struct DNSKEY_DATA*); - RecordValPtr BuildNSEC3_Val(struct NSEC3_DATA*); - RecordValPtr BuildDS_Val(struct DS_DATA*); + zeek::RecordValPtr BuildHdrVal(); + zeek::RecordValPtr BuildAnswerVal(); + zeek::RecordValPtr BuildEDNS_Val(); + zeek::RecordValPtr BuildTSIG_Val(struct TSIG_DATA*); + zeek::RecordValPtr BuildRRSIG_Val(struct RRSIG_DATA*); + zeek::RecordValPtr BuildDNSKEY_Val(struct DNSKEY_DATA*); + zeek::RecordValPtr BuildNSEC3_Val(struct NSEC3_DATA*); + zeek::RecordValPtr BuildDS_Val(struct DS_DATA*); int id; int opcode; ///< query type, see DNS_Opcode @@ -203,7 +203,7 @@ public: int arcount; ///< number of additional RRs int is_query; ///< whether it came from the session initiator - StringValPtr query_name; + zeek::StringValPtr query_name; RR_Type atype; int aclass; ///< normally = 1, inet uint32_t ttl; diff --git a/src/analyzer/protocol/file/File.cc b/src/analyzer/protocol/file/File.cc index f43f00df95..9a313e3883 100644 --- a/src/analyzer/protocol/file/File.cc +++ b/src/analyzer/protocol/file/File.cc @@ -82,8 +82,8 @@ void File_Analyzer::Identify() EnqueueConnEvent( file_transferred, ConnVal(), - zeek::make_intrusive(buffer_len, buffer), - zeek::make_intrusive(""), - zeek::make_intrusive(match) + zeek::make_intrusive(buffer_len, buffer), + zeek::make_intrusive(""), + zeek::make_intrusive(match) ); } diff --git a/src/analyzer/protocol/finger/Finger.cc b/src/analyzer/protocol/finger/Finger.cc index faf19582e3..1790fa2341 100644 --- a/src/analyzer/protocol/finger/Finger.cc +++ b/src/analyzer/protocol/finger/Finger.cc @@ -70,8 +70,8 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig EnqueueConnEvent(finger_request, ConnVal(), val_mgr->Bool(long_cnt), - zeek::make_intrusive(at - line, line), - zeek::make_intrusive(end_of_line - host, host) + zeek::make_intrusive(at - line, line), + zeek::make_intrusive(end_of_line - host, host) ); Conn()->Match(Rule::FINGER, (const u_char *) line, @@ -87,7 +87,7 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig EnqueueConnEvent(finger_reply, ConnVal(), - zeek::make_intrusive(end_of_line - line, line) + zeek::make_intrusive(end_of_line - line, line) ); } } diff --git a/src/analyzer/protocol/ftp/FTP.cc b/src/analyzer/protocol/ftp/FTP.cc index d2b00b7ee7..080c2bb654 100644 --- a/src/analyzer/protocol/ftp/FTP.cc +++ b/src/analyzer/protocol/ftp/FTP.cc @@ -82,7 +82,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig) { int cmd_len; const char* cmd; - StringVal* cmd_str; + zeek::StringVal* cmd_str; line = skip_whitespace(line, end_of_line); get_word(end_of_line - line, line, cmd_len, cmd); @@ -91,15 +91,15 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig) if ( cmd_len == 0 ) { // Weird("FTP command missing", end_of_line - orig_line, orig_line); - cmd_str = new StringVal(""); + cmd_str = new zeek::StringVal(""); } else - cmd_str = (new StringVal(cmd_len, cmd))->ToUpper(); + cmd_str = (new zeek::StringVal(cmd_len, cmd))->ToUpper(); vl = { ConnVal(), zeek::IntrusivePtr{zeek::AdoptRef{}, cmd_str}, - zeek::make_intrusive(end_of_line - line, line), + zeek::make_intrusive(end_of_line - line, line), }; f = ftp_request; @@ -178,7 +178,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig) vl = { ConnVal(), val_mgr->Count(reply_code), - zeek::make_intrusive(end_of_line - line, line), + zeek::make_intrusive(end_of_line - line, line), val_mgr->Bool(cont_resp) }; @@ -216,7 +216,7 @@ void FTP_ADAT_Analyzer::DeliverStream(int len, const u_char* data, bool orig) if ( strncmp(cmd, "ADAT", cmd_len) == 0 ) { line = skip_whitespace(line + cmd_len, end_of_line); - StringVal encoded(end_of_line - line, line); + zeek::StringVal encoded(end_of_line - line, line); decoded_adat = decode_base64(encoded.AsString(), nullptr, Conn()); if ( first_token ) @@ -291,7 +291,7 @@ void FTP_ADAT_Analyzer::DeliverStream(int len, const u_char* data, bool orig) if ( end_of_line - line >= 5 && strncmp(line, "ADAT=", 5) == 0 ) { line += 5; - StringVal encoded(end_of_line - line, line); + zeek::StringVal encoded(end_of_line - line, line); decoded_adat = decode_base64(encoded.AsString(), nullptr, Conn()); } diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif index 527d6cf370..fff440d27b 100644 --- a/src/analyzer/protocol/ftp/functions.bif +++ b/src/analyzer/protocol/ftp/functions.bif @@ -4,9 +4,9 @@ type ftp_port: record; %%{ #include "Reporter.h" -static ValPtr parse_port(const char* line) +static zeek::ValPtr parse_port(const char* line) { - auto r = zeek::make_intrusive(zeek::BifType::Record::ftp_port); + auto r = zeek::make_intrusive(zeek::BifType::Record::ftp_port); int bytes[6]; if ( line && sscanf(line, "%d,%d,%d,%d,%d,%d", @@ -33,13 +33,13 @@ static ValPtr parse_port(const char* line) good = 0; } - r->Assign(0, zeek::make_intrusive(htonl(addr))); + r->Assign(0, zeek::make_intrusive(htonl(addr))); r->Assign(1, val_mgr->Port(port, TRANSPORT_TCP)); r->Assign(2, val_mgr->Bool(good)); } else { - r->Assign(0, zeek::make_intrusive(uint32_t(0))); + r->Assign(0, zeek::make_intrusive(uint32_t(0))); r->Assign(1, val_mgr->Port(0, TRANSPORT_TCP)); r->Assign(2, val_mgr->False()); } @@ -47,9 +47,9 @@ static ValPtr parse_port(const char* line) return r; } -static ValPtr parse_eftp(const char* line) +static zeek::ValPtr parse_eftp(const char* line) { - auto r = zeek::make_intrusive(zeek::BifType::Record::ftp_port); + auto r = zeek::make_intrusive(zeek::BifType::Record::ftp_port); int net_proto = 0; // currently not used IPAddr addr; // unspecified IPv6 address (all 128 bits zero) @@ -109,7 +109,7 @@ static ValPtr parse_eftp(const char* line) } - r->Assign(0, zeek::make_intrusive(addr)); + r->Assign(0, zeek::make_intrusive(addr)); r->Assign(1, val_mgr->Port(port, TRANSPORT_TCP)); r->Assign(2, val_mgr->Bool(good)); @@ -206,10 +206,10 @@ function fmt_ftp_port%(a: addr, p: port%): string { uint32_t a = ntohl(addr[0]); uint32_t pn = p->Port(); - return zeek::make_intrusive(fmt("%d,%d,%d,%d,%d,%d", - a >> 24, (a >> 16) & 0xff, - (a >> 8) & 0xff, a & 0xff, - pn >> 8, pn & 0xff)); + return zeek::make_intrusive(fmt("%d,%d,%d,%d,%d,%d", + a >> 24, (a >> 16) & 0xff, + (a >> 8) & 0xff, a & 0xff, + pn >> 8, pn & 0xff)); } else { diff --git a/src/analyzer/protocol/gnutella/Gnutella.cc b/src/analyzer/protocol/gnutella/Gnutella.cc index 940b7692c1..5ac04baeec 100644 --- a/src/analyzer/protocol/gnutella/Gnutella.cc +++ b/src/analyzer/protocol/gnutella/Gnutella.cc @@ -72,11 +72,10 @@ void Gnutella_Analyzer::Done() { if ( ! p->msg_sent && p->msg_pos ) EnqueueConnEvent(gnutella_partial_binary_msg, - ConnVal(), - zeek::make_intrusive(p->msg), - val_mgr->Bool((i == 0)), - val_mgr->Count(p->msg_pos) - ); + ConnVal(), + zeek::make_intrusive(p->msg), + val_mgr->Bool((i == 0)), + val_mgr->Count(p->msg_pos)); else if ( ! p->msg_sent && p->payload_left ) SendEvents(p, (i == 0)); @@ -177,10 +176,9 @@ void Gnutella_Analyzer::DeliverLines(int len, const u_char* data, bool orig) { if ( gnutella_text_msg ) EnqueueConnEvent(gnutella_text_msg, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(ms->headers.data()) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(ms->headers.data())); ms->headers = ""; state |= new_state; @@ -215,17 +213,16 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig) if ( gnutella_binary_msg ) EnqueueConnEvent(gnutella_binary_msg, - ConnVal(), - val_mgr->Bool(is_orig), - val_mgr->Count(p->msg_type), - val_mgr->Count(p->msg_ttl), - val_mgr->Count(p->msg_hops), - val_mgr->Count(p->msg_len), - zeek::make_intrusive(p->payload), - val_mgr->Count(p->payload_len), - val_mgr->Bool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))), - val_mgr->Bool((p->payload_left == 0)) - ); + ConnVal(), + val_mgr->Bool(is_orig), + val_mgr->Count(p->msg_type), + val_mgr->Count(p->msg_ttl), + val_mgr->Count(p->msg_hops), + val_mgr->Count(p->msg_len), + zeek::make_intrusive(p->payload), + val_mgr->Count(p->payload_len), + val_mgr->Bool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))), + val_mgr->Bool((p->payload_left == 0))); } diff --git a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac index 316dca5f52..0b8ec914d3 100644 --- a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac +++ b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac @@ -4,9 +4,9 @@ %} %code{ -RecordValPtr BuildGTPv1Hdr(const GTPv1_Header* pdu) +zeek::RecordValPtr BuildGTPv1Hdr(const GTPv1_Header* pdu) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::gtpv1_hdr); + auto rv = zeek::make_intrusive(zeek::BifType::Record::gtpv1_hdr); rv->Assign(0, val_mgr->Count(pdu->version())); rv->Assign(1, val_mgr->Bool(pdu->pt_flag())); @@ -28,14 +28,14 @@ RecordValPtr BuildGTPv1Hdr(const GTPv1_Header* pdu) return rv; } -static ValPtr BuildIMSI(const InformationElement* ie) +static zeek::ValPtr BuildIMSI(const InformationElement* ie) { return val_mgr->Count(ie->imsi()->value()); } -static ValPtr BuildRAI(const InformationElement* ie) +static zeek::ValPtr BuildRAI(const InformationElement* ie) { - auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_rai); + auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_rai); ev->Assign(0, val_mgr->Count(ie->rai()->mcc())); ev->Assign(1, val_mgr->Count(ie->rai()->mnc())); ev->Assign(2, val_mgr->Count(ie->rai()->lac())); @@ -43,49 +43,49 @@ static ValPtr BuildRAI(const InformationElement* ie) return ev; } -static ValPtr BuildRecovery(const InformationElement* ie) +static zeek::ValPtr BuildRecovery(const InformationElement* ie) { return val_mgr->Count(ie->recovery()->restart_counter()); } -static ValPtr BuildSelectionMode(const InformationElement* ie) +static zeek::ValPtr BuildSelectionMode(const InformationElement* ie) { return val_mgr->Count(ie->selection_mode()->mode()); } -static ValPtr BuildTEID1(const InformationElement* ie) +static zeek::ValPtr BuildTEID1(const InformationElement* ie) { return val_mgr->Count(ie->teid1()->value()); } -static ValPtr BuildTEID_ControlPlane(const InformationElement* ie) +static zeek::ValPtr BuildTEID_ControlPlane(const InformationElement* ie) { return val_mgr->Count(ie->teidcp()->value()); } -static ValPtr BuildNSAPI(const InformationElement* ie) +static zeek::ValPtr BuildNSAPI(const InformationElement* ie) { return val_mgr->Count(ie->nsapi()->nsapi()); } -static ValPtr BuildChargingCharacteristics(const InformationElement* ie) +static zeek::ValPtr BuildChargingCharacteristics(const InformationElement* ie) { return val_mgr->Count(ie->charging_characteristics()->value()); } -static ValPtr BuildTraceReference(const InformationElement* ie) +static zeek::ValPtr BuildTraceReference(const InformationElement* ie) { return val_mgr->Count(ie->trace_reference()->value()); } -static ValPtr BuildTraceType(const InformationElement* ie) +static zeek::ValPtr BuildTraceType(const InformationElement* ie) { return val_mgr->Count(ie->trace_type()->value()); } -ValPtr BuildEndUserAddr(const InformationElement* ie) +zeek::ValPtr BuildEndUserAddr(const InformationElement* ie) { - auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_end_user_addr); + auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_end_user_addr); ev->Assign(0, val_mgr->Count(ie->end_user_addr()->pdp_type_org())); ev->Assign(1, val_mgr->Count(ie->end_user_addr()->pdp_type_num())); @@ -97,15 +97,15 @@ ValPtr BuildEndUserAddr(const InformationElement* ie) switch ( ie->end_user_addr()->pdp_type_num() ) { case 0x21: - ev->Assign(2, zeek::make_intrusive( + ev->Assign(2, zeek::make_intrusive( IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); break; case 0x57: - ev->Assign(2, zeek::make_intrusive( + ev->Assign(2, zeek::make_intrusive( IPAddr(IPv6, (const uint32*) d, IPAddr::Network))); break; default: - ev->Assign(3, zeek::make_intrusive( + ev->Assign(3, zeek::make_intrusive( new BroString((const u_char*) d, len, false))); break; } @@ -114,121 +114,121 @@ ValPtr BuildEndUserAddr(const InformationElement* ie) return ev; } -ValPtr BuildAccessPointName(const InformationElement* ie) +zeek::ValPtr BuildAccessPointName(const InformationElement* ie) { BroString* bs = new BroString((const u_char*) ie->ap_name()->value().data(), ie->ap_name()->value().length(), false); - return zeek::make_intrusive(bs); + return zeek::make_intrusive(bs); } -ValPtr BuildProtoConfigOptions(const InformationElement* ie) +zeek::ValPtr BuildProtoConfigOptions(const InformationElement* ie) { const u_char* d = (const u_char*) ie->proto_config_opts()->value().data(); int len = ie->proto_config_opts()->value().length(); - return zeek::make_intrusive(new BroString(d, len, false)); + return zeek::make_intrusive(new BroString(d, len, false)); } -ValPtr BuildGSN_Addr(const InformationElement* ie) +zeek::ValPtr BuildGSN_Addr(const InformationElement* ie) { - auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_gsn_addr); + auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_gsn_addr); int len = ie->gsn_addr()->value().length(); const uint8* d = ie->gsn_addr()->value().data(); if ( len == 4 ) - ev->Assign(0, zeek::make_intrusive( + ev->Assign(0, zeek::make_intrusive( IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); else if ( len == 16 ) - ev->Assign(0, zeek::make_intrusive( + ev->Assign(0, zeek::make_intrusive( IPAddr(IPv6, (const uint32*) d, IPAddr::Network))); else - ev->Assign(1, zeek::make_intrusive(new BroString((const u_char*) d, len, false))); + ev->Assign(1, zeek::make_intrusive(new BroString((const u_char*) d, len, false))); return ev; } -ValPtr BuildMSISDN(const InformationElement* ie) +zeek::ValPtr BuildMSISDN(const InformationElement* ie) { const u_char* d = (const u_char*) ie->msisdn()->value().data(); int len = ie->msisdn()->value().length(); - return zeek::make_intrusive(new BroString(d, len, false)); + return zeek::make_intrusive(new BroString(d, len, false)); } -ValPtr BuildQoS_Profile(const InformationElement* ie) +zeek::ValPtr BuildQoS_Profile(const InformationElement* ie) { - auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_qos_profile); + auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_qos_profile); const u_char* d = (const u_char*) ie->qos_profile()->data().data(); int len = ie->qos_profile()->data().length(); ev->Assign(0, val_mgr->Count(ie->qos_profile()->alloc_retention_priority())); - ev->Assign(1, zeek::make_intrusive(new BroString(d, len, false))); + ev->Assign(1, zeek::make_intrusive(new BroString(d, len, false))); return ev; } -ValPtr BuildTrafficFlowTemplate(const InformationElement* ie) +zeek::ValPtr BuildTrafficFlowTemplate(const InformationElement* ie) { const uint8* d = ie->traffic_flow_template()->value().data(); int len = ie->traffic_flow_template()->value().length(); - return zeek::make_intrusive(new BroString((const u_char*) d, len, false)); + return zeek::make_intrusive(new BroString((const u_char*) d, len, false)); } -ValPtr BuildTriggerID(const InformationElement* ie) +zeek::ValPtr BuildTriggerID(const InformationElement* ie) { const uint8* d = ie->trigger_id()->value().data(); int len = ie->trigger_id()->value().length(); - return zeek::make_intrusive(new BroString((const u_char*) d, len, false)); + return zeek::make_intrusive(new BroString((const u_char*) d, len, false)); } -ValPtr BuildOMC_ID(const InformationElement* ie) +zeek::ValPtr BuildOMC_ID(const InformationElement* ie) { const uint8* d = ie->omc_id()->value().data(); int len = ie->omc_id()->value().length(); - return zeek::make_intrusive(new BroString((const u_char*) d, len, false)); + return zeek::make_intrusive(new BroString((const u_char*) d, len, false)); } -ValPtr BuildPrivateExt(const InformationElement* ie) +zeek::ValPtr BuildPrivateExt(const InformationElement* ie) { - auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_private_extension); + auto ev = zeek::make_intrusive(zeek::BifType::Record::gtp_private_extension); const uint8* d = ie->private_ext()->value().data(); int len = ie->private_ext()->value().length(); ev->Assign(0, val_mgr->Count(ie->private_ext()->id())); - ev->Assign(1, zeek::make_intrusive(new BroString((const u_char*) d, len, false))); + ev->Assign(1, zeek::make_intrusive(new BroString((const u_char*) d, len, false))); return ev; } -static ValPtr BuildCause(const InformationElement* ie) +static zeek::ValPtr BuildCause(const InformationElement* ie) { return val_mgr->Count(ie->cause()->value()); } -static ValPtr BuildReorderReq(const InformationElement* ie) +static zeek::ValPtr BuildReorderReq(const InformationElement* ie) { return val_mgr->Bool(ie->reorder_req()->req()); } -static ValPtr BuildChargingID(const InformationElement* ie) +static zeek::ValPtr BuildChargingID(const InformationElement* ie) { return val_mgr->Count(ie->charging_id()->value());; } -ValPtr BuildChargingGatewayAddr(const InformationElement* ie) +zeek::ValPtr BuildChargingGatewayAddr(const InformationElement* ie) { const uint8* d = ie->charging_gateway_addr()->value().data(); int len = ie->charging_gateway_addr()->value().length(); if ( len == 4 ) - return zeek::make_intrusive(IPAddr(IPv4, (const uint32*) d, IPAddr::Network)); + return zeek::make_intrusive(IPAddr(IPv4, (const uint32*) d, IPAddr::Network)); else if ( len == 16 ) - return zeek::make_intrusive(IPAddr(IPv6, (const uint32*) d, IPAddr::Network)); + return zeek::make_intrusive(IPAddr(IPv6, (const uint32*) d, IPAddr::Network)); else return nullptr; } -static ValPtr BuildTeardownInd(const InformationElement* ie) +static zeek::ValPtr BuildTeardownInd(const InformationElement* ie) { return val_mgr->Bool(ie->teardown_ind()->ind()); } @@ -237,7 +237,7 @@ void CreatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu) { if ( ! ::gtpv1_create_pdp_ctx_request ) return; - auto rv = zeek::make_intrusive( + auto rv = zeek::make_intrusive( zeek::BifType::Record::gtp_create_pdp_ctx_request_elements); const vector * v = pdu->create_pdp_ctx_request(); @@ -337,7 +337,7 @@ void CreatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu) if ( ! ::gtpv1_create_pdp_ctx_response ) return; - auto rv = zeek::make_intrusive( + auto rv = zeek::make_intrusive( zeek::BifType::Record::gtp_create_pdp_ctx_response_elements); const vector * v = pdu->create_pdp_ctx_response(); @@ -406,7 +406,7 @@ void UpdatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu) if ( ! ::gtpv1_update_pdp_ctx_request ) return; - auto rv = zeek::make_intrusive( + auto rv = zeek::make_intrusive( zeek::BifType::Record::gtp_update_pdp_ctx_request_elements); const vector * v = pdu->update_pdp_ctx_request(); @@ -484,7 +484,7 @@ void UpdatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu) if ( ! ::gtpv1_update_pdp_ctx_response ) return; - auto rv = zeek::make_intrusive( + auto rv = zeek::make_intrusive( zeek::BifType::Record::gtp_update_pdp_ctx_response_elements); const vector * v = pdu->update_pdp_ctx_response(); @@ -544,7 +544,7 @@ void DeletePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu) if ( ! ::gtpv1_delete_pdp_ctx_request ) return; - auto rv = zeek::make_intrusive( + auto rv = zeek::make_intrusive( zeek::BifType::Record::gtp_delete_pdp_ctx_request_elements); const vector * v = pdu->delete_pdp_ctx_request(); @@ -578,7 +578,7 @@ void DeletePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu) if ( ! ::gtpv1_delete_pdp_ctx_response ) return; - auto rv = zeek::make_intrusive( + auto rv = zeek::make_intrusive( zeek::BifType::Record::gtp_delete_pdp_ctx_response_elements); const vector * v = pdu->delete_pdp_ctx_response(); @@ -760,7 +760,7 @@ flow GTPv1_Flow(is_orig: bool) if ( ::gtpv1_g_pdu_packet ) zeek::BifEvent::enqueue_gtpv1_g_pdu_packet(a, c, BuildGTPv1Hdr(pdu), - inner->ToPktHdrVal()); + inner->ToPktHdrVal()); EncapsulatingConn ec(c, BifEnum::Tunnel::GTPv1); diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index 34b23044fc..ed93fbc1a5 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -613,14 +613,14 @@ HTTP_Message::~HTTP_Message() delete [] entity_data_buffer; } -RecordValPtr HTTP_Message::BuildMessageStat(bool interrupted, const char* msg) +zeek::RecordValPtr HTTP_Message::BuildMessageStat(bool interrupted, const char* msg) { static auto http_message_stat = zeek::id::find_type("http_message_stat"); - auto stat = zeek::make_intrusive(http_message_stat); + auto stat = zeek::make_intrusive(http_message_stat); int field = 0; - stat->Assign(field++, zeek::make_intrusive(start_time)); + stat->Assign(field++, zeek::make_intrusive(start_time)); stat->Assign(field++, val_mgr->Bool(interrupted)); - stat->Assign(field++, zeek::make_intrusive(msg)); + stat->Assign(field++, zeek::make_intrusive(msg)); stat->Assign(field++, val_mgr->Count(body_length)); stat->Assign(field++, val_mgr->Count(content_gap_length)); stat->Assign(field++, val_mgr->Count(header_length)); @@ -1153,11 +1153,11 @@ void HTTP_Analyzer::GenStats() if ( http_stats ) { static auto http_stats_rec = zeek::id::find_type("http_stats_rec"); - auto r = zeek::make_intrusive(http_stats_rec); + auto r = zeek::make_intrusive(http_stats_rec); r->Assign(0, val_mgr->Count(num_requests)); r->Assign(1, val_mgr->Count(num_replies)); - r->Assign(2, zeek::make_intrusive(request_version.ToDouble())); - r->Assign(3, zeek::make_intrusive(reply_version.ToDouble())); + r->Assign(2, zeek::make_intrusive(request_version.ToDouble())); + r->Assign(3, zeek::make_intrusive(reply_version.ToDouble())); // DEBUG_MSG("%.6f http_stats\n", network_time); EnqueueConnEvent(http_stats, ConnVal(), std::move(r)); @@ -1242,7 +1242,7 @@ int HTTP_Analyzer::HTTP_RequestLine(const char* line, const char* end_of_line) return -1; } - request_method = zeek::make_intrusive(end_of_method - line, line); + request_method = zeek::make_intrusive(end_of_method - line, line); Conn()->Match(Rule::HTTP_REQUEST, (const u_char*) unescaped_URI->AsString()->Bytes(), @@ -1312,8 +1312,8 @@ bool HTTP_Analyzer::ParseRequest(const char* line, const char* end_of_line) // NormalizeURI(line, end_of_uri); - request_URI = zeek::make_intrusive(end_of_uri - line, line); - unescaped_URI = zeek::make_intrusive( + request_URI = zeek::make_intrusive(end_of_uri - line, line); + unescaped_URI = zeek::make_intrusive( unescape_URI((const u_char*) line, (const u_char*) end_of_uri, this)); return true; @@ -1352,21 +1352,21 @@ void HTTP_Analyzer::SetVersion(HTTP_VersionNumber* version, HTTP_VersionNumber n void HTTP_Analyzer::HTTP_Event(const char* category, const char* detail) { - HTTP_Event(category, zeek::make_intrusive(detail)); + HTTP_Event(category, zeek::make_intrusive(detail)); } -void HTTP_Analyzer::HTTP_Event(const char* category, StringValPtr detail) +void HTTP_Analyzer::HTTP_Event(const char* category, zeek::StringValPtr detail) { if ( http_event ) // DEBUG_MSG("%.6f http_event\n", network_time); EnqueueConnEvent(http_event, ConnVal(), - zeek::make_intrusive(category), + zeek::make_intrusive(category), std::move(detail)); } -StringValPtr -HTTP_Analyzer::TruncateURI(const StringValPtr& uri) +zeek::StringValPtr +HTTP_Analyzer::TruncateURI(const zeek::StringValPtr& uri) { const BroString* str = uri->AsString(); @@ -1375,7 +1375,7 @@ HTTP_Analyzer::TruncateURI(const StringValPtr& uri) u_char* s = new u_char[truncate_http_URI + 4]; memcpy(s, str->Bytes(), truncate_http_URI); memcpy(s + truncate_http_URI, "...", 4); - return zeek::make_intrusive(new BroString(true, s, truncate_http_URI+3)); + return zeek::make_intrusive(new BroString(true, s, truncate_http_URI+3)); } else return uri; @@ -1398,7 +1398,7 @@ void HTTP_Analyzer::HTTP_Request() request_method, TruncateURI(request_URI), TruncateURI(unescaped_URI), - zeek::make_intrusive(fmt("%.1f", request_version.ToDouble())) + zeek::make_intrusive(fmt("%.1f", request_version.ToDouble())) ); } @@ -1407,11 +1407,11 @@ void HTTP_Analyzer::HTTP_Reply() if ( http_reply ) EnqueueConnEvent(http_reply, ConnVal(), - zeek::make_intrusive(fmt("%.1f", reply_version.ToDouble())), + zeek::make_intrusive(fmt("%.1f", reply_version.ToDouble())), val_mgr->Count(reply_code), reply_reason_phrase ? reply_reason_phrase : - zeek::make_intrusive("") + zeek::make_intrusive("") ); else reply_reason_phrase = nullptr; @@ -1473,7 +1473,7 @@ void HTTP_Analyzer::ReplyMade(bool interrupted, const char* msg) if ( http_connection_upgrade ) EnqueueConnEvent(http_connection_upgrade, ConnVal(), - zeek::make_intrusive(upgrade_protocol) + zeek::make_intrusive(upgrade_protocol) ); } @@ -1487,7 +1487,7 @@ void HTTP_Analyzer::ReplyMade(bool interrupted, const char* msg) reply_state = EXPECT_REPLY_LINE; } -void HTTP_Analyzer::RequestClash(Val* /* clash_val */) +void HTTP_Analyzer::RequestClash(zeek::Val* /* clash_val */) { Weird("multiple_HTTP_request_elements"); @@ -1551,7 +1551,7 @@ int HTTP_Analyzer::HTTP_ReplyLine(const char* line, const char* end_of_line) rest = skip_whitespace(rest, end_of_line); reply_reason_phrase = - zeek::make_intrusive(end_of_line - rest, (const char *) rest); + zeek::make_intrusive(end_of_line - rest, (const char *) rest); return 1; } @@ -1655,7 +1655,7 @@ void HTTP_Analyzer::HTTP_EntityData(bool is_orig, BroString* entity_data) ConnVal(), val_mgr->Bool(is_orig), val_mgr->Count(entity_data->Len()), - zeek::make_intrusive(entity_data) + zeek::make_intrusive(entity_data) ); else delete entity_data; diff --git a/src/analyzer/protocol/http/HTTP.h b/src/analyzer/protocol/http/HTTP.h index 91340bdfde..8cb1ad7689 100644 --- a/src/analyzer/protocol/http/HTTP.h +++ b/src/analyzer/protocol/http/HTTP.h @@ -145,7 +145,7 @@ protected: HTTP_Entity* current_entity; - RecordValPtr BuildMessageStat(bool interrupted, const char* msg); + zeek::RecordValPtr BuildMessageStat(bool interrupted, const char* msg); }; class HTTP_Analyzer final : public tcp::TCP_ApplicationAnalyzer { @@ -156,7 +156,7 @@ public: void HTTP_EntityData(bool is_orig, BroString* entity_data); void HTTP_MessageDone(bool is_orig, HTTP_Message* message); void HTTP_Event(const char* category, const char* detail); - void HTTP_Event(const char* category, StringValPtr detail); + void HTTP_Event(const char* category, zeek::StringValPtr detail); void SkipEntityData(bool is_orig); @@ -230,14 +230,14 @@ protected: void RequestMade(bool interrupted, const char* msg); void ReplyMade(bool interrupted, const char* msg); - void RequestClash(Val* clash_val); + void RequestClash(zeek::Val* clash_val); const BroString* UnansweredRequestMethod(); int HTTP_ReplyCode(const char* code_str); int ExpectReplyMessageBody(); - StringValPtr TruncateURI(const StringValPtr& uri); + zeek::StringValPtr TruncateURI(const zeek::StringValPtr& uri); int request_state, reply_state; int num_requests, num_replies; @@ -257,19 +257,19 @@ protected: // in a reply. std::string upgrade_protocol; - StringValPtr request_method; + zeek::StringValPtr request_method; // request_URI is in the original form (may contain '%' // sequences). - StringValPtr request_URI; + zeek::StringValPtr request_URI; // unescaped_URI does not contain escaped sequences. - StringValPtr unescaped_URI; + zeek::StringValPtr unescaped_URI; - std::queue unanswered_requests; + std::queue unanswered_requests; int reply_code; - StringValPtr reply_reason_phrase; + zeek::StringValPtr reply_reason_phrase; tcp::ContentLine_Analyzer* content_line_orig; tcp::ContentLine_Analyzer* content_line_resp; diff --git a/src/analyzer/protocol/http/functions.bif b/src/analyzer/protocol/http/functions.bif index 5cba5455a7..3b950e26fc 100644 --- a/src/analyzer/protocol/http/functions.bif +++ b/src/analyzer/protocol/http/functions.bif @@ -52,5 +52,5 @@ function unescape_URI%(URI: string%): string const u_char* line = URI->Bytes(); const u_char* const line_end = line + URI->Len(); - return zeek::make_intrusive(analyzer::http::unescape_URI(line, line_end, 0)); + return zeek::make_intrusive(analyzer::http::unescape_URI(line, line_end, 0)); %} diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc index af6824f6f6..f129e0fb1d 100644 --- a/src/analyzer/protocol/icmp/ICMP.cc +++ b/src/analyzer/protocol/icmp/ICMP.cc @@ -214,22 +214,21 @@ void ICMP_Analyzer::ICMP_Sent(const struct icmp* icmpp, int len, int caplen, EnqueueConnEvent(icmp_sent_payload, ConnVal(), BuildICMPVal(icmpp, len, icmpv6, ip_hdr), - zeek::make_intrusive(payload) + zeek::make_intrusive(payload) ); } } -RecordValPtr -ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len, - int icmpv6, const IP_Hdr* ip_hdr) +zeek::RecordValPtr ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len, + int icmpv6, const IP_Hdr* ip_hdr) { if ( ! icmp_conn_val ) { static auto icmp_conn = zeek::id::find_type("icmp_conn"); - icmp_conn_val = zeek::make_intrusive(icmp_conn); + icmp_conn_val = zeek::make_intrusive(icmp_conn); - icmp_conn_val->Assign(0, zeek::make_intrusive(Conn()->OrigAddr())); - icmp_conn_val->Assign(1, zeek::make_intrusive(Conn()->RespAddr())); + icmp_conn_val->Assign(0, zeek::make_intrusive(Conn()->OrigAddr())); + icmp_conn_val->Assign(1, zeek::make_intrusive(Conn()->RespAddr())); icmp_conn_val->Assign(2, val_mgr->Count(icmpp->icmp_type)); icmp_conn_val->Assign(3, val_mgr->Count(icmpp->icmp_code)); icmp_conn_val->Assign(4, val_mgr->Count(len)); @@ -305,7 +304,7 @@ TransportProto ICMP_Analyzer::GetContextProtocol(const IP_Hdr* ip_hdr, uint32_t* return proto; } -RecordValPtr ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data) +zeek::RecordValPtr ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data) { const IP_Hdr ip_hdr_data((const struct ip*) data, false); const IP_Hdr* ip_hdr = &ip_hdr_data; @@ -352,12 +351,12 @@ RecordValPtr ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data) } static auto icmp_context = zeek::id::find_type("icmp_context"); - auto iprec = zeek::make_intrusive(icmp_context); - auto id_val = zeek::make_intrusive(zeek::id::conn_id); + auto iprec = zeek::make_intrusive(icmp_context); + auto id_val = zeek::make_intrusive(zeek::id::conn_id); - id_val->Assign(0, zeek::make_intrusive(src_addr)); + id_val->Assign(0, zeek::make_intrusive(src_addr)); id_val->Assign(1, val_mgr->Port(src_port, proto)); - id_val->Assign(2, zeek::make_intrusive(dst_addr)); + id_val->Assign(2, zeek::make_intrusive(dst_addr)); id_val->Assign(3, val_mgr->Port(dst_port, proto)); iprec->Assign(0, std::move(id_val)); @@ -372,7 +371,7 @@ RecordValPtr ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data) return iprec; } -RecordValPtr ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data) +zeek::RecordValPtr ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data) { int DF = 0, MF = 0, bad_hdr_len = 0; TransportProto proto = TRANSPORT_UNKNOWN; @@ -412,12 +411,12 @@ RecordValPtr ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data) } static auto icmp_context = zeek::id::find_type("icmp_context"); - auto iprec = zeek::make_intrusive(icmp_context); - auto id_val = zeek::make_intrusive(zeek::id::conn_id); + auto iprec = zeek::make_intrusive(icmp_context); + auto id_val = zeek::make_intrusive(zeek::id::conn_id); - id_val->Assign(0, zeek::make_intrusive(src_addr)); + id_val->Assign(0, zeek::make_intrusive(src_addr)); id_val->Assign(1, val_mgr->Port(src_port, proto)); - id_val->Assign(2, zeek::make_intrusive(dst_addr)); + id_val->Assign(2, zeek::make_intrusive(dst_addr)); id_val->Assign(3, val_mgr->Port(dst_port, proto)); iprec->Assign(0, std::move(id_val)); @@ -457,7 +456,7 @@ void ICMP_Analyzer::Describe(ODesc* d) const d->Add(Conn()->RespAddr()); } -void ICMP_Analyzer::UpdateConnVal(RecordVal *conn_val) +void ICMP_Analyzer::UpdateConnVal(zeek::RecordVal *conn_val) { const auto& orig_endp = conn_val->GetField("orig"); const auto& resp_endp = conn_val->GetField("resp"); @@ -469,7 +468,7 @@ void ICMP_Analyzer::UpdateConnVal(RecordVal *conn_val) Analyzer::UpdateConnVal(conn_val); } -void ICMP_Analyzer::UpdateEndpointVal(const ValPtr& endp_arg, bool is_orig) +void ICMP_Analyzer::UpdateEndpointVal(const zeek::ValPtr& endp_arg, bool is_orig) { Conn()->EnableStatusUpdateTimer(); @@ -523,7 +522,7 @@ void ICMP_Analyzer::Echo(double t, const struct icmp* icmpp, int len, BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr), val_mgr->Count(iid), val_mgr->Count(iseq), - zeek::make_intrusive(payload) + zeek::make_intrusive(payload) ); } @@ -556,9 +555,9 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len, val_mgr->Count((icmpp->icmp_wpa & 0x18)>>3), // Pref val_mgr->Bool(icmpp->icmp_wpa & 0x04), // Proxy val_mgr->Count(icmpp->icmp_wpa & 0x02), // Reserved - zeek::make_intrusive((double)ntohs(icmpp->icmp_lifetime), Seconds), - zeek::make_intrusive((double)ntohl(reachable), Milliseconds), - zeek::make_intrusive((double)ntohl(retrans), Milliseconds), + zeek::make_intrusive((double)ntohs(icmpp->icmp_lifetime), Seconds), + zeek::make_intrusive((double)ntohl(reachable), Milliseconds), + zeek::make_intrusive((double)ntohl(retrans), Milliseconds), BuildNDOptionsVal(caplen - opt_offset, data + opt_offset) ); } @@ -585,7 +584,7 @@ void ICMP_Analyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len, val_mgr->Bool(icmpp->icmp_num_addrs & 0x80), // Router val_mgr->Bool(icmpp->icmp_num_addrs & 0x40), // Solicited val_mgr->Bool(icmpp->icmp_num_addrs & 0x20), // Override - zeek::make_intrusive(tgtaddr), + zeek::make_intrusive(tgtaddr), BuildNDOptionsVal(caplen - opt_offset, data + opt_offset) ); } @@ -609,7 +608,7 @@ void ICMP_Analyzer::NeighborSolicit(double t, const struct icmp* icmpp, int len, EnqueueConnEvent(f, ConnVal(), BuildICMPVal(icmpp, len, 1, ip_hdr), - zeek::make_intrusive(tgtaddr), + zeek::make_intrusive(tgtaddr), BuildNDOptionsVal(caplen - opt_offset, data + opt_offset) ); } @@ -636,8 +635,8 @@ void ICMP_Analyzer::Redirect(double t, const struct icmp* icmpp, int len, EnqueueConnEvent(f, ConnVal(), BuildICMPVal(icmpp, len, 1, ip_hdr), - zeek::make_intrusive(tgtaddr), - zeek::make_intrusive(dstaddr), + zeek::make_intrusive(tgtaddr), + zeek::make_intrusive(dstaddr), BuildNDOptionsVal(caplen - opt_offset, data + opt_offset) ); } @@ -722,12 +721,12 @@ void ICMP_Analyzer::Context6(double t, const struct icmp* icmpp, ); } -VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) +zeek::VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) { static auto icmp6_nd_option_type = zeek::id::find_type("icmp6_nd_option"); static auto icmp6_nd_prefix_info_type = zeek::id::find_type("icmp6_nd_prefix_info"); - auto vv = zeek::make_intrusive( + auto vv = zeek::make_intrusive( zeek::id::find_type("icmp6_nd_options")); while ( caplen > 0 ) @@ -748,7 +747,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) break; } - auto rv = zeek::make_intrusive(icmp6_nd_option_type); + auto rv = zeek::make_intrusive(icmp6_nd_option_type); rv->Assign(0, val_mgr->Count(type)); rv->Assign(1, val_mgr->Count(length)); @@ -769,7 +768,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) if ( caplen >= length ) { BroString* link_addr = new BroString(data, length, false); - rv->Assign(2, zeek::make_intrusive(link_addr)); + rv->Assign(2, zeek::make_intrusive(link_addr)); } else set_payload_field = true; @@ -782,7 +781,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) { if ( caplen >= 30 ) { - auto info = zeek::make_intrusive(icmp6_nd_prefix_info_type); + auto info = zeek::make_intrusive(icmp6_nd_prefix_info_type); uint8_t prefix_len = *((const uint8_t*)(data)); bool L_flag = (*((const uint8_t*)(data + 1)) & 0x80) != 0; bool A_flag = (*((const uint8_t*)(data + 1)) & 0x40) != 0; @@ -792,9 +791,9 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) info->Assign(0, val_mgr->Count(prefix_len)); info->Assign(1, val_mgr->Bool(L_flag)); info->Assign(2, val_mgr->Bool(A_flag)); - info->Assign(3, zeek::make_intrusive((double)ntohl(valid_life), Seconds)); - info->Assign(4, zeek::make_intrusive((double)ntohl(prefer_life), Seconds)); - info->Assign(5, zeek::make_intrusive(IPAddr(prefix))); + info->Assign(3, zeek::make_intrusive((double)ntohl(valid_life), Seconds)); + info->Assign(4, zeek::make_intrusive((double)ntohl(prefer_life), Seconds)); + info->Assign(5, zeek::make_intrusive(IPAddr(prefix))); rv->Assign(3, std::move(info)); } @@ -839,7 +838,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) if ( set_payload_field ) { BroString* payload = new BroString(data, std::min((int)length, caplen), false); - rv->Assign(6, zeek::make_intrusive(payload)); + rv->Assign(6, zeek::make_intrusive(payload)); } data += length; diff --git a/src/analyzer/protocol/icmp/ICMP.h b/src/analyzer/protocol/icmp/ICMP.h index f102b64006..2e62d477bb 100644 --- a/src/analyzer/protocol/icmp/ICMP.h +++ b/src/analyzer/protocol/icmp/ICMP.h @@ -6,8 +6,10 @@ #include "analyzer/Analyzer.h" #include "net_util.h" -class VectorVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek); +namespace zeek { using VectorValPtr = zeek::IntrusivePtr; +} namespace analyzer { namespace icmp { @@ -22,7 +24,7 @@ class ICMP_Analyzer final : public analyzer::TransportLayerAnalyzer { public: explicit ICMP_Analyzer(Connection* conn); - void UpdateConnVal(RecordVal *conn_val) override; + void UpdateConnVal(zeek::RecordVal *conn_val) override; static analyzer::Analyzer* Instantiate(Connection* conn) { return new ICMP_Analyzer(conn); } @@ -30,7 +32,7 @@ public: protected: void Done() override; void DeliverPacket(int len, const u_char* data, bool orig, - uint64_t seq, const IP_Hdr* ip, int caplen) override; + uint64_t seq, const IP_Hdr* ip, int caplen) override; bool IsReuse(double t, const u_char* pkt) override; unsigned int MemoryAllocation() const override; @@ -52,32 +54,32 @@ protected: void Describe(ODesc* d) const; - RecordValPtr BuildICMPVal(const struct icmp* icmpp, int len, - int icmpv6, const IP_Hdr* ip_hdr); + zeek::RecordValPtr BuildICMPVal(const struct icmp* icmpp, int len, + int icmpv6, const IP_Hdr* ip_hdr); void NextICMP4(double t, const struct icmp* icmpp, int len, int caplen, - const u_char*& data, const IP_Hdr* ip_hdr ); + const u_char*& data, const IP_Hdr* ip_hdr ); - RecordValPtr ExtractICMP4Context(int len, const u_char*& data); + zeek::RecordValPtr ExtractICMP4Context(int len, const u_char*& data); void Context4(double t, const struct icmp* icmpp, int len, int caplen, - const u_char*& data, const IP_Hdr* ip_hdr); + const u_char*& data, const IP_Hdr* ip_hdr); TransportProto GetContextProtocol(const IP_Hdr* ip_hdr, uint32_t* src_port, - uint32_t* dst_port); + uint32_t* dst_port); void NextICMP6(double t, const struct icmp* icmpp, int len, int caplen, - const u_char*& data, const IP_Hdr* ip_hdr ); + const u_char*& data, const IP_Hdr* ip_hdr ); - RecordValPtr ExtractICMP6Context(int len, const u_char*& data); + zeek::RecordValPtr ExtractICMP6Context(int len, const u_char*& data); void Context6(double t, const struct icmp* icmpp, int len, int caplen, - const u_char*& data, const IP_Hdr* ip_hdr); + const u_char*& data, const IP_Hdr* ip_hdr); // RFC 4861 Neighbor Discover message options - VectorValPtr BuildNDOptionsVal(int caplen, const u_char* data); + zeek::VectorValPtr BuildNDOptionsVal(int caplen, const u_char* data); - RecordValPtr icmp_conn_val; + zeek::RecordValPtr icmp_conn_val; int type; int code; int request_len, reply_len; @@ -85,7 +87,7 @@ protected: RuleMatcherState matcher_state; private: - void UpdateEndpointVal(const ValPtr& endp, bool is_orig); + void UpdateEndpointVal(const zeek::ValPtr& endp, bool is_orig); }; // Returns the counterpart type to the given type (e.g., the counterpart diff --git a/src/analyzer/protocol/ident/Ident.cc b/src/analyzer/protocol/ident/Ident.cc index 5e78a88035..ee3c4db2c0 100644 --- a/src/analyzer/protocol/ident/Ident.cc +++ b/src/analyzer/protocol/ident/Ident.cc @@ -149,7 +149,7 @@ void Ident_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig) ConnVal(), val_mgr->Port(local_port, TRANSPORT_TCP), val_mgr->Port(remote_port, TRANSPORT_TCP), - zeek::make_intrusive(end_of_line - line, line) + zeek::make_intrusive(end_of_line - line, line) ); } @@ -182,8 +182,8 @@ void Ident_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig) ConnVal(), val_mgr->Port(local_port, TRANSPORT_TCP), val_mgr->Port(remote_port, TRANSPORT_TCP), - zeek::make_intrusive(end_of_line - line, line), - zeek::make_intrusive(sys_type_s) + zeek::make_intrusive(end_of_line - line, line), + zeek::make_intrusive(sys_type_s) ); } } diff --git a/src/analyzer/protocol/imap/imap-analyzer.pac b/src/analyzer/protocol/imap/imap-analyzer.pac index e127374fad..196af72e98 100644 --- a/src/analyzer/protocol/imap/imap-analyzer.pac +++ b/src/analyzer/protocol/imap/imap-analyzer.pac @@ -59,12 +59,12 @@ refine connection IMAP_Conn += { if ( ! imap_capabilities ) return true; - auto capv = zeek::make_intrusive(zeek::id::string_vec); + auto capv = zeek::make_intrusive(zeek::id::string_vec); for ( unsigned int i = 0; i< capabilities->size(); i++ ) { const bytestring& capability = (*capabilities)[i]->cap(); - capv->Assign(i, zeek::make_intrusive(capability.length(), (const char*)capability.data())); + capv->Assign(i, zeek::make_intrusive(capability.length(), (const char*)capability.data())); } zeek::BifEvent::enqueue_imap_capabilities(bro_analyzer(), bro_analyzer()->Conn(), std::move(capv)); diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc index 7f197a2d04..bf7f876ebf 100644 --- a/src/analyzer/protocol/irc/IRC.cc +++ b/src/analyzer/protocol/irc/IRC.cc @@ -237,12 +237,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } EnqueueConnEvent(irc_network_info, - ConnVal(), - val_mgr->Bool(orig), - val_mgr->Int(users), - val_mgr->Int(services), - val_mgr->Int(servers) - ); + ConnVal(), + val_mgr->Bool(orig), + val_mgr->Int(users), + val_mgr->Int(services), + val_mgr->Int(servers)); } break; @@ -273,23 +272,22 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts.size() > 0 && parts[0][0] == ':' ) parts[0] = parts[0].substr(1); - auto set = zeek::make_intrusive(zeek::id::string_set); + auto set = zeek::make_intrusive(zeek::id::string_set); for ( unsigned int i = 0; i < parts.size(); ++i ) { if ( parts[i][0] == '@' ) parts[i] = parts[i].substr(1); - auto idx = zeek::make_intrusive(parts[i].c_str()); + auto idx = zeek::make_intrusive(parts[i].c_str()); set->Assign(std::move(idx), nullptr); } EnqueueConnEvent(irc_names_info, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(type.c_str()), - zeek::make_intrusive(channel.c_str()), - std::move(set) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(type.c_str()), + zeek::make_intrusive(channel.c_str()), + std::move(set)); } break; @@ -318,12 +316,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } EnqueueConnEvent(irc_server_info, - ConnVal(), - val_mgr->Bool(orig), - val_mgr->Int(users), - val_mgr->Int(services), - val_mgr->Int(servers) - ); + ConnVal(), + val_mgr->Bool(orig), + val_mgr->Int(users), + val_mgr->Int(services), + val_mgr->Int(servers)); } break; @@ -340,10 +337,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) channels = atoi(parts[i - 1].c_str()); EnqueueConnEvent(irc_channel_info, - ConnVal(), - val_mgr->Bool(orig), - val_mgr->Int(channels) - ); + ConnVal(), + val_mgr->Bool(orig), + val_mgr->Int(channels)); } break; @@ -372,11 +368,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } EnqueueConnEvent(irc_global_users, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(eop - prefix, prefix), - zeek::make_intrusive(++msg) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(eop - prefix, prefix), + zeek::make_intrusive(++msg)); break; } @@ -400,9 +395,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) vl.reserve(6); vl.emplace_back(ConnVal()); vl.emplace_back(val_mgr->Bool(orig)); - vl.emplace_back(zeek::make_intrusive(parts[0].c_str())); - vl.emplace_back(zeek::make_intrusive(parts[1].c_str())); - vl.emplace_back(zeek::make_intrusive(parts[2].c_str())); + vl.emplace_back(zeek::make_intrusive(parts[0].c_str())); + vl.emplace_back(zeek::make_intrusive(parts[1].c_str())); + vl.emplace_back(zeek::make_intrusive(parts[2].c_str())); parts.erase(parts.begin(), parts.begin() + 4); @@ -413,7 +408,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( real_name[0] == ':' ) real_name = real_name.substr(1); - vl.emplace_back(zeek::make_intrusive(real_name.c_str())); + vl.emplace_back(zeek::make_intrusive(real_name.c_str())); EnqueueConnEvent(irc_whois_user_line, std::move(vl)); } @@ -437,10 +432,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } EnqueueConnEvent(irc_whois_operator_line, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(parts[0].c_str()) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(parts[0].c_str())); } break; @@ -466,20 +460,19 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts.size() > 0 && parts[0][0] == ':' ) parts[0] = parts[0].substr(1); - auto set = zeek::make_intrusive(zeek::id::string_set); + auto set = zeek::make_intrusive(zeek::id::string_set); for ( unsigned int i = 0; i < parts.size(); ++i ) { - auto idx = zeek::make_intrusive(parts[i].c_str()); + auto idx = zeek::make_intrusive(parts[i].c_str()); set->Assign(std::move(idx), nullptr); } EnqueueConnEvent(irc_whois_channel_line, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(nick.c_str()), - std::move(set) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(nick.c_str()), + std::move(set)); } break; @@ -506,11 +499,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) ++t; EnqueueConnEvent(irc_channel_topic, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(parts[1].c_str()), - zeek::make_intrusive(t) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(parts[1].c_str()), + zeek::make_intrusive(t)); } else { @@ -540,18 +532,17 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) parts[7] = parts[7].substr(1); EnqueueConnEvent(irc_who_line, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(parts[0].c_str()), - zeek::make_intrusive(parts[1].c_str()), - zeek::make_intrusive(parts[2].c_str()), - zeek::make_intrusive(parts[3].c_str()), - zeek::make_intrusive(parts[4].c_str()), - zeek::make_intrusive(parts[5].c_str()), - zeek::make_intrusive(parts[6].c_str()), - val_mgr->Int(atoi(parts[7].c_str())), - zeek::make_intrusive(parts[8].c_str()) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(parts[0].c_str()), + zeek::make_intrusive(parts[1].c_str()), + zeek::make_intrusive(parts[2].c_str()), + zeek::make_intrusive(parts[3].c_str()), + zeek::make_intrusive(parts[4].c_str()), + zeek::make_intrusive(parts[5].c_str()), + zeek::make_intrusive(parts[6].c_str()), + val_mgr->Int(atoi(parts[7].c_str())), + zeek::make_intrusive(parts[8].c_str())); } break; @@ -562,9 +553,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) case 436: if ( irc_invalid_nick ) EnqueueConnEvent(irc_invalid_nick, - ConnVal(), - val_mgr->Bool(orig) - ); + ConnVal(), + val_mgr->Bool(orig)); break; // Operator responses. @@ -572,10 +562,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) case 491: // user is not operator if ( irc_oper_response ) EnqueueConnEvent(irc_oper_response, - ConnVal(), - val_mgr->Bool(orig), - val_mgr->Bool(code == 381) - ); + ConnVal(), + val_mgr->Bool(orig), + val_mgr->Bool(code == 381)); break; case 670: @@ -587,12 +576,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) default: if ( irc_reply ) EnqueueConnEvent(irc_reply, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - val_mgr->Count(code), - zeek::make_intrusive(params.c_str()) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + val_mgr->Count(code), + zeek::make_intrusive(params.c_str())); break; } return; @@ -658,27 +646,27 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_dcc_message ) EnqueueConnEvent(irc_dcc_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(target.c_str()), - zeek::make_intrusive(parts[1].c_str()), - zeek::make_intrusive(parts[2].c_str()), - zeek::make_intrusive(htonl(raw_ip)), - val_mgr->Count(atoi(parts[4].c_str())), - parts.size() >= 6 ? val_mgr->Count(atoi(parts[5].c_str())) : val_mgr->Count(0) - ); + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(target.c_str()), + zeek::make_intrusive(parts[1].c_str()), + zeek::make_intrusive(parts[2].c_str()), + zeek::make_intrusive(htonl(raw_ip)), + val_mgr->Count(atoi(parts[4].c_str())), + parts.size() >= 6 ? val_mgr->Count(atoi(parts[5].c_str())) : val_mgr->Count(0) + ); } else { if ( irc_privmsg_message ) EnqueueConnEvent(irc_privmsg_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(target.c_str()), - zeek::make_intrusive(message.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(target.c_str()), + zeek::make_intrusive(message.c_str()) ); } } @@ -699,11 +687,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) message = message.substr(1); EnqueueConnEvent(irc_notice_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(target.c_str()), - zeek::make_intrusive(message.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(target.c_str()), + zeek::make_intrusive(message.c_str()) ); } @@ -723,11 +711,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) message = message.substr(1); EnqueueConnEvent(irc_squery_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(target.c_str()), - zeek::make_intrusive(message.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(target.c_str()), + zeek::make_intrusive(message.c_str()) ); } @@ -741,15 +729,15 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) vl.emplace_back(val_mgr->Bool(orig)); if ( parts.size() > 0 ) - vl.emplace_back(zeek::make_intrusive(parts[0].c_str())); + vl.emplace_back(zeek::make_intrusive(parts[0].c_str())); else vl.emplace_back(val_mgr->EmptyString()); if ( parts.size() > 1 ) - vl.emplace_back(zeek::make_intrusive(parts[1].c_str())); + vl.emplace_back(zeek::make_intrusive(parts[1].c_str())); else vl.emplace_back(val_mgr->EmptyString()); if ( parts.size() > 2 ) - vl.emplace_back(zeek::make_intrusive(parts[2].c_str())); + vl.emplace_back(zeek::make_intrusive(parts[2].c_str())); else vl.emplace_back(val_mgr->EmptyString()); string realname; @@ -761,7 +749,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } const char* name = realname.c_str(); - vl.emplace_back(zeek::make_intrusive(*name == ':' ? name + 1 : name)); + vl.emplace_back(zeek::make_intrusive(*name == ':' ? name + 1 : name)); EnqueueConnEvent(irc_user_message, std::move(vl)); } @@ -772,10 +760,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) vector parts = SplitWords(params, ' '); if ( parts.size() == 2 ) EnqueueConnEvent(irc_oper_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(parts[0].c_str()), - zeek::make_intrusive(parts[1].c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(parts[0].c_str()), + zeek::make_intrusive(parts[1].c_str()) ); else @@ -796,9 +784,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) vl.reserve(6); vl.emplace_back(ConnVal()); vl.emplace_back(val_mgr->Bool(orig)); - vl.emplace_back(zeek::make_intrusive(prefix.c_str())); - vl.emplace_back(zeek::make_intrusive(parts[0].c_str())); - vl.emplace_back(zeek::make_intrusive(parts[1].c_str())); + vl.emplace_back(zeek::make_intrusive(prefix.c_str())); + vl.emplace_back(zeek::make_intrusive(parts[0].c_str())); + vl.emplace_back(zeek::make_intrusive(parts[1].c_str())); if ( parts.size() > 2 ) { @@ -809,7 +797,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( comment[0] == ':' ) comment = comment.substr(1); - vl.emplace_back(zeek::make_intrusive(comment.c_str())); + vl.emplace_back(zeek::make_intrusive(comment.c_str())); } else vl.emplace_back(val_mgr->EmptyString()); @@ -838,7 +826,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) nickname = prefix.substr(0, pos); } - auto list = zeek::make_intrusive(irc_join_list); + auto list = zeek::make_intrusive(irc_join_list); vector channels = SplitWords(parts[0], ','); vector passwords; @@ -849,15 +837,15 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) string empty_string = ""; for ( unsigned int i = 0; i < channels.size(); ++i ) { - auto info = zeek::make_intrusive(irc_join_info); - info->Assign(0, zeek::make_intrusive(nickname.c_str())); - info->Assign(1, zeek::make_intrusive(channels[i].c_str())); + auto info = zeek::make_intrusive(irc_join_info); + info->Assign(0, zeek::make_intrusive(nickname.c_str())); + info->Assign(1, zeek::make_intrusive(channels[i].c_str())); if ( i < passwords.size() ) - info->Assign(2, zeek::make_intrusive(passwords[i].c_str())); + info->Assign(2, zeek::make_intrusive(passwords[i].c_str())); else - info->Assign(2, zeek::make_intrusive(empty_string.c_str())); + info->Assign(2, zeek::make_intrusive(empty_string.c_str())); // User mode. - info->Assign(3, zeek::make_intrusive(empty_string.c_str())); + info->Assign(3, zeek::make_intrusive(empty_string.c_str())); list->Assign(std::move(info), nullptr); } @@ -882,13 +870,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) parts[1] = parts[1].substr(1); vector users = SplitWords(parts[1], ','); - auto list = zeek::make_intrusive(irc_join_list); + auto list = zeek::make_intrusive(irc_join_list); string empty_string = ""; for ( unsigned int i = 0; i < users.size(); ++i ) { - auto info = zeek::make_intrusive(irc_join_info); + auto info = zeek::make_intrusive(irc_join_info); string nick = users[i]; string mode = "none"; @@ -912,12 +900,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) mode = "voice"; } - info->Assign(0, zeek::make_intrusive(nick.c_str())); - info->Assign(1, zeek::make_intrusive(channel.c_str())); + info->Assign(0, zeek::make_intrusive(nick.c_str())); + info->Assign(1, zeek::make_intrusive(channel.c_str())); // Password: - info->Assign(2, zeek::make_intrusive(empty_string.c_str())); + info->Assign(2, zeek::make_intrusive(empty_string.c_str())); // User mode: - info->Assign(3, zeek::make_intrusive(mode.c_str())); + info->Assign(3, zeek::make_intrusive(mode.c_str())); list->Assign(std::move(info), nullptr); } @@ -952,20 +940,20 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) nick = nick.substr(0, pos); vector channelList = SplitWords(channels, ','); - auto set = zeek::make_intrusive(zeek::id::string_set); + auto set = zeek::make_intrusive(zeek::id::string_set); for ( unsigned int i = 0; i < channelList.size(); ++i ) { - auto idx = zeek::make_intrusive(channelList[i].c_str()); + auto idx = zeek::make_intrusive(channelList[i].c_str()); set->Assign(std::move(idx), nullptr); } EnqueueConnEvent(irc_part_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(nick.c_str()), - std::move(set), - zeek::make_intrusive(message.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(nick.c_str()), + std::move(set), + zeek::make_intrusive(message.c_str()) ); } @@ -984,10 +972,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } EnqueueConnEvent(irc_quit_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(nickname.c_str()), - zeek::make_intrusive(message.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(nickname.c_str()), + zeek::make_intrusive(message.c_str()) ); } @@ -998,10 +986,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) nick = nick.substr(1); EnqueueConnEvent(irc_nick_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(nick.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(nick.c_str()) ); } @@ -1023,12 +1011,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) parts[0] = parts[0].substr(1); EnqueueConnEvent(irc_who_message, - ConnVal(), - val_mgr->Bool(orig), - parts.size() > 0 ? - zeek::make_intrusive(parts[0].c_str()) : - val_mgr->EmptyString(), - val_mgr->Bool(oper) + ConnVal(), + val_mgr->Bool(orig), + parts.size() > 0 ? + zeek::make_intrusive(parts[0].c_str()) : + val_mgr->EmptyString(), + val_mgr->Bool(oper) ); } @@ -1053,10 +1041,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) users = parts[0]; EnqueueConnEvent(irc_whois_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(server.c_str()), - zeek::make_intrusive(users.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(server.c_str()), + zeek::make_intrusive(users.c_str()) ); } @@ -1066,10 +1054,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) params = params.substr(1); EnqueueConnEvent(irc_error_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(params.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(params.c_str()) ); } @@ -1082,11 +1070,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) parts[1] = parts[1].substr(1); EnqueueConnEvent(irc_invite_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(parts[0].c_str()), - zeek::make_intrusive(parts[1].c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(parts[0].c_str()), + zeek::make_intrusive(parts[1].c_str()) ); } else @@ -1097,10 +1085,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) { if ( params.size() > 0 ) EnqueueConnEvent(irc_mode_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(params.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(params.c_str()) ); else @@ -1110,9 +1098,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) else if ( irc_password_message && command == "PASS" ) { EnqueueConnEvent(irc_password_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(params.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(params.c_str()) ); } @@ -1132,11 +1120,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } EnqueueConnEvent(irc_squit_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(server.c_str()), - zeek::make_intrusive(message.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(server.c_str()), + zeek::make_intrusive(message.c_str()) ); } @@ -1146,11 +1134,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_request ) { EnqueueConnEvent(irc_request, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(command.c_str()), - zeek::make_intrusive(params.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(command.c_str()), + zeek::make_intrusive(params.c_str()) ); } } @@ -1160,11 +1148,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_message ) { EnqueueConnEvent(irc_message, - ConnVal(), - val_mgr->Bool(orig), - zeek::make_intrusive(prefix.c_str()), - zeek::make_intrusive(command.c_str()), - zeek::make_intrusive(params.c_str()) + ConnVal(), + val_mgr->Bool(orig), + zeek::make_intrusive(prefix.c_str()), + zeek::make_intrusive(command.c_str()), + zeek::make_intrusive(params.c_str()) ); } } diff --git a/src/analyzer/protocol/krb/KRB.cc b/src/analyzer/protocol/krb/KRB.cc index dd882cd1cc..a296e283ab 100644 --- a/src/analyzer/protocol/krb/KRB.cc +++ b/src/analyzer/protocol/krb/KRB.cc @@ -87,9 +87,9 @@ void KRB_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, } } -StringValPtr KRB_Analyzer::GetAuthenticationInfo(const BroString* principal, - const BroString* ciphertext, - const bro_uint_t enctype) +zeek::StringValPtr KRB_Analyzer::GetAuthenticationInfo(const BroString* principal, + const BroString* ciphertext, + const bro_uint_t enctype) { #ifdef USE_KRB5 if ( !krb_available ) @@ -147,7 +147,7 @@ StringValPtr KRB_Analyzer::GetAuthenticationInfo(const BroString* principal, return nullptr; } - auto ret = zeek::make_intrusive(cp); + auto ret = zeek::make_intrusive(cp); krb5_free_unparsed_name(krb_context, cp); krb5_free_ticket(krb_context, tkt); diff --git a/src/analyzer/protocol/krb/KRB.h b/src/analyzer/protocol/krb/KRB.h index 0539a9b8ec..15a5d760d5 100644 --- a/src/analyzer/protocol/krb/KRB.h +++ b/src/analyzer/protocol/krb/KRB.h @@ -25,9 +25,9 @@ public: static analyzer::Analyzer* Instantiate(Connection* conn) { return new KRB_Analyzer(conn); } - StringValPtr GetAuthenticationInfo(const BroString* principal, - const BroString* ciphertext, - const bro_uint_t enctype); + zeek::StringValPtr GetAuthenticationInfo(const BroString* principal, + const BroString* ciphertext, + const bro_uint_t enctype); protected: diff --git a/src/analyzer/protocol/krb/KRB_TCP.h b/src/analyzer/protocol/krb/KRB_TCP.h index 31d076c83c..05d04eb1ed 100644 --- a/src/analyzer/protocol/krb/KRB_TCP.h +++ b/src/analyzer/protocol/krb/KRB_TCP.h @@ -21,9 +21,9 @@ public: // Overriden from tcp::TCP_ApplicationAnalyzer. void EndpointEOF(bool is_orig) override; - StringValPtr GetAuthenticationInfo(const BroString* principal, - const BroString* ciphertext, - const bro_uint_t enctype) + zeek::StringValPtr GetAuthenticationInfo(const BroString* principal, + const BroString* ciphertext, + const bro_uint_t enctype) { return val_mgr->EmptyString(); } static analyzer::Analyzer* Instantiate(Connection* conn) diff --git a/src/analyzer/protocol/krb/krb-analyzer.pac b/src/analyzer/protocol/krb/krb-analyzer.pac index f2d97e813d..7d873f4b3d 100644 --- a/src/analyzer/protocol/krb/krb-analyzer.pac +++ b/src/analyzer/protocol/krb/krb-analyzer.pac @@ -1,14 +1,14 @@ %header{ -RecordValPtr proc_krb_kdc_options(const KRB_KDC_Options* opts); -RecordValPtr proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer); +zeek::RecordValPtr proc_krb_kdc_options(const KRB_KDC_Options* opts); +zeek::RecordValPtr proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer); -bool proc_error_arguments(RecordVal* rv, const std::vector* args, int64 error_code); +bool proc_error_arguments(zeek::RecordVal* rv, const std::vector* args, int64 error_code); %} %code{ -RecordValPtr proc_krb_kdc_options(const KRB_KDC_Options* opts) +zeek::RecordValPtr proc_krb_kdc_options(const KRB_KDC_Options* opts) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::KDC_Options); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::KDC_Options); rv->Assign(0, val_mgr->Bool(opts->forwardable())); rv->Assign(1, val_mgr->Bool(opts->forwarded())); @@ -27,9 +27,9 @@ RecordValPtr proc_krb_kdc_options(const KRB_KDC_Options* opts) return rv; } -RecordValPtr proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer) +zeek::RecordValPtr proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::KDC_Request); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::KDC_Request); rv->Assign(0, asn1_integer_to_val(msg->pvno()->data(), zeek::TYPE_COUNT)); rv->Assign(1, asn1_integer_to_val(msg->msg_type()->data(), zeek::TYPE_COUNT)); @@ -93,7 +93,7 @@ RecordValPtr proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_ } -bool proc_error_arguments(RecordVal* rv, const std::vector* args, int64 error_code ) +bool proc_error_arguments(zeek::RecordVal* rv, const std::vector* args, int64 error_code ) { uint ctime_i = 0, stime_i = 0; int64 ctime_usecs = 0, stime_usecs = 0; @@ -201,9 +201,9 @@ refine connection KRB_Conn += { %{ bro_analyzer()->ProtocolConfirmation(); auto msg_type = binary_to_int64(${msg.msg_type.data.content}); - auto make_arg = [this, msg]() -> RecordValPtr + auto make_arg = [this, msg]() -> zeek::RecordValPtr { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::KDC_Response); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::KDC_Response); rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, zeek::TYPE_COUNT)); rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, zeek::TYPE_COUNT)); @@ -244,7 +244,7 @@ refine connection KRB_Conn += { bro_analyzer()->ProtocolConfirmation(); if ( krb_error ) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::Error_Msg); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::Error_Msg); proc_error_arguments(rv.get(), ${msg.args1}, 0); rv->Assign(4, asn1_integer_to_val(${msg.error_code}, zeek::TYPE_COUNT)); proc_error_arguments(rv.get(), ${msg.args2}, binary_to_int64(${msg.error_code.encoding.content})); @@ -258,7 +258,7 @@ refine connection KRB_Conn += { bro_analyzer()->ProtocolConfirmation(); if ( krb_ap_request ) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::AP_Options); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::AP_Options); rv->Assign(0, val_mgr->Bool(${msg.ap_options.use_session_key})); rv->Assign(1, val_mgr->Bool(${msg.ap_options.mutual_required})); @@ -289,7 +289,7 @@ refine connection KRB_Conn += { bro_analyzer()->ProtocolConfirmation(); if ( krb_safe ) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::SAFE_Msg); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::SAFE_Msg); rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, zeek::TYPE_COUNT)); rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, zeek::TYPE_COUNT)); diff --git a/src/analyzer/protocol/krb/krb-asn1.pac b/src/analyzer/protocol/krb/krb-asn1.pac index a9c0101cd1..34c2d928a0 100644 --- a/src/analyzer/protocol/krb/krb-asn1.pac +++ b/src/analyzer/protocol/krb/krb-asn1.pac @@ -2,20 +2,20 @@ %include ../asn1/asn1.pac %header{ - ValPtr GetTimeFromAsn1(const KRB_Time* atime, int64 usecs); - ValPtr GetTimeFromAsn1(StringVal* atime, int64 usecs); + zeek::ValPtr GetTimeFromAsn1(const KRB_Time* atime, int64 usecs); + zeek::ValPtr GetTimeFromAsn1(zeek::StringVal* atime, int64 usecs); %} %code{ -ValPtr GetTimeFromAsn1(const KRB_Time* atime, int64 usecs) +zeek::ValPtr GetTimeFromAsn1(const KRB_Time* atime, int64 usecs) { auto atime_bytestring = to_stringval(atime->time()); auto result = GetTimeFromAsn1(atime_bytestring.get(), usecs); return result; } -ValPtr GetTimeFromAsn1(StringVal* atime, int64 usecs) +zeek::ValPtr GetTimeFromAsn1(zeek::StringVal* atime, int64 usecs) { time_t lResult = 0; @@ -51,7 +51,7 @@ ValPtr GetTimeFromAsn1(StringVal* atime, int64 usecs) if ( !lResult ) lResult = 0; - return zeek::make_intrusive(double(lResult + double(usecs/100000.0))); + return zeek::make_intrusive(double(lResult + double(usecs/100000.0))); } %} diff --git a/src/analyzer/protocol/krb/krb-padata.pac b/src/analyzer/protocol/krb/krb-padata.pac index ed99231c18..12b56b2772 100644 --- a/src/analyzer/protocol/krb/krb-padata.pac +++ b/src/analyzer/protocol/krb/krb-padata.pac @@ -7,13 +7,13 @@ %} %header{ -VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error); +zeek::VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error); %} %code{ -VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error) +zeek::VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error) { - auto vv = zeek::make_intrusive(zeek::id::find_type("KRB::Type_Value_Vector")); + auto vv = zeek::make_intrusive(zeek::id::find_type("KRB::Type_Value_Vector")); if ( ! data->data()->has_padata() ) return vv; @@ -36,7 +36,7 @@ VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro break; case PA_PW_SALT: { - auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); + auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); type_val->Assign(0, val_mgr->Count(element->data_type())); type_val->Assign(1, to_stringval(element->pa_data_element()->pa_pw_salt()->encoding()->content())); vv->Assign(vv->Size(), std::move(type_val)); @@ -44,7 +44,7 @@ VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro } case PA_ENCTYPE_INFO: { - auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); + auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); type_val->Assign(0, val_mgr->Count(element->data_type())); type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info()->salt())); vv->Assign(vv->Size(), std::move(type_val)); @@ -52,7 +52,7 @@ VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro } case PA_ENCTYPE_INFO2: { - auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); + auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); type_val->Assign(0, val_mgr->Count(element->data_type())); type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info2()->salt())); vv->Assign(vv->Size(), std::move(type_val)); @@ -110,7 +110,7 @@ VectorValPtr proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro { if ( ! is_error && element->pa_data_element()->unknown()->meta()->length() > 0 ) { - auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); + auto type_val = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); type_val->Assign(0, val_mgr->Count(element->data_type())); type_val->Assign(1, to_stringval(element->pa_data_element()->unknown()->content())); vv->Assign(vv->Size(), std::move(type_val)); diff --git a/src/analyzer/protocol/krb/krb-types.pac b/src/analyzer/protocol/krb/krb-types.pac index fe3a00b814..1e2f44e259 100644 --- a/src/analyzer/protocol/krb/krb-types.pac +++ b/src/analyzer/protocol/krb/krb-types.pac @@ -1,41 +1,41 @@ # Fundamental KRB types %header{ -ValPtr GetStringFromPrincipalName(const KRB_Principal_Name* pname); +zeek::ValPtr GetStringFromPrincipalName(const KRB_Principal_Name* pname); -VectorValPtr proc_cipher_list(const Array* list); +zeek::VectorValPtr proc_cipher_list(const Array* list); -VectorValPtr proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list); -RecordValPtr proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr); +zeek::VectorValPtr proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list); +zeek::RecordValPtr proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr); -VectorValPtr proc_tickets(const KRB_Ticket_Sequence* list); -RecordValPtr proc_ticket(const KRB_Ticket* ticket); +zeek::VectorValPtr proc_tickets(const KRB_Ticket_Sequence* list); +zeek::RecordValPtr proc_ticket(const KRB_Ticket* ticket); %} %code{ -ValPtr GetStringFromPrincipalName(const KRB_Principal_Name* pname) +zeek::ValPtr GetStringFromPrincipalName(const KRB_Principal_Name* pname) { if ( pname->data()->size() == 1 ) return to_stringval(pname->data()[0][0]->encoding()->content()); if ( pname->data()->size() == 2 ) - return zeek::make_intrusive(fmt("%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin())); + return zeek::make_intrusive(fmt("%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin())); if ( pname->data()->size() == 3 ) // if the name-string has a third value, this will just append it, else this will return unknown as the principal name - return zeek::make_intrusive(fmt("%s/%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin(), (char *)pname->data()[0][2]->encoding()->content().begin())); + return zeek::make_intrusive(fmt("%s/%s/%s", (char *) pname->data()[0][0]->encoding()->content().begin(), (char *)pname->data()[0][1]->encoding()->content().begin(), (char *)pname->data()[0][2]->encoding()->content().begin())); - return zeek::make_intrusive("unknown"); + return zeek::make_intrusive("unknown"); } -VectorValPtr proc_cipher_list(const Array* list) +zeek::VectorValPtr proc_cipher_list(const Array* list) { - auto ciphers = zeek::make_intrusive(zeek::id::index_vec); + auto ciphers = zeek::make_intrusive(zeek::id::index_vec); for ( uint i = 0; i < list->data()->size(); ++i ) ciphers->Assign(ciphers->Size(), asn1_integer_to_val((*list->data())[i], zeek::TYPE_COUNT)); return ciphers; } -VectorValPtr proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list) +zeek::VectorValPtr proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list) { - auto addrs = zeek::make_intrusive(zeek::id::find_type("KRB::Host_Address_Vector")); + auto addrs = zeek::make_intrusive(zeek::id::find_type("KRB::Host_Address_Vector")); for ( uint i = 0; i < list->addresses()->size(); ++i ) { @@ -45,9 +45,9 @@ VectorValPtr proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresse return addrs; } -RecordValPtr proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr) +zeek::RecordValPtr proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::Host_Address); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::Host_Address); const auto& addr_bytes = addr->address()->data()->content(); switch ( binary_to_int64(addr->addr_type()->encoding()->content()) ) @@ -61,7 +61,7 @@ RecordValPtr proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr } auto bytes = reinterpret_cast(addr_bytes.data()); - rv->Assign(0, zeek::make_intrusive(IPAddr(IPv4, bytes, IPAddr::Network))); + rv->Assign(0, zeek::make_intrusive(IPAddr(IPv4, bytes, IPAddr::Network))); return rv; } case 24: @@ -73,7 +73,7 @@ RecordValPtr proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr } auto bytes = reinterpret_cast(addr_bytes.data()); - rv->Assign(0, zeek::make_intrusive(IPAddr(IPv6, bytes, IPAddr::Network))); + rv->Assign(0, zeek::make_intrusive(IPAddr(IPv6, bytes, IPAddr::Network))); return rv; } case 20: @@ -85,16 +85,16 @@ RecordValPtr proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr break; } - auto unk = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); + auto unk = zeek::make_intrusive(zeek::BifType::Record::KRB::Type_Value); unk->Assign(0, asn1_integer_to_val(addr->addr_type(), zeek::TYPE_COUNT)); unk->Assign(1, to_stringval(addr_bytes)); rv->Assign(2, std::move(unk)); return rv; } -VectorValPtr proc_tickets(const KRB_Ticket_Sequence* list) +zeek::VectorValPtr proc_tickets(const KRB_Ticket_Sequence* list) { - auto tickets = zeek::make_intrusive(zeek::id::find_type("KRB::Ticket_Vector")); + auto tickets = zeek::make_intrusive(zeek::id::find_type("KRB::Ticket_Vector")); for ( uint i = 0; i < list->tickets()->size(); ++i ) { @@ -105,9 +105,9 @@ VectorValPtr proc_tickets(const KRB_Ticket_Sequence* list) return tickets; } -RecordValPtr proc_ticket(const KRB_Ticket* ticket) +zeek::RecordValPtr proc_ticket(const KRB_Ticket* ticket) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::Ticket); + auto rv = zeek::make_intrusive(zeek::BifType::Record::KRB::Ticket); rv->Assign(0, asn1_integer_to_val(ticket->tkt_vno()->data(), zeek::TYPE_COUNT)); rv->Assign(1, to_stringval(ticket->realm()->data()->content())); diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc index f7f462024f..761930ef9a 100644 --- a/src/analyzer/protocol/login/Login.cc +++ b/src/analyzer/protocol/login/Login.cc @@ -25,7 +25,7 @@ static RE_Matcher* re_login_failure_msgs; static RE_Matcher* re_login_success_msgs; static RE_Matcher* re_login_timeouts; -static RE_Matcher* init_RE(ListVal* l); +static RE_Matcher* init_RE(zeek::ListVal* l); Login_Analyzer::Login_Analyzer(const char* name, Connection* conn) : tcp::TCP_ApplicationAnalyzer(name, conn), user_text() @@ -45,13 +45,13 @@ Login_Analyzer::Login_Analyzer(const char* name, Connection* conn) if ( ! re_skip_authentication ) { - ListValPtr skip_authentication = zeek::id::find_val("skip_authentication")->AsTableVal()->ToPureListVal(); - ListValPtr direct_login_prompts = zeek::id::find_val("direct_login_prompts")->AsTableVal()->ToPureListVal(); - ListValPtr login_prompts = zeek::id::find_val("login_prompts")->AsTableVal()->ToPureListVal(); - ListValPtr login_non_failure_msgs = zeek::id::find_val("login_non_failure_msgs")->AsTableVal()->ToPureListVal(); - ListValPtr login_failure_msgs = zeek::id::find_val("login_failure_msgs")->AsTableVal()->ToPureListVal(); - ListValPtr login_success_msgs = zeek::id::find_val("login_success_msgs")->AsTableVal()->ToPureListVal(); - ListValPtr login_timeouts = zeek::id::find_val("login_timeouts")->AsTableVal()->ToPureListVal(); + zeek::ListValPtr skip_authentication = zeek::id::find_val("skip_authentication")->AsTableVal()->ToPureListVal(); + zeek::ListValPtr direct_login_prompts = zeek::id::find_val("direct_login_prompts")->AsTableVal()->ToPureListVal(); + zeek::ListValPtr login_prompts = zeek::id::find_val("login_prompts")->AsTableVal()->ToPureListVal(); + zeek::ListValPtr login_non_failure_msgs = zeek::id::find_val("login_non_failure_msgs")->AsTableVal()->ToPureListVal(); + zeek::ListValPtr login_failure_msgs = zeek::id::find_val("login_failure_msgs")->AsTableVal()->ToPureListVal(); + zeek::ListValPtr login_success_msgs = zeek::id::find_val("login_success_msgs")->AsTableVal()->ToPureListVal(); + zeek::ListValPtr login_timeouts = zeek::id::find_val("login_timeouts")->AsTableVal()->ToPureListVal(); #ifdef USE_PERFTOOLS_DEBUG HeapLeakChecker::Disabler disabler; @@ -336,25 +336,25 @@ void Login_Analyzer::SetEnv(bool orig, char* name, char* val) } // "val" gets copied here. - username = new StringVal(val); + username = new zeek::StringVal(val); } else if ( login_terminal && streq(name, "TERM") ) EnqueueConnEvent(login_terminal, ConnVal(), - zeek::make_intrusive(val) + zeek::make_intrusive(val) ); else if ( login_display && streq(name, "DISPLAY") ) EnqueueConnEvent(login_display, ConnVal(), - zeek::make_intrusive(val) + zeek::make_intrusive(val) ); else if ( login_prompt && streq(name, "TTYPROMPT") ) EnqueueConnEvent(login_prompt, ConnVal(), - zeek::make_intrusive(val) + zeek::make_intrusive(val) ); } @@ -389,7 +389,7 @@ void Login_Analyzer::LoginEvent(EventHandlerPtr f, const char* line, if ( no_user_okay ) { Unref(username); - username = new StringVal(""); + username = new zeek::StringVal(""); } else @@ -414,7 +414,7 @@ void Login_Analyzer::LoginEvent(EventHandlerPtr f, const char* line, if ( no_user_okay ) { Unref(username); - username = new StringVal(""); + username = new zeek::StringVal(""); } else @@ -425,8 +425,8 @@ void Login_Analyzer::LoginEvent(EventHandlerPtr f, const char* line, } } - Val* password = HaveTypeahead() ? - PopUserTextVal() : new StringVal(""); + zeek::Val* password = HaveTypeahead() ? + PopUserTextVal() : new zeek::StringVal(""); EnqueueConnEvent(f, ConnVal(), @@ -434,7 +434,7 @@ void Login_Analyzer::LoginEvent(EventHandlerPtr f, const char* line, client_name ? zeek::IntrusivePtr{zeek::NewRef{}, client_name} : val_mgr->EmptyString(), zeek::IntrusivePtr{zeek::AdoptRef{}, password}, - zeek::make_intrusive(line) + zeek::make_intrusive(line) ); } @@ -453,7 +453,7 @@ void Login_Analyzer::LineEvent(EventHandlerPtr f, const char* line) EnqueueConnEvent(f, ConnVal(), - zeek::make_intrusive(line) + zeek::make_intrusive(line) ); } @@ -465,8 +465,8 @@ void Login_Analyzer::Confused(const char* msg, const char* line) if ( login_confused ) EnqueueConnEvent(login_confused, ConnVal(), - zeek::make_intrusive(msg), - zeek::make_intrusive(line) + zeek::make_intrusive(msg), + zeek::make_intrusive(line) ); if ( login_confused_text ) @@ -489,7 +489,7 @@ void Login_Analyzer::ConfusionText(const char* line) if ( login_confused_text ) EnqueueConnEvent(login_confused_text, ConnVal(), - zeek::make_intrusive(line) + zeek::make_intrusive(line) ); } @@ -595,12 +595,12 @@ char* Login_Analyzer::PopUserText() return s; } -Val* Login_Analyzer::PopUserTextVal() +zeek::Val* Login_Analyzer::PopUserTextVal() { char* s = PopUserText(); if ( s ) - return new StringVal(new BroString(true, byte_vec(s), strlen(s))); + return new zeek::StringVal(new BroString(true, byte_vec(s), strlen(s))); else return val_mgr->EmptyString()->Ref(); } @@ -625,7 +625,7 @@ void Login_Analyzer::FlushEmptyTypeahead() delete [] PopUserText(); } -RE_Matcher* init_RE(ListVal* l) +RE_Matcher* init_RE(zeek::ListVal* l) { RE_Matcher* re = l->BuildRE(); if ( re ) diff --git a/src/analyzer/protocol/login/Login.h b/src/analyzer/protocol/login/Login.h index 6398725ec0..20072f95b6 100644 --- a/src/analyzer/protocol/login/Login.h +++ b/src/analyzer/protocol/login/Login.h @@ -56,7 +56,7 @@ protected: void AddUserText(const char* line); // complains on overflow char* PeekUserText(); // internal warning on underflow char* PopUserText(); // internal warning on underflow - Val* PopUserTextVal(); + zeek::Val* PopUserTextVal(); bool MatchesTypeahead(const char* line) const; bool HaveTypeahead() const { return num_user_text > 0; } @@ -69,8 +69,8 @@ protected: int user_text_first, user_text_last; // indices into user_text int num_user_text; // number of entries in user_text - Val* username; // last username reported - Val* client_name; // rlogin client name (or nil if none) + zeek::Val* username; // last username reported + zeek::Val* client_name; // rlogin client name (or nil if none) login_state state; int lines_scanned; diff --git a/src/analyzer/protocol/login/NVT.cc b/src/analyzer/protocol/login/NVT.cc index 6336a0229b..258e879bab 100644 --- a/src/analyzer/protocol/login/NVT.cc +++ b/src/analyzer/protocol/login/NVT.cc @@ -461,7 +461,7 @@ void NVT_Analyzer::SetTerminal(const u_char* terminal, int len) if ( login_terminal ) EnqueueConnEvent(login_terminal, ConnVal(), - zeek::make_intrusive(new BroString(terminal, len, false)) + zeek::make_intrusive(new BroString(terminal, len, false)) ); } diff --git a/src/analyzer/protocol/login/RSH.cc b/src/analyzer/protocol/login/RSH.cc index 73c331bf31..c615093b55 100644 --- a/src/analyzer/protocol/login/RSH.cc +++ b/src/analyzer/protocol/login/RSH.cc @@ -177,14 +177,14 @@ void Rsh_Analyzer::DeliverStream(int len, const u_char* data, bool orig) if ( client_name ) vl.emplace_back(zeek::NewRef{}, client_name); else - vl.emplace_back(zeek::make_intrusive("")); + vl.emplace_back(zeek::make_intrusive("")); if ( username ) vl.emplace_back(zeek::NewRef{}, username); else - vl.emplace_back(zeek::make_intrusive("")); + vl.emplace_back(zeek::make_intrusive("")); - vl.emplace_back(zeek::make_intrusive(line)); + vl.emplace_back(zeek::make_intrusive(line)); if ( orig ) { @@ -209,7 +209,7 @@ void Rsh_Analyzer::ClientUserName(const char* s) return; } - client_name = new StringVal(s); + client_name = new zeek::StringVal(s); } void Rsh_Analyzer::ServerUserName(const char* s) @@ -221,5 +221,5 @@ void Rsh_Analyzer::ServerUserName(const char* s) return; } - username = new StringVal(s); + username = new zeek::StringVal(s); } diff --git a/src/analyzer/protocol/login/Rlogin.cc b/src/analyzer/protocol/login/Rlogin.cc index 70cf4b9719..dfb868c621 100644 --- a/src/analyzer/protocol/login/Rlogin.cc +++ b/src/analyzer/protocol/login/Rlogin.cc @@ -231,7 +231,7 @@ void Rlogin_Analyzer::ClientUserName(const char* s) return; } - client_name = new StringVal(s); + client_name = new zeek::StringVal(s); } void Rlogin_Analyzer::ServerUserName(const char* s) @@ -246,6 +246,6 @@ void Rlogin_Analyzer::TerminalType(const char* s) if ( login_terminal ) EnqueueConnEvent(login_terminal, ConnVal(), - zeek::make_intrusive(s) + zeek::make_intrusive(s) ); } diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc index 39e13d9bcb..b4a54f739e 100644 --- a/src/analyzer/protocol/mime/MIME.cc +++ b/src/analyzer/protocol/mime/MIME.cc @@ -108,26 +108,26 @@ bool is_lws(char ch) return ch == 9 || ch == 32; } -StringVal* new_string_val(int length, const char* data) +zeek::StringVal* new_string_val(int length, const char* data) { return to_string_val(length, data).release(); } -StringVal* new_string_val(const char* data, const char* end_of_data) +zeek::StringVal* new_string_val(const char* data, const char* end_of_data) { return to_string_val(data, end_of_data).release(); } -StringVal* new_string_val(const data_chunk_t buf) +zeek::StringVal* new_string_val(const data_chunk_t buf) { return to_string_val(buf).release(); } -StringValPtr to_string_val(int length, const char* data) +zeek::StringValPtr to_string_val(int length, const char* data) { - return zeek::make_intrusive(length, data); + return zeek::make_intrusive(length, data); } -StringValPtr to_string_val(const char* data, const char* end_of_data) +zeek::StringValPtr to_string_val(const char* data, const char* end_of_data) { - return zeek::make_intrusive(end_of_data - data, data); + return zeek::make_intrusive(end_of_data - data, data); } -StringValPtr to_string_val(const data_chunk_t buf) +zeek::StringValPtr to_string_val(const data_chunk_t buf) { return to_string_val(buf.length, buf.data); } @@ -560,8 +560,8 @@ void MIME_Entity::init() need_to_parse_parameters = 0; - content_type_str = zeek::make_intrusive("TEXT"); - content_subtype_str = zeek::make_intrusive("PLAIN"); + content_type_str = zeek::make_intrusive("TEXT"); + content_subtype_str = zeek::make_intrusive("PLAIN"); content_encoding_str = nullptr; multipart_boundary = nullptr; @@ -811,9 +811,9 @@ bool MIME_Entity::ParseContentTypeField(MIME_Header* h) data += offset; len -= offset; - content_type_str = zeek::make_intrusive(ty.length, ty.data); + content_type_str = zeek::make_intrusive(ty.length, ty.data); content_type_str->ToUpper(); - content_subtype_str = zeek::make_intrusive(subty.length, subty.data); + content_subtype_str = zeek::make_intrusive(subty.length, subty.data); content_subtype_str->ToUpper(); ParseContentType(ty, subty); @@ -1298,13 +1298,13 @@ void MIME_Entity::DebugPrintHeaders() #endif } -RecordVal* MIME_Message::BuildHeaderVal(MIME_Header* h) +zeek::RecordVal* MIME_Message::BuildHeaderVal(MIME_Header* h) { return ToHeaderVal(h).release(); } -RecordValPtr MIME_Message::ToHeaderVal(MIME_Header* h) +zeek::RecordValPtr MIME_Message::ToHeaderVal(MIME_Header* h) { static auto mime_header_rec = zeek::id::find_type("mime_header_rec"); - auto header_record = zeek::make_intrusive(mime_header_rec); + auto header_record = zeek::make_intrusive(mime_header_rec); header_record->Assign(0, to_string_val(h->get_name())); auto upper_hn = to_string_val(h->get_name()); upper_hn->ToUpper(); @@ -1313,13 +1313,13 @@ RecordValPtr MIME_Message::ToHeaderVal(MIME_Header* h) return header_record; } -TableVal* MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist) +zeek::TableVal* MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist) { return ToHeaderTable(hlist).release(); } -TableValPtr MIME_Message::ToHeaderTable(MIME_HeaderList& hlist) +zeek::TableValPtr MIME_Message::ToHeaderTable(MIME_HeaderList& hlist) { static auto mime_header_list = zeek::id::find_type("mime_header_list"); - auto t = zeek::make_intrusive(mime_header_list); + auto t = zeek::make_intrusive(mime_header_list); for ( unsigned int i = 0; i < hlist.size(); ++i ) { @@ -1383,7 +1383,7 @@ void MIME_Mail::Done() analyzer->EnqueueConnEvent(mime_content_hash, analyzer->ConnVal(), val_mgr->Count(content_hash_length), - zeek::make_intrusive(new BroString(true, digest, 16)) + zeek::make_intrusive(new BroString(true, digest, 16)) ); } @@ -1423,7 +1423,7 @@ void MIME_Mail::EndEntity(MIME_Entity* /* entity */) analyzer->EnqueueConnEvent(mime_entity_data, analyzer->ConnVal(), val_mgr->Count(s->Len()), - zeek::make_intrusive(s) + zeek::make_intrusive(s) ); if ( ! mime_all_data ) @@ -1490,7 +1490,7 @@ void MIME_Mail::SubmitData(int len, const char* buf) analyzer->EnqueueConnEvent(mime_segment_data, analyzer->ConnVal(), val_mgr->Count(data_len), - zeek::make_intrusive(data_len, data) + zeek::make_intrusive(data_len, data) ); } @@ -1537,7 +1537,7 @@ void MIME_Mail::SubmitAllData() analyzer->EnqueueConnEvent(mime_all_data, analyzer->ConnVal(), val_mgr->Count(s->Len()), - zeek::make_intrusive(s) + zeek::make_intrusive(s) ); } } @@ -1564,7 +1564,7 @@ void MIME_Mail::SubmitEvent(int event_type, const char* detail) if ( mime_event ) analyzer->EnqueueConnEvent(mime_event, analyzer->ConnVal(), - zeek::make_intrusive(category), - zeek::make_intrusive(detail) + zeek::make_intrusive(category), + zeek::make_intrusive(detail) ); } diff --git a/src/analyzer/protocol/mime/MIME.h b/src/analyzer/protocol/mime/MIME.h index 009d8d0aec..4c2122028b 100644 --- a/src/analyzer/protocol/mime/MIME.h +++ b/src/analyzer/protocol/mime/MIME.h @@ -10,12 +10,14 @@ #include "Reporter.h" #include "analyzer/Analyzer.h" -class TableVal; -class StringVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek); class Base64Converter; +namespace zeek { using TableValPtr = zeek::IntrusivePtr; using StringValPtr = zeek::IntrusivePtr; +} namespace analyzer { namespace mime { @@ -102,11 +104,11 @@ public: MIME_Entity* Parent() const { return parent; } int MIMEContentType() const { return content_type; } [[deprecated("Remove in v4.1. Use GetContentType().")]] - StringVal* ContentType() const { return content_type_str.get(); } + zeek::StringVal* ContentType() const { return content_type_str.get(); } [[deprecated("Remove in v4.1. Use GetContentSubType().")]] - StringVal* ContentSubType() const { return content_subtype_str.get(); } - const StringValPtr& GetContentType() const { return content_type_str; } - const StringValPtr& GetContentSubType() const { return content_subtype_str; } + zeek::StringVal* ContentSubType() const { return content_subtype_str.get(); } + const zeek::StringValPtr& GetContentType() const { return content_type_str; } + const zeek::StringValPtr& GetContentSubType() const { return content_subtype_str; } int ContentTransferEncoding() const { return content_encoding; } protected: @@ -162,8 +164,8 @@ protected: int current_field_type; int need_to_parse_parameters; - StringValPtr content_type_str; - StringValPtr content_subtype_str; + zeek::StringValPtr content_type_str; + zeek::StringValPtr content_subtype_str; BroString* content_encoding_str; BroString* multipart_boundary; @@ -234,12 +236,12 @@ protected: bool finished; [[deprecated("Remove in v4.1. Use ToHeaderVal().")]] - RecordVal* BuildHeaderVal(MIME_Header* h); + zeek::RecordVal* BuildHeaderVal(MIME_Header* h); [[deprecated("Remove in v4.1. Use ToHeaderTable().")]] - TableVal* BuildHeaderTable(MIME_HeaderList& hlist); + zeek::TableVal* BuildHeaderTable(MIME_HeaderList& hlist); - RecordValPtr ToHeaderVal(MIME_Header* h); - TableValPtr ToHeaderTable(MIME_HeaderList& hlist); + zeek::RecordValPtr ToHeaderVal(MIME_Header* h); + zeek::TableValPtr ToHeaderTable(MIME_HeaderList& hlist); }; class MIME_Mail final : public MIME_Message { @@ -276,17 +278,16 @@ protected: std::string cur_entity_id; }; - extern bool is_null_data_chunk(data_chunk_t b); [[deprecated("Remove in v4.1. Use analyzer::mime::to_string_val().")]] -extern StringVal* new_string_val(int length, const char* data); +extern zeek::StringVal* new_string_val(int length, const char* data); [[deprecated("Remove in v4.1. Use analyzer::mime::to_string_val().")]] -extern StringVal* new_string_val(const char* data, const char* end_of_data); +extern zeek::StringVal* new_string_val(const char* data, const char* end_of_data); [[deprecated("Remove in v4.1. Use analyzer::mime::to_string_val().")]] -extern StringVal* new_string_val(const data_chunk_t buf); -extern StringValPtr to_string_val(int length, const char* data); -extern StringValPtr to_string_val(const char* data, const char* end_of_data); -extern StringValPtr to_string_val(const data_chunk_t buf); +extern zeek::StringVal* new_string_val(const data_chunk_t buf); +extern zeek::StringValPtr to_string_val(int length, const char* data); +extern zeek::StringValPtr to_string_val(const char* data, const char* end_of_data); +extern zeek::StringValPtr to_string_val(const data_chunk_t buf); extern int fputs(data_chunk_t b, FILE* fp); extern bool istrequal(data_chunk_t s, const char* t); extern bool is_lws(char ch); diff --git a/src/analyzer/protocol/modbus/modbus-analyzer.pac b/src/analyzer/protocol/modbus/modbus-analyzer.pac index 512210c85a..8379b046ea 100644 --- a/src/analyzer/protocol/modbus/modbus-analyzer.pac +++ b/src/analyzer/protocol/modbus/modbus-analyzer.pac @@ -8,15 +8,15 @@ # %header{ - VectorValPtr bytestring_to_coils(const bytestring& coils, uint quantity); - RecordValPtr HeaderToVal(ModbusTCP_TransportHeader* header); - VectorValPtr create_vector_of_count(); + zeek::VectorValPtr bytestring_to_coils(const bytestring& coils, uint quantity); + zeek::RecordValPtr HeaderToVal(ModbusTCP_TransportHeader* header); + zeek::VectorValPtr create_vector_of_count(); %} %code{ - VectorValPtr bytestring_to_coils(const bytestring& coils, uint quantity) + zeek::VectorValPtr bytestring_to_coils(const bytestring& coils, uint quantity) { - auto modbus_coils = zeek::make_intrusive(zeek::BifType::Vector::ModbusCoils); + auto modbus_coils = zeek::make_intrusive(zeek::BifType::Vector::ModbusCoils); for ( uint i = 0; i < quantity; i++ ) { @@ -27,9 +27,9 @@ return modbus_coils; } - RecordValPtr HeaderToVal(ModbusTCP_TransportHeader* header) + zeek::RecordValPtr HeaderToVal(ModbusTCP_TransportHeader* header) { - auto modbus_header = zeek::make_intrusive(zeek::BifType::Record::ModbusHeaders); + auto modbus_header = zeek::make_intrusive(zeek::BifType::Record::ModbusHeaders); modbus_header->Assign(0, val_mgr->Count(header->tid())); modbus_header->Assign(1, val_mgr->Count(header->pid())); modbus_header->Assign(2, val_mgr->Count(header->uid())); @@ -37,10 +37,10 @@ return modbus_header; } - VectorValPtr create_vector_of_count() + zeek::VectorValPtr create_vector_of_count() { auto vt = zeek::make_intrusive(zeek::base_type(zeek::TYPE_COUNT)); - auto vv = zeek::make_intrusive(std::move(vt)); + auto vv = zeek::make_intrusive(std::move(vt)); return vv; } @@ -209,7 +209,7 @@ refine flow ModbusTCP_Flow += { if ( ::modbus_read_holding_registers_response ) { - auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); + auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); for ( unsigned int i=0; i < ${message.registers}->size(); ++i ) { @@ -253,7 +253,7 @@ refine flow ModbusTCP_Flow += { if ( ::modbus_read_input_registers_response ) { - auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); + auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); for ( unsigned int i=0; i < (${message.registers})->size(); ++i ) { @@ -397,7 +397,7 @@ refine flow ModbusTCP_Flow += { if ( ::modbus_write_multiple_registers_request ) { - auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); + auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); for ( unsigned int i = 0; i < (${message.registers}->size()); ++i ) { @@ -582,7 +582,7 @@ refine flow ModbusTCP_Flow += { if ( ::modbus_read_write_multiple_registers_request ) { - auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); + auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); for ( unsigned int i = 0; i < ${message.write_register_values}->size(); ++i ) { @@ -614,7 +614,7 @@ refine flow ModbusTCP_Flow += { if ( ::modbus_read_write_multiple_registers_response ) { - auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); + auto t = zeek::make_intrusive(zeek::BifType::Vector::ModbusRegisters); for ( unsigned int i = 0; i < ${message.registers}->size(); ++i ) { diff --git a/src/analyzer/protocol/mqtt/commands/connack.pac b/src/analyzer/protocol/mqtt/commands/connack.pac index d2dd9e68ef..1a9532490e 100644 --- a/src/analyzer/protocol/mqtt/commands/connack.pac +++ b/src/analyzer/protocol/mqtt/commands/connack.pac @@ -15,7 +15,7 @@ refine flow MQTT_Flow += { %{ if ( mqtt_connack ) { - auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::ConnectAckMsg); + auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::ConnectAckMsg); m->Assign(0, val_mgr->Count(${msg.return_code})); m->Assign(1, val_mgr->Bool(${msg.session_present})); zeek::BifEvent::enqueue_mqtt_connack(connection()->bro_analyzer(), diff --git a/src/analyzer/protocol/mqtt/commands/connect.pac b/src/analyzer/protocol/mqtt/commands/connect.pac index 15d732141c..ac1b9fd80b 100644 --- a/src/analyzer/protocol/mqtt/commands/connect.pac +++ b/src/analyzer/protocol/mqtt/commands/connect.pac @@ -44,13 +44,13 @@ refine flow MQTT_Flow += { %{ if ( mqtt_connect ) { - auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::ConnectMsg); - m->Assign(0, zeek::make_intrusive(${msg.protocol_name.str}.length(), + auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::ConnectMsg); + m->Assign(0, zeek::make_intrusive(${msg.protocol_name.str}.length(), reinterpret_cast(${msg.protocol_name.str}.begin()))); m->Assign(1, val_mgr->Count(${msg.protocol_version})); - m->Assign(2, zeek::make_intrusive(${msg.client_id.str}.length(), + m->Assign(2, zeek::make_intrusive(${msg.client_id.str}.length(), reinterpret_cast(${msg.client_id.str}.begin()))); - m->Assign(3, zeek::make_intrusive(double(${msg.keep_alive}), Seconds)); + m->Assign(3, zeek::make_intrusive(double(${msg.keep_alive}), Seconds)); m->Assign(4, val_mgr->Bool(${msg.clean_session})); m->Assign(5, val_mgr->Bool(${msg.will_retain})); @@ -58,20 +58,20 @@ refine flow MQTT_Flow += { if ( ${msg.will_flag} ) { - m->Assign(7, zeek::make_intrusive(${msg.will.topic.str}.length(), + m->Assign(7, zeek::make_intrusive(${msg.will.topic.str}.length(), reinterpret_cast(${msg.will.topic.str}.begin()))); - m->Assign(8, zeek::make_intrusive(${msg.will.msg.str}.length(), + m->Assign(8, zeek::make_intrusive(${msg.will.msg.str}.length(), reinterpret_cast(${msg.will.msg.str}.begin()))); } if ( ${msg.username} ) { - m->Assign(9, zeek::make_intrusive(${msg.uname.str}.length(), + m->Assign(9, zeek::make_intrusive(${msg.uname.str}.length(), reinterpret_cast(${msg.uname.str}.begin()))); } if ( ${msg.password} ) { - m->Assign(10, zeek::make_intrusive(${msg.pass.str}.length(), + m->Assign(10, zeek::make_intrusive(${msg.pass.str}.length(), reinterpret_cast(${msg.pass.str}.begin()))); } diff --git a/src/analyzer/protocol/mqtt/commands/publish.pac b/src/analyzer/protocol/mqtt/commands/publish.pac index 0748278756..65db8e4799 100644 --- a/src/analyzer/protocol/mqtt/commands/publish.pac +++ b/src/analyzer/protocol/mqtt/commands/publish.pac @@ -23,11 +23,11 @@ refine flow MQTT_Flow += { %{ if ( mqtt_publish ) { - auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::PublishMsg); + auto m = zeek::make_intrusive(zeek::BifType::Record::MQTT::PublishMsg); m->Assign(0, val_mgr->Bool(${msg.dup})); m->Assign(1, val_mgr->Count(${msg.qos})); m->Assign(2, val_mgr->Bool(${msg.retain})); - m->Assign(3, ${msg.topic.str}.length(), + m->Assign(3, ${msg.topic.str}.length(), reinterpret_cast(${msg.topic.str}.begin())); auto len = ${msg.payload}.length(); @@ -37,7 +37,7 @@ refine flow MQTT_Flow += { if ( len > static_cast(max) ) len = max; - m->Assign(4, len, + m->Assign(4, len, reinterpret_cast(${msg.payload}.begin())); m->Assign(5, val_mgr->Count(${msg.payload}.length())); diff --git a/src/analyzer/protocol/mqtt/commands/subscribe.pac b/src/analyzer/protocol/mqtt/commands/subscribe.pac index 6d0f667906..f0ab7a9a2a 100644 --- a/src/analyzer/protocol/mqtt/commands/subscribe.pac +++ b/src/analyzer/protocol/mqtt/commands/subscribe.pac @@ -19,12 +19,12 @@ refine flow MQTT_Flow += { %{ if ( mqtt_subscribe ) { - auto topics = zeek::make_intrusive(zeek::id::string_vec); - auto qos_levels = zeek::make_intrusive(zeek::id::index_vec); + auto topics = zeek::make_intrusive(zeek::id::string_vec); + auto qos_levels = zeek::make_intrusive(zeek::id::index_vec); for ( auto topic: *${msg.topics} ) { - auto subscribe_topic = zeek::make_intrusive(${topic.name.str}.length(), + auto subscribe_topic = zeek::make_intrusive(${topic.name.str}.length(), reinterpret_cast(${topic.name.str}.begin())); auto qos = val_mgr->Count(${topic.requested_QoS}); topics->Assign(topics->Size(), std::move(subscribe_topic)); diff --git a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac index 7bf6b2b931..f9363efebd 100644 --- a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac +++ b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac @@ -14,11 +14,11 @@ refine flow MQTT_Flow += { %{ if ( mqtt_unsubscribe ) { - auto topics = zeek::make_intrusive(zeek::id::string_vec); + auto topics = zeek::make_intrusive(zeek::id::string_vec); for ( auto topic: *${msg.topics} ) { - auto unsubscribe_topic = zeek::make_intrusive(${topic.str}.length(), + auto unsubscribe_topic = zeek::make_intrusive(${topic.str}.length(), reinterpret_cast(${topic.str}.begin())); topics->Assign(topics->Size(), std::move(unsubscribe_topic)); } diff --git a/src/analyzer/protocol/mysql/mysql-analyzer.pac b/src/analyzer/protocol/mysql/mysql-analyzer.pac index c02a1d1e8e..f019cbcf39 100644 --- a/src/analyzer/protocol/mysql/mysql-analyzer.pac +++ b/src/analyzer/protocol/mysql/mysql-analyzer.pac @@ -8,11 +8,11 @@ refine flow MySQL_Flow += { if ( ${msg.version} == 10 ) zeek::BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), - zeek::make_intrusive(c_str(${msg.handshake10.server_version}))); + zeek::make_intrusive(c_str(${msg.handshake10.server_version}))); if ( ${msg.version} == 9 ) zeek::BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), - zeek::make_intrusive(c_str(${msg.handshake9.server_version}))); + zeek::make_intrusive(c_str(${msg.handshake9.server_version}))); } return true; %} @@ -27,11 +27,11 @@ refine flow MySQL_Flow += { if ( ${msg.version} == 10 ) zeek::BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), - zeek::make_intrusive(c_str(${msg.v10_response.username}))); + zeek::make_intrusive(c_str(${msg.v10_response.username}))); if ( ${msg.version} == 9 ) zeek::BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), - zeek::make_intrusive(c_str(${msg.v9_response.username}))); + zeek::make_intrusive(c_str(${msg.v9_response.username}))); } return true; %} @@ -83,11 +83,11 @@ refine flow MySQL_Flow += { return true; auto vt = zeek::id::string_vec; - auto vv = zeek::make_intrusive(std::move(vt)); + auto vv = zeek::make_intrusive(std::move(vt)); auto& bstring = ${msg.row.first_field.val}; auto ptr = reinterpret_cast(bstring.data()); - vv->Assign(vv->Size(), zeek::make_intrusive(bstring.length(), ptr)); + vv->Assign(vv->Size(), zeek::make_intrusive(bstring.length(), ptr)); auto& fields = *${msg.row.fields}; @@ -95,7 +95,7 @@ refine flow MySQL_Flow += { { auto& bstring = f->val(); auto ptr = reinterpret_cast(bstring.data()); - vv->Assign(vv->Size(), zeek::make_intrusive(bstring.length(), ptr)); + vv->Assign(vv->Size(), zeek::make_intrusive(bstring.length(), ptr)); } zeek::BifEvent::enqueue_mysql_result_row(connection()->bro_analyzer(), diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc index 8872afa781..8118fa5505 100644 --- a/src/analyzer/protocol/netbios/NetbiosSSN.cc +++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc @@ -322,15 +322,13 @@ void NetbiosSSN_Interpreter::Event(EventHandlerPtr event, const u_char* data, if ( is_orig >= 0 ) analyzer->EnqueueConnEvent(event, - analyzer->ConnVal(), - val_mgr->Bool(is_orig), - zeek::make_intrusive(new BroString(data, len, false)) - ); + analyzer->ConnVal(), + val_mgr->Bool(is_orig), + zeek::make_intrusive(new BroString(data, len, false))); else analyzer->EnqueueConnEvent(event, - analyzer->ConnVal(), - zeek::make_intrusive(new BroString(data, len, false)) - ); + analyzer->ConnVal(), + zeek::make_intrusive(new BroString(data, len, false))); } diff --git a/src/analyzer/protocol/netbios/functions.bif b/src/analyzer/protocol/netbios/functions.bif index 0bd3f59cf1..8ba8d8d059 100644 --- a/src/analyzer/protocol/netbios/functions.bif +++ b/src/analyzer/protocol/netbios/functions.bif @@ -34,7 +34,7 @@ function decode_netbios_name%(name: string%): string break; } - return zeek::make_intrusive(i, result); + return zeek::make_intrusive(i, result); %} ## Converts a NetBIOS name type to its corresponding numeric value. diff --git a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac index 2f8330be85..e36500fb9e 100644 --- a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac +++ b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac @@ -1,25 +1,25 @@ %header{ - ValPtr filetime2brotime(uint64_t ts); - RecordValPtr build_version_record(NTLM_Version* val); - RecordValPtr build_negotiate_flag_record(NTLM_Negotiate_Flags* val); + zeek::ValPtr filetime2brotime(uint64_t ts); + zeek::RecordValPtr build_version_record(NTLM_Version* val); + zeek::RecordValPtr build_negotiate_flag_record(NTLM_Negotiate_Flags* val); %} %code{ // This is replicated from the SMB analyzer. :( - ValPtr filetime2brotime(uint64_t ts) + zeek::ValPtr filetime2brotime(uint64_t ts) { double secs = (ts / 10000000.0); // Bro can't support times back to the 1600's // so we subtract a lot of seconds. - auto bro_ts = zeek::make_intrusive(secs - 11644473600.0); + auto bro_ts = zeek::make_intrusive(secs - 11644473600.0); return bro_ts; } - RecordValPtr build_version_record(NTLM_Version* val) + zeek::RecordValPtr build_version_record(NTLM_Version* val) { - auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Version); + auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Version); result->Assign(0, val_mgr->Count(${val.major_version})); result->Assign(1, val_mgr->Count(${val.minor_version})); result->Assign(2, val_mgr->Count(${val.build_number})); @@ -28,9 +28,9 @@ return result; } - RecordValPtr build_negotiate_flag_record(NTLM_Negotiate_Flags* val) + zeek::RecordValPtr build_negotiate_flag_record(NTLM_Negotiate_Flags* val) { - auto flags = zeek::make_intrusive(zeek::BifType::Record::NTLM::NegotiateFlags); + auto flags = zeek::make_intrusive(zeek::BifType::Record::NTLM::NegotiateFlags); flags->Assign(0, val_mgr->Bool(${val.negotiate_56})); flags->Assign(1, val_mgr->Bool(${val.negotiate_key_exch})); flags->Assign(2, val_mgr->Bool(${val.negotiate_128})); @@ -62,7 +62,7 @@ refine connection NTLM_Conn += { function build_av_record(val: NTLM_AV_Pair_Sequence, len: uint16): BroVal %{ - RecordVal* result = new RecordVal(zeek::BifType::Record::NTLM::AVs); + zeek::RecordVal* result = new zeek::RecordVal(zeek::BifType::Record::NTLM::AVs); for ( uint i = 0; ; i++ ) { if ( i >= ${val.pairs}->size() ) @@ -117,7 +117,7 @@ refine connection NTLM_Conn += { if ( ! ntlm_negotiate ) return true; - auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Negotiate); + auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Negotiate); result->Assign(0, build_negotiate_flag_record(${val.flags})); if ( ${val}->has_domain_name() ) @@ -141,7 +141,7 @@ refine connection NTLM_Conn += { if ( ! ntlm_challenge ) return true; - auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Challenge); + auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Challenge); result->Assign(0, build_negotiate_flag_record(${val.flags})); if ( ${val}->has_target_name() ) @@ -165,7 +165,7 @@ refine connection NTLM_Conn += { if ( ! ntlm_authenticate ) return true; - auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Authenticate); + auto result = zeek::make_intrusive(zeek::BifType::Record::NTLM::Authenticate); result->Assign(0, build_negotiate_flag_record(${val.flags})); if ( ${val}->has_domain_name() > 0 ) diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index aaa7764dbd..ffdd0d7704 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -8,37 +8,37 @@ %} %header{ - ValPtr proc_ntp_short(const NTP_Short_Time* t); - ValPtr proc_ntp_timestamp(const NTP_Time* t); - RecordValPtr BuildNTPStdMsg(NTP_std_msg* nsm); - RecordValPtr BuildNTPControlMsg(NTP_control_msg* ncm); - RecordValPtr BuildNTPMode7Msg(NTP_mode7_msg* m7); + zeek::ValPtr proc_ntp_short(const NTP_Short_Time* t); + zeek::ValPtr proc_ntp_timestamp(const NTP_Time* t); + zeek::RecordValPtr BuildNTPStdMsg(NTP_std_msg* nsm); + zeek::RecordValPtr BuildNTPControlMsg(NTP_control_msg* ncm); + zeek::RecordValPtr BuildNTPMode7Msg(NTP_mode7_msg* m7); %} %code{ - ValPtr proc_ntp_short(const NTP_Short_Time* t) + zeek::ValPtr proc_ntp_short(const NTP_Short_Time* t) { if ( t->seconds() == 0 && t->fractions() == 0 ) - return zeek::make_intrusive(0.0); - return zeek::make_intrusive(t->seconds() + t->fractions()*FRAC_16); + return zeek::make_intrusive(0.0); + return zeek::make_intrusive(t->seconds() + t->fractions()*FRAC_16); } - ValPtr proc_ntp_timestamp(const NTP_Time* t) + zeek::ValPtr proc_ntp_timestamp(const NTP_Time* t) { if ( t->seconds() == 0 && t->fractions() == 0) - return zeek::make_intrusive(0.0); - return zeek::make_intrusive(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32); + return zeek::make_intrusive(0.0); + return zeek::make_intrusive(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32); } // This builds the standard msg record - RecordValPtr BuildNTPStdMsg(NTP_std_msg* nsm) + zeek::RecordValPtr BuildNTPStdMsg(NTP_std_msg* nsm) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::StandardMessage); + auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::StandardMessage); rv->Assign(0, val_mgr->Count(${nsm.stratum})); - rv->Assign(1, zeek::make_intrusive(pow(2, ${nsm.poll}))); - rv->Assign(2, zeek::make_intrusive(pow(2, ${nsm.precision}))); + rv->Assign(1, zeek::make_intrusive(pow(2, ${nsm.poll}))); + rv->Assign(2, zeek::make_intrusive(pow(2, ${nsm.precision}))); rv->Assign(3, proc_ntp_short(${nsm.root_delay})); rv->Assign(4, proc_ntp_short(${nsm.root_dispersion})); @@ -54,7 +54,7 @@ default: { const uint8* d = ${nsm.reference_id}.data(); - rv->Assign(7, zeek::make_intrusive(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); + rv->Assign(7, zeek::make_intrusive(IPAddr(IPv4, (const uint32*) d, IPAddr::Network))); } break; } @@ -85,9 +85,9 @@ } // This builds the control msg record - RecordValPtr BuildNTPControlMsg(NTP_control_msg* ncm) + zeek::RecordValPtr BuildNTPControlMsg(NTP_control_msg* ncm) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::ControlMessage); + auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::ControlMessage); rv->Assign(0, val_mgr->Count(${ncm.OpCode})); rv->Assign(1, val_mgr->Bool(${ncm.R})); @@ -110,9 +110,9 @@ } // This builds the mode7 msg record - RecordValPtr BuildNTPMode7Msg(NTP_mode7_msg* m7) + zeek::RecordValPtr BuildNTPMode7Msg(NTP_mode7_msg* m7) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::Mode7Message); + auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::Mode7Message); rv->Assign(0, val_mgr->Count(${m7.request_code})); rv->Assign(1, val_mgr->Bool(${m7.auth_bit})); @@ -138,7 +138,7 @@ refine flow NTP_Flow += { if ( ! ntp_message ) return false; - auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::Message); + auto rv = zeek::make_intrusive(zeek::BifType::Record::NTP::Message); rv->Assign(0, val_mgr->Count(${msg.version})); rv->Assign(1, val_mgr->Count(${msg.mode})); diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc index 238cf8ebb6..45097f755f 100644 --- a/src/analyzer/protocol/pop3/POP3.cc +++ b/src/analyzer/protocol/pop3/POP3.cc @@ -923,9 +923,9 @@ void POP3_Analyzer::POP3Event(EventHandlerPtr event, bool is_orig, vl.emplace_back(val_mgr->Bool(is_orig)); if ( arg1 ) - vl.emplace_back(zeek::make_intrusive(arg1)); + vl.emplace_back(zeek::make_intrusive(arg1)); if ( arg2 ) - vl.emplace_back(zeek::make_intrusive(arg2)); + vl.emplace_back(zeek::make_intrusive(arg2)); EnqueueConnEvent(event, std::move(vl)); } diff --git a/src/analyzer/protocol/radius/radius-analyzer.pac b/src/analyzer/protocol/radius/radius-analyzer.pac index 7822e8e1d4..f8a50bc084 100644 --- a/src/analyzer/protocol/radius/radius-analyzer.pac +++ b/src/analyzer/protocol/radius/radius-analyzer.pac @@ -7,14 +7,14 @@ refine flow RADIUS_Flow += { if ( ! radius_message ) return false; - auto result = zeek::make_intrusive(zeek::BifType::Record::RADIUS::Message); + auto result = zeek::make_intrusive(zeek::BifType::Record::RADIUS::Message); result->Assign(0, val_mgr->Count(${msg.code})); result->Assign(1, val_mgr->Count(${msg.trans_id})); result->Assign(2, to_stringval(${msg.authenticator})); if ( ${msg.attributes}->size() ) { - auto attributes = zeek::make_intrusive(zeek::BifType::Table::RADIUS::Attributes); + auto attributes = zeek::make_intrusive(zeek::BifType::Table::RADIUS::Attributes); for ( uint i = 0; i < ${msg.attributes}->size(); ++i ) { @@ -22,17 +22,17 @@ refine flow RADIUS_Flow += { // Do we already have a vector of attributes for this type? auto current = attributes->FindOrDefault(index); - ValPtr val = to_stringval(${msg.attributes[i].value}); + zeek::ValPtr val = to_stringval(${msg.attributes[i].value}); if ( current ) { - VectorVal* vcurrent = current->AsVectorVal(); + zeek::VectorVal* vcurrent = current->AsVectorVal(); vcurrent->Assign(vcurrent->Size(), std::move(val)); } else { - auto attribute_list = zeek::make_intrusive(zeek::BifType::Vector::RADIUS::AttributeList); + auto attribute_list = zeek::make_intrusive(zeek::BifType::Vector::RADIUS::AttributeList); attribute_list->Assign((unsigned int)0, std::move(val)); attributes->Assign(std::move(index), std::move(attribute_list)); } diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac index 209de1f012..74070322df 100644 --- a/src/analyzer/protocol/rdp/rdp-analyzer.pac +++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac @@ -64,7 +64,7 @@ refine flow RDP_Flow += { if ( rdp_client_core_data ) { - auto ec_flags = zeek::make_intrusive(zeek::BifType::Record::RDP::EarlyCapabilityFlags); + auto ec_flags = zeek::make_intrusive(zeek::BifType::Record::RDP::EarlyCapabilityFlags); ec_flags->Assign(0, val_mgr->Bool(${ccore.SUPPORT_ERRINFO_PDU})); ec_flags->Assign(1, val_mgr->Bool(${ccore.WANT_32BPP_SESSION})); ec_flags->Assign(2, val_mgr->Bool(${ccore.SUPPORT_STATUSINFO_PDU})); @@ -75,7 +75,7 @@ refine flow RDP_Flow += { ec_flags->Assign(7, val_mgr->Bool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE})); ec_flags->Assign(8, val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU})); - auto ccd = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientCoreData); + auto ccd = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientCoreData); ccd->Assign(0, val_mgr->Count(${ccore.version_major})); ccd->Assign(1, val_mgr->Count(${ccore.version_minor})); ccd->Assign(2, val_mgr->Count(${ccore.desktop_width})); @@ -110,7 +110,7 @@ refine flow RDP_Flow += { if ( ! rdp_client_security_data ) return false; - auto csd = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientSecurityData); + auto csd = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientSecurityData); csd->Assign(0, val_mgr->Count(${csec.encryption_methods})); csd->Assign(1, val_mgr->Count(${csec.ext_encryption_methods})); @@ -127,11 +127,11 @@ refine flow RDP_Flow += { if ( ${cnetwork.channel_def_array}->size() ) { - auto channels = zeek::make_intrusive(zeek::BifType::Vector::RDP::ClientChannelList); + auto channels = zeek::make_intrusive(zeek::BifType::Vector::RDP::ClientChannelList); for ( uint i = 0; i < ${cnetwork.channel_def_array}->size(); ++i ) { - auto channel_def = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientChannelDef); + auto channel_def = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientChannelDef); channel_def->Assign(0, to_stringval(${cnetwork.channel_def_array[i].name})); channel_def->Assign(1, val_mgr->Count(${cnetwork.channel_def_array[i].options})); @@ -164,7 +164,7 @@ refine flow RDP_Flow += { if ( ! rdp_client_cluster_data ) return false; - auto ccld = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientClusterData); + auto ccld = zeek::make_intrusive(zeek::BifType::Record::RDP::ClientClusterData); ccld->Assign(0, val_mgr->Count(${ccluster.flags})); ccld->Assign(1, val_mgr->Count(${ccluster.redir_session_id})); ccld->Assign(2, val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED})); diff --git a/src/analyzer/protocol/rfb/rfb-analyzer.pac b/src/analyzer/protocol/rfb/rfb-analyzer.pac index 31fc358fe7..36bf163ce4 100644 --- a/src/analyzer/protocol/rfb/rfb-analyzer.pac +++ b/src/analyzer/protocol/rfb/rfb-analyzer.pac @@ -52,7 +52,7 @@ refine flow RFB_Flow += { auto name_ptr = &((*vec_ptr)[0]); zeek::BifEvent::enqueue_rfb_server_parameters( connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), - zeek::make_intrusive(${msg.name}->size(), (const char*)name_ptr), + zeek::make_intrusive(${msg.name}->size(), (const char*)name_ptr), ${msg.width}, ${msg.height}); } diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc index 64201c7f24..bd119ddd1e 100644 --- a/src/analyzer/protocol/rpc/MOUNT.cc +++ b/src/analyzer/protocol/rpc/MOUNT.cc @@ -22,7 +22,7 @@ bool MOUNT_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n) uint32_t proc = c->Proc(); // The call arguments, depends on the call type obviously ... - RecordValPtr callarg; + zeek::RecordValPtr callarg; switch ( proc ) { case BifEnum::MOUNT3::PROC_NULL: @@ -69,7 +69,7 @@ bool MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_statu double last_time, int reply_len) { EventHandlerPtr event = nullptr; - ValPtr reply; + zeek::ValPtr reply; BifEnum::MOUNT3::status_t mount_status = BifEnum::MOUNT3::MNT3_OK; bool rpc_success = ( rpc_status == BifEnum::RPC_SUCCESS ); @@ -177,40 +177,40 @@ zeek::Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c, zeek::Args vl; vl.reserve(2 + extra_elements); vl.emplace_back(analyzer->ConnVal()); - auto auxgids = zeek::make_intrusive(zeek::id::index_vec); + auto auxgids = zeek::make_intrusive(zeek::id::index_vec); for (size_t i = 0; i < c->AuxGIDs().size(); ++i) { auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i])); } - auto info = zeek::make_intrusive(zeek::BifType::Record::MOUNT3::info_t); + auto info = zeek::make_intrusive(zeek::BifType::Record::MOUNT3::info_t); info->Assign(0, zeek::BifType::Enum::rpc_status->GetVal(rpc_status)); info->Assign(1, zeek::BifType::Enum::MOUNT3::status_t->GetVal(mount_status)); - info->Assign(2, zeek::make_intrusive(c->StartTime())); - info->Assign(3, zeek::make_intrusive(c->LastTime() - c->StartTime())); + info->Assign(2, zeek::make_intrusive(c->StartTime())); + info->Assign(3, zeek::make_intrusive(c->LastTime() - c->StartTime())); info->Assign(4, val_mgr->Count(c->RPCLen())); - info->Assign(5, zeek::make_intrusive(rep_start_time)); - info->Assign(6, zeek::make_intrusive(rep_last_time - rep_start_time)); + info->Assign(5, zeek::make_intrusive(rep_start_time)); + info->Assign(6, zeek::make_intrusive(rep_last_time - rep_start_time)); info->Assign(7, val_mgr->Count(reply_len)); info->Assign(8, val_mgr->Count(c->Uid())); info->Assign(9, val_mgr->Count(c->Gid())); info->Assign(10, val_mgr->Count(c->Stamp())); - info->Assign(11, zeek::make_intrusive(c->MachineName())); + info->Assign(11, zeek::make_intrusive(c->MachineName())); info->Assign(12, std::move(auxgids)); vl.emplace_back(std::move(info)); return vl; } -EnumValPtr MOUNT_Interp::mount3_auth_flavor(const u_char*& buf, int& n) +zeek::EnumValPtr MOUNT_Interp::mount3_auth_flavor(const u_char*& buf, int& n) { BifEnum::MOUNT3::auth_flavor_t t = (BifEnum::MOUNT3::auth_flavor_t)extract_XDR_uint32(buf, n); auto rval = zeek::BifType::Enum::MOUNT3::auth_flavor_t->GetVal(t); return rval; } -StringValPtr MOUNT_Interp::mount3_fh(const u_char*& buf, int& n) +zeek::StringValPtr MOUNT_Interp::mount3_fh(const u_char*& buf, int& n) { int fh_n; const u_char* fh = extract_XDR_opaque(buf, n, fh_n, 64); @@ -218,10 +218,10 @@ StringValPtr MOUNT_Interp::mount3_fh(const u_char*& buf, int& n) if ( ! fh ) return nullptr; - return zeek::make_intrusive(new BroString(fh, fh_n, false)); + return zeek::make_intrusive(new BroString(fh, fh_n, false)); } -StringValPtr MOUNT_Interp::mount3_filename(const u_char*& buf, int& n) +zeek::StringValPtr MOUNT_Interp::mount3_filename(const u_char*& buf, int& n) { int name_len; const u_char* name = extract_XDR_opaque(buf, n, name_len); @@ -229,20 +229,20 @@ StringValPtr MOUNT_Interp::mount3_filename(const u_char*& buf, int& n) if ( ! name ) return nullptr; - return zeek::make_intrusive(new BroString(name, name_len, false)); + return zeek::make_intrusive(new BroString(name, name_len, false)); } -RecordValPtr MOUNT_Interp::mount3_dirmntargs(const u_char*& buf, int& n) +zeek::RecordValPtr MOUNT_Interp::mount3_dirmntargs(const u_char*& buf, int& n) { - auto dirmntargs = zeek::make_intrusive(zeek::BifType::Record::MOUNT3::dirmntargs_t); + auto dirmntargs = zeek::make_intrusive(zeek::BifType::Record::MOUNT3::dirmntargs_t); dirmntargs->Assign(0, mount3_filename(buf, n)); return dirmntargs; } -RecordValPtr MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n, - BifEnum::MOUNT3::status_t status) +zeek::RecordValPtr MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n, + BifEnum::MOUNT3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::MOUNT3::mnt_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::MOUNT3::mnt_reply_t); if ( status == BifEnum::MOUNT3::MNT3_OK ) { @@ -259,7 +259,7 @@ RecordValPtr MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n, } auto enum_vector = zeek::make_intrusive(zeek::base_type(zeek::TYPE_ENUM)); - auto auth_flavors = zeek::make_intrusive(std::move(enum_vector)); + auto auth_flavors = zeek::make_intrusive(std::move(enum_vector)); for ( auto i = 0u; i < auth_flavors_count; ++i ) auth_flavors->Assign(auth_flavors->Size(), diff --git a/src/analyzer/protocol/rpc/MOUNT.h b/src/analyzer/protocol/rpc/MOUNT.h index ab062ae712..888cc5b47e 100644 --- a/src/analyzer/protocol/rpc/MOUNT.h +++ b/src/analyzer/protocol/rpc/MOUNT.h @@ -29,12 +29,12 @@ protected: // to 0. However, the methods might still return an allocated Val * ! // So, you might want to Unref() the Val if buf is 0. Method names // are based on the type names of RFC 1813. - EnumValPtr mount3_auth_flavor(const u_char*& buf, int& n); - StringValPtr mount3_fh(const u_char*& buf, int& n); - RecordValPtr mount3_dirmntargs(const u_char*&buf, int &n); - StringValPtr mount3_filename(const u_char*& buf, int& n); + zeek::EnumValPtr mount3_auth_flavor(const u_char*& buf, int& n); + zeek::StringValPtr mount3_fh(const u_char*& buf, int& n); + zeek::RecordValPtr mount3_dirmntargs(const u_char*&buf, int &n); + zeek::StringValPtr mount3_filename(const u_char*& buf, int& n); - RecordValPtr mount3_mnt_reply(const u_char*& buf, int& n, BifEnum::MOUNT3::status_t status); + zeek::RecordValPtr mount3_mnt_reply(const u_char*& buf, int& n, BifEnum::MOUNT3::status_t status); }; class MOUNT_Analyzer : public RPC_Analyzer { diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc index 281067a0c1..fa140b7995 100644 --- a/src/analyzer/protocol/rpc/NFS.cc +++ b/src/analyzer/protocol/rpc/NFS.cc @@ -22,7 +22,7 @@ bool NFS_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n) uint32_t proc = c->Proc(); // The call arguments, depends on the call type obviously ... - ValPtr callarg; + zeek::ValPtr callarg; switch ( proc ) { case BifEnum::NFS3::PROC_NULL: @@ -124,7 +124,7 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status, double last_time, int reply_len) { EventHandlerPtr event = nullptr; - ValPtr reply; + zeek::ValPtr reply; BifEnum::NFS3::status_t nfs_status = BifEnum::NFS3::NFS3ERR_OK; bool rpc_success = ( rpc_status == BifEnum::RPC_SUCCESS ); @@ -278,7 +278,7 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status, return true; } -StringValPtr NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size) +zeek::StringValPtr NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size) { int data_n; @@ -297,7 +297,7 @@ StringValPtr NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t off data_n = std::min(data_n, int(zeek::BifConst::NFS3::return_data_max)); if ( data && data_n > 0 ) - return zeek::make_intrusive(new BroString(data, data_n, false)); + return zeek::make_intrusive(new BroString(data, data_n, false)); return nullptr; } @@ -312,31 +312,31 @@ zeek::Args NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_ zeek::Args vl; vl.reserve(2 + extra_elements); vl.emplace_back(analyzer->ConnVal()); - auto auxgids = zeek::make_intrusive(zeek::id::index_vec); + auto auxgids = zeek::make_intrusive(zeek::id::index_vec); for ( size_t i = 0; i < c->AuxGIDs().size(); ++i ) auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i])); - auto info = zeek::make_intrusive(zeek::BifType::Record::NFS3::info_t); + auto info = zeek::make_intrusive(zeek::BifType::Record::NFS3::info_t); info->Assign(0, zeek::BifType::Enum::rpc_status->GetVal(rpc_status)); info->Assign(1, zeek::BifType::Enum::NFS3::status_t->GetVal(nfs_status)); - info->Assign(2, zeek::make_intrusive(c->StartTime())); - info->Assign(3, zeek::make_intrusive(c->LastTime()-c->StartTime())); + info->Assign(2, zeek::make_intrusive(c->StartTime())); + info->Assign(3, zeek::make_intrusive(c->LastTime()-c->StartTime())); info->Assign(4, val_mgr->Count(c->RPCLen())); - info->Assign(5, zeek::make_intrusive(rep_start_time)); - info->Assign(6, zeek::make_intrusive(rep_last_time-rep_start_time)); + info->Assign(5, zeek::make_intrusive(rep_start_time)); + info->Assign(6, zeek::make_intrusive(rep_last_time-rep_start_time)); info->Assign(7, val_mgr->Count(reply_len)); info->Assign(8, val_mgr->Count(c->Uid())); info->Assign(9, val_mgr->Count(c->Gid())); info->Assign(10, val_mgr->Count(c->Stamp())); - info->Assign(11, zeek::make_intrusive(c->MachineName())); + info->Assign(11, zeek::make_intrusive(c->MachineName())); info->Assign(12, std::move(auxgids)); vl.emplace_back(std::move(info)); return vl; } -StringValPtr NFS_Interp::nfs3_fh(const u_char*& buf, int& n) +zeek::StringValPtr NFS_Interp::nfs3_fh(const u_char*& buf, int& n) { int fh_n; const u_char* fh = extract_XDR_opaque(buf, n, fh_n, 64); @@ -344,13 +344,13 @@ StringValPtr NFS_Interp::nfs3_fh(const u_char*& buf, int& n) if ( ! fh ) return nullptr; - return zeek::make_intrusive(new BroString(fh, fh_n, false)); + return zeek::make_intrusive(new BroString(fh, fh_n, false)); } -RecordValPtr NFS_Interp::nfs3_sattr(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_sattr(const u_char*& buf, int& n) { - auto attrs = zeek::make_intrusive(zeek::BifType::Record::NFS3::sattr_t); + auto attrs = zeek::make_intrusive(zeek::BifType::Record::NFS3::sattr_t); attrs->Assign(0, nullptr); // mode int mode_set_it = extract_XDR_uint32(buf, n); @@ -379,9 +379,9 @@ RecordValPtr NFS_Interp::nfs3_sattr(const u_char*& buf, int& n) return attrs; } -RecordValPtr NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) +zeek::RecordValPtr NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::sattr_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::sattr_reply_t); if ( status == BifEnum::NFS3::NFS3ERR_OK ) { @@ -397,9 +397,9 @@ RecordValPtr NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::N return rep; } -RecordValPtr NFS_Interp::nfs3_fattr(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_fattr(const u_char*& buf, int& n) { - auto attrs = zeek::make_intrusive(zeek::BifType::Record::NFS3::fattr_t); + auto attrs = zeek::make_intrusive(zeek::BifType::Record::NFS3::fattr_t); attrs->Assign(0, nfs3_ftype(buf, n)); // file type attrs->Assign(1, ExtractUint32(buf, n)); // mode @@ -419,23 +419,23 @@ RecordValPtr NFS_Interp::nfs3_fattr(const u_char*& buf, int& n) return attrs; } -EnumValPtr NFS_Interp::nfs3_time_how(const u_char*& buf, int& n) +zeek::EnumValPtr NFS_Interp::nfs3_time_how(const u_char*& buf, int& n) { BifEnum::NFS3::time_how_t t = (BifEnum::NFS3::time_how_t)extract_XDR_uint32(buf, n); auto rval = zeek::BifType::Enum::NFS3::time_how_t->GetVal(t); return rval; } -EnumValPtr NFS_Interp::nfs3_ftype(const u_char*& buf, int& n) +zeek::EnumValPtr NFS_Interp::nfs3_ftype(const u_char*& buf, int& n) { BifEnum::NFS3::file_type_t t = (BifEnum::NFS3::file_type_t)extract_XDR_uint32(buf, n); auto rval = zeek::BifType::Enum::NFS3::file_type_t->GetVal(t); return rval; } -RecordValPtr NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n) { - auto attrs = zeek::make_intrusive(zeek::BifType::Record::NFS3::wcc_attr_t); + auto attrs = zeek::make_intrusive(zeek::BifType::Record::NFS3::wcc_attr_t); attrs->Assign(0, ExtractUint64(buf, n)); // size attrs->Assign(1, ExtractTime(buf, n)); // mtime @@ -444,7 +444,7 @@ RecordValPtr NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n) return attrs; } -StringValPtr NFS_Interp::nfs3_filename(const u_char*& buf, int& n) +zeek::StringValPtr NFS_Interp::nfs3_filename(const u_char*& buf, int& n) { int name_len; const u_char* name = extract_XDR_opaque(buf, n, name_len); @@ -452,12 +452,12 @@ StringValPtr NFS_Interp::nfs3_filename(const u_char*& buf, int& n) if ( ! name ) return nullptr; - return zeek::make_intrusive(new BroString(name, name_len, false)); + return zeek::make_intrusive(new BroString(name, name_len, false)); } -RecordValPtr NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n) { - auto diropargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::diropargs_t); + auto diropargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::diropargs_t); diropargs->Assign(0, nfs3_fh(buf, n)); diropargs->Assign(1, nfs3_filename(buf, n)); @@ -465,9 +465,9 @@ RecordValPtr NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n) return diropargs; } -RecordValPtr NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n) { - auto symlinkdata = zeek::make_intrusive(zeek::BifType::Record::NFS3::symlinkdata_t); + auto symlinkdata = zeek::make_intrusive(zeek::BifType::Record::NFS3::symlinkdata_t); symlinkdata->Assign(0, nfs3_sattr(buf, n)); symlinkdata->Assign(1, nfs3_nfspath(buf, n)); @@ -475,9 +475,9 @@ RecordValPtr NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n) return symlinkdata; } -RecordValPtr NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n) { - auto renameopargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::renameopargs_t); + auto renameopargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::renameopargs_t); renameopargs->Assign(0, nfs3_fh(buf, n)); renameopargs->Assign(1, nfs3_filename(buf, n)); @@ -487,7 +487,7 @@ RecordValPtr NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n) return renameopargs; } -RecordValPtr NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n) { int have_attrs = extract_XDR_uint32(buf, n); @@ -497,7 +497,7 @@ RecordValPtr NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n) return nullptr; } -StringValPtr NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n) +zeek::StringValPtr NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n) { int have_fh = extract_XDR_uint32(buf, n); @@ -507,7 +507,7 @@ StringValPtr NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n) return nullptr; } -RecordValPtr NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n) { int have_attrs = extract_XDR_uint32(buf, n); @@ -516,16 +516,16 @@ RecordValPtr NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n) return nullptr; } -EnumValPtr NFS_Interp::nfs3_stable_how(const u_char*& buf, int& n) +zeek::EnumValPtr NFS_Interp::nfs3_stable_how(const u_char*& buf, int& n) { BifEnum::NFS3::stable_how_t stable = (BifEnum::NFS3::stable_how_t)extract_XDR_uint32(buf, n); auto rval = zeek::BifType::Enum::NFS3::stable_how_t->GetVal(stable); return rval; } -RecordValPtr NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) +zeek::RecordValPtr NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::lookup_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::lookup_reply_t); if ( status == BifEnum::NFS3::NFS3ERR_OK ) { @@ -542,9 +542,9 @@ RecordValPtr NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum:: return rep; } -RecordValPtr NFS_Interp::nfs3_readargs(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_readargs(const u_char*& buf, int& n) { - auto readargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::readargs_t); + auto readargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::readargs_t); readargs->Assign(0, nfs3_fh(buf, n)); readargs->Assign(1, ExtractUint64(buf, n)); // offset @@ -553,10 +553,10 @@ RecordValPtr NFS_Interp::nfs3_readargs(const u_char*& buf, int& n) return readargs; } -RecordValPtr NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, +zeek::RecordValPtr NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, bro_uint_t offset) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::read_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::read_reply_t); if (status == BifEnum::NFS3::NFS3ERR_OK) { @@ -576,9 +576,9 @@ RecordValPtr NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NF return rep; } -RecordValPtr NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) +zeek::RecordValPtr NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::readlink_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::readlink_reply_t); if (status == BifEnum::NFS3::NFS3ERR_OK) { @@ -593,9 +593,9 @@ RecordValPtr NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum return rep; } -RecordValPtr NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) +zeek::RecordValPtr NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::link_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::link_reply_t); if ( status == BifEnum::NFS3::NFS3ERR_OK ) { @@ -609,9 +609,9 @@ RecordValPtr NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NF return rep; } -RecordValPtr NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n) { - auto symlinkargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::symlinkargs_t); + auto symlinkargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::symlinkargs_t); symlinkargs->Assign(0, nfs3_diropargs(buf, n)); symlinkargs->Assign(1, nfs3_symlinkdata(buf, n)); @@ -619,9 +619,9 @@ RecordValPtr NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n) return symlinkargs; } -RecordValPtr NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n) { - auto sattrargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::sattrargs_t); + auto sattrargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::sattrargs_t); sattrargs->Assign(0, nfs3_fh(buf, n)); sattrargs->Assign(1, nfs3_sattr(buf, n)); @@ -629,9 +629,9 @@ RecordValPtr NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n) return sattrargs; } -RecordValPtr NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n) { - auto linkargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::linkargs_t); + auto linkargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::linkargs_t); linkargs->Assign(0, nfs3_fh(buf, n)); linkargs->Assign(1, nfs3_diropargs(buf, n)); @@ -639,11 +639,11 @@ RecordValPtr NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n) return linkargs; } -RecordValPtr NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n) { uint32_t bytes; uint64_t offset; - auto writeargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::writeargs_t); + auto writeargs = zeek::make_intrusive(zeek::BifType::Record::NFS3::writeargs_t); writeargs->Assign(0, nfs3_fh(buf, n)); offset = extract_XDR_uint64(buf, n); @@ -657,9 +657,9 @@ RecordValPtr NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n) return writeargs; } -RecordValPtr NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) +zeek::RecordValPtr NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::write_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::write_reply_t); if ( status == BifEnum::NFS3::NFS3ERR_OK ) { @@ -682,9 +682,9 @@ RecordValPtr NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::N return rep; } -RecordValPtr NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) +zeek::RecordValPtr NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::newobj_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::newobj_reply_t); if (status == BifEnum::NFS3::NFS3ERR_OK) { @@ -706,9 +706,9 @@ RecordValPtr NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum:: return rep; } -RecordValPtr NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::delobj_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::delobj_reply_t); // wcc_data rep->Assign(0, nfs3_pre_op_attr(buf, n)); @@ -717,9 +717,9 @@ RecordValPtr NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n) return rep; } -RecordValPtr NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n) +zeek::RecordValPtr NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::renameobj_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::renameobj_reply_t); // wcc_data rep->Assign(0, nfs3_pre_op_attr(buf, n)); @@ -730,9 +730,9 @@ RecordValPtr NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n) return rep; } -RecordValPtr NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n) +zeek::RecordValPtr NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n) { - auto args = zeek::make_intrusive(zeek::BifType::Record::NFS3::readdirargs_t); + auto args = zeek::make_intrusive(zeek::BifType::Record::NFS3::readdirargs_t); args->Assign(0, val_mgr->Bool(isplus)); args->Assign(1, nfs3_fh(buf, n)); @@ -746,17 +746,17 @@ RecordValPtr NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n return args; } -RecordValPtr NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf, +zeek::RecordValPtr NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf, int&n, BifEnum::NFS3::status_t status) { - auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::readdir_reply_t); + auto rep = zeek::make_intrusive(zeek::BifType::Record::NFS3::readdir_reply_t); rep->Assign(0, val_mgr->Bool(isplus)); if ( status == BifEnum::NFS3::NFS3ERR_OK ) { unsigned pos; - auto entries = zeek::make_intrusive(zeek::BifType::Vector::NFS3::direntry_vec_t); + auto entries = zeek::make_intrusive(zeek::BifType::Vector::NFS3::direntry_vec_t); rep->Assign(1, nfs3_post_op_attr(buf,n)); // dir_attr rep->Assign(2, ExtractUint64(buf,n)); // cookieverf @@ -765,7 +765,7 @@ RecordValPtr NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf, while ( extract_XDR_uint32(buf,n) ) { - auto entry = zeek::make_intrusive(zeek::BifType::Record::NFS3::direntry_t); + auto entry = zeek::make_intrusive(zeek::BifType::Record::NFS3::direntry_t); entry->Assign(0, ExtractUint64(buf,n)); // fileid entry->Assign(1, nfs3_filename(buf,n)); // fname entry->Assign(2, ExtractUint64(buf,n)); // cookie @@ -791,27 +791,27 @@ RecordValPtr NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf, return rep; } -ValPtr NFS_Interp::ExtractUint32(const u_char*& buf, int& n) +zeek::ValPtr NFS_Interp::ExtractUint32(const u_char*& buf, int& n) { return val_mgr->Count(extract_XDR_uint32(buf, n)); } -ValPtr NFS_Interp::ExtractUint64(const u_char*& buf, int& n) +zeek::ValPtr NFS_Interp::ExtractUint64(const u_char*& buf, int& n) { return val_mgr->Count(extract_XDR_uint64(buf, n)); } -ValPtr NFS_Interp::ExtractTime(const u_char*& buf, int& n) +zeek::ValPtr NFS_Interp::ExtractTime(const u_char*& buf, int& n) { - return zeek::make_intrusive(extract_XDR_time(buf, n)); + return zeek::make_intrusive(extract_XDR_time(buf, n)); } -ValPtr NFS_Interp::ExtractInterval(const u_char*& buf, int& n) +zeek::ValPtr NFS_Interp::ExtractInterval(const u_char*& buf, int& n) { - return zeek::make_intrusive(double(extract_XDR_uint32(buf, n)), 1.0); + return zeek::make_intrusive(double(extract_XDR_uint32(buf, n)), 1.0); } -ValPtr NFS_Interp::ExtractBool(const u_char*& buf, int& n) +zeek::ValPtr NFS_Interp::ExtractBool(const u_char*& buf, int& n) { return val_mgr->Bool(extract_XDR_uint32(buf, n)); } diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h index fee77490c3..c8b160e276 100644 --- a/src/analyzer/protocol/rpc/NFS.h +++ b/src/analyzer/protocol/rpc/NFS.h @@ -30,53 +30,53 @@ protected: // to 0. However, the methods might still return an allocated Val * ! // So, you might want to Unref() the Val if buf is 0. Method names // are based on the type names of RFC 1813. - StringValPtr nfs3_fh(const u_char*& buf, int& n); - RecordValPtr nfs3_fattr(const u_char*& buf, int& n); - RecordValPtr nfs3_sattr(const u_char*& buf, int& n); - EnumValPtr nfs3_ftype(const u_char*& buf, int& n); - EnumValPtr nfs3_time_how(const u_char*& buf, int& n); - RecordValPtr nfs3_wcc_attr(const u_char*& buf, int& n); - RecordValPtr nfs3_diropargs(const u_char*&buf, int &n); - RecordValPtr nfs3_symlinkdata(const u_char*& buf, int& n); - RecordValPtr nfs3_renameopargs(const u_char*&buf, int &n); - StringValPtr nfs3_filename(const u_char*& buf, int& n); - RecordValPtr nfs3_linkargs(const u_char*& buf, int& n); - RecordValPtr nfs3_symlinkargs(const u_char*& buf, int& n); - RecordValPtr nfs3_sattrargs(const u_char*& buf, int& n); - StringValPtr nfs3_nfspath(const u_char*& buf, int& n) + zeek::StringValPtr nfs3_fh(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_fattr(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_sattr(const u_char*& buf, int& n); + zeek::EnumValPtr nfs3_ftype(const u_char*& buf, int& n); + zeek::EnumValPtr nfs3_time_how(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_wcc_attr(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_diropargs(const u_char*&buf, int &n); + zeek::RecordValPtr nfs3_symlinkdata(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_renameopargs(const u_char*&buf, int &n); + zeek::StringValPtr nfs3_filename(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_linkargs(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_symlinkargs(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_sattrargs(const u_char*& buf, int& n); + zeek::StringValPtr nfs3_nfspath(const u_char*& buf, int& n) { return nfs3_filename(buf,n); } - RecordValPtr nfs3_post_op_attr(const u_char*&buf, int &n); // Return 0 or an fattr - RecordValPtr nfs3_pre_op_attr(const u_char*&buf, int &n); // Return 0 or an wcc_attr - RecordValPtr nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); - RecordValPtr nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); - RecordValPtr nfs3_readargs(const u_char*& buf, int& n); - RecordValPtr nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, bro_uint_t offset); - RecordValPtr nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); - RecordValPtr nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); - RecordValPtr nfs3_writeargs(const u_char*& buf, int& n); - EnumValPtr nfs3_stable_how(const u_char*& buf, int& n); - RecordValPtr nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); - RecordValPtr nfs3_newobj_reply(const u_char*& buf, int&n, BifEnum::NFS3::status_t status); - RecordValPtr nfs3_delobj_reply(const u_char*& buf, int& n); - RecordValPtr nfs3_renameobj_reply(const u_char*& buf, int& n); - StringValPtr nfs3_post_op_fh(const u_char*& buf, int& n); - RecordValPtr nfs3_readdirargs(bool isplus, const u_char*& buf, int&n); - RecordValPtr nfs3_readdir_reply(bool isplus, const u_char*& buf, int&n, BifEnum::NFS3::status_t status); + zeek::RecordValPtr nfs3_post_op_attr(const u_char*&buf, int &n); // Return 0 or an fattr + zeek::RecordValPtr nfs3_pre_op_attr(const u_char*&buf, int &n); // Return 0 or an wcc_attr + zeek::RecordValPtr nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); + zeek::RecordValPtr nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); + zeek::RecordValPtr nfs3_readargs(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, bro_uint_t offset); + zeek::RecordValPtr nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); + zeek::RecordValPtr nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); + zeek::RecordValPtr nfs3_writeargs(const u_char*& buf, int& n); + zeek::EnumValPtr nfs3_stable_how(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status); + zeek::RecordValPtr nfs3_newobj_reply(const u_char*& buf, int&n, BifEnum::NFS3::status_t status); + zeek::RecordValPtr nfs3_delobj_reply(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_renameobj_reply(const u_char*& buf, int& n); + zeek::StringValPtr nfs3_post_op_fh(const u_char*& buf, int& n); + zeek::RecordValPtr nfs3_readdirargs(bool isplus, const u_char*& buf, int&n); + zeek::RecordValPtr nfs3_readdir_reply(bool isplus, const u_char*& buf, int&n, BifEnum::NFS3::status_t status); // Consumes the file data in the RPC message. Depending on NFS::return_data* consts // in bro.init returns NULL or the data as string val: // * offset is the offset of the read/write call // * size is the amount of bytes read (or requested to be written), - StringValPtr nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size); + zeek::StringValPtr nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size); - ValPtr ExtractUint32(const u_char*& buf, int& n); - ValPtr ExtractUint64(const u_char*& buf, int& n); - ValPtr ExtractTime(const u_char*& buf, int& n); - ValPtr ExtractInterval(const u_char*& buf, int& n); - ValPtr ExtractBool(const u_char*& buf, int& n); + zeek::ValPtr ExtractUint32(const u_char*& buf, int& n); + zeek::ValPtr ExtractUint64(const u_char*& buf, int& n); + zeek::ValPtr ExtractTime(const u_char*& buf, int& n); + zeek::ValPtr ExtractInterval(const u_char*& buf, int& n); + zeek::ValPtr ExtractBool(const u_char*& buf, int& n); }; class NFS_Analyzer : public RPC_Analyzer { diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc index 4d9d57e341..1bedf43a43 100644 --- a/src/analyzer/protocol/rpc/Portmap.cc +++ b/src/analyzer/protocol/rpc/Portmap.cc @@ -79,7 +79,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu int reply_len) { EventHandlerPtr event; - ValPtr reply; + zeek::ValPtr reply; int success = (status == BifEnum::RPC_SUCCESS); switch ( c->Proc() ) { @@ -124,7 +124,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu if ( ! buf ) return false; - RecordVal* rv = c->RequestVal()->AsRecordVal(); + zeek::RecordVal* rv = c->RequestVal()->AsRecordVal(); const auto& is_tcp = rv->GetField(2); reply = val_mgr->Port(CheckPort(port), is_tcp->IsOne() ? TRANSPORT_TCP : TRANSPORT_UDP); @@ -139,7 +139,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu if ( success ) { static auto pm_mappings = zeek::id::find_type("pm_mappings"); - auto mappings = zeek::make_intrusive(pm_mappings); + auto mappings = zeek::make_intrusive(pm_mappings); uint32_t nmap = 0; // Each call in the loop test pulls the next "opted" @@ -189,10 +189,10 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu return true; } -ValPtr PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) +zeek::ValPtr PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) { static auto pm_mapping = zeek::id::find_type("pm_mapping"); - auto mapping = zeek::make_intrusive(pm_mapping); + auto mapping = zeek::make_intrusive(pm_mapping); mapping->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); mapping->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len))); @@ -207,10 +207,10 @@ ValPtr PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) return mapping; } -ValPtr PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) +zeek::ValPtr PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) { static auto pm_port_request = zeek::id::find_type("pm_port_request"); - auto pr = zeek::make_intrusive(pm_port_request); + auto pr = zeek::make_intrusive(pm_port_request); pr->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); pr->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len))); @@ -225,10 +225,10 @@ ValPtr PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) return pr; } -ValPtr PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len) +zeek::ValPtr PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len) { static auto pm_callit_request = zeek::id::find_type("pm_callit_request"); - auto c = zeek::make_intrusive(pm_callit_request); + auto c = zeek::make_intrusive(pm_callit_request); c->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len))); c->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len))); @@ -262,7 +262,7 @@ uint32_t PortmapperInterp::CheckPort(uint32_t port) return port; } -void PortmapperInterp::Event(EventHandlerPtr f, ValPtr request, BifEnum::rpc_status status, ValPtr reply) +void PortmapperInterp::Event(EventHandlerPtr f, zeek::ValPtr request, BifEnum::rpc_status status, zeek::ValPtr reply) { if ( ! f ) return; diff --git a/src/analyzer/protocol/rpc/Portmap.h b/src/analyzer/protocol/rpc/Portmap.h index dd783e22ae..309f310d06 100644 --- a/src/analyzer/protocol/rpc/Portmap.h +++ b/src/analyzer/protocol/rpc/Portmap.h @@ -17,11 +17,11 @@ protected: double last_time, int reply_len) override; uint32_t CheckPort(uint32_t port); - void Event(EventHandlerPtr f, ValPtr request, BifEnum::rpc_status status, ValPtr reply); + void Event(EventHandlerPtr f, zeek::ValPtr request, BifEnum::rpc_status status, zeek::ValPtr reply); - ValPtr ExtractMapping(const u_char*& buf, int& len); - ValPtr ExtractPortRequest(const u_char*& buf, int& len); - ValPtr ExtractCallItRequest(const u_char*& buf, int& len); + zeek::ValPtr ExtractMapping(const u_char*& buf, int& len); + zeek::ValPtr ExtractPortRequest(const u_char*& buf, int& len); + zeek::ValPtr ExtractCallItRequest(const u_char*& buf, int& len); }; class Portmapper_Analyzer : public RPC_Analyzer { diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc index 8fa16b2f86..ed5e918744 100644 --- a/src/analyzer/protocol/rpc/RPC.cc +++ b/src/analyzer/protocol/rpc/RPC.cc @@ -342,7 +342,7 @@ void RPC_Interpreter::Event_RPC_Dialogue(RPC_CallInfo* c, BifEnum::rpc_status st val_mgr->Count(c->Version()), val_mgr->Count(c->Proc()), zeek::BifType::Enum::rpc_status->GetVal(status), - zeek::make_intrusive(c->StartTime()), + zeek::make_intrusive(c->StartTime()), val_mgr->Count(c->CallLen()), val_mgr->Count(reply_len) ); diff --git a/src/analyzer/protocol/rpc/RPC.h b/src/analyzer/protocol/rpc/RPC.h index a4f0fa20fd..b54062c413 100644 --- a/src/analyzer/protocol/rpc/RPC.h +++ b/src/analyzer/protocol/rpc/RPC.h @@ -52,9 +52,9 @@ public: double last_time, int rpc_len); ~RPC_CallInfo(); - void AddVal(ValPtr arg_v) { v = std::move(arg_v); } - const ValPtr& RequestVal() const { return v; } - ValPtr TakeRequestVal() { auto rv = std::move(v); return rv; } + void AddVal(zeek::ValPtr arg_v) { v = std::move(arg_v); } + const zeek::ValPtr& RequestVal() const { return v; } + zeek::ValPtr TakeRequestVal() { auto rv = std::move(v); return rv; } bool CompareRexmit(const u_char* buf, int n) const; @@ -95,7 +95,7 @@ protected: int header_len; // size of data before the arguments bool valid_call; // whether call was well-formed - ValPtr v; // single (perhaps compound) value corresponding to call + zeek::ValPtr v; // single (perhaps compound) value corresponding to call }; class RPC_Interpreter { diff --git a/src/analyzer/protocol/sip/sip-analyzer.pac b/src/analyzer/protocol/sip/sip-analyzer.pac index 2a8a2802d6..e3959047a5 100644 --- a/src/analyzer/protocol/sip/sip-analyzer.pac +++ b/src/analyzer/protocol/sip/sip-analyzer.pac @@ -3,7 +3,7 @@ refine flow SIP_Flow += { %member{ int content_length; bool build_headers; - std::vector headers; + std::vector headers; %} %init{ @@ -68,7 +68,7 @@ refine flow SIP_Flow += { function build_sip_headers_val(): BroVal %{ static auto mime_header_list = zeek::id::find_type("mime_header_list"); - TableVal* t = new TableVal(mime_header_list); + auto* t = new zeek::TableVal(mime_header_list); for ( unsigned int i = 0; i < headers.size(); ++i ) { // index starting from 1 @@ -103,13 +103,13 @@ refine flow SIP_Flow += { function build_sip_header_val(name: const_bytestring, value: const_bytestring): BroVal %{ static auto mime_header_rec = zeek::id::find_type("mime_header_rec"); - RecordVal* header_record = new RecordVal(mime_header_rec); - StringValPtr name_val; + auto* header_record = new zeek::RecordVal(mime_header_rec); + zeek::StringValPtr name_val; if ( name.length() > 0 ) { // Make it all uppercase. - name_val = zeek::make_intrusive(name.length(), (const char*) name.begin()); + name_val = zeek::make_intrusive(name.length(), (const char*) name.begin()); name_val->ToUpper(); } else diff --git a/src/analyzer/protocol/smb/smb-strings.pac b/src/analyzer/protocol/smb/smb-strings.pac index fe7e2155d2..3e6e8815ce 100644 --- a/src/analyzer/protocol/smb/smb-strings.pac +++ b/src/analyzer/protocol/smb/smb-strings.pac @@ -3,7 +3,7 @@ %} %code{ -StringValPtr binpac::SMB::SMB_Conn::uint8s_to_stringval(std::vector* data) +zeek::StringValPtr binpac::SMB::SMB_Conn::uint8s_to_stringval(std::vector* data) { int length = data->size(); auto buf = std::make_unique(length); @@ -15,7 +15,7 @@ StringValPtr binpac::SMB::SMB_Conn::uint8s_to_stringval(std::vector* da return utf16_to_utf8_val(bro_analyzer()->Conn(), bs); } -StringValPtr binpac::SMB::SMB_Conn::extract_string(SMB_string* s) +zeek::StringValPtr binpac::SMB::SMB_Conn::extract_string(SMB_string* s) { if ( s->unicode() == false ) { @@ -31,18 +31,18 @@ StringValPtr binpac::SMB::SMB_Conn::extract_string(SMB_string* s) if ( length > 0 && buf[length-1] == 0x00 ) length--; - return zeek::make_intrusive(length, buf.get()); + return zeek::make_intrusive(length, buf.get()); } else return uint8s_to_stringval(s->u()->s()); } -StringValPtr binpac::SMB::SMB_Conn::smb_string2stringval(SMB_string* s) +zeek::StringValPtr binpac::SMB::SMB_Conn::smb_string2stringval(SMB_string* s) { return extract_string(s); } -StringValPtr binpac::SMB::SMB_Conn::smb2_string2stringval(SMB2_string* s) +zeek::StringValPtr binpac::SMB::SMB_Conn::smb2_string2stringval(SMB2_string* s) { return uint8s_to_stringval(s->s()); } @@ -50,10 +50,10 @@ StringValPtr binpac::SMB::SMB_Conn::smb2_string2stringval(SMB2_string* s) refine connection SMB_Conn += { %member{ - StringValPtr uint8s_to_stringval(std::vector* data); - StringValPtr extract_string(SMB_string* s); - StringValPtr smb_string2stringval(SMB_string* s); - StringValPtr smb2_string2stringval(SMB2_string* s); + zeek::StringValPtr uint8s_to_stringval(std::vector* data); + zeek::StringValPtr extract_string(SMB_string* s); + zeek::StringValPtr smb_string2stringval(SMB_string* s); + zeek::StringValPtr smb2_string2stringval(SMB2_string* s); SMB_unicode_string* me; %} diff --git a/src/analyzer/protocol/smb/smb-time.pac b/src/analyzer/protocol/smb/smb-time.pac index ff5109edc1..c658ec1ae1 100644 --- a/src/analyzer/protocol/smb/smb-time.pac +++ b/src/analyzer/protocol/smb/smb-time.pac @@ -1,21 +1,21 @@ %header{ -ValPtr filetime2brotime(uint64_t ts); -ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz); +zeek::ValPtr filetime2brotime(uint64_t ts); +zeek::ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz); -RecordValPtr SMB_BuildMACTimes(uint64_t modify, uint64_t access, - uint64_t create, uint64_t change); +zeek::RecordValPtr SMB_BuildMACTimes(uint64_t modify, uint64_t access, + uint64_t create, uint64_t change); %} %code{ -ValPtr filetime2brotime(uint64_t ts) +zeek::ValPtr filetime2brotime(uint64_t ts) { // Bro can't support times back to the 1600's // so we subtract a lot of seconds. double secs = (ts / 10000000.0L) - 11644473600.0L; - return zeek::make_intrusive(secs); + return zeek::make_intrusive(secs); } -ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz) +zeek::ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz) { tm lTime; lTime.tm_sec = ${t.two_seconds} * 2; @@ -26,13 +26,13 @@ ValPtr time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz) lTime.tm_year = 1980 + ${d.year}; lTime.tm_isdst = -1; double lResult = mktime(&lTime); - return zeek::make_intrusive(lResult + tz); + return zeek::make_intrusive(lResult + tz); } -RecordValPtr SMB_BuildMACTimes(uint64_t modify, uint64_t access, - uint64_t create, uint64_t change) +zeek::RecordValPtr SMB_BuildMACTimes(uint64_t modify, uint64_t access, + uint64_t create, uint64_t change) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB::MACTimes); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB::MACTimes); r->Assign(0, filetime2brotime(modify)); r->Assign(1, filetime2brotime(access)); r->Assign(2, filetime2brotime(create)); diff --git a/src/analyzer/protocol/smb/smb1-com-negotiate.pac b/src/analyzer/protocol/smb/smb1-com-negotiate.pac index 7328dece81..17f1e64565 100644 --- a/src/analyzer/protocol/smb/smb1-com-negotiate.pac +++ b/src/analyzer/protocol/smb/smb1-com-negotiate.pac @@ -15,7 +15,7 @@ refine connection SMB_Conn += { %{ if ( smb1_negotiate_request ) { - auto dialects = zeek::make_intrusive(zeek::id::string_vec); + auto dialects = zeek::make_intrusive(zeek::id::string_vec); for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i ) { @@ -35,13 +35,13 @@ refine connection SMB_Conn += { %{ if ( smb1_negotiate_response ) { - auto response = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponse); + auto response = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponse); switch ( ${val.word_count} ) { case 0x01: { - auto core = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseCore); + auto core = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseCore); core->Assign(0, val_mgr->Count(${val.dialect_index})); response->Assign(0, std::move(core)); @@ -50,15 +50,15 @@ refine connection SMB_Conn += { case 0x0d: { - auto security = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseSecurity); + auto security = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseSecurity); security->Assign(0, val_mgr->Bool(${val.lanman.security_user_level})); security->Assign(1, val_mgr->Bool(${val.lanman.security_challenge_response})); - auto raw = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateRawMode); + auto raw = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateRawMode); raw->Assign(0, val_mgr->Bool(${val.lanman.raw_read_supported})); raw->Assign(1, val_mgr->Bool(${val.lanman.raw_write_supported})); - auto lanman = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseLANMAN); + auto lanman = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseLANMAN); lanman->Assign(0, val_mgr->Count(${val.word_count})); lanman->Assign(1, val_mgr->Count(${val.dialect_index})); lanman->Assign(2, std::move(security)); @@ -79,13 +79,13 @@ refine connection SMB_Conn += { case 0x11: { - auto security = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseSecurity); + auto security = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseSecurity); security->Assign(0, val_mgr->Bool(${val.ntlm.security_user_level})); security->Assign(1, val_mgr->Bool(${val.ntlm.security_challenge_response})); security->Assign(2, val_mgr->Bool(${val.ntlm.security_signatures_enabled})); security->Assign(3, val_mgr->Bool(${val.ntlm.security_signatures_required})); - auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateCapabilities); + auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateCapabilities); capabilities->Assign(0, val_mgr->Bool(${val.ntlm.capabilities_raw_mode})); capabilities->Assign(1, val_mgr->Bool(${val.ntlm.capabilities_mpx_mode})); capabilities->Assign(2, val_mgr->Bool(${val.ntlm.capabilities_unicode})); @@ -108,7 +108,7 @@ refine connection SMB_Conn += { capabilities->Assign(16, val_mgr->Bool(${val.ntlm.capabilities_compressed_data})); capabilities->Assign(17, val_mgr->Bool(${val.ntlm.capabilities_extended_security})); - auto ntlm = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseNTLM); + auto ntlm = zeek::make_intrusive(zeek::BifType::Record::SMB1::NegotiateResponseNTLM); ntlm->Assign(0, val_mgr->Count(${val.word_count})); ntlm->Assign(1, val_mgr->Count(${val.dialect_index})); ntlm->Assign(2, std::move(security)); diff --git a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac index f17902c35f..2b9c6ae544 100644 --- a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac +++ b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac @@ -12,7 +12,7 @@ refine connection SMB_Conn += { %{ if ( smb1_session_setup_andx_request ) { - auto request = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXRequest); + auto request = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXRequest); request->Assign(0, val_mgr->Count(${val.word_count})); switch ( ${val.word_count} ) { @@ -31,7 +31,7 @@ refine connection SMB_Conn += { break; case 12: // NT LM 0.12 with extended security { - auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities); + auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities); capabilities->Assign(0, val_mgr->Bool(${val.ntlm_extended_security.capabilities.unicode})); capabilities->Assign(1, val_mgr->Bool(${val.ntlm_extended_security.capabilities.large_files})); capabilities->Assign(2, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_smbs})); @@ -53,7 +53,7 @@ refine connection SMB_Conn += { case 13: // NT LM 0.12 without extended security { - auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities); + auto capabilities = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities); capabilities->Assign(0, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.unicode})); capabilities->Assign(1, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.large_files})); capabilities->Assign(2, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_smbs})); @@ -90,7 +90,7 @@ refine connection SMB_Conn += { %{ if ( smb1_session_setup_andx_response ) { - auto response = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXResponse); + auto response = zeek::make_intrusive(zeek::BifType::Record::SMB1::SessionSetupAndXResponse); response->Assign(0, val_mgr->Count(${val.word_count})); switch ( ${val.word_count} ) diff --git a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac index c0abbc23b2..c33b062ffb 100644 --- a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac +++ b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac @@ -5,7 +5,7 @@ refine connection SMB_Conn += { if ( ! smb1_transaction_secondary_request ) return false; - auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans_Sec_Args); + auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans_Sec_Args); args->Assign(0, val_mgr->Count(${val.total_param_count})); args->Assign(1, val_mgr->Count(${val.total_data_count})); args->Assign(2, val_mgr->Count(${val.param_count})); @@ -15,9 +15,9 @@ refine connection SMB_Conn += { args->Assign(6, val_mgr->Count(${val.data_offset})); args->Assign(7, val_mgr->Count(${val.data_displacement})); - auto parameters = zeek::make_intrusive(${val.parameters}.length(), + auto parameters = zeek::make_intrusive(${val.parameters}.length(), (const char*)${val.parameters}.data()); - StringValPtr payload_str; + zeek::StringValPtr payload_str; SMB1_transaction_data* payload = nullptr; if ( ${val.data_count} > 0 ) @@ -29,13 +29,13 @@ refine connection SMB_Conn += { { switch ( payload->trans_type() ) { case SMB_PIPE: - payload_str = zeek::make_intrusive(${val.data_count}, (const char*)${val.data.pipe_data}.data()); + payload_str = zeek::make_intrusive(${val.data_count}, (const char*)${val.data.pipe_data}.data()); break; case SMB_UNKNOWN: - payload_str = zeek::make_intrusive(${val.data_count}, (const char*)${val.data.unknown}.data()); + payload_str = zeek::make_intrusive(${val.data_count}, (const char*)${val.data.unknown}.data()); break; default: - payload_str = zeek::make_intrusive(${val.data_count}, (const char*)${val.data.data}.data()); + payload_str = zeek::make_intrusive(${val.data_count}, (const char*)${val.data.data}.data()); break; } } diff --git a/src/analyzer/protocol/smb/smb1-com-transaction.pac b/src/analyzer/protocol/smb/smb1-com-transaction.pac index acf7fdeec6..fcdb5e0980 100644 --- a/src/analyzer/protocol/smb/smb1-com-transaction.pac +++ b/src/analyzer/protocol/smb/smb1-com-transaction.pac @@ -5,7 +5,7 @@ enum Trans_subcommands { }; %code{ - StringValPtr SMB_Conn::transaction_data_to_val(SMB1_transaction_data* payload) + zeek::StringValPtr SMB_Conn::transaction_data_to_val(SMB1_transaction_data* payload) { switch ( payload->trans_type() ) { case SMB_PIPE: @@ -26,7 +26,7 @@ refine connection SMB_Conn += { %member{ map is_file_a_pipe; - static StringValPtr transaction_data_to_val(SMB1_transaction_data* payload); + static zeek::StringValPtr transaction_data_to_val(SMB1_transaction_data* payload); %} function get_is_file_a_pipe(id: uint16): bool @@ -53,9 +53,9 @@ refine connection SMB_Conn += { if ( ! smb1_transaction_request ) return false; - auto parameters = zeek::make_intrusive(${val.parameters}.length(), + auto parameters = zeek::make_intrusive(${val.parameters}.length(), (const char*)${val.parameters}.data()); - StringValPtr payload_str; + zeek::StringValPtr payload_str; if ( ${val.data_count} > 0 ) payload_str = transaction_data_to_val(${val.data}); @@ -78,9 +78,9 @@ refine connection SMB_Conn += { if ( ! smb1_transaction_response ) return false; - auto parameters = zeek::make_intrusive(${val.parameters}.length(), + auto parameters = zeek::make_intrusive(${val.parameters}.length(), (const char*)${val.parameters}.data()); - StringValPtr payload_str; + zeek::StringValPtr payload_str; if ( ${val.data_count} > 0 ) payload_str = transaction_data_to_val(${val.data[0]}); diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac index a8253767df..fcb20a3a8b 100644 --- a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac +++ b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac @@ -5,7 +5,7 @@ refine connection SMB_Conn += { if ( ! smb1_transaction2_secondary_request ) return false; - auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans2_Sec_Args); + auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans2_Sec_Args); args->Assign(0, val_mgr->Count(${val.total_param_count})); args->Assign(1, val_mgr->Count(${val.total_data_count})); args->Assign(2, val_mgr->Count(${val.param_count})); @@ -16,8 +16,8 @@ refine connection SMB_Conn += { args->Assign(7, val_mgr->Count(${val.data_displacement})); args->Assign(8, val_mgr->Count(${val.FID})); - auto parameters = zeek::make_intrusive(${val.parameters}.length(), (const char*)${val.parameters}.data()); - auto payload = zeek::make_intrusive(${val.data}.length(), (const char*)${val.data}.data()); + auto parameters = zeek::make_intrusive(${val.parameters}.length(), (const char*)${val.parameters}.data()); + auto payload = zeek::make_intrusive(${val.data}.length(), (const char*)${val.data}.data()); zeek::BifEvent::enqueue_smb1_transaction2_secondary_request(bro_analyzer(), bro_analyzer()->Conn(), diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2.pac b/src/analyzer/protocol/smb/smb1-com-transaction2.pac index a29b158b14..120086646f 100644 --- a/src/analyzer/protocol/smb/smb1-com-transaction2.pac +++ b/src/analyzer/protocol/smb/smb1-com-transaction2.pac @@ -24,7 +24,7 @@ refine connection SMB_Conn += { %{ if ( smb1_transaction2_request ) { - auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans2_Args); + auto args = zeek::make_intrusive(zeek::BifType::Record::SMB1::Trans2_Args); args->Assign(0, val_mgr->Count(${val.total_param_count})); args->Assign(1, val_mgr->Count(${val.total_data_count})); args->Assign(2, val_mgr->Count(${val.max_param_count})); @@ -131,7 +131,7 @@ refine connection SMB_Conn += { %{ if ( smb1_trans2_find_first2_request ) { - auto result = zeek::make_intrusive(zeek::BifType::Record::SMB1::Find_First2_Request_Args); + auto result = zeek::make_intrusive(zeek::BifType::Record::SMB1::Find_First2_Request_Args); result->Assign(0, val_mgr->Count(${val.search_attrs})); result->Assign(1, val_mgr->Count(${val.search_count})); result->Assign(2, val_mgr->Count(${val.flags})); @@ -139,9 +139,9 @@ refine connection SMB_Conn += { result->Assign(4, val_mgr->Count(${val.search_storage_type})); result->Assign(5, smb_string2stringval(${val.file_name})); zeek::BifEvent::enqueue_smb1_trans2_find_first2_request(bro_analyzer(), - bro_analyzer()->Conn(), - SMBHeaderVal(header), - std::move(result)); + bro_analyzer()->Conn(), + SMBHeaderVal(header), + std::move(result)); } return true; diff --git a/src/analyzer/protocol/smb/smb1-protocol.pac b/src/analyzer/protocol/smb/smb1-protocol.pac index 6ef9caf51b..23a523d07f 100644 --- a/src/analyzer/protocol/smb/smb1-protocol.pac +++ b/src/analyzer/protocol/smb/smb1-protocol.pac @@ -3,13 +3,13 @@ %} %header{ - RecordValPtr SMBHeaderVal(SMB_Header* hdr); + zeek::RecordValPtr SMBHeaderVal(SMB_Header* hdr); %} %code{ - RecordValPtr SMBHeaderVal(SMB_Header* hdr) + zeek::RecordValPtr SMBHeaderVal(SMB_Header* hdr) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB1::Header); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB1::Header); //unsigned int status = 0; // diff --git a/src/analyzer/protocol/smb/smb2-com-close.pac b/src/analyzer/protocol/smb/smb2-com-close.pac index c7f7641e9c..688f64a71d 100644 --- a/src/analyzer/protocol/smb/smb2-com-close.pac +++ b/src/analyzer/protocol/smb/smb2-com-close.pac @@ -20,7 +20,7 @@ refine connection SMB_Conn += { %{ if ( smb2_close_response ) { - auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::CloseResponse); + auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::CloseResponse); resp->Assign(0, val_mgr->Count(${val.alloc_size})); resp->Assign(1, val_mgr->Count(${val.eof})); diff --git a/src/analyzer/protocol/smb/smb2-com-create.pac b/src/analyzer/protocol/smb/smb2-com-create.pac index dda0ce455e..a4f0787ac4 100644 --- a/src/analyzer/protocol/smb/smb2-com-create.pac +++ b/src/analyzer/protocol/smb/smb2-com-create.pac @@ -16,7 +16,7 @@ refine connection SMB_Conn += { if ( smb2_create_request ) { - auto requestinfo = zeek::make_intrusive(zeek::BifType::Record::SMB2::CreateRequest); + auto requestinfo = zeek::make_intrusive(zeek::BifType::Record::SMB2::CreateRequest); requestinfo->Assign(0, std::move(filename)); requestinfo->Assign(1, val_mgr->Count(${val.disposition})); requestinfo->Assign(2, val_mgr->Count(${val.create_options})); @@ -33,7 +33,7 @@ refine connection SMB_Conn += { %{ if ( smb2_create_response ) { - auto responseinfo = zeek::make_intrusive(zeek::BifType::Record::SMB2::CreateResponse); + auto responseinfo = zeek::make_intrusive(zeek::BifType::Record::SMB2::CreateResponse); responseinfo->Assign(0, BuildSMB2GUID(${val.file_id})); responseinfo->Assign(1, val_mgr->Count(${val.eof})); responseinfo->Assign(2, SMB_BuildMACTimes(${val.last_write_time}, @@ -45,7 +45,7 @@ refine connection SMB_Conn += { zeek::BifEvent::enqueue_smb2_create_response(bro_analyzer(), bro_analyzer()->Conn(), BuildSMB2HeaderVal(h), - std::move(responseinfo)); + std::move(responseinfo)); } return true; diff --git a/src/analyzer/protocol/smb/smb2-com-negotiate.pac b/src/analyzer/protocol/smb/smb2-com-negotiate.pac index 2f6931a1b6..f9f4239c07 100644 --- a/src/analyzer/protocol/smb/smb2-com-negotiate.pac +++ b/src/analyzer/protocol/smb/smb2-com-negotiate.pac @@ -22,7 +22,7 @@ refine connection SMB_Conn += { %{ if ( smb2_negotiate_request ) { - auto dialects = zeek::make_intrusive(zeek::id::index_vec); + auto dialects = zeek::make_intrusive(zeek::id::index_vec); for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i ) dialects->Assign(i, val_mgr->Count((*${val.dialects})[i])); @@ -39,7 +39,7 @@ refine connection SMB_Conn += { %{ if ( smb2_negotiate_response ) { - auto nr = zeek::make_intrusive(zeek::BifType::Record::SMB2::NegotiateResponse); + auto nr = zeek::make_intrusive(zeek::BifType::Record::SMB2::NegotiateResponse); nr->Assign(0, val_mgr->Count(${val.dialect_revision})); nr->Assign(1, val_mgr->Count(${val.security_mode})); @@ -48,7 +48,7 @@ refine connection SMB_Conn += { nr->Assign(4, filetime2brotime(${val.server_start_time})); nr->Assign(5, val_mgr->Count(${val.negotiate_context_count})); - auto cv = zeek::make_intrusive(zeek::BifType::Vector::SMB2::NegotiateContextValues); + auto cv = zeek::make_intrusive(zeek::BifType::Vector::SMB2::NegotiateContextValues); if ( ${val.dialect_revision} == 0x0311 && ${val.negotiate_context_count} > 0 ) { @@ -61,8 +61,8 @@ refine connection SMB_Conn += { nr->Assign(6, std::move(cv)); zeek::BifEvent::enqueue_smb2_negotiate_response(bro_analyzer(), bro_analyzer()->Conn(), - BuildSMB2HeaderVal(h), - std::move(nr)); + BuildSMB2HeaderVal(h), + std::move(nr)); } return true; diff --git a/src/analyzer/protocol/smb/smb2-com-session-setup.pac b/src/analyzer/protocol/smb/smb2-com-session-setup.pac index 566a11c39b..74955b8bc5 100644 --- a/src/analyzer/protocol/smb/smb2-com-session-setup.pac +++ b/src/analyzer/protocol/smb/smb2-com-session-setup.pac @@ -4,7 +4,7 @@ refine connection SMB_Conn += { %{ if ( smb2_session_setup_request ) { - auto req = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupRequest); + auto req = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupRequest); req->Assign(0, val_mgr->Count(${val.security_mode})); zeek::BifEvent::enqueue_smb2_session_setup_request(bro_analyzer(), @@ -20,12 +20,12 @@ refine connection SMB_Conn += { %{ if ( smb2_session_setup_response ) { - auto flags = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupFlags); + auto flags = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupFlags); flags->Assign(0, val_mgr->Bool(${val.flag_guest})); flags->Assign(1, val_mgr->Bool(${val.flag_anonymous})); flags->Assign(2, val_mgr->Bool(${val.flag_encrypt})); - auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupResponse); + auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::SessionSetupResponse); resp->Assign(0, std::move(flags)); zeek::BifEvent::enqueue_smb2_session_setup_response(bro_analyzer(), diff --git a/src/analyzer/protocol/smb/smb2-com-set-info.pac b/src/analyzer/protocol/smb/smb2-com-set-info.pac index d8fef7981e..d7539db3bd 100644 --- a/src/analyzer/protocol/smb/smb2-com-set-info.pac +++ b/src/analyzer/protocol/smb/smb2-com-set-info.pac @@ -93,11 +93,11 @@ refine connection SMB_Conn += { %{ if ( smb2_file_fullea ) { - auto eas = zeek::make_intrusive(zeek::BifType::Vector::SMB2::FileEAs); + auto eas = zeek::make_intrusive(zeek::BifType::Vector::SMB2::FileEAs); for ( auto i = 0u; i < ${val.ea_vector}->size(); ++i ) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::FileEA); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::FileEA); r->Assign(0, smb2_string2stringval(${val.ea_vector[i].ea_name})); r->Assign(1, smb2_string2stringval(${val.ea_vector[i].ea_value})); @@ -192,7 +192,7 @@ refine connection SMB_Conn += { %{ if ( smb2_file_fscontrol ) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Fscontrol); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Fscontrol); r->Assign(0, val_mgr->Int(${val.free_space_start_filtering})); r->Assign(1, val_mgr->Int(${val.free_space_start_threshold})); r->Assign(2, val_mgr->Int(${val.free_space_stop_filtering})); diff --git a/src/analyzer/protocol/smb/smb2-com-transform-header.pac b/src/analyzer/protocol/smb/smb2-com-transform-header.pac index 645ecc3d63..102401ddf2 100644 --- a/src/analyzer/protocol/smb/smb2-com-transform-header.pac +++ b/src/analyzer/protocol/smb/smb2-com-transform-header.pac @@ -4,7 +4,7 @@ refine connection SMB_Conn += { %{ if ( smb2_transform_header ) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Transform_header); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Transform_header); r->Assign(0, to_stringval(${hdr.signature})); r->Assign(1, to_stringval(${hdr.nonce})); r->Assign(2, val_mgr->Count(${hdr.orig_msg_size})); diff --git a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac index 5028c41d31..b797daa496 100644 --- a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac +++ b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac @@ -18,13 +18,13 @@ refine connection SMB_Conn += { if ( smb2_tree_connect_response ) { - auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::TreeConnectResponse); + auto resp = zeek::make_intrusive(zeek::BifType::Record::SMB2::TreeConnectResponse); resp->Assign(0, val_mgr->Count(${val.share_type})); zeek::BifEvent::enqueue_smb2_tree_connect_response(bro_analyzer(), bro_analyzer()->Conn(), BuildSMB2HeaderVal(header), - std::move(resp)); + std::move(resp)); } return true; diff --git a/src/analyzer/protocol/smb/smb2-protocol.pac b/src/analyzer/protocol/smb/smb2-protocol.pac index 490b375c70..394484cbf8 100644 --- a/src/analyzer/protocol/smb/smb2-protocol.pac +++ b/src/analyzer/protocol/smb/smb2-protocol.pac @@ -2,16 +2,16 @@ # http://msdn.microsoft.com/en-us/library/cc246497(v=PROT.13).aspx %header{ -RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr); -RecordValPtr BuildSMB2GUID(SMB2_guid* file_id); -RecordValPtr smb2_file_attrs_to_bro(SMB2_file_attributes* val); -RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv); +zeek::RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr); +zeek::RecordValPtr BuildSMB2GUID(SMB2_guid* file_id); +zeek::RecordValPtr smb2_file_attrs_to_bro(SMB2_file_attributes* val); +zeek::RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv); %} %code{ -RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr) +zeek::RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Header); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::Header); r->Assign(0, val_mgr->Count(${hdr.credit_charge})); r->Assign(1, val_mgr->Count(${hdr.status})); r->Assign(2, val_mgr->Count(${hdr.command})); @@ -25,17 +25,17 @@ RecordValPtr BuildSMB2HeaderVal(SMB2_Header* hdr) return r; } -RecordValPtr BuildSMB2GUID(SMB2_guid* file_id) +zeek::RecordValPtr BuildSMB2GUID(SMB2_guid* file_id) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::GUID); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::GUID); r->Assign(0, val_mgr->Count(${file_id.persistent})); r->Assign(1, val_mgr->Count(${file_id._volatile})); return r; } -RecordValPtr smb2_file_attrs_to_bro(SMB2_file_attributes* val) +zeek::RecordValPtr smb2_file_attrs_to_bro(SMB2_file_attributes* val) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::FileAttrs); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::FileAttrs); r->Assign(0, val_mgr->Bool(${val.read_only})); r->Assign(1, val_mgr->Bool(${val.hidden})); r->Assign(2, val_mgr->Bool(${val.system})); @@ -54,9 +54,9 @@ RecordValPtr smb2_file_attrs_to_bro(SMB2_file_attributes* val) return r; } -RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) +zeek::RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) { - auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::NegotiateContextValue); + auto r = zeek::make_intrusive(zeek::BifType::Record::SMB2::NegotiateContextValue); r->Assign(0, val_mgr->Count(${ncv.context_type})); r->Assign(1, val_mgr->Count(${ncv.data_length})); @@ -64,11 +64,11 @@ RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) switch ( ${ncv.context_type} ) { case SMB2_PREAUTH_INTEGRITY_CAPABILITIES: { - auto rpreauth = zeek::make_intrusive(zeek::BifType::Record::SMB2::PreAuthIntegrityCapabilities); + auto rpreauth = zeek::make_intrusive(zeek::BifType::Record::SMB2::PreAuthIntegrityCapabilities); rpreauth->Assign(0, val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg_count})); rpreauth->Assign(1, val_mgr->Count(${ncv.preauth_integrity_capabilities.salt_length})); - auto ha = zeek::make_intrusive(zeek::id::index_vec); + auto ha = zeek::make_intrusive(zeek::id::index_vec); for ( int i = 0; i < ${ncv.preauth_integrity_capabilities.hash_alg_count}; ++i ) { @@ -84,10 +84,10 @@ RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) case SMB2_ENCRYPTION_CAPABILITIES: { - auto rencr = zeek::make_intrusive(zeek::BifType::Record::SMB2::EncryptionCapabilities); + auto rencr = zeek::make_intrusive(zeek::BifType::Record::SMB2::EncryptionCapabilities); rencr->Assign(0, val_mgr->Count(${ncv.encryption_capabilities.cipher_count})); - auto c = zeek::make_intrusive(zeek::id::index_vec); + auto c = zeek::make_intrusive(zeek::id::index_vec); for ( int i = 0; i < ${ncv.encryption_capabilities.cipher_count}; ++i ) { @@ -102,10 +102,10 @@ RecordValPtr BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv) case SMB2_COMPRESSION_CAPABILITIES: { - auto rcomp = zeek::make_intrusive(zeek::BifType::Record::SMB2::CompressionCapabilities); + auto rcomp = zeek::make_intrusive(zeek::BifType::Record::SMB2::CompressionCapabilities); rcomp->Assign(0, val_mgr->Count(${ncv.compression_capabilities.alg_count})); - auto c = zeek::make_intrusive(zeek::id::index_vec); + auto c = zeek::make_intrusive(zeek::id::index_vec); for ( int i = 0; i < ${ncv.compression_capabilities.alg_count}; ++i ) { diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc index 013b173bc2..6bd73eddc6 100644 --- a/src/analyzer/protocol/smtp/SMTP.cc +++ b/src/analyzer/protocol/smtp/SMTP.cc @@ -222,7 +222,7 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig) EnqueueConnEvent(smtp_data, ConnVal(), val_mgr->Bool(orig), - zeek::make_intrusive(data_len, line) + zeek::make_intrusive(data_len, line) ); } } @@ -353,8 +353,8 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig) ConnVal(), val_mgr->Bool(orig), val_mgr->Count(reply_code), - zeek::make_intrusive(cmd), - zeek::make_intrusive(end_of_line - line, line), + zeek::make_intrusive(cmd), + zeek::make_intrusive(end_of_line - line, line), val_mgr->Bool((pending_reply > 0)) ); } @@ -855,14 +855,14 @@ void SMTP_Analyzer::RequestEvent(int cmd_len, const char* cmd, if ( smtp_request ) { - auto cmd_arg = zeek::make_intrusive(cmd_len, cmd); + auto cmd_arg = zeek::make_intrusive(cmd_len, cmd); cmd_arg->ToUpper(); EnqueueConnEvent(smtp_request, ConnVal(), val_mgr->Bool(orig_is_sender), std::move(cmd_arg), - zeek::make_intrusive(arg_len, arg) + zeek::make_intrusive(arg_len, arg) ); } } @@ -882,8 +882,8 @@ void SMTP_Analyzer::Unexpected(bool is_sender, const char* msg, EnqueueConnEvent(smtp_unexpected, ConnVal(), val_mgr->Bool(is_orig), - zeek::make_intrusive(msg), - zeek::make_intrusive(detail_len, detail) + zeek::make_intrusive(msg), + zeek::make_intrusive(detail_len, detail) ); } } diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac index 4ded91a635..eda0bf74af 100644 --- a/src/analyzer/protocol/snmp/snmp-analyzer.pac +++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac @@ -8,26 +8,26 @@ %} %header{ -AddrValPtr network_address_to_val(const ASN1Encoding* na); -AddrValPtr network_address_to_val(const NetworkAddress* na); -ValPtr asn1_obj_to_val(const ASN1Encoding* obj); +zeek::AddrValPtr network_address_to_val(const ASN1Encoding* na); +zeek::AddrValPtr network_address_to_val(const NetworkAddress* na); +zeek::ValPtr asn1_obj_to_val(const ASN1Encoding* obj); -RecordValPtr build_hdr(const Header* header); -RecordValPtr build_hdrV3(const Header* header); -VectorValPtr build_bindings(const VarBindList* vbl); -RecordValPtr build_pdu(const CommonPDU* pdu); -RecordValPtr build_trap_pdu(const TrapPDU* pdu); -RecordValPtr build_bulk_pdu(const GetBulkRequestPDU* pdu); +zeek::RecordValPtr build_hdr(const Header* header); +zeek::RecordValPtr build_hdrV3(const Header* header); +zeek::VectorValPtr build_bindings(const VarBindList* vbl); +zeek::RecordValPtr build_pdu(const CommonPDU* pdu); +zeek::RecordValPtr build_trap_pdu(const TrapPDU* pdu); +zeek::RecordValPtr build_bulk_pdu(const GetBulkRequestPDU* pdu); %} %code{ -AddrValPtr network_address_to_val(const NetworkAddress* na) +zeek::AddrValPtr network_address_to_val(const NetworkAddress* na) { return network_address_to_val(na->encoding()); } -AddrValPtr network_address_to_val(const ASN1Encoding* na) +zeek::AddrValPtr network_address_to_val(const ASN1Encoding* na) { bytestring const& bs = na->content(); @@ -35,16 +35,16 @@ AddrValPtr network_address_to_val(const ASN1Encoding* na) // but standards don't seem to currently make any provisions for IPv6, // so ignore anything that can't be IPv4. if ( bs.length() != 4 ) - return zeek::make_intrusive(IPAddr()); + return zeek::make_intrusive(IPAddr()); const u_char* data = reinterpret_cast(bs.data()); uint32 network_order = extract_uint32(data); - return zeek::make_intrusive(ntohl(network_order)); + return zeek::make_intrusive(ntohl(network_order)); } -ValPtr asn1_obj_to_val(const ASN1Encoding* obj) +zeek::ValPtr asn1_obj_to_val(const ASN1Encoding* obj) { - RecordValPtr rval = zeek::make_intrusive(zeek::BifType::Record::SNMP::ObjectValue); + zeek::RecordValPtr rval = zeek::make_intrusive(zeek::BifType::Record::SNMP::ObjectValue); uint8 tag = obj->meta()->tag(); rval->Assign(0, val_mgr->Count(tag)); @@ -85,20 +85,20 @@ ValPtr asn1_obj_to_val(const ASN1Encoding* obj) return rval; } -ValPtr time_ticks_to_val(const TimeTicks* tt) +zeek::ValPtr time_ticks_to_val(const TimeTicks* tt) { return asn1_integer_to_val(tt->asn1_integer(), zeek::TYPE_COUNT); } -RecordValPtr build_hdr(const Header* header) +zeek::RecordValPtr build_hdr(const Header* header) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::Header); + auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::Header); rv->Assign(0, val_mgr->Count(header->version())); switch ( header->version() ) { case SNMPV1_TAG: { - auto v1 = zeek::make_intrusive(zeek::BifType::Record::SNMP::HeaderV1); + auto v1 = zeek::make_intrusive(zeek::BifType::Record::SNMP::HeaderV1); v1->Assign(0, asn1_octet_string_to_val(header->v1()->community())); rv->Assign(1, std::move(v1)); } @@ -106,7 +106,7 @@ RecordValPtr build_hdr(const Header* header) case SNMPV2_TAG: { - auto v2 = zeek::make_intrusive(zeek::BifType::Record::SNMP::HeaderV2); + auto v2 = zeek::make_intrusive(zeek::BifType::Record::SNMP::HeaderV2); v2->Assign(0, asn1_octet_string_to_val(header->v2()->community())); rv->Assign(2, std::move(v2)); } @@ -122,9 +122,9 @@ RecordValPtr build_hdr(const Header* header) return rv; } -RecordValPtr build_hdrV3(const Header* header) +zeek::RecordValPtr build_hdrV3(const Header* header) { - auto v3 = zeek::make_intrusive(zeek::BifType::Record::SNMP::HeaderV3); + auto v3 = zeek::make_intrusive(zeek::BifType::Record::SNMP::HeaderV3); const v3Header* v3hdr = header->v3(); const v3HeaderData* global_data = v3hdr->global_data(); bytestring const& flags = global_data->flags()->encoding()->content(); @@ -142,7 +142,7 @@ RecordValPtr build_hdrV3(const Header* header) if ( v3hdr->next()->tag() == ASN1_SEQUENCE_TAG ) { const v3ScopedPDU* spdu = v3hdr->plaintext_pdu(); - auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::ScopedPDU_Context); + auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::ScopedPDU_Context); rv->Assign(0, asn1_octet_string_to_val(spdu->context_engine_id())); rv->Assign(1, asn1_octet_string_to_val(spdu->context_name())); v3->Assign(8, std::move(rv)); @@ -151,14 +151,14 @@ RecordValPtr build_hdrV3(const Header* header) return v3; } -VectorValPtr build_bindings(const VarBindList* vbl) +zeek::VectorValPtr build_bindings(const VarBindList* vbl) { - auto vv = zeek::make_intrusive(zeek::BifType::Vector::SNMP::Bindings); + auto vv = zeek::make_intrusive(zeek::BifType::Vector::SNMP::Bindings); for ( size_t i = 0; i < vbl->bindings()->size(); ++i ) { VarBind* vb = (*vbl->bindings())[i]; - auto binding = zeek::make_intrusive(zeek::BifType::Record::SNMP::Binding); + auto binding = zeek::make_intrusive(zeek::BifType::Record::SNMP::Binding); binding->Assign(0, asn1_oid_to_val(vb->name()->oid())); binding->Assign(1, asn1_obj_to_val(vb->value()->encoding())); vv->Assign(i, std::move(binding)); @@ -167,9 +167,9 @@ VectorValPtr build_bindings(const VarBindList* vbl) return vv; } -RecordValPtr build_pdu(const CommonPDU* pdu) +zeek::RecordValPtr build_pdu(const CommonPDU* pdu) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::PDU); + auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::PDU); rv->Assign(0, asn1_integer_to_val(pdu->request_id(), zeek::TYPE_INT)); rv->Assign(1, asn1_integer_to_val(pdu->error_status(), zeek::TYPE_INT)); rv->Assign(2, asn1_integer_to_val(pdu->error_index(), zeek::TYPE_INT)); @@ -177,9 +177,9 @@ RecordValPtr build_pdu(const CommonPDU* pdu) return rv; } -RecordValPtr build_trap_pdu(const TrapPDU* pdu) +zeek::RecordValPtr build_trap_pdu(const TrapPDU* pdu) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::TrapPDU); + auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::TrapPDU); rv->Assign(0, asn1_oid_to_val(pdu->enterprise())); rv->Assign(1, network_address_to_val(pdu->agent_addr())); rv->Assign(2, asn1_integer_to_val(pdu->generic_trap(), zeek::TYPE_INT)); @@ -189,9 +189,9 @@ RecordValPtr build_trap_pdu(const TrapPDU* pdu) return rv; } -RecordValPtr build_bulk_pdu(const GetBulkRequestPDU* pdu) +zeek::RecordValPtr build_bulk_pdu(const GetBulkRequestPDU* pdu) { - auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::BulkPDU); + auto rv = zeek::make_intrusive(zeek::BifType::Record::SNMP::BulkPDU); rv->Assign(0, asn1_integer_to_val(pdu->request_id(), zeek::TYPE_INT)); rv->Assign(1, asn1_integer_to_val(pdu->non_repeaters(), zeek::TYPE_COUNT)); rv->Assign(2, asn1_integer_to_val(pdu->max_repititions(), zeek::TYPE_COUNT)); diff --git a/src/analyzer/protocol/socks/socks-analyzer.pac b/src/analyzer/protocol/socks/socks-analyzer.pac index 3509621b20..9748a5dda2 100644 --- a/src/analyzer/protocol/socks/socks-analyzer.pac +++ b/src/analyzer/protocol/socks/socks-analyzer.pac @@ -1,10 +1,10 @@ %header{ -StringValPtr array_to_string(vector *a); +zeek::StringValPtr array_to_string(vector *a); %} %code{ -StringValPtr array_to_string(vector *a) +zeek::StringValPtr array_to_string(vector *a) { int len = a->size(); auto tmp = std::make_unique(len); @@ -14,7 +14,7 @@ StringValPtr array_to_string(vector *a) while ( len > 0 && tmp[len-1] == '\0' ) --len; - return zeek::make_intrusive(len, tmp.get()); + return zeek::make_intrusive(len, tmp.get()); } %} @@ -25,8 +25,8 @@ refine connection SOCKS_Conn += { if ( socks_request ) { static auto socks_address = zeek::id::find_type("SOCKS::Address"); - auto sa = zeek::make_intrusive(socks_address); - sa->Assign(0, zeek::make_intrusive(htonl(${request.addr}))); + auto sa = zeek::make_intrusive(socks_address); + sa->Assign(0, zeek::make_intrusive(htonl(${request.addr}))); if ( ${request.v4a} ) sa->Assign(1, array_to_string(${request.name})); @@ -50,8 +50,8 @@ refine connection SOCKS_Conn += { if ( socks_reply ) { static auto socks_address = zeek::id::find_type("SOCKS::Address"); - auto sa = zeek::make_intrusive(socks_address); - sa->Assign(0, zeek::make_intrusive(htonl(${reply.addr}))); + auto sa = zeek::make_intrusive(socks_address); + sa->Assign(0, zeek::make_intrusive(htonl(${reply.addr}))); zeek::BifEvent::enqueue_socks_reply(bro_analyzer(), bro_analyzer()->Conn(), @@ -83,22 +83,22 @@ refine connection SOCKS_Conn += { } static auto socks_address = zeek::id::find_type("SOCKS::Address"); - auto sa = zeek::make_intrusive(socks_address); + auto sa = zeek::make_intrusive(socks_address); // This is dumb and there must be a better way (checking for presence of a field)... switch ( ${request.remote_name.addr_type} ) { case 1: - sa->Assign(0, zeek::make_intrusive(htonl(${request.remote_name.ipv4}))); + sa->Assign(0, zeek::make_intrusive(htonl(${request.remote_name.ipv4}))); break; case 3: - sa->Assign(1, zeek::make_intrusive(${request.remote_name.domain_name.name}.length(), + sa->Assign(1, zeek::make_intrusive(${request.remote_name.domain_name.name}.length(), (const char*) ${request.remote_name.domain_name.name}.data())); break; case 4: - sa->Assign(0, zeek::make_intrusive(IPAddr(IPv6, (const uint32_t*) ${request.remote_name.ipv6}, IPAddr::Network))); + sa->Assign(0, zeek::make_intrusive(IPAddr(IPv6, (const uint32_t*) ${request.remote_name.ipv6}, IPAddr::Network))); break; default: @@ -123,22 +123,22 @@ refine connection SOCKS_Conn += { function socks5_reply(reply: SOCKS5_Reply): bool %{ static auto socks_address = zeek::id::find_type("SOCKS::Address"); - auto sa = zeek::make_intrusive(socks_address); + auto sa = zeek::make_intrusive(socks_address); // This is dumb and there must be a better way (checking for presence of a field)... switch ( ${reply.bound.addr_type} ) { case 1: - sa->Assign(0, zeek::make_intrusive(htonl(${reply.bound.ipv4}))); + sa->Assign(0, zeek::make_intrusive(htonl(${reply.bound.ipv4}))); break; case 3: - sa->Assign(1, zeek::make_intrusive(${reply.bound.domain_name.name}.length(), + sa->Assign(1, zeek::make_intrusive(${reply.bound.domain_name.name}.length(), (const char*) ${reply.bound.domain_name.name}.data())); break; case 4: - sa->Assign(0, zeek::make_intrusive(IPAddr(IPv6, (const uint32_t*) ${reply.bound.ipv6}, IPAddr::Network))); + sa->Assign(0, zeek::make_intrusive(IPAddr(IPv6, (const uint32_t*) ${reply.bound.ipv6}, IPAddr::Network))); break; default: @@ -164,8 +164,8 @@ refine connection SOCKS_Conn += { if ( ! socks_login_userpass_request ) return true; - auto user = zeek::make_intrusive(${request.username}.length(), (const char*) ${request.username}.begin()); - auto pass = zeek::make_intrusive(${request.password}.length(), (const char*) ${request.password}.begin()); + auto user = zeek::make_intrusive(${request.username}.length(), (const char*) ${request.username}.begin()); + auto pass = zeek::make_intrusive(${request.password}.length(), (const char*) ${request.password}.begin()); zeek::BifEvent::enqueue_socks_login_userpass_request(bro_analyzer(), bro_analyzer()->Conn(), diff --git a/src/analyzer/protocol/ssh/ssh-analyzer.pac b/src/analyzer/protocol/ssh/ssh-analyzer.pac index de770a0ade..bd22db7528 100644 --- a/src/analyzer/protocol/ssh/ssh-analyzer.pac +++ b/src/analyzer/protocol/ssh/ssh-analyzer.pac @@ -5,14 +5,14 @@ %} %header{ -VectorValPtr name_list_to_vector(const bytestring& nl); +zeek::VectorValPtr name_list_to_vector(const bytestring& nl); %} %code{ // Copied from IRC_Analyzer::SplitWords -VectorValPtr name_list_to_vector(const bytestring& nl) +zeek::VectorValPtr name_list_to_vector(const bytestring& nl) { - auto vv = zeek::make_intrusive(zeek::id::string_vec); + auto vv = zeek::make_intrusive(zeek::id::string_vec); string name_list = std_str(nl); if ( name_list.size() < 1 ) @@ -32,7 +32,7 @@ VectorValPtr name_list_to_vector(const bytestring& nl) { word = name_list.substr(start, split_pos - start); if ( word.size() > 0 && word[0] != ',' ) - vv->Assign(vv->Size(), zeek::make_intrusive(word)); + vv->Assign(vv->Size(), zeek::make_intrusive(word)); start = split_pos + 1; } @@ -41,7 +41,7 @@ VectorValPtr name_list_to_vector(const bytestring& nl) if ( start < name_list.size() ) { word = name_list.substr(start, name_list.size() - start); - vv->Assign(vv->Size(), zeek::make_intrusive(word)); + vv->Assign(vv->Size(), zeek::make_intrusive(word)); } return vv; } @@ -70,28 +70,28 @@ refine flow SSH_Flow += { if ( ! ssh_capabilities ) return false; - auto result = zeek::make_intrusive(zeek::BifType::Record::SSH::Capabilities); + auto result = zeek::make_intrusive(zeek::BifType::Record::SSH::Capabilities); result->Assign(0, name_list_to_vector(${msg.kex_algorithms.val})); result->Assign(1, name_list_to_vector(${msg.server_host_key_algorithms.val})); - auto encryption_algs = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); + auto encryption_algs = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); encryption_algs->Assign(0, name_list_to_vector(${msg.encryption_algorithms_client_to_server.val})); encryption_algs->Assign(1, name_list_to_vector(${msg.encryption_algorithms_server_to_client.val})); result->Assign(2, std::move(encryption_algs)); - auto mac_algs = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); + auto mac_algs = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); mac_algs->Assign(0, name_list_to_vector(${msg.mac_algorithms_client_to_server.val})); mac_algs->Assign(1, name_list_to_vector(${msg.mac_algorithms_server_to_client.val})); result->Assign(3, std::move(mac_algs)); - auto compression_algs = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); + auto compression_algs = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); compression_algs->Assign(0, name_list_to_vector(${msg.compression_algorithms_client_to_server.val})); compression_algs->Assign(1, name_list_to_vector(${msg.compression_algorithms_server_to_client.val})); result->Assign(4, std::move(compression_algs)); if ( ${msg.languages_client_to_server.len} || ${msg.languages_server_to_client.len} ) { - auto languages = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); + auto languages = zeek::make_intrusive(zeek::BifType::Record::SSH::Algorithm_Prefs); if ( ${msg.languages_client_to_server.len} ) languages->Assign(0, name_list_to_vector(${msg.languages_client_to_server.val})); if ( ${msg.languages_server_to_client.len} ) diff --git a/src/analyzer/protocol/ssl/proc-client-hello.pac b/src/analyzer/protocol/ssl/proc-client-hello.pac index 70b8e25114..20c00034d4 100644 --- a/src/analyzer/protocol/ssl/proc-client-hello.pac +++ b/src/analyzer/protocol/ssl/proc-client-hello.pac @@ -23,7 +23,7 @@ else std::transform(cipher_suites24->begin(), cipher_suites24->end(), std::back_inserter(cipher_suites), to_int()); - auto cipher_vec = zeek::make_intrusive(zeek::id::index_vec); + auto cipher_vec = zeek::make_intrusive(zeek::id::index_vec); for ( unsigned int i = 0; i < cipher_suites.size(); ++i ) { @@ -31,7 +31,7 @@ cipher_vec->Assign(i, ciph); } - auto comp_vec = zeek::make_intrusive(zeek::id::index_vec); + auto comp_vec = zeek::make_intrusive(zeek::id::index_vec); if ( compression_methods ) { @@ -44,8 +44,8 @@ zeek::BifEvent::enqueue_ssl_client_hello(bro_analyzer(), bro_analyzer()->Conn(), version, record_version(), ts, - zeek::make_intrusive(client_random.length(), - (const char*) client_random.data()), + zeek::make_intrusive(client_random.length(), + (const char*) client_random.data()), {zeek::AdoptRef{}, to_string_val(session_id)}, std::move(cipher_vec), std::move(comp_vec)); } diff --git a/src/analyzer/protocol/ssl/proc-server-hello.pac b/src/analyzer/protocol/ssl/proc-server-hello.pac index ed81ae0f92..f49eacbc68 100644 --- a/src/analyzer/protocol/ssl/proc-server-hello.pac +++ b/src/analyzer/protocol/ssl/proc-server-hello.pac @@ -28,8 +28,8 @@ zeek::BifEvent::enqueue_ssl_server_hello(bro_analyzer(), bro_analyzer()->Conn(), version, record_version(), ts, - zeek::make_intrusive(server_random.length(), - (const char*) server_random.data()), + zeek::make_intrusive(server_random.length(), + (const char*) server_random.data()), {zeek::AdoptRef{}, to_string_val(session_id)}, ciphers->size()==0 ? 0 : ciphers->at(0), comp_method); diff --git a/src/analyzer/protocol/ssl/ssl-defs.pac b/src/analyzer/protocol/ssl/ssl-defs.pac index 6c2d6a0bfa..e13d6ca169 100644 --- a/src/analyzer/protocol/ssl/ssl-defs.pac +++ b/src/analyzer/protocol/ssl/ssl-defs.pac @@ -48,7 +48,7 @@ string orig_label(bool is_orig) extern type to_int; -function to_string_val(data : uint8[]) : StringVal +function to_string_val(data : uint8[]) : zeek::StringVal %{ char tmp[32]; memset(tmp, 0, sizeof(tmp)); @@ -60,7 +60,7 @@ function to_string_val(data : uint8[]) : StringVal tmp[i-1] = (*data)[i-1]; } - return new StringVal(32, tmp); + return new zeek::StringVal(32, tmp); %} function version_ok(vers : uint16) : bool diff --git a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac index f91ed8dbd1..ae4a86b460 100644 --- a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac +++ b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac @@ -76,7 +76,7 @@ refine connection SSL_Conn += { if ( ssl_heartbeat ) zeek::BifEvent::enqueue_ssl_heartbeat(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, ${rec.length}, type, payload_length, - zeek::make_intrusive(data.length(), (const char*) data.data())); + zeek::make_intrusive(data.length(), (const char*) data.data())); return true; %} diff --git a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac index 957a41ccd2..fdc6d57f22 100644 --- a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac +++ b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac @@ -37,7 +37,7 @@ refine connection Handshake_Conn += { zeek::BifEvent::enqueue_ssl_session_ticket_handshake(bro_analyzer(), bro_analyzer()->Conn(), ${rec.ticket_lifetime_hint}, - zeek::make_intrusive(${rec.data}.length(), (const char*) ${rec.data}.data())); + zeek::make_intrusive(${rec.data}.length(), (const char*) ${rec.data}.data())); } return true; %} @@ -66,7 +66,7 @@ refine connection Handshake_Conn += { if ( ssl_extension ) zeek::BifEvent::enqueue_ssl_extension(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, type, - zeek::make_intrusive(length, reinterpret_cast(data))); + zeek::make_intrusive(length, reinterpret_cast(data))); return true; %} @@ -75,7 +75,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_ec_point_formats ) return true; - auto points = zeek::make_intrusive(zeek::id::index_vec); + auto points = zeek::make_intrusive(zeek::id::index_vec); if ( point_format_list ) { @@ -94,7 +94,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_elliptic_curves ) return true; - auto curves = zeek::make_intrusive(zeek::id::index_vec); + auto curves = zeek::make_intrusive(zeek::id::index_vec); if ( list ) { @@ -113,7 +113,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_key_share ) return true; - auto nglist = zeek::make_intrusive(zeek::id::index_vec); + auto nglist = zeek::make_intrusive(zeek::id::index_vec); if ( keyshare ) { @@ -131,7 +131,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_key_share ) return true; - auto nglist = zeek::make_intrusive(zeek::id::index_vec); + auto nglist = zeek::make_intrusive(zeek::id::index_vec); nglist->Assign(0u, val_mgr->Count(keyshare->namedgroup())); zeek::BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist)); @@ -143,7 +143,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_key_share ) return true; - auto nglist = zeek::make_intrusive(zeek::id::index_vec); + auto nglist = zeek::make_intrusive(zeek::id::index_vec); nglist->Assign(0u, val_mgr->Count(namedgroup)); zeek::BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist)); @@ -155,13 +155,13 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_signature_algorithm ) return true; - auto slist = zeek::make_intrusive(zeek::id::find_type("signature_and_hashalgorithm_vec")); + auto slist = zeek::make_intrusive(zeek::id::find_type("signature_and_hashalgorithm_vec")); if ( supported_signature_algorithms ) { for ( unsigned int i = 0; i < supported_signature_algorithms->size(); ++i ) { - auto el = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); + auto el = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); el->Assign(0, val_mgr->Count((*supported_signature_algorithms)[i]->HashAlgorithm())); el->Assign(1, val_mgr->Count((*supported_signature_algorithms)[i]->SignatureAlgorithm())); slist->Assign(i, std::move(el)); @@ -178,12 +178,12 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_application_layer_protocol_negotiation ) return true; - auto plist = zeek::make_intrusive(zeek::id::string_vec); + auto plist = zeek::make_intrusive(zeek::id::string_vec); if ( protocols ) { for ( unsigned int i = 0; i < protocols->size(); ++i ) - plist->Assign(i, zeek::make_intrusive((*protocols)[i]->name().length(), (const char*) (*protocols)[i]->name().data())); + plist->Assign(i, zeek::make_intrusive((*protocols)[i]->name().length(), (const char*) (*protocols)[i]->name().data())); } zeek::BifEvent::enqueue_ssl_extension_application_layer_protocol_negotiation(bro_analyzer(), bro_analyzer()->Conn(), @@ -194,7 +194,7 @@ refine connection Handshake_Conn += { function proc_server_name(rec: HandshakeRecord, list: ServerName[]) : bool %{ - auto servers = zeek::make_intrusive(zeek::id::string_vec); + auto servers = zeek::make_intrusive(zeek::id::string_vec); if ( list ) { @@ -208,7 +208,7 @@ refine connection Handshake_Conn += { } if ( servername->host_name() ) - servers->Assign(j++, zeek::make_intrusive(servername->host_name()->host_name().length(), (const char*) servername->host_name()->host_name().data())); + servers->Assign(j++, zeek::make_intrusive(servername->host_name()->host_name().length(), (const char*) servername->host_name()->host_name().data())); else bro_analyzer()->Weird("Empty server_name extension in ssl connection"); } @@ -226,7 +226,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_supported_versions ) return true; - auto versions = zeek::make_intrusive(zeek::id::index_vec); + auto versions = zeek::make_intrusive(zeek::id::index_vec); if ( versions_list ) { @@ -245,7 +245,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_supported_versions ) return true; - auto versions = zeek::make_intrusive(zeek::id::index_vec); + auto versions = zeek::make_intrusive(zeek::id::index_vec); versions->Assign(0u, val_mgr->Count(version)); zeek::BifEvent::enqueue_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(), @@ -259,7 +259,7 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_psk_key_exchange_modes ) return true; - auto modes = zeek::make_intrusive(zeek::id::index_vec); + auto modes = zeek::make_intrusive(zeek::id::index_vec); if ( mode_list ) { @@ -317,7 +317,7 @@ refine connection Handshake_Conn += { zeek::BifEvent::enqueue_ssl_stapled_ocsp(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, - zeek::make_intrusive(response.length(), (const char*) response.data())); + zeek::make_intrusive(response.length(), (const char*) response.data())); file_mgr->EndOfFile(file_id); } @@ -338,11 +338,11 @@ refine connection Handshake_Conn += { zeek::BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(), bro_analyzer()->Conn(), ${kex.params.curve}, - zeek::make_intrusive(${kex.params.point}.length(), (const char*)${kex.params.point}.data())); + zeek::make_intrusive(${kex.params.point}.length(), (const char*)${kex.params.point}.data())); if ( ssl_server_signature ) { - auto ha = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); + auto ha = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); if ( ${kex.signed_params.uses_signature_and_hashalgorithm} ) { @@ -359,7 +359,7 @@ refine connection Handshake_Conn += { zeek::BifEvent::enqueue_ssl_server_signature(bro_analyzer(), bro_analyzer()->Conn(), std::move(ha), - zeek::make_intrusive(${kex.signed_params.signature}.length(), (const char*)(${kex.signed_params.signature}).data())); + zeek::make_intrusive(${kex.signed_params.signature}.length(), (const char*)(${kex.signed_params.signature}).data())); } return true; @@ -374,7 +374,7 @@ refine connection Handshake_Conn += { zeek::BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(), bro_analyzer()->Conn(), ${kex.params.curve}, - zeek::make_intrusive(${kex.params.point}.length(), (const char*)${kex.params.point}.data())); + zeek::make_intrusive(${kex.params.point}.length(), (const char*)${kex.params.point}.data())); return true; %} @@ -384,7 +384,7 @@ refine connection Handshake_Conn += { if ( ssl_rsa_client_pms ) zeek::BifEvent::enqueue_ssl_rsa_client_pms(bro_analyzer(), bro_analyzer()->Conn(), - zeek::make_intrusive(rsa_pms.length(), (const char*)rsa_pms.data())); + zeek::make_intrusive(rsa_pms.length(), (const char*)rsa_pms.data())); return true; %} @@ -394,7 +394,7 @@ refine connection Handshake_Conn += { if ( ssl_dh_client_params ) zeek::BifEvent::enqueue_ssl_dh_client_params(bro_analyzer(), bro_analyzer()->Conn(), - zeek::make_intrusive(Yc.length(), (const char*)Yc.data())); + zeek::make_intrusive(Yc.length(), (const char*)Yc.data())); return true; %} @@ -404,7 +404,7 @@ refine connection Handshake_Conn += { if ( ssl_ecdh_client_params ) zeek::BifEvent::enqueue_ssl_ecdh_client_params(bro_analyzer(), bro_analyzer()->Conn(), - zeek::make_intrusive(point.length(), (const char*)point.data())); + zeek::make_intrusive(point.length(), (const char*)point.data())); return true; %} @@ -414,17 +414,17 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_signed_certificate_timestamp ) return true; - auto ha = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); + auto ha = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); ha->Assign(0, val_mgr->Count(digitally_signed_algorithms->HashAlgorithm())); ha->Assign(1, val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm())); zeek::BifEvent::enqueue_ssl_extension_signed_certificate_timestamp(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, version, - zeek::make_intrusive(logid.length(), reinterpret_cast(logid.begin())), + zeek::make_intrusive(logid.length(), reinterpret_cast(logid.begin())), timestamp, std::move(ha), - zeek::make_intrusive(digitally_signed_signature.length(), reinterpret_cast(digitally_signed_signature.begin())) + zeek::make_intrusive(digitally_signed_signature.length(), reinterpret_cast(digitally_signed_signature.begin())) ); return true; @@ -435,14 +435,14 @@ refine connection Handshake_Conn += { if ( ssl_ecdh_server_params ) zeek::BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(), bro_analyzer()->Conn(), - zeek::make_intrusive(p.length(), (const char*) p.data()), - zeek::make_intrusive(g.length(), (const char*) g.data()), - zeek::make_intrusive(Ys.length(), (const char*) Ys.data()) + zeek::make_intrusive(p.length(), (const char*) p.data()), + zeek::make_intrusive(g.length(), (const char*) g.data()), + zeek::make_intrusive(Ys.length(), (const char*) Ys.data()) ); if ( ssl_server_signature ) { - auto ha = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); + auto ha = zeek::make_intrusive(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm); if ( ${signed_params.uses_signature_and_hashalgorithm} ) { @@ -458,7 +458,7 @@ refine connection Handshake_Conn += { zeek::BifEvent::enqueue_ssl_server_signature(bro_analyzer(), bro_analyzer()->Conn(), std::move(ha), - zeek::make_intrusive(${signed_params.signature}.length(), (const char*)(${signed_params.signature}).data()) + zeek::make_intrusive(${signed_params.signature}.length(), (const char*)(${signed_params.signature}).data()) ); } @@ -470,9 +470,9 @@ refine connection Handshake_Conn += { if ( ssl_dh_server_params ) zeek::BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(), bro_analyzer()->Conn(), - zeek::make_intrusive(p.length(), (const char*) p.data()), - zeek::make_intrusive(g.length(), (const char*) g.data()), - zeek::make_intrusive(Ys.length(), (const char*) Ys.data()) + zeek::make_intrusive(p.length(), (const char*) p.data()), + zeek::make_intrusive(g.length(), (const char*) g.data()), + zeek::make_intrusive(Ys.length(), (const char*) Ys.data()) ); return true; @@ -492,25 +492,25 @@ refine connection Handshake_Conn += { if ( ! ssl_extension_pre_shared_key_server_hello ) return true; - auto slist = zeek::make_intrusive(zeek::id::find_type("psk_identity_vec")); + auto slist = zeek::make_intrusive(zeek::id::find_type("psk_identity_vec")); if ( identities && identities->identities() ) { for ( auto&& identity : *(identities->identities()) ) { - auto el = zeek::make_intrusive(zeek::BifType::Record::SSL::PSKIdentity); - el->Assign(0, zeek::make_intrusive(identity->identity().length(), (const char*) identity->identity().data())); + auto el = zeek::make_intrusive(zeek::BifType::Record::SSL::PSKIdentity); + el->Assign(0, zeek::make_intrusive(identity->identity().length(), (const char*) identity->identity().data())); el->Assign(1, val_mgr->Count(identity->obfuscated_ticket_age())); slist->Assign(slist->Size(), std::move(el)); } } - auto blist = zeek::make_intrusive(zeek::id::string_vec); + auto blist = zeek::make_intrusive(zeek::id::string_vec); if ( binders && binders->binders() ) { for ( auto&& binder : *(binders->binders()) ) - blist->Assign(blist->Size(), zeek::make_intrusive(binder->binder().length(), (const char*) binder->binder().data())); + blist->Assign(blist->Size(), zeek::make_intrusive(binder->binder().length(), (const char*) binder->binder().data())); } zeek::BifEvent::enqueue_ssl_extension_pre_shared_key_client_hello(bro_analyzer(), bro_analyzer()->Conn(), diff --git a/src/analyzer/protocol/syslog/syslog-analyzer.pac b/src/analyzer/protocol/syslog/syslog-analyzer.pac index ec684ed115..1dff5f6f66 100644 --- a/src/analyzer/protocol/syslog/syslog-analyzer.pac +++ b/src/analyzer/protocol/syslog/syslog-analyzer.pac @@ -20,7 +20,7 @@ flow Syslog_Flow connection()->bro_analyzer()->Conn(), ${m.PRI.facility}, ${m.PRI.severity}, - zeek::make_intrusive(${m.msg}.length(), (const char*)${m.msg}.begin()) + zeek::make_intrusive(${m.msg}.length(), (const char*)${m.msg}.begin()) ); else zeek::BifEvent::enqueue_syslog_message( @@ -28,7 +28,7 @@ flow Syslog_Flow connection()->bro_analyzer()->Conn(), 999, 999, - zeek::make_intrusive(${m.msg}.length(), (const char*)${m.msg}.begin()) + zeek::make_intrusive(${m.msg}.length(), (const char*)${m.msg}.begin()) ); return true; diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc index 35fd0eadfa..81ceb400e4 100644 --- a/src/analyzer/protocol/tcp/TCP.cc +++ b/src/analyzer/protocol/tcp/TCP.cc @@ -42,8 +42,8 @@ namespace { // local namespace static const int ORIG = 1; static const int RESP = 2; -static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip, - const struct tcphdr* tcp) +static zeek::RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip, + const struct tcphdr* tcp) { int winscale = -1; int MSS = 0; @@ -108,7 +108,7 @@ static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip, } static auto SYN_packet = zeek::id::find_type("SYN_packet"); - RecordVal* v = new RecordVal(SYN_packet); + auto* v = new zeek::RecordVal(SYN_packet); v->Assign(0, val_mgr->Bool(is_orig)); v->Assign(1, val_mgr->Bool(int(ip->DF()))); @@ -789,13 +789,13 @@ void TCP_Analyzer::GeneratePacketEvent( EnqueueConnEvent(tcp_packet, ConnVal(), val_mgr->Bool(is_orig), - zeek::make_intrusive(flags.AsString()), + zeek::make_intrusive(flags.AsString()), val_mgr->Count(rel_seq), val_mgr->Count(flags.ACK() ? rel_ack : 0), val_mgr->Count(len), // We need the min() here because Ethernet padding can lead to // caplen > len. - zeek::make_intrusive(std::min(caplen, len), (const char*) data) + zeek::make_intrusive(std::min(caplen, len), (const char*) data) ); } @@ -1097,7 +1097,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, if ( flags.SYN() ) { syn_weirds(flags, endpoint, len); - RecordVal* SYN_vals = build_syn_packet_val(is_orig, ip, tp); + zeek::RecordVal* SYN_vals = build_syn_packet_val(is_orig, ip, tp); init_window(endpoint, peer, flags, SYN_vals->GetField(5)->CoerceToInt(), base_seq, ack_seq); @@ -1285,10 +1285,10 @@ void TCP_Analyzer::FlipRoles() resp->is_orig = !resp->is_orig; } -void TCP_Analyzer::UpdateConnVal(RecordVal *conn_val) +void TCP_Analyzer::UpdateConnVal(zeek::RecordVal *conn_val) { - RecordVal* orig_endp_val = conn_val->GetField("orig")->AsRecordVal(); - RecordVal* resp_endp_val = conn_val->GetField("resp")->AsRecordVal(); + zeek::RecordVal* orig_endp_val = conn_val->GetField("orig")->AsRecordVal(); + zeek::RecordVal* resp_endp_val = conn_val->GetField("resp")->AsRecordVal(); orig_endp_val->Assign(0, val_mgr->Count(orig->Size())); orig_endp_val->Assign(1, val_mgr->Count(int(orig->state))); @@ -1356,23 +1356,23 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) if ( tcp_options ) { - auto option_list = zeek::make_intrusive(zeek::BifType::Vector::TCP::OptionList); + auto option_list = zeek::make_intrusive(zeek::BifType::Vector::TCP::OptionList); - auto add_option_data = [](const RecordValPtr& rv, const u_char* odata, int olen) + auto add_option_data = [](const zeek::RecordValPtr& rv, const u_char* odata, int olen) { if ( olen <= 2 ) return; auto data_len = olen - 2; auto data = reinterpret_cast(odata + 2); - rv->Assign(2, zeek::make_intrusive(data_len, data)); + rv->Assign(2, zeek::make_intrusive(data_len, data)); }; for ( const auto& o : opts ) { auto kind = o[0]; auto length = kind < 2 ? 1 : o[1]; - auto option_record = zeek::make_intrusive(zeek::BifType::Record::TCP::Option); + auto option_record = zeek::make_intrusive(zeek::BifType::Record::TCP::Option); option_list->Assign(option_list->Size(), option_record); option_record->Assign(0, val_mgr->Count(kind)); option_record->Assign(1, val_mgr->Count(length)); @@ -1423,7 +1423,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) auto p = reinterpret_cast(o + 2); auto num_pointers = (length - 2) / 4; auto vt = zeek::id::index_vec; - auto sack = zeek::make_intrusive(std::move(vt)); + auto sack = zeek::make_intrusive(std::move(vt)); for ( auto i = 0; i < num_pointers; ++i ) sack->Assign(sack->Size(), val_mgr->Count(ntohl(p[i]))); @@ -2076,10 +2076,10 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl return false; } -RecordVal* TCPStats_Endpoint::BuildStats() +zeek::RecordVal* TCPStats_Endpoint::BuildStats() { static auto endpoint_stats = zeek::id::find_type("endpoint_stats"); - RecordVal* stats = new RecordVal(endpoint_stats); + auto* stats = new zeek::RecordVal(endpoint_stats); stats->Assign(0, val_mgr->Count(num_pkts)); stats->Assign(1, val_mgr->Count(num_rxmit)); diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h index 696d1d1526..a1cfa69643 100644 --- a/src/analyzer/protocol/tcp/TCP.h +++ b/src/analyzer/protocol/tcp/TCP.h @@ -64,7 +64,7 @@ public: BroFilePtr GetContentsFile(unsigned int direction) const override; // From Analyzer.h - void UpdateConnVal(RecordVal *conn_val) override; + void UpdateConnVal(zeek::RecordVal *conn_val) override; int ParseTCPOptions(const struct tcphdr* tcp, bool is_orig); @@ -267,7 +267,7 @@ public: bool DataSent(double t, uint64_t seq, int len, int caplen, const u_char* data, const IP_Hdr* ip, const struct tcphdr* tp); - RecordVal* BuildStats(); + zeek::RecordVal* BuildStats(); protected: TCP_Endpoint* endp; diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc index 1d0f787594..f7dbc605e1 100644 --- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc +++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc @@ -240,7 +240,7 @@ bool TCP_Endpoint::DataSent(double t, uint64_t seq, int len, int caplen, tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, Conn()->ConnVal(), val_mgr->Bool(IsOrig()), - zeek::make_intrusive(buf) + zeek::make_intrusive(buf) ); } } diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc index 63b37668aa..2d64cb5046 100644 --- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc +++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc @@ -41,8 +41,8 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer, if ( ::tcp_contents ) { - static auto tcp_content_delivery_ports_orig = zeek::id::find_val("tcp_content_delivery_ports_orig"); - static auto tcp_content_delivery_ports_resp = zeek::id::find_val("tcp_content_delivery_ports_resp"); + static auto tcp_content_delivery_ports_orig = zeek::id::find_val("tcp_content_delivery_ports_orig"); + static auto tcp_content_delivery_ports_resp = zeek::id::find_val("tcp_content_delivery_ports_resp"); const auto& dst_port_val = val_mgr->Port(ntohs(tcp_analyzer->Conn()->RespPort()), TRANSPORT_TCP); const auto& ports = IsOrig() ? @@ -359,7 +359,7 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, const BroFilePtr& f) tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, Endpoint()->Conn()->ConnVal(), val_mgr->Bool(IsOrig()), - zeek::make_intrusive("TCP reassembler content write failure") + zeek::make_intrusive("TCP reassembler content write failure") ); } @@ -374,7 +374,7 @@ void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, const Br tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, Endpoint()->Conn()->ConnVal(), val_mgr->Bool(IsOrig()), - zeek::make_intrusive("TCP reassembler gap write failure") + zeek::make_intrusive("TCP reassembler gap write failure") ); } @@ -453,9 +453,9 @@ void TCP_Reassembler::Overlap(const u_char* b1, const u_char* b2, uint64_t n) tcp_analyzer->EnqueueConnEvent(rexmit_inconsistency, tcp_analyzer->ConnVal(), - zeek::make_intrusive(b1_s), - zeek::make_intrusive(b2_s), - zeek::make_intrusive(flags.AsString()) + zeek::make_intrusive(b1_s), + zeek::make_intrusive(b2_s), + zeek::make_intrusive(flags.AsString()) ); } } @@ -611,7 +611,7 @@ void TCP_Reassembler::DeliverBlock(uint64_t seq, int len, const u_char* data) tcp_analyzer->ConnVal(), val_mgr->Bool(IsOrig()), val_mgr->Count(seq), - zeek::make_intrusive(len, (const char*) data) + zeek::make_intrusive(len, (const char*) data) ); // Q. Can we say this because it is already checked in DataSent()? diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif index 743bbb22ca..37f0a0ddbd 100644 --- a/src/analyzer/protocol/tcp/functions.bif +++ b/src/analyzer/protocol/tcp/functions.bif @@ -127,7 +127,7 @@ function get_contents_file%(cid: conn_id, direction: count%): file auto cf = c->GetRootAnalyzer()->GetContentsFile(direction); if ( cf ) - return zeek::make_intrusive(std::move(cf)); + return zeek::make_intrusive(std::move(cf)); } // Return some sort of error value. @@ -136,5 +136,5 @@ function get_contents_file%(cid: conn_id, direction: count%): file else builtin_error("no contents file for given direction"); - return zeek::make_intrusive(zeek::make_intrusive(stderr, "-", "w")); + return zeek::make_intrusive(zeek::make_intrusive(stderr, "-", "w")); %} diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc index 5c546ffc25..693fdab4e4 100644 --- a/src/analyzer/protocol/teredo/Teredo.cc +++ b/src/analyzer/protocol/teredo/Teredo.cc @@ -96,24 +96,24 @@ bool TeredoEncapsulation::DoParse(const u_char* data, int& len, return false; } -RecordValPtr TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const +zeek::RecordValPtr TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const { static auto teredo_hdr_type = zeek::id::find_type("teredo_hdr"); static auto teredo_auth_type = zeek::id::find_type("teredo_auth"); static auto teredo_origin_type = zeek::id::find_type("teredo_origin"); - auto teredo_hdr = zeek::make_intrusive(teredo_hdr_type); + auto teredo_hdr = zeek::make_intrusive(teredo_hdr_type); if ( auth ) { - auto teredo_auth = zeek::make_intrusive(teredo_auth_type); + auto teredo_auth = zeek::make_intrusive(teredo_auth_type); uint8_t id_len = *((uint8_t*)(auth + 2)); uint8_t au_len = *((uint8_t*)(auth + 3)); uint64_t nonce = ntohll(*((uint64_t*)(auth + 4 + id_len + au_len))); uint8_t conf = *((uint8_t*)(auth + 4 + id_len + au_len + 8)); - teredo_auth->Assign(0, zeek::make_intrusive( + teredo_auth->Assign(0, zeek::make_intrusive( new BroString(auth + 4, id_len, true))); - teredo_auth->Assign(1, zeek::make_intrusive( + teredo_auth->Assign(1, zeek::make_intrusive( new BroString(auth + 4 + id_len, au_len, true))); teredo_auth->Assign(2, val_mgr->Count(nonce)); teredo_auth->Assign(3, val_mgr->Count(conf)); @@ -122,11 +122,11 @@ RecordValPtr TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const if ( origin_indication ) { - auto teredo_origin = zeek::make_intrusive(teredo_origin_type); + auto teredo_origin = zeek::make_intrusive(teredo_origin_type); uint16_t port = ntohs(*((uint16_t*)(origin_indication + 2))) ^ 0xFFFF; uint32_t addr = ntohl(*((uint32_t*)(origin_indication + 4))) ^ 0xFFFFFFFF; teredo_origin->Assign(0, val_mgr->Port(port, TRANSPORT_UDP)); - teredo_origin->Assign(1, zeek::make_intrusive(htonl(addr))); + teredo_origin->Assign(1, zeek::make_intrusive(htonl(addr))); teredo_hdr->Assign(1, std::move(teredo_origin)); } @@ -194,7 +194,7 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, return; } - ValPtr teredo_hdr; + zeek::ValPtr teredo_hdr; if ( teredo_packet ) { diff --git a/src/analyzer/protocol/teredo/Teredo.h b/src/analyzer/protocol/teredo/Teredo.h index c80bef0905..b8b06c0db7 100644 --- a/src/analyzer/protocol/teredo/Teredo.h +++ b/src/analyzer/protocol/teredo/Teredo.h @@ -74,7 +74,7 @@ public: const u_char* Authentication() const { return auth; } - RecordValPtr BuildVal(const IP_Hdr* inner) const; + zeek::RecordValPtr BuildVal(const IP_Hdr* inner) const; protected: bool DoParse(const u_char* data, int& len, bool found_orig, bool found_au); diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc index ce6e78637a..d18a120c44 100644 --- a/src/analyzer/protocol/udp/UDP.cc +++ b/src/analyzer/protocol/udp/UDP.cc @@ -42,7 +42,7 @@ void UDP_Analyzer::Done() } void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, - uint64_t seq, const IP_Hdr* ip, int caplen) + uint64_t seq, const IP_Hdr* ip, int caplen) { assert(ip); @@ -134,9 +134,9 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, if ( udp_contents ) { - static auto udp_content_ports = zeek::id::find_val("udp_content_ports"); - static auto udp_content_delivery_ports_orig = zeek::id::find_val("udp_content_delivery_ports_orig"); - static auto udp_content_delivery_ports_resp = zeek::id::find_val("udp_content_delivery_ports_resp"); + static auto udp_content_ports = zeek::id::find_val("udp_content_ports"); + static auto udp_content_delivery_ports_orig = zeek::id::find_val("udp_content_delivery_ports_orig"); + static auto udp_content_delivery_ports_resp = zeek::id::find_val("udp_content_delivery_ports_resp"); bool do_udp_contents = false; const auto& sport_val = val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP); const auto& dport_val = val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP); @@ -168,10 +168,9 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, if ( do_udp_contents ) EnqueueConnEvent(udp_contents, - ConnVal(), - val_mgr->Bool(is_orig), - zeek::make_intrusive(len, (const char*) data) - ); + ConnVal(), + val_mgr->Bool(is_orig), + zeek::make_intrusive(len, (const char*) data)); } if ( is_orig ) @@ -214,10 +213,10 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, ForwardPacket(len, data, is_orig, seq, ip, caplen); } -void UDP_Analyzer::UpdateConnVal(RecordVal *conn_val) +void UDP_Analyzer::UpdateConnVal(zeek::RecordVal* conn_val) { - RecordVal* orig_endp = conn_val->GetField("orig")->AsRecordVal(); - RecordVal* resp_endp = conn_val->GetField("resp")->AsRecordVal(); + zeek::RecordVal* orig_endp = conn_val->GetField("orig")->AsRecordVal(); + zeek::RecordVal* resp_endp = conn_val->GetField("resp")->AsRecordVal(); UpdateEndpointVal(orig_endp, true); UpdateEndpointVal(resp_endp, false); @@ -226,7 +225,7 @@ void UDP_Analyzer::UpdateConnVal(RecordVal *conn_val) Analyzer::UpdateConnVal(conn_val); } -void UDP_Analyzer::UpdateEndpointVal(RecordVal* endp, bool is_orig) +void UDP_Analyzer::UpdateEndpointVal(zeek::RecordVal* endp, bool is_orig) { bro_int_t size = is_orig ? request_len : reply_len; if ( size < 0 ) diff --git a/src/analyzer/protocol/udp/UDP.h b/src/analyzer/protocol/udp/UDP.h index 1fa3877772..d7df56f5e2 100644 --- a/src/analyzer/protocol/udp/UDP.h +++ b/src/analyzer/protocol/udp/UDP.h @@ -18,7 +18,7 @@ public: ~UDP_Analyzer() override; void Init() override; - void UpdateConnVal(RecordVal *conn_val) override; + void UpdateConnVal(zeek::RecordVal *conn_val) override; static analyzer::Analyzer* Instantiate(Connection* conn) { return new UDP_Analyzer(conn); } @@ -39,7 +39,7 @@ protected: bro_int_t request_len, reply_len; private: - void UpdateEndpointVal(RecordVal* endp, bool is_orig); + void UpdateEndpointVal(zeek::RecordVal* endp, bool is_orig); #define HIST_ORIG_DATA_PKT 0x1 #define HIST_RESP_DATA_PKT 0x2 diff --git a/src/binpac_bro-lib.pac b/src/binpac_bro-lib.pac index ead66b5d0b..5fe9cfaac7 100644 --- a/src/binpac_bro-lib.pac +++ b/src/binpac_bro-lib.pac @@ -7,7 +7,7 @@ %} %code{ -StringValPtr utf16_to_utf8_val(Connection* conn, const bytestring& utf16) +zeek::StringValPtr utf16_to_utf8_val(Connection* conn, const bytestring& utf16) { std::string resultstring; @@ -52,10 +52,10 @@ StringValPtr utf16_to_utf8_val(Connection* conn, const bytestring& utf16) // We're relying on no nulls being in the string. //return new StringVal(resultstring.length(), (const char *) resultstring.data()); - return zeek::make_intrusive(resultstring.c_str()); + return zeek::make_intrusive(resultstring.c_str()); } -StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16) +zeek::StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16) { return utf16_to_utf8_val(conn, utf16).release(); } diff --git a/src/binpac_bro.h b/src/binpac_bro.h index 004f8e4e6a..90b8ebcd58 100644 --- a/src/binpac_bro.h +++ b/src/binpac_bro.h @@ -1,8 +1,6 @@ #pragma once class Connection; -class Val; -class PortVal; namespace analyzer { class Analyzer; } @@ -17,32 +15,32 @@ namespace analyzer { class Analyzer; } namespace binpac { -typedef analyzer::Analyzer* BroAnalyzer; -typedef file_analysis::Analyzer BroFileAnalyzer; -typedef Val* BroVal; -typedef PortVal* BroPortVal; -typedef StringVal* BroStringVal; +using BroAnalyzer = analyzer::Analyzer*; +using BroFileAnalyzer = file_analysis::Analyzer; +using BroVal = zeek::Val*; +using BroPortVal = zeek::PortVal*; +using BroStringVal = zeek::StringVal*; [[deprecated("Remove in v4.1. Use StringVal constructor directly.")]] -inline StringVal* string_to_val(string const &str) +inline zeek::StringVal* string_to_val(string const &str) { - return new StringVal(str.c_str()); + return new zeek::StringVal(str.c_str()); } [[deprecated("Remove in v4.1. Use binpac::to_stringval() instead.")]] -inline StringVal* bytestring_to_val(const_bytestring const &str) +inline zeek::StringVal* bytestring_to_val(const_bytestring const &str) { - return new StringVal(str.length(), (const char*) str.begin()); + return new zeek::StringVal(str.length(), (const char*) str.begin()); } -inline StringValPtr to_stringval(const_bytestring const& str) +inline zeek::StringValPtr to_stringval(const_bytestring const& str) { - return zeek::make_intrusive(str.length(), (const char*) str.begin()); + return zeek::make_intrusive(str.length(), (const char*) str.begin()); } -StringValPtr utf16_to_utf8_val(Connection* conn, const bytestring& utf16); +zeek::StringValPtr utf16_to_utf8_val(Connection* conn, const bytestring& utf16); [[deprecated("Remove in v4.1. Use utf16_to_utf8_val() instead.")]] -StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16); +zeek::StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16); } // namespace binpac diff --git a/src/broker/Data.cc b/src/broker/Data.cc index 8104d20de2..4157da2e00 100644 --- a/src/broker/Data.cc +++ b/src/broker/Data.cc @@ -73,7 +73,7 @@ TEST_CASE("converting Broker to Zeek protocol constants") } struct val_converter { - using result_type = ValPtr; + using result_type = zeek::ValPtr; zeek::Type* type; @@ -108,7 +108,7 @@ struct val_converter { result_type operator()(double a) { if ( type->Tag() == zeek::TYPE_DOUBLE ) - return zeek::make_intrusive(a); + return zeek::make_intrusive(a); return nullptr; } @@ -116,13 +116,13 @@ struct val_converter { { switch ( type->Tag() ) { case zeek::TYPE_STRING: - return zeek::make_intrusive(a.size(), a.data()); + return zeek::make_intrusive(a.size(), a.data()); case zeek::TYPE_FILE: { auto file = BroFile::Get(a.data()); if ( file ) - return zeek::make_intrusive(std::move(file)); + return zeek::make_intrusive(std::move(file)); return nullptr; } @@ -136,7 +136,7 @@ struct val_converter { if ( type->Tag() == zeek::TYPE_ADDR ) { auto bits = reinterpret_cast(&a.bytes()); - return zeek::make_intrusive(IPAddr(*bits)); + return zeek::make_intrusive(IPAddr(*bits)); } return nullptr; @@ -147,7 +147,7 @@ struct val_converter { if ( type->Tag() == zeek::TYPE_SUBNET ) { auto bits = reinterpret_cast(&a.network().bytes()); - return zeek::make_intrusive(IPPrefix(IPAddr(*bits), a.length())); + return zeek::make_intrusive(IPPrefix(IPAddr(*bits), a.length())); } return nullptr; @@ -168,7 +168,7 @@ struct val_converter { using namespace std::chrono; auto s = duration_cast(a.time_since_epoch()); - return zeek::make_intrusive(s.count()); + return zeek::make_intrusive(s.count()); } result_type operator()(broker::timespan& a) @@ -178,7 +178,7 @@ struct val_converter { using namespace std::chrono; auto s = duration_cast(a); - return zeek::make_intrusive(s.count()); + return zeek::make_intrusive(s.count()); } result_type operator()(broker::enum_value& a) @@ -204,7 +204,7 @@ struct val_converter { return nullptr; auto tt = type->AsTableType(); - auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, tt}); + auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, tt}); for ( auto& item : a ) { @@ -237,7 +237,7 @@ struct val_converter { if ( expected_index_types.size() != indices->size() ) return nullptr; - auto list_val = zeek::make_intrusive(zeek::TYPE_ANY); + auto list_val = zeek::make_intrusive(zeek::TYPE_ANY); for ( auto i = 0u; i < indices->size(); ++i ) { @@ -263,7 +263,7 @@ struct val_converter { return nullptr; auto tt = type->AsTableType(); - auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, tt}); + auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, tt}); for ( auto& item : a ) { @@ -296,7 +296,7 @@ struct val_converter { if ( expected_index_types.size() != indices->size() ) return nullptr; - auto list_val = zeek::make_intrusive(zeek::TYPE_ANY); + auto list_val = zeek::make_intrusive(zeek::TYPE_ANY); for ( auto i = 0u; i < indices->size(); ++i ) { @@ -326,7 +326,7 @@ struct val_converter { if ( type->Tag() == zeek::TYPE_VECTOR ) { auto vt = type->AsVectorType(); - auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, vt}); + auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, vt}); for ( auto& item : a ) { @@ -383,7 +383,7 @@ struct val_converter { else if ( type->Tag() == zeek::TYPE_RECORD ) { auto rt = type->AsRecordType(); - auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, rt}); + auto rval = zeek::make_intrusive(zeek::IntrusivePtr{zeek::NewRef{}, rt}); auto idx = 0u; for ( auto i = 0u; i < static_cast(rt->NumFields()); ++i ) @@ -432,11 +432,11 @@ struct val_converter { return nullptr; } - auto rval = zeek::make_intrusive(re); + auto rval = zeek::make_intrusive(re); return rval; } else if ( type->Tag() == zeek::TYPE_OPAQUE ) - return OpaqueVal::Unserialize(a); + return zeek::OpaqueVal::Unserialize(a); return nullptr; } @@ -763,7 +763,7 @@ struct type_checker { { // TODO: Could avoid doing the full unserialization here // and just check if the type is a correct match. - auto ov = OpaqueVal::Unserialize(a); + auto ov = zeek::OpaqueVal::Unserialize(a); return ov != nullptr; } @@ -779,7 +779,7 @@ static bool data_type_check(const broker::data& d, zeek::Type* t) return caf::visit(type_checker{t}, d); } -ValPtr bro_broker::data_to_val(broker::data d, zeek::Type* type) +zeek::ValPtr bro_broker::data_to_val(broker::data d, zeek::Type* type) { if ( type->Tag() == zeek::TYPE_ANY ) return bro_broker::make_data_val(move(d)); @@ -787,7 +787,7 @@ ValPtr bro_broker::data_to_val(broker::data d, zeek::Type* type) return caf::visit(val_converter{type}, std::move(d)); } -broker::expected bro_broker::val_to_data(const Val* v) +broker::expected bro_broker::val_to_data(const zeek::Val* v) { switch ( v->GetType()->Tag() ) { case zeek::TYPE_BOOL: @@ -891,7 +891,7 @@ broker::expected bro_broker::val_to_data(const Val* v) rval = broker::table(); HashKey* hk; - TableEntryVal* entry; + zeek::TableEntryVal* entry; auto c = table->InitForIteration(); while ( (entry = table->NextEntry(hk, c)) ) @@ -1010,9 +1010,9 @@ broker::expected bro_broker::val_to_data(const Val* v) return broker::ec::invalid_data; } -RecordValPtr bro_broker::make_data_val(Val* v) +zeek::RecordValPtr bro_broker::make_data_val(zeek::Val* v) { - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); auto data = val_to_data(v); if ( data ) @@ -1023,15 +1023,15 @@ RecordValPtr bro_broker::make_data_val(Val* v) return rval; } -RecordValPtr bro_broker::make_data_val(broker::data d) +zeek::RecordValPtr bro_broker::make_data_val(broker::data d) { - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); rval->Assign(0, zeek::make_intrusive(move(d))); return rval; } struct data_type_getter { - using result_type = EnumValPtr; + using result_type = zeek::EnumValPtr; result_type operator()(broker::none) { @@ -1112,12 +1112,12 @@ struct data_type_getter { } }; -EnumValPtr bro_broker::get_data_type(RecordVal* v, Frame* frame) +zeek::EnumValPtr bro_broker::get_data_type(zeek::RecordVal* v, Frame* frame) { return caf::visit(data_type_getter{}, opaque_field_to_data(v, frame)); } -broker::data& bro_broker::opaque_field_to_data(RecordVal* v, Frame* f) +broker::data& bro_broker::opaque_field_to_data(zeek::RecordVal* v, Frame* f) { const auto& d = v->GetField(0); @@ -1142,7 +1142,7 @@ bool bro_broker::DataVal::canCastTo(zeek::Type* t) const return data_type_check(data, t); } -ValPtr bro_broker::DataVal::castTo(zeek::Type* t) +zeek::ValPtr bro_broker::DataVal::castTo(zeek::Type* t) { return data_to_val(data, t); } diff --git a/src/broker/Data.h b/src/broker/Data.h index 2d8d6f6a9b..0085ed2844 100644 --- a/src/broker/Data.h +++ b/src/broker/Data.h @@ -31,14 +31,14 @@ TransportProto to_bro_port_proto(broker::port::protocol tp); * @return a Broker::Data value, where the optional field is set if the conversion * was possible, else it is unset. */ -RecordValPtr make_data_val(Val* v); +zeek::RecordValPtr make_data_val(zeek::Val* v); /** * Create a Broker::Data value from a Broker data value. * @param d the Broker value to wrap in an opaque type. * @return a Broker::Data value that wraps the Broker value. */ -RecordValPtr make_data_val(broker::data d); +zeek::RecordValPtr make_data_val(broker::data d); /** * Get the type of Broker data that Broker::Data wraps. @@ -46,14 +46,14 @@ RecordValPtr make_data_val(broker::data d); * @param frame used to get location info upon error. * @return a Broker::DataType value. */ -EnumValPtr get_data_type(RecordVal* v, Frame* frame); +zeek::EnumValPtr get_data_type(zeek::RecordVal* v, Frame* frame); /** * Convert a Bro value to a Broker data value. * @param v a Bro value. * @return a Broker data value if the Bro value could be converted to one. */ -broker::expected val_to_data(const Val* v); +broker::expected val_to_data(const zeek::Val* v); /** * Convert a Broker data value to a Bro value. @@ -62,7 +62,7 @@ broker::expected val_to_data(const Val* v); * @return a pointer to a new Bro value or a nullptr if the conversion was not * possible. */ -ValPtr data_to_val(broker::data d, zeek::Type* type); +zeek::ValPtr data_to_val(broker::data d, zeek::Type* type); /** * Convert a Bro threading::Value to a Broker data value. @@ -97,7 +97,7 @@ threading::Field* data_to_threading_field(broker::data d); /** * A Bro value which wraps a Broker data value. */ -class DataVal : public OpaqueVal { +class DataVal : public zeek::OpaqueVal { public: DataVal(broker::data arg_data) @@ -106,7 +106,7 @@ public: void ValDescribe(ODesc* d) const override; - ValPtr castTo(zeek::Type* t); + zeek::ValPtr castTo(zeek::Type* t); bool canCastTo(zeek::Type* t) const; // Returns the Bro type that scripts use to represent a Broker data @@ -188,7 +188,7 @@ struct type_name_getter { * @return a reference to the wrapped Broker data value. A runtime interpreter * exception is thrown if the the optional opaque value of \a v is not set. */ -broker::data& opaque_field_to_data(RecordVal* v, Frame* f); +broker::data& opaque_field_to_data(zeek::RecordVal* v, Frame* f); /** * Retrieve variant data from a Broker data value. @@ -217,18 +217,18 @@ T& require_data_type(broker::data& d, zeek::TypeTag tag, Frame* f) * @see require_data_type() and opaque_field_to_data(). */ template -inline T& require_data_type(RecordVal* v, zeek::TypeTag tag, Frame* f) +inline T& require_data_type(zeek::RecordVal* v, zeek::TypeTag tag, Frame* f) { return require_data_type(opaque_field_to_data(v, f), tag, f); } // Copying data in to iterator vals is not the fastest approach, but safer... -class SetIterator : public OpaqueVal { +class SetIterator : public zeek::OpaqueVal { public: - SetIterator(RecordVal* v, zeek::TypeTag tag, Frame* f) - : OpaqueVal(bro_broker::opaque_of_set_iterator), + SetIterator(zeek::RecordVal* v, zeek::TypeTag tag, Frame* f) + : zeek::OpaqueVal(bro_broker::opaque_of_set_iterator), dat(require_data_type(v, zeek::TYPE_TABLE, f)), it(dat.begin()) {} @@ -238,17 +238,17 @@ public: protected: SetIterator() - : OpaqueVal(bro_broker::opaque_of_set_iterator) + : zeek::OpaqueVal(bro_broker::opaque_of_set_iterator) {} DECLARE_OPAQUE_VALUE(bro_broker::SetIterator) }; -class TableIterator : public OpaqueVal { +class TableIterator : public zeek::OpaqueVal { public: - TableIterator(RecordVal* v, zeek::TypeTag tag, Frame* f) - : OpaqueVal(bro_broker::opaque_of_table_iterator), + TableIterator(zeek::RecordVal* v, zeek::TypeTag tag, Frame* f) + : zeek::OpaqueVal(bro_broker::opaque_of_table_iterator), dat(require_data_type(v, zeek::TYPE_TABLE, f)), it(dat.begin()) {} @@ -258,17 +258,17 @@ public: protected: TableIterator() - : OpaqueVal(bro_broker::opaque_of_table_iterator) + : zeek::OpaqueVal(bro_broker::opaque_of_table_iterator) {} DECLARE_OPAQUE_VALUE(bro_broker::TableIterator) }; -class VectorIterator : public OpaqueVal { +class VectorIterator : public zeek::OpaqueVal { public: - VectorIterator(RecordVal* v, zeek::TypeTag tag, Frame* f) - : OpaqueVal(bro_broker::opaque_of_vector_iterator), + VectorIterator(zeek::RecordVal* v, zeek::TypeTag tag, Frame* f) + : zeek::OpaqueVal(bro_broker::opaque_of_vector_iterator), dat(require_data_type(v, zeek::TYPE_VECTOR, f)), it(dat.begin()) {} @@ -278,17 +278,17 @@ public: protected: VectorIterator() - : OpaqueVal(bro_broker::opaque_of_vector_iterator) + : zeek::OpaqueVal(bro_broker::opaque_of_vector_iterator) {} DECLARE_OPAQUE_VALUE(bro_broker::VectorIterator) }; -class RecordIterator : public OpaqueVal { +class RecordIterator : public zeek::OpaqueVal { public: - RecordIterator(RecordVal* v, zeek::TypeTag tag, Frame* f) - : OpaqueVal(bro_broker::opaque_of_record_iterator), + RecordIterator(zeek::RecordVal* v, zeek::TypeTag tag, Frame* f) + : zeek::OpaqueVal(bro_broker::opaque_of_record_iterator), dat(require_data_type(v, zeek::TYPE_RECORD, f)), it(dat.begin()) {} @@ -298,7 +298,7 @@ public: protected: RecordIterator() - : OpaqueVal(bro_broker::opaque_of_record_iterator) + : zeek::OpaqueVal(bro_broker::opaque_of_record_iterator) {} DECLARE_OPAQUE_VALUE(bro_broker::RecordIterator) diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index 4228008811..3b0b334206 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -28,7 +28,7 @@ using namespace std; namespace bro_broker { -static inline Val* get_option(const char* option) +static inline zeek::Val* get_option(const char* option) { const auto& id = global_scope()->Find(option); @@ -379,7 +379,7 @@ bool Manager::PublishEvent(string topic, std::string name, broker::vector args) return true; } -bool Manager::PublishEvent(string topic, RecordVal* args) +bool Manager::PublishEvent(string topic, zeek::RecordVal* args) { if ( bstate->endpoint.is_shutdown() ) return true; @@ -442,10 +442,10 @@ bool Manager::PublishIdentifier(std::string topic, std::string id) return true; } -bool Manager::PublishLogCreate(EnumVal* stream, EnumVal* writer, - const logging::WriterBackend::WriterInfo& info, - int num_fields, const threading::Field* const * fields, - const broker::endpoint_info& peer) +bool Manager::PublishLogCreate(zeek::EnumVal* stream, zeek::EnumVal* writer, + const logging::WriterBackend::WriterInfo& info, + int num_fields, const threading::Field* const * fields, + const broker::endpoint_info& peer) { if ( bstate->endpoint.is_shutdown() ) return true; @@ -499,7 +499,8 @@ bool Manager::PublishLogCreate(EnumVal* stream, EnumVal* writer, return true; } -bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int num_fields, const threading::Value* const * vals) +bool Manager::PublishLogWrite(zeek::EnumVal* stream, zeek::EnumVal* writer, string path, + int num_fields, const threading::Value* const * vals) { if ( bstate->endpoint.is_shutdown() ) return true; @@ -554,7 +555,7 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int free(data); auto v = log_topic_func->Invoke(zeek::IntrusivePtr{zeek::NewRef{}, stream}, - zeek::make_intrusive(path)); + zeek::make_intrusive(path)); if ( ! v ) { @@ -637,7 +638,7 @@ void Manager::Error(const char* format, ...) reporter->Error("%s", msg); } -bool Manager::AutoPublishEvent(string topic, Val* event) +bool Manager::AutoPublishEvent(string topic, zeek::Val* event) { if ( event->GetType()->Tag() != zeek::TYPE_FUNC ) { @@ -666,7 +667,7 @@ bool Manager::AutoPublishEvent(string topic, Val* event) return true; } -bool Manager::AutoUnpublishEvent(const string& topic, Val* event) +bool Manager::AutoUnpublishEvent(const string& topic, zeek::Val* event) { if ( event->GetType()->Tag() != zeek::TYPE_FUNC ) { @@ -698,10 +699,10 @@ bool Manager::AutoUnpublishEvent(const string& topic, Val* event) return true; } -RecordVal* Manager::MakeEvent(val_list* args, Frame* frame) +zeek::RecordVal* Manager::MakeEvent(val_list* args, Frame* frame) { - auto rval = new RecordVal(zeek::BifType::Record::Broker::Event); - auto arg_vec = zeek::make_intrusive(vector_of_data_type); + auto rval = new zeek::RecordVal(zeek::BifType::Record::Broker::Event); + auto arg_vec = zeek::make_intrusive(vector_of_data_type); rval->Assign(1, arg_vec); Func* func = nullptr; scoped_reporter_location srl{frame}; @@ -737,7 +738,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame) return rval; } - rval->Assign(0, zeek::make_intrusive(func->Name())); + rval->Assign(0, zeek::make_intrusive(func->Name())); continue; } @@ -753,7 +754,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame) return rval; } - RecordValPtr data_val; + zeek::RecordValPtr data_val; if ( same_type(got_type, bro_broker::DataVal::ScriptDataType()) ) data_val = {zeek::NewRef{}, (*args)[i]->AsRecordVal()}; @@ -1247,24 +1248,24 @@ void Manager::ProcessStatus(broker::status stat) return; static auto ei = zeek::id::find_type("Broker::EndpointInfo"); - auto endpoint_info = zeek::make_intrusive(ei); + auto endpoint_info = zeek::make_intrusive(ei); if ( ctx ) { - endpoint_info->Assign(0, zeek::make_intrusive(to_string(ctx->node))); + endpoint_info->Assign(0, zeek::make_intrusive(to_string(ctx->node))); static auto ni = zeek::id::find_type("Broker::NetworkInfo"); - auto network_info = zeek::make_intrusive(ni); + auto network_info = zeek::make_intrusive(ni); if ( ctx->network ) { - network_info->Assign(0, zeek::make_intrusive(ctx->network->address.data())); + network_info->Assign(0, zeek::make_intrusive(ctx->network->address.data())); network_info->Assign(1, val_mgr->Port(ctx->network->port, TRANSPORT_TCP)); } else { // TODO: are there any status messages where the ctx->network // is not set and actually could be? - network_info->Assign(0, zeek::make_intrusive("")); + network_info->Assign(0, zeek::make_intrusive("")); network_info->Assign(1, val_mgr->Port(0, TRANSPORT_TCP)); } @@ -1272,7 +1273,7 @@ void Manager::ProcessStatus(broker::status stat) } auto str = stat.message(); - auto msg = zeek::make_intrusive(str ? *str : ""); + auto msg = zeek::make_intrusive(str ? *str : ""); mgr.Enqueue(event, std::move(endpoint_info), std::move(msg)); } @@ -1353,7 +1354,7 @@ void Manager::ProcessError(broker::error err) mgr.Enqueue(Broker::error, zeek::BifType::Enum::Broker::ErrorCode->GetVal(ec), - zeek::make_intrusive(msg) + zeek::make_intrusive(msg) ); } diff --git a/src/broker/Manager.h b/src/broker/Manager.h index 3b1286ad8b..cbc370b7f6 100644 --- a/src/broker/Manager.h +++ b/src/broker/Manager.h @@ -168,7 +168,7 @@ public: * a Broker::Event record type. * @return true if the message is sent successfully. */ - bool PublishEvent(std::string topic, RecordVal* ev); + bool PublishEvent(std::string topic, zeek::RecordVal* ev); /** * Send a message to create a log stream to any interested peers. @@ -183,7 +183,7 @@ public: * @param peer If given, send the message only to this peer. * @return true if the message is sent successfully. */ - bool PublishLogCreate(EnumVal* stream, EnumVal* writer, + bool PublishLogCreate(zeek::EnumVal* stream, zeek::EnumVal* writer, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const * fields, @@ -200,8 +200,9 @@ public: * See the Broker::SendFlags record type. * @return true if the message is sent successfully. */ - bool PublishLogWrite(EnumVal* stream, EnumVal* writer, std::string path, int num_vals, - const threading::Value* const * vals); + bool PublishLogWrite(zeek::EnumVal* stream, zeek::EnumVal* writer, + std::string path, int num_vals, + const threading::Value* const * vals); /** * Automatically send an event to any interested peers whenever it is @@ -212,7 +213,7 @@ public: * @param event a Bro event value. * @return true if automatic event sending is now enabled. */ - bool AutoPublishEvent(std::string topic, Val* event); + bool AutoPublishEvent(std::string topic, zeek::Val* event); /** * Stop automatically sending an event to peers upon local dispatch. @@ -220,7 +221,7 @@ public: * @param event an event originally given to bro_broker::Manager::AutoPublish(). * @return true if automatic events will no occur for the topic/event pair. */ - bool AutoUnpublishEvent(const std::string& topic, Val* event); + bool AutoUnpublishEvent(const std::string& topic, zeek::Val* event); /** * Create an `Event` record value from an event and its arguments. @@ -230,7 +231,7 @@ public: * @return an `Event` record value. If an invalid event or arguments * were supplied the optional "name" field will not be set. */ - RecordVal* MakeEvent(val_list* args, Frame* frame); + zeek::RecordVal* MakeEvent(val_list* args, Frame* frame); /** * Register interest in peer event messages that use a certain topic prefix. diff --git a/src/broker/Store.cc b/src/broker/Store.cc index 8af0d840e0..c6c05f9695 100644 --- a/src/broker/Store.cc +++ b/src/broker/Store.cc @@ -7,7 +7,7 @@ namespace bro_broker { zeek::OpaqueTypePtr opaque_of_store_handle; -EnumValPtr query_status(bool success) +zeek::EnumValPtr query_status(bool success) { static zeek::EnumType* store_query_status = nullptr; static int success_val; @@ -99,7 +99,7 @@ broker::backend to_backend_type(BifEnum::Broker::BackendType type) } broker::backend_options to_backend_options(broker::backend backend, - RecordVal* options) + zeek::RecordVal* options) { switch ( backend ) { case broker::backend::sqlite: diff --git a/src/broker/Store.h b/src/broker/Store.h index 5cfaf88a80..cd4c9e2298 100644 --- a/src/broker/Store.h +++ b/src/broker/Store.h @@ -18,17 +18,17 @@ extern zeek::OpaqueTypePtr opaque_of_store_handle; * @param success whether the query status should be set to success or failure. * @return a Broker::QueryStatus value. */ -EnumValPtr query_status(bool success); +zeek::EnumValPtr query_status(bool success); /** * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating * a failure. */ -inline RecordValPtr query_result() +inline zeek::RecordValPtr query_result() { - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::QueryResult); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::QueryResult); rval->Assign(0, query_status(false)); - rval->Assign(1, zeek::make_intrusive(zeek::BifType::Record::Broker::Data)); + rval->Assign(1, zeek::make_intrusive(zeek::BifType::Record::Broker::Data)); return rval; } @@ -37,9 +37,9 @@ inline RecordValPtr query_result() * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating * a success. */ -inline RecordValPtr query_result(RecordValPtr data) +inline zeek::RecordValPtr query_result(zeek::RecordValPtr data) { - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::QueryResult); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::QueryResult); rval->Assign(0, query_status(true)); rval->Assign(1, std::move(data)); return rval; @@ -62,7 +62,7 @@ public: Unref(trigger); } - void Result(const RecordValPtr& result) + void Result(const zeek::RecordValPtr& result) { trigger->Cache(call, result.get()); trigger->Release(); @@ -91,10 +91,10 @@ private: /** * An opaque handle which wraps a Broker data store. */ -class StoreHandleVal : public OpaqueVal { +class StoreHandleVal : public zeek::OpaqueVal { public: StoreHandleVal(broker::store s) - : OpaqueVal(bro_broker::opaque_of_store_handle), store{s}, proxy{store} + : zeek::OpaqueVal(bro_broker::opaque_of_store_handle), store{s}, proxy{store} { } void ValDescribe(ODesc* d) const override; @@ -108,7 +108,7 @@ protected: { return { zeek::NewRef{}, this }; } StoreHandleVal() - : OpaqueVal(bro_broker::opaque_of_store_handle) + : zeek::OpaqueVal(bro_broker::opaque_of_store_handle) {} DECLARE_OPAQUE_VALUE(StoreHandleVal) @@ -119,6 +119,6 @@ broker::backend to_backend_type(BifEnum::Broker::BackendType type); // Helper function to construct broker backend options from script land. broker::backend_options to_backend_options(broker::backend backend, - RecordVal* options); + zeek::RecordVal* options); } // namespace bro_broker diff --git a/src/broker/comm.bif b/src/broker/comm.bif index 6bfc19e87b..f7829d1304 100644 --- a/src/broker/comm.bif +++ b/src/broker/comm.bif @@ -94,7 +94,7 @@ function Broker::__unpeer%(a: string, p: port%): bool function Broker::__peers%(%): PeerInfos %{ bro_broker::Manager::ScriptScopeGuard ssg; - auto rval = zeek::make_intrusive(zeek::id::find_type("Broker::PeerInfos")); + auto rval = zeek::make_intrusive(zeek::id::find_type("Broker::PeerInfos")); auto i = 0; for ( auto& p : broker_mgr->Peers() ) @@ -102,23 +102,23 @@ function Broker::__peers%(%): PeerInfos const auto& pi = zeek::id::find_type("Broker::PeerInfo"); const auto& ei = zeek::id::find_type("Broker::EndpointInfo"); const auto& ni = zeek::id::find_type("Broker::NetworkInfo"); - auto peer_info = zeek::make_intrusive(pi); - auto endpoint_info = zeek::make_intrusive(ei); - auto network_info = zeek::make_intrusive(ni); + auto peer_info = zeek::make_intrusive(pi); + auto endpoint_info = zeek::make_intrusive(ei); + auto network_info = zeek::make_intrusive(ni); auto n = p.peer.network; if ( n ) { - network_info->Assign(0, zeek::make_intrusive(IPAddr(n->address))); + network_info->Assign(0, zeek::make_intrusive(IPAddr(n->address))); network_info->Assign(1, val_mgr->Port(n->port, TRANSPORT_TCP)); } else { - network_info->Assign(0, zeek::make_intrusive("0.0.0.0")); + network_info->Assign(0, zeek::make_intrusive("0.0.0.0")); network_info->Assign(1, val_mgr->Port(0, TRANSPORT_TCP)); } - endpoint_info->Assign(0, zeek::make_intrusive(to_string(p.peer.node))); + endpoint_info->Assign(0, zeek::make_intrusive(to_string(p.peer.node))); endpoint_info->Assign(1, std::move(network_info)); auto ps = (BifEnum::Broker::PeerStatus)p.status; @@ -135,5 +135,5 @@ function Broker::__peers%(%): PeerInfos function Broker::__node_id%(%): string %{ bro_broker::Manager::ScriptScopeGuard ssg; - return zeek::make_intrusive(broker_mgr->NodeID()); + return zeek::make_intrusive(broker_mgr->NodeID()); %} diff --git a/src/broker/data.bif b/src/broker/data.bif index 1d2f3ebb27..55149521cc 100644 --- a/src/broker/data.bif +++ b/src/broker/data.bif @@ -146,7 +146,7 @@ function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Broker::Data %{ auto set_it = static_cast(it); - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); if ( set_it->it == set_it->dat.end() ) { @@ -204,7 +204,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker:: if ( ! k ) { builtin_error("invalid Broker data conversion for key argument"); - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); } auto v = bro_broker::val_to_data(val); @@ -212,7 +212,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker:: if ( ! v ) { builtin_error("invalid Broker data conversion for value argument"); - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); } try @@ -225,7 +225,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker:: catch (const std::out_of_range&) { table[std::move(*k)] = std::move(*v); - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); } %} @@ -239,13 +239,13 @@ function Broker::__table_remove%(t: Broker::Data, key: any%): Broker::Data if ( ! k ) { builtin_error("invalid Broker data conversion for key argument"); - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); } auto it = table.find(*k); if ( it == table.end() ) - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); else { auto rval = bro_broker::make_data_val(move(it->second)); @@ -264,13 +264,13 @@ function Broker::__table_lookup%(t: Broker::Data, key: any%): Broker::Data if ( ! k ) { builtin_error("invalid Broker data conversion for key argument"); - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); } auto it = table.find(*k); if ( it == table.end() ) - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); else return bro_broker::make_data_val(it->second); %} @@ -300,9 +300,9 @@ function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): b function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%): Broker::TableItem %{ auto ti = static_cast(it); - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::TableItem); - auto key_val = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); - auto val_val = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::TableItem); + auto key_val = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + auto val_val = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); rval->Assign(0, key_val); rval->Assign(1, val_val); @@ -367,7 +367,7 @@ function Broker::__vector_replace%(v: Broker::Data, idx: count, d: any%): Broker } if ( idx >= vec.size() ) - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); auto rval = bro_broker::make_data_val(move(vec[idx])); vec[idx] = std::move(*item); @@ -380,7 +380,7 @@ function Broker::__vector_remove%(v: Broker::Data, idx: count%): Broker::Data zeek::TYPE_VECTOR, frame); if ( idx >= vec.size() ) - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); auto rval = bro_broker::make_data_val(move(vec[idx])); vec.erase(vec.begin() + idx); @@ -393,7 +393,7 @@ function Broker::__vector_lookup%(v: Broker::Data, idx: count%): Broker::Data zeek::TYPE_VECTOR, frame); if ( idx >= vec.size() ) - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); return bro_broker::make_data_val(vec[idx]); %} @@ -423,7 +423,7 @@ function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%): function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%): Broker::Data %{ auto vi = static_cast(it); - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); if ( vi->it == vi->dat.end() ) { @@ -472,7 +472,7 @@ function Broker::__record_lookup%(r: Broker::Data, idx: count%): Broker::Data zeek::TYPE_RECORD, frame); if ( idx >= v.size() || caf::get_if(&v[idx]) ) - return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + return zeek::make_intrusive(zeek::BifType::Record::Broker::Data); return bro_broker::make_data_val(v[idx]); %} @@ -502,7 +502,7 @@ function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%): function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%): Broker::Data %{ auto ri = static_cast(it); - auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Broker::Data); if ( ri->it == ri->dat.end() ) { diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif index 2dd75aaf74..43610ae63d 100644 --- a/src/broker/messaging.bif +++ b/src/broker/messaging.bif @@ -20,7 +20,7 @@ static bool is_string_set(const zeek::Type* type) return index_types[0]->Tag() == zeek::TYPE_STRING; } -std::set val_to_topic_set(Val* val) +std::set val_to_topic_set(zeek::Val* val) { std::set rval; @@ -28,7 +28,7 @@ std::set val_to_topic_set(Val* val) rval.emplace(val->AsString()->CheckString()); else { - const PDict* tbl = val->AsTable(); + const PDict* tbl = val->AsTable(); if ( tbl->Length() == 0 ) return rval; diff --git a/src/broker/store.bif b/src/broker/store.bif index dd94602041..909fd9df7d 100644 --- a/src/broker/store.bif +++ b/src/broker/store.bif @@ -121,7 +121,7 @@ function Broker::__store_name%(h: opaque of Broker::Store%): string } auto handle = static_cast(h); - return zeek::make_intrusive(handle->store.name()); + return zeek::make_intrusive(handle->store.name()); %} function Broker::__exists%(h: opaque of Broker::Store, diff --git a/src/file_analysis/Analyzer.cc b/src/file_analysis/Analyzer.cc index 02fc8e5861..b39e29e96a 100644 --- a/src/file_analysis/Analyzer.cc +++ b/src/file_analysis/Analyzer.cc @@ -19,7 +19,7 @@ void file_analysis::Analyzer::SetAnalyzerTag(const file_analysis::Tag& arg_tag) } file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag, - RecordValPtr arg_args, + zeek::RecordValPtr arg_args, File* arg_file) : tag(arg_tag), args(std::move(arg_args)), @@ -30,16 +30,16 @@ file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag, id = ++id_counter; } -file_analysis::Analyzer::Analyzer(RecordValPtr arg_args, File* arg_file) +file_analysis::Analyzer::Analyzer(zeek::RecordValPtr arg_args, File* arg_file) : Analyzer({}, std::move(arg_args), arg_file) {} file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag, - RecordVal* arg_args, + zeek::RecordVal* arg_args, File* arg_file) : Analyzer(arg_tag, {zeek::NewRef{}, arg_args}, arg_file) {} -file_analysis::Analyzer::Analyzer(RecordVal* arg_args, File* arg_file) +file_analysis::Analyzer::Analyzer(zeek::RecordVal* arg_args, File* arg_file) : Analyzer({}, {zeek::NewRef{}, arg_args}, arg_file) {} diff --git a/src/file_analysis/Analyzer.h b/src/file_analysis/Analyzer.h index f42a87b72b..8858b17a7c 100644 --- a/src/file_analysis/Analyzer.h +++ b/src/file_analysis/Analyzer.h @@ -6,8 +6,10 @@ #include // for u_char -class RecordVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); +namespace zeek { using RecordValPtr = zeek::IntrusivePtr; +} namespace file_analysis { @@ -96,11 +98,11 @@ public: /** * @return the AnalyzerArgs associated with the analyzer. */ - const RecordValPtr& GetArgs() const + const zeek::RecordValPtr& GetArgs() const { return args; } [[deprecated("Remove in v4.1. Use GetArgs().")]] - RecordVal* Args() const + zeek::RecordVal* Args() const { return args.get(); } /** @@ -152,10 +154,10 @@ protected: * tunable options, if any, related to a particular analyzer type. * @param arg_file the file to which the the analyzer is being attached. */ - Analyzer(file_analysis::Tag arg_tag, RecordValPtr arg_args, File* arg_file); + Analyzer(file_analysis::Tag arg_tag, zeek::RecordValPtr arg_args, File* arg_file); [[deprecated("Remove in v4.1.. Construct using IntrusivePtr instead.")]] - Analyzer(file_analysis::Tag arg_tag, RecordVal* arg_args, File* arg_file); + Analyzer(file_analysis::Tag arg_tag, zeek::RecordVal* arg_args, File* arg_file); /** * Constructor. Only derived classes are meant to be instantiated. @@ -166,16 +168,16 @@ protected: * tunable options, if any, related to a particular analyzer type. * @param arg_file the file to which the the analyzer is being attached. */ - Analyzer(RecordValPtr arg_args, File* arg_file); + Analyzer(zeek::RecordValPtr arg_args, File* arg_file); [[deprecated("Remove in v4.1.. Construct using IntrusivePtr instead.")]] - Analyzer(RecordVal* arg_args, File* arg_file); + Analyzer(zeek::RecordVal* arg_args, File* arg_file); private: ID id; /**< Unique instance ID. */ file_analysis::Tag tag; /**< The particular type of the analyzer instance. */ - RecordValPtr args; /**< \c AnalyzerArgs val gives tunable analyzer params. */ + zeek::RecordValPtr args; /**< \c AnalyzerArgs val gives tunable analyzer params. */ File* file; /**< The file to which the analyzer is attached. */ bool got_stream_delivery; bool skip; diff --git a/src/file_analysis/AnalyzerSet.cc b/src/file_analysis/AnalyzerSet.cc index 5e563fb3de..042f7b029a 100644 --- a/src/file_analysis/AnalyzerSet.cc +++ b/src/file_analysis/AnalyzerSet.cc @@ -41,14 +41,14 @@ AnalyzerSet::~AnalyzerSet() } Analyzer* AnalyzerSet::Find(const file_analysis::Tag& tag, - RecordValPtr args) + zeek::RecordValPtr args) { auto key = GetKey(tag, std::move(args)); Analyzer* rval = analyzer_map.Lookup(key.get()); return rval; } -bool AnalyzerSet::Add(const file_analysis::Tag& tag, RecordValPtr args) +bool AnalyzerSet::Add(const file_analysis::Tag& tag, zeek::RecordValPtr args) { auto key = GetKey(tag, args); @@ -72,7 +72,7 @@ bool AnalyzerSet::Add(const file_analysis::Tag& tag, RecordValPtr args) } Analyzer* AnalyzerSet::QueueAdd(const file_analysis::Tag& tag, - RecordValPtr args) + zeek::RecordValPtr args) { auto key = GetKey(tag, args); file_analysis::Analyzer* a = InstantiateAnalyzer(tag, std::move(args)); @@ -108,7 +108,7 @@ void AnalyzerSet::AddMod::Abort() } bool AnalyzerSet::Remove(const file_analysis::Tag& tag, - RecordValPtr args) + zeek::RecordValPtr args) { return Remove(tag, GetKey(tag, std::move(args))); } @@ -140,7 +140,7 @@ bool AnalyzerSet::Remove(const file_analysis::Tag& tag, } bool AnalyzerSet::QueueRemove(const file_analysis::Tag& tag, - RecordValPtr args) + zeek::RecordValPtr args) { auto key = GetKey(tag, std::move(args)); auto rval = analyzer_map.Lookup(key.get()); @@ -154,9 +154,9 @@ bool AnalyzerSet::RemoveMod::Perform(AnalyzerSet* set) } std::unique_ptr AnalyzerSet::GetKey(const file_analysis::Tag& t, - RecordValPtr args) const + zeek::RecordValPtr args) const { - auto lv = zeek::make_intrusive(zeek::TYPE_ANY); + auto lv = zeek::make_intrusive(zeek::TYPE_ANY); lv->Append(t.AsVal()); lv->Append(std::move(args)); auto key = analyzer_hash->MakeHashKey(*lv, true); @@ -168,7 +168,7 @@ std::unique_ptr AnalyzerSet::GetKey(const file_analysis::Tag& t, } file_analysis::Analyzer* AnalyzerSet::InstantiateAnalyzer(const Tag& tag, - RecordValPtr args) const + zeek::RecordValPtr args) const { auto a = file_mgr->InstantiateAnalyzer(tag, std::move(args), file); diff --git a/src/file_analysis/AnalyzerSet.h b/src/file_analysis/AnalyzerSet.h index bc5bd197d1..e8f5cc9c89 100644 --- a/src/file_analysis/AnalyzerSet.h +++ b/src/file_analysis/AnalyzerSet.h @@ -10,8 +10,10 @@ class CompositeHash; -class RecordVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); +namespace zeek { using RecordValPtr = zeek::IntrusivePtr; +} namespace file_analysis { @@ -45,7 +47,7 @@ public: * @param args an \c AnalyzerArgs record. * @return pointer to an analyzer instance, or a null pointer if not found. */ - Analyzer* Find(const file_analysis::Tag& tag, RecordValPtr args); + Analyzer* Find(const file_analysis::Tag& tag, zeek::RecordValPtr args); /** * Attach an analyzer to #file immediately. @@ -53,7 +55,7 @@ public: * @param args an \c AnalyzerArgs value which specifies an analyzer. * @return true if analyzer was instantiated/attached, else false. */ - bool Add(const file_analysis::Tag& tag, RecordValPtr args); + bool Add(const file_analysis::Tag& tag, zeek::RecordValPtr args); /** * Queue the attachment of an analyzer to #file. @@ -63,7 +65,7 @@ public: * a null pointer. The caller does *not* take ownership of the memory. */ file_analysis::Analyzer* QueueAdd(const file_analysis::Tag& tag, - RecordValPtr args); + zeek::RecordValPtr args); /** * Remove an analyzer from #file immediately. @@ -71,7 +73,7 @@ public: * @param args an \c AnalyzerArgs value which specifies an analyzer. * @return false if analyzer didn't exist and so wasn't removed, else true. */ - bool Remove(const file_analysis::Tag& tag, RecordValPtr args); + bool Remove(const file_analysis::Tag& tag, zeek::RecordValPtr args); /** * Queue the removal of an analyzer from #file. @@ -79,7 +81,7 @@ public: * @param args an \c AnalyzerArgs value which specifies an analyzer. * @return true if analyzer exists at time of call, else false; */ - bool QueueRemove(const file_analysis::Tag& tag, RecordValPtr args); + bool QueueRemove(const file_analysis::Tag& tag, zeek::RecordValPtr args); /** * Perform all queued modifications to the current analyzer set. @@ -113,7 +115,7 @@ protected: * @return the hash key calculated from \a args */ std::unique_ptr GetKey(const file_analysis::Tag& tag, - RecordValPtr args) const; + zeek::RecordValPtr args) const; /** * Create an instance of a file analyzer. @@ -122,7 +124,7 @@ protected: * @return a new file analyzer instance. */ file_analysis::Analyzer* InstantiateAnalyzer(const file_analysis::Tag& tag, - RecordValPtr args) const; + zeek::RecordValPtr args) const; /** * Insert an analyzer instance in to the set. diff --git a/src/file_analysis/Component.h b/src/file_analysis/Component.h index 749579ea58..07621ce5b2 100644 --- a/src/file_analysis/Component.h +++ b/src/file_analysis/Component.h @@ -8,8 +8,10 @@ #include "../zeek-config.h" -class RecordVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); +namespace zeek { using RecordValPtr = zeek::IntrusivePtr; +} namespace file_analysis { @@ -26,8 +28,8 @@ class Manager; class Component : public zeek::plugin::Component, public plugin::TaggedComponent { public: - typedef Analyzer* (*factory_callback)(RecordVal* args, File* file); - using factory_function = Analyzer* (*)(RecordValPtr args, File* file); + typedef Analyzer* (*factory_callback)(zeek::RecordVal* args, File* file); + using factory_function = Analyzer* (*)(zeek::RecordValPtr args, File* file); /** * Constructor. diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index 600793b6ae..7bc87c2b64 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -21,21 +21,21 @@ using namespace file_analysis; -static TableValPtr empty_connection_table() +static zeek::TableValPtr empty_connection_table() { auto tbl_index = zeek::make_intrusive(zeek::id::conn_id); tbl_index->Append(zeek::id::conn_id); auto tbl_type = zeek::make_intrusive(std::move(tbl_index), zeek::id::connection); - return zeek::make_intrusive(std::move(tbl_type)); + return zeek::make_intrusive(std::move(tbl_type)); } -static RecordValPtr get_conn_id_val(const Connection* conn) +static zeek::RecordValPtr get_conn_id_val(const Connection* conn) { - auto v = zeek::make_intrusive(zeek::id::conn_id); - v->Assign(0, zeek::make_intrusive(conn->OrigAddr())); + auto v = zeek::make_intrusive(zeek::id::conn_id); + v->Assign(0, zeek::make_intrusive(conn->OrigAddr())); v->Assign(1, val_mgr->Port(ntohs(conn->OrigPort()), conn->ConnTransport())); - v->Assign(2, zeek::make_intrusive(conn->RespAddr())); + v->Assign(2, zeek::make_intrusive(conn->RespAddr())); v->Assign(3, val_mgr->Port(ntohs(conn->RespPort()), conn->ConnTransport())); return v; } @@ -91,8 +91,8 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Creating new File object", file_id.c_str()); - val = zeek::make_intrusive(zeek::id::fa_file); - val->Assign(id_idx, zeek::make_intrusive(file_id.c_str())); + val = zeek::make_intrusive(zeek::id::fa_file); + val->Assign(id_idx, zeek::make_intrusive(file_id.c_str())); SetSource(source_name); if ( conn ) @@ -115,7 +115,7 @@ File::~File() void File::UpdateLastActivityTime() { - val->Assign(last_active_idx, zeek::make_intrusive(network_time)); + val->Assign(last_active_idx, zeek::make_intrusive(network_time)); } double File::GetLastActivityTime() const @@ -128,7 +128,7 @@ bool File::UpdateConnectionFields(Connection* conn, bool is_orig) if ( ! conn ) return false; - Val* conns = val->GetField(conns_idx).get(); + zeek::Val* conns = val->GetField(conns_idx).get(); if ( ! conns ) { @@ -190,7 +190,7 @@ std::string File::GetSource() const void File::SetSource(const std::string& source) { - val->Assign(source_idx, zeek::make_intrusive(source.c_str())); + val->Assign(source_idx, zeek::make_intrusive(source.c_str())); } double File::GetTimeoutInterval() const @@ -200,13 +200,13 @@ double File::GetTimeoutInterval() const void File::SetTimeoutInterval(double interval) { - val->Assign(timeout_interval_idx, zeek::make_intrusive(interval)); + val->Assign(timeout_interval_idx, zeek::make_intrusive(interval)); } -bool File::SetExtractionLimit(RecordVal* args, uint64_t bytes) +bool File::SetExtractionLimit(zeek::RecordVal* args, uint64_t bytes) { return SetExtractionLimit({zeek::NewRef{}, args}, bytes); } -bool File::SetExtractionLimit(RecordValPtr args, uint64_t bytes) +bool File::SetExtractionLimit(zeek::RecordValPtr args, uint64_t bytes) { Analyzer* a = analyzers.Find(file_mgr->GetComponentTag("EXTRACT"), std::move(args)); @@ -253,10 +253,10 @@ void File::ScheduleInactivityTimer() const timer_mgr->Add(new FileTimer(network_time, id, GetTimeoutInterval())); } -bool File::AddAnalyzer(file_analysis::Tag tag, RecordVal* args) +bool File::AddAnalyzer(file_analysis::Tag tag, zeek::RecordVal* args) { return AddAnalyzer(tag, {zeek::NewRef{}, args}); } -bool File::AddAnalyzer(file_analysis::Tag tag, RecordValPtr args) +bool File::AddAnalyzer(file_analysis::Tag tag, zeek::RecordValPtr args) { DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Queuing addition of %s analyzer", id.c_str(), file_mgr->GetComponentName(tag).c_str()); @@ -267,10 +267,10 @@ bool File::AddAnalyzer(file_analysis::Tag tag, RecordValPtr args) return analyzers.QueueAdd(tag, std::move(args)) != nullptr; } -bool File::RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args) +bool File::RemoveAnalyzer(file_analysis::Tag tag, zeek::RecordVal* args) { return RemoveAnalyzer(tag, {zeek::NewRef{}, args}); } -bool File::RemoveAnalyzer(file_analysis::Tag tag, RecordValPtr args) +bool File::RemoveAnalyzer(file_analysis::Tag tag, zeek::RecordValPtr args) { DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Queuing remove of %s analyzer", id.c_str(), file_mgr->GetComponentName(tag).c_str()); @@ -306,8 +306,8 @@ bool File::SetMime(const std::string& mime_type) if ( ! FileEventAvailable(file_sniff) ) return false; - auto meta = zeek::make_intrusive(zeek::id::fa_metadata); - meta->Assign(meta_mime_type_idx, zeek::make_intrusive(mime_type)); + auto meta = zeek::make_intrusive(zeek::id::fa_metadata); + meta->Assign(meta_mime_type_idx, zeek::make_intrusive(mime_type)); meta->Assign(meta_inferred_idx, val_mgr->False()); FileEvent(file_sniff, {val, std::move(meta)}); @@ -318,7 +318,7 @@ void File::InferMetadata() { did_metadata_inference = true; - Val* bof_buffer_val = val->GetField(bof_buffer_idx).get(); + zeek::Val* bof_buffer_val = val->GetField(bof_buffer_idx).get(); if ( ! bof_buffer_val ) { @@ -326,7 +326,7 @@ void File::InferMetadata() return; BroString* bs = concatenate(bof_buffer.chunks); - val->Assign(bof_buffer_idx, bs); + val->Assign(bof_buffer_idx, bs); bof_buffer_val = val->GetField(bof_buffer_idx).get(); } @@ -339,11 +339,11 @@ void File::InferMetadata() len = std::min(len, LookupFieldDefaultCount(bof_buffer_size_idx)); file_mgr->DetectMIME(data, len, &matches); - auto meta = zeek::make_intrusive(zeek::id::fa_metadata); + auto meta = zeek::make_intrusive(zeek::id::fa_metadata); if ( ! matches.empty() ) { - meta->Assign(meta_mime_type_idx, + meta->Assign(meta_mime_type_idx, *(matches.begin()->second.begin())); meta->Assign(meta_mime_types_idx, file_analysis::GenMIMEMatchesVal(matches)); @@ -370,7 +370,7 @@ bool File::BufferBOF(const u_char* data, uint64_t len) if ( bof_buffer.size > 0 ) { BroString* bs = concatenate(bof_buffer.chunks); - val->Assign(bof_buffer_idx, zeek::make_intrusive(bs)); + val->Assign(bof_buffer_idx, zeek::make_intrusive(bs)); } return false; diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h index 4501de0747..9a1f35adb3 100644 --- a/src/file_analysis/File.h +++ b/src/file_analysis/File.h @@ -16,14 +16,13 @@ class Connection; class EventHandlerPtr; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek); namespace zeek { +using RecordValPtr = zeek::IntrusivePtr; using RecordTypePtr = zeek::IntrusivePtr; } -class RecordVal; -using RecordValPtr = zeek::IntrusivePtr; - namespace file_analysis { class FileReassembler; @@ -44,11 +43,11 @@ public: /** * @return the wrapped \c fa_file record value, #val. */ - const RecordValPtr& ToVal() const + const zeek::RecordValPtr& ToVal() const { return val; } [[deprecated("Remove in v4.1. Use ToVal().")]] - RecordVal* GetVal() const + zeek::RecordVal* GetVal() const { return val.get(); } /** @@ -80,10 +79,10 @@ public: * @param bytes new limit. * @return false if no extraction analyzer is active, else true. */ - bool SetExtractionLimit(RecordValPtr args, uint64_t bytes); + bool SetExtractionLimit(zeek::RecordValPtr args, uint64_t bytes); [[deprecated("Remove in v4.1. Pass an IntrusivePtr instead.")]] - bool SetExtractionLimit(RecordVal* args, uint64_t bytes); + bool SetExtractionLimit(zeek::RecordVal* args, uint64_t bytes); /** * @return value of the "id" field from #val record. @@ -128,10 +127,10 @@ public: * @param args an \c AnalyzerArgs value representing a file analyzer. * @return false if analyzer can't be instantiated, else true. */ - bool AddAnalyzer(file_analysis::Tag tag, RecordValPtr args); + bool AddAnalyzer(file_analysis::Tag tag, zeek::RecordValPtr args); [[deprecated("Remove in v4.1. Pass an IntrusivePtr instead.")]] - bool AddAnalyzer(file_analysis::Tag tag, RecordVal* args); + bool AddAnalyzer(file_analysis::Tag tag, zeek::RecordVal* args); /** * Queues removal of an analyzer. @@ -139,10 +138,10 @@ public: * @param args an \c AnalyzerArgs value representing a file analyzer. * @return true if analyzer was active at time of call, else false. */ - bool RemoveAnalyzer(file_analysis::Tag tag, RecordValPtr args); + bool RemoveAnalyzer(file_analysis::Tag tag, zeek::RecordValPtr args); [[deprecated("Remove in v4.1. Pass an IntrusivePtr instead.")]] - bool RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args); + bool RemoveAnalyzer(file_analysis::Tag tag, zeek::RecordVal* args); /** * Signal that this analyzer can be deleted once it's safe to do so. @@ -353,7 +352,7 @@ protected: protected: std::string id; /**< A pretty hash that likely identifies file */ - RecordValPtr val; /**< \c fa_file from script layer. */ + zeek::RecordValPtr val; /**< \c fa_file from script layer. */ FileReassembler* file_reassembler; /**< A reassembler for the file if it's needed. */ uint64_t stream_offset; /**< The offset of the file which has been forwarded. */ uint64_t reassembly_max_buffer; /**< Maximum allowed buffer for reassembly. */ diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc index e30e036620..7c8c273db3 100644 --- a/src/file_analysis/Manager.cc +++ b/src/file_analysis/Manager.cc @@ -258,12 +258,12 @@ bool Manager::SetReassemblyBuffer(const string& file_id, uint64_t max) return true; } -bool Manager::SetExtractionLimit(const string& file_id, RecordVal* args, +bool Manager::SetExtractionLimit(const string& file_id, zeek::RecordVal* args, uint64_t n) const { return SetExtractionLimit(file_id, {zeek::NewRef{}, args}, n); } bool Manager::SetExtractionLimit(const string& file_id, - RecordValPtr args, uint64_t n) const + zeek::RecordValPtr args, uint64_t n) const { File* file = LookupFile(file_id); @@ -274,11 +274,11 @@ bool Manager::SetExtractionLimit(const string& file_id, } bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag, - RecordVal* args) const + zeek::RecordVal* args) const { return AddAnalyzer(file_id, tag, {zeek::NewRef{}, args}); } bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag, - RecordValPtr args) const + zeek::RecordValPtr args) const { File* file = LookupFile(file_id); @@ -289,11 +289,11 @@ bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag, } bool Manager::RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag, - RecordVal* args) const + zeek::RecordVal* args) const { return RemoveAnalyzer(file_id, tag, {zeek::NewRef{}, args}); } bool Manager::RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag, - RecordValPtr args) const + zeek::RecordValPtr args) const { File* file = LookupFile(file_id); @@ -454,11 +454,11 @@ bool Manager::IsDisabled(const analyzer::Tag& tag) return yield->AsBool(); } -Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f) const +Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, zeek::RecordVal* args, File* f) const { return InstantiateAnalyzer(tag, {zeek::NewRef{}, args}, f); } Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, - RecordValPtr args, + zeek::RecordValPtr args, File* f) const { Component* c = Lookup(tag); @@ -517,22 +517,22 @@ string Manager::DetectMIME(const u_char* data, uint64_t len) const return *(matches.begin()->second.begin()); } -VectorValPtr file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m) +zeek::VectorValPtr file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m) { static auto mime_matches = zeek::id::find_type("mime_matches"); static auto mime_match = zeek::id::find_type("mime_match"); - auto rval = zeek::make_intrusive(mime_matches); + auto rval = zeek::make_intrusive(mime_matches); for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin(); it != m.end(); ++it ) { - auto element = zeek::make_intrusive(mime_match); + auto element = zeek::make_intrusive(mime_match); for ( set::const_iterator it2 = it->second.begin(); it2 != it->second.end(); ++it2 ) { element->Assign(0, val_mgr->Int(it->first)); - element->Assign(1, zeek::make_intrusive(*it2)); + element->Assign(1, zeek::make_intrusive(*it2)); } rval->Assign(rval->Size(), std::move(element)); diff --git a/src/file_analysis/Manager.h b/src/file_analysis/Manager.h index 2592247aa6..4b67d7d282 100644 --- a/src/file_analysis/Manager.h +++ b/src/file_analysis/Manager.h @@ -14,8 +14,8 @@ #include "analyzer/Tag.h" -class TableVal; -class VectorVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(TableVal, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(VectorVal, zeek); namespace analyzer { class Analyzer; @@ -254,10 +254,10 @@ public: * else true. */ bool SetExtractionLimit(const std::string& file_id, - RecordValPtr args, uint64_t n) const; + zeek::RecordValPtr args, uint64_t n) const; [[deprecated("Remove in v4.1. Pass IntrusivePtr args param instead.")]] - bool SetExtractionLimit(const std::string& file_id, RecordVal* args, + bool SetExtractionLimit(const std::string& file_id, zeek::RecordVal* args, uint64_t n) const; /** @@ -278,11 +278,11 @@ public: * @return false if the analyzer failed to be instantiated, else true. */ bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag, - RecordValPtr args) const; + zeek::RecordValPtr args) const; [[deprecated("Remove in v4.1. Pass IntrusivePtr args param instead.")]] bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag, - RecordVal* args) const; + zeek::RecordVal* args) const; /** * Queue removal of an analyzer for a given file identifier. @@ -292,11 +292,11 @@ public: * @return true if the analyzer is active at the time of call, else false. */ bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag, - RecordValPtr args) const; + zeek::RecordValPtr args) const; [[deprecated("Remove in v4.1. Pass IntrusivePtr args param instead.")]] bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag, - RecordVal* args) const; + zeek::RecordVal* args) const; /** * Tells whether analysis for a file is active or ignored. @@ -312,11 +312,11 @@ public: * @param f The file analzer is to be associated with. * @return The new analyzer instance or null if tag is invalid. */ - Analyzer* InstantiateAnalyzer(const Tag& tag, RecordValPtr args, + Analyzer* InstantiateAnalyzer(const Tag& tag, zeek::RecordValPtr args, File* f) const; [[deprecated("Remove in v4.1. Pass in IntrusivePtr args instead.")]] - Analyzer* InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f) const; + Analyzer* InstantiateAnalyzer(const Tag& tag, zeek::RecordVal* args, File* f) const; /** * Returns a set of all matching MIME magic signatures for a given @@ -427,7 +427,7 @@ private: RuleFileMagicState* magic_state; /**< File magic signature match state. */ MIMEMap mime_types;/**< Mapping of MIME types to analyzers. */ - inline static TableVal* disabled = nullptr; /**< Table of disabled analyzers. */ + inline static zeek::TableVal* disabled = nullptr; /**< Table of disabled analyzers. */ inline static zeek::TableType* tag_set_type = nullptr; /**< Type for set[tag]. */ size_t cumulative_files; @@ -438,7 +438,7 @@ private: * Returns a script-layer value corresponding to the \c mime_matches type. * @param m The MIME match information with which to populate the value. */ -VectorValPtr GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m); +zeek::VectorValPtr GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m); } // namespace file_analysis diff --git a/src/file_analysis/Tag.cc b/src/file_analysis/Tag.cc index 6d285d5e08..712f90dd59 100644 --- a/src/file_analysis/Tag.cc +++ b/src/file_analysis/Tag.cc @@ -18,20 +18,20 @@ file_analysis::Tag& file_analysis::Tag::operator=(const file_analysis::Tag& othe return *this; } -const EnumValPtr& file_analysis::Tag::AsVal() const +const zeek::EnumValPtr& file_analysis::Tag::AsVal() const { return ::Tag::AsVal(file_mgr->GetTagType()); } -EnumVal* file_analysis::Tag::AsEnumVal() const +zeek::EnumVal* file_analysis::Tag::AsEnumVal() const { return AsVal().get(); } -file_analysis::Tag::Tag(EnumValPtr val) +file_analysis::Tag::Tag(zeek::EnumValPtr val) : ::Tag(std::move(val)) { } -file_analysis::Tag::Tag(EnumVal* val) +file_analysis::Tag::Tag(zeek::EnumVal* val) : ::Tag({zeek::NewRef{}, val}) { } diff --git a/src/file_analysis/Tag.h b/src/file_analysis/Tag.h index e4c52c2032..1aa758b6ff 100644 --- a/src/file_analysis/Tag.h +++ b/src/file_analysis/Tag.h @@ -5,7 +5,7 @@ #include "zeek-config.h" #include "../Tag.h" -class EnumVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek); namespace zeek::plugin { template class TaggedComponent; @@ -88,10 +88,10 @@ public: * * @param etype the script-layer enum type associated with the tag. */ - const EnumValPtr& AsVal() const; + const zeek::EnumValPtr& AsVal() const; [[deprecated("Remove in v4.1. Use AsVal() instead.")]] - EnumVal* AsEnumVal() const; + zeek::EnumVal* AsEnumVal() const; static const Tag Error; @@ -116,10 +116,10 @@ protected: * * @param val An enum value of script type \c Files::Tag. */ - explicit Tag(EnumValPtr val); + explicit Tag(zeek::EnumValPtr val); [[deprecated("Remove in v4.1. Construct from IntrusivePtr instead.")]] - explicit Tag(EnumVal* val); + explicit Tag(zeek::EnumVal* val); }; } diff --git a/src/file_analysis/analyzer/data_event/DataEvent.cc b/src/file_analysis/analyzer/data_event/DataEvent.cc index cc660e19ac..553cbed4ae 100644 --- a/src/file_analysis/analyzer/data_event/DataEvent.cc +++ b/src/file_analysis/analyzer/data_event/DataEvent.cc @@ -11,7 +11,7 @@ using namespace file_analysis; -DataEvent::DataEvent(RecordValPtr args, File* file, +DataEvent::DataEvent(zeek::RecordValPtr args, File* file, EventHandlerPtr ce, EventHandlerPtr se) : file_analysis::Analyzer(file_mgr->GetComponentTag("DATA_EVENT"), std::move(args), file), @@ -19,7 +19,7 @@ DataEvent::DataEvent(RecordValPtr args, File* file, { } -file_analysis::Analyzer* DataEvent::Instantiate(RecordValPtr args, +file_analysis::Analyzer* DataEvent::Instantiate(zeek::RecordValPtr args, File* file) { const auto& chunk_val = args->GetField("chunk_event"); @@ -44,9 +44,9 @@ bool DataEvent::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset) if ( ! chunk_event ) return true; mgr.Enqueue(chunk_event, - GetFile()->ToVal(), - zeek::make_intrusive(new BroString(data, len, false)), - val_mgr->Count(offset) + GetFile()->ToVal(), + zeek::make_intrusive(new BroString(data, len, false)), + val_mgr->Count(offset) ); return true; @@ -57,8 +57,8 @@ bool DataEvent::DeliverStream(const u_char* data, uint64_t len) if ( ! stream_event ) return true; mgr.Enqueue(stream_event, - GetFile()->ToVal(), - zeek::make_intrusive(new BroString(data, len, false)) + GetFile()->ToVal(), + zeek::make_intrusive(new BroString(data, len, false)) ); return true; diff --git a/src/file_analysis/analyzer/data_event/DataEvent.h b/src/file_analysis/analyzer/data_event/DataEvent.h index 125eb7a548..6c340e0f17 100644 --- a/src/file_analysis/analyzer/data_event/DataEvent.h +++ b/src/file_analysis/analyzer/data_event/DataEvent.h @@ -43,7 +43,7 @@ public: * @return the new DataEvent analyzer instance or a null pointer if * no "chunk_event" or "stream_event" field was specfied in \a args. */ - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file); protected: @@ -57,7 +57,7 @@ protected: * @param se pointer to event handler which will be called to receive * sequential file data. */ - DataEvent(RecordValPtr args, File* file, + DataEvent(zeek::RecordValPtr args, File* file, EventHandlerPtr ce, EventHandlerPtr se); private: diff --git a/src/file_analysis/analyzer/entropy/Entropy.cc b/src/file_analysis/analyzer/entropy/Entropy.cc index 98ebfbb040..5d532e936d 100644 --- a/src/file_analysis/analyzer/entropy/Entropy.cc +++ b/src/file_analysis/analyzer/entropy/Entropy.cc @@ -9,12 +9,12 @@ using namespace file_analysis; -Entropy::Entropy(RecordValPtr args, File* file) +Entropy::Entropy(zeek::RecordValPtr args, File* file) : file_analysis::Analyzer(file_mgr->GetComponentTag("ENTROPY"), std::move(args), file) { //entropy->Init(); - entropy = new EntropyVal; + entropy = new zeek::EntropyVal; fed = false; } @@ -23,7 +23,7 @@ Entropy::~Entropy() Unref(entropy); } -file_analysis::Analyzer* Entropy::Instantiate(RecordValPtr args, +file_analysis::Analyzer* Entropy::Instantiate(zeek::RecordValPtr args, File* file) { return new Entropy(std::move(args), file); @@ -63,12 +63,12 @@ void Entropy::Finalize() entropy->Get(&ent, &chisq, &mean, &montepi, &scc); static auto entropy_test_result = zeek::id::find_type("entropy_test_result"); - auto ent_result = zeek::make_intrusive(entropy_test_result); - ent_result->Assign(0, ent); - ent_result->Assign(1, chisq); - ent_result->Assign(2, mean); - ent_result->Assign(3, montepi); - ent_result->Assign(4, scc); + auto ent_result = zeek::make_intrusive(entropy_test_result); + ent_result->Assign(0, ent); + ent_result->Assign(1, chisq); + ent_result->Assign(2, mean); + ent_result->Assign(3, montepi); + ent_result->Assign(4, scc); mgr.Enqueue(file_entropy, GetFile()->ToVal(), diff --git a/src/file_analysis/analyzer/entropy/Entropy.h b/src/file_analysis/analyzer/entropy/Entropy.h index df1e7702a4..0614e10df7 100644 --- a/src/file_analysis/analyzer/entropy/Entropy.h +++ b/src/file_analysis/analyzer/entropy/Entropy.h @@ -31,7 +31,7 @@ public: * @return the new Entropy analyzer instance or a null pointer if the * the "extraction_file" field of \a args wasn't set. */ - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file); /** @@ -66,7 +66,7 @@ protected: * @param hv specific hash calculator object. * @param kind human readable name of the hash algorithm to use. */ - Entropy(RecordValPtr args, File* file); + Entropy(zeek::RecordValPtr args, File* file); /** * If some file contents have been seen, finalizes the entropy of them and @@ -75,7 +75,7 @@ protected: void Finalize(); private: - EntropyVal* entropy; + zeek::EntropyVal* entropy; bool fed; }; diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc index cd468353a8..8d22591d5a 100644 --- a/src/file_analysis/analyzer/extract/Extract.cc +++ b/src/file_analysis/analyzer/extract/Extract.cc @@ -10,7 +10,7 @@ using namespace file_analysis; -Extract::Extract(RecordValPtr args, File* file, +Extract::Extract(zeek::RecordValPtr args, File* file, const std::string& arg_filename, uint64_t arg_limit) : file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"), std::move(args), file), @@ -33,8 +33,8 @@ Extract::~Extract() safe_close(fd); } -static const ValPtr& get_extract_field_val(const RecordValPtr& args, - const char* name) +static const zeek::ValPtr& get_extract_field_val(const zeek::RecordValPtr& args, + const char* name) { const auto& rval = args->GetField(name); @@ -44,7 +44,7 @@ static const ValPtr& get_extract_field_val(const RecordValPtr& args, return rval; } -file_analysis::Analyzer* Extract::Instantiate(RecordValPtr args, File* file) +file_analysis::Analyzer* Extract::Instantiate(zeek::RecordValPtr args, File* file) { const auto& fname = get_extract_field_val(args, "extract_filename"); const auto& limit = get_extract_field_val(args, "extract_limit"); diff --git a/src/file_analysis/analyzer/extract/Extract.h b/src/file_analysis/analyzer/extract/Extract.h index 104df05469..3d146dba68 100644 --- a/src/file_analysis/analyzer/extract/Extract.h +++ b/src/file_analysis/analyzer/extract/Extract.h @@ -47,7 +47,7 @@ public: * @return the new Extract analyzer instance or a null pointer if the * the "extraction_file" field of \a args wasn't set. */ - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file); /** @@ -67,7 +67,7 @@ protected: * to which the contents of the file will be extracted/written. * @param arg_limit the maximum allowed file size. */ - Extract(RecordValPtr args, File* file, + Extract(zeek::RecordValPtr args, File* file, const std::string& arg_filename, uint64_t arg_limit); private: diff --git a/src/file_analysis/analyzer/hash/Hash.cc b/src/file_analysis/analyzer/hash/Hash.cc index 54274e6eb8..53a640da02 100644 --- a/src/file_analysis/analyzer/hash/Hash.cc +++ b/src/file_analysis/analyzer/hash/Hash.cc @@ -9,7 +9,7 @@ using namespace file_analysis; -Hash::Hash(RecordValPtr args, File* file, HashVal* hv, const char* arg_kind) +Hash::Hash(zeek::RecordValPtr args, File* file, zeek::HashVal* hv, const char* arg_kind) : file_analysis::Analyzer(file_mgr->GetComponentTag(to_upper(arg_kind).c_str()), std::move(args), file), hash(hv), fed(false), kind(arg_kind) @@ -54,8 +54,8 @@ void Hash::Finalize() return; mgr.Enqueue(file_hash, - GetFile()->ToVal(), - zeek::make_intrusive(kind), - hash->Get() + GetFile()->ToVal(), + zeek::make_intrusive(kind), + hash->Get() ); } diff --git a/src/file_analysis/analyzer/hash/Hash.h b/src/file_analysis/analyzer/hash/Hash.h index a3ddc2eb69..3a87e00182 100644 --- a/src/file_analysis/analyzer/hash/Hash.h +++ b/src/file_analysis/analyzer/hash/Hash.h @@ -56,7 +56,7 @@ protected: * @param hv specific hash calculator object. * @param kind human readable name of the hash algorithm to use. */ - Hash(RecordValPtr args, File* file, HashVal* hv, const char* kind); + Hash(zeek::RecordValPtr args, File* file, zeek::HashVal* hv, const char* kind); /** * If some file contents have been seen, finalizes the hash of them and @@ -65,7 +65,7 @@ protected: void Finalize(); private: - HashVal* hash; + zeek::HashVal* hash; bool fed; const char* kind; }; @@ -83,7 +83,7 @@ public: * @return the new MD5 analyzer instance or a null pointer if there's no * handler for the "file_hash" event. */ - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file) { return file_hash ? new MD5(std::move(args), file) : nullptr; } @@ -94,8 +94,8 @@ protected: * @param args the \c AnalyzerArgs value which represents the analyzer. * @param file the file to which the analyzer will be attached. */ - MD5(RecordValPtr args, File* file) - : Hash(std::move(args), file, new MD5Val(), "md5") + MD5(zeek::RecordValPtr args, File* file) + : Hash(std::move(args), file, new zeek::MD5Val(), "md5") {} }; @@ -112,7 +112,7 @@ public: * @return the new MD5 analyzer instance or a null pointer if there's no * handler for the "file_hash" event. */ - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file) { return file_hash ? new SHA1(std::move(args), file) : nullptr; } @@ -123,8 +123,8 @@ protected: * @param args the \c AnalyzerArgs value which represents the analyzer. * @param file the file to which the analyzer will be attached. */ - SHA1(RecordValPtr args, File* file) - : Hash(std::move(args), file, new SHA1Val(), "sha1") + SHA1(zeek::RecordValPtr args, File* file) + : Hash(std::move(args), file, new zeek::SHA1Val(), "sha1") {} }; @@ -141,7 +141,7 @@ public: * @return the new MD5 analyzer instance or a null pointer if there's no * handler for the "file_hash" event. */ - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file) { return file_hash ? new SHA256(std::move(args), file) : nullptr; } @@ -152,8 +152,8 @@ protected: * @param args the \c AnalyzerArgs value which represents the analyzer. * @param file the file to which the analyzer will be attached. */ - SHA256(RecordValPtr args, File* file) - : Hash(std::move(args), file, new SHA256Val(), "sha256") + SHA256(zeek::RecordValPtr args, File* file) + : Hash(std::move(args), file, new zeek::SHA256Val(), "sha256") {} }; diff --git a/src/file_analysis/analyzer/pe/PE.cc b/src/file_analysis/analyzer/pe/PE.cc index 8b03360d73..5217f4e107 100644 --- a/src/file_analysis/analyzer/pe/PE.cc +++ b/src/file_analysis/analyzer/pe/PE.cc @@ -3,7 +3,7 @@ using namespace file_analysis; -PE::PE(RecordValPtr args, File* file) +PE::PE(zeek::RecordValPtr args, File* file) : file_analysis::Analyzer(file_mgr->GetComponentTag("PE"), std::move(args), file) { diff --git a/src/file_analysis/analyzer/pe/PE.h b/src/file_analysis/analyzer/pe/PE.h index fd4477dcba..ef14744c3f 100644 --- a/src/file_analysis/analyzer/pe/PE.h +++ b/src/file_analysis/analyzer/pe/PE.h @@ -15,7 +15,7 @@ class PE : public file_analysis::Analyzer { public: ~PE(); - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file) { return new PE(std::move(args), file); } @@ -24,7 +24,7 @@ public: virtual bool EndOfFile(); protected: - PE(RecordValPtr args, File* file); + PE(zeek::RecordValPtr args, File* file); binpac::PE::File* interp; binpac::PE::MockConnection* conn; bool done; diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac index 91e5b3b839..ed7ba18862 100644 --- a/src/file_analysis/analyzer/pe/pe-analyzer.pac +++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac @@ -5,14 +5,14 @@ %} %header{ -VectorValPtr process_rvas(const RVAS* rvas); -TableValPtr characteristics_to_bro(uint32_t c, uint8_t len); +zeek::VectorValPtr process_rvas(const RVAS* rvas); +zeek::TableValPtr characteristics_to_bro(uint32_t c, uint8_t len); %} %code{ -VectorValPtr process_rvas(const RVAS* rva_table) +zeek::VectorValPtr process_rvas(const RVAS* rva_table) { - auto rvas = zeek::make_intrusive(zeek::id::index_vec); + auto rvas = zeek::make_intrusive(zeek::id::index_vec); for ( uint16 i=0; i < rva_table->rvas()->size(); ++i ) rvas->Assign(i, val_mgr->Count((*rva_table->rvas())[i]->size())); @@ -20,10 +20,10 @@ VectorValPtr process_rvas(const RVAS* rva_table) return rvas; } -TableValPtr characteristics_to_bro(uint32_t c, uint8_t len) +zeek::TableValPtr characteristics_to_bro(uint32_t c, uint8_t len) { uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF; - auto char_set = zeek::make_intrusive(zeek::id::count_set); + auto char_set = zeek::make_intrusive(zeek::id::count_set); for ( uint16 i=0; i < len; ++i ) { @@ -46,8 +46,8 @@ refine flow File += { %{ if ( pe_dos_header ) { - auto dh = zeek::make_intrusive(zeek::BifType::Record::PE::DOSHeader); - dh->Assign(0, zeek::make_intrusive(${h.signature}.length(), (const char*) ${h.signature}.data())); + auto dh = zeek::make_intrusive(zeek::BifType::Record::PE::DOSHeader); + dh->Assign(0, zeek::make_intrusive(${h.signature}.length(), (const char*) ${h.signature}.data())); dh->Assign(1, val_mgr->Count(${h.UsedBytesInTheLastPage})); dh->Assign(2, val_mgr->Count(${h.FileSizeInPages})); dh->Assign(3, val_mgr->Count(${h.NumberOfRelocationItems})); @@ -77,7 +77,7 @@ refine flow File += { if ( pe_dos_code ) mgr.Enqueue(pe_dos_code, connection()->bro_analyzer()->GetFile()->ToVal(), - zeek::make_intrusive(code.length(), (const char*) code.data()) + zeek::make_intrusive(code.length(), (const char*) code.data()) ); return true; %} @@ -96,9 +96,9 @@ refine flow File += { %{ if ( pe_file_header ) { - auto fh = zeek::make_intrusive(zeek::BifType::Record::PE::FileHeader); + auto fh = zeek::make_intrusive(zeek::BifType::Record::PE::FileHeader); fh->Assign(0, val_mgr->Count(${h.Machine})); - fh->Assign(1, zeek::make_intrusive(static_cast(${h.TimeDateStamp}))); + fh->Assign(1, zeek::make_intrusive(static_cast(${h.TimeDateStamp}))); fh->Assign(2, val_mgr->Count(${h.PointerToSymbolTable})); fh->Assign(3, val_mgr->Count(${h.NumberOfSymbols})); fh->Assign(4, val_mgr->Count(${h.SizeOfOptionalHeader})); @@ -124,7 +124,7 @@ refine flow File += { if ( pe_optional_header ) { - auto oh = zeek::make_intrusive(zeek::BifType::Record::PE::OptionalHeader); + auto oh = zeek::make_intrusive(zeek::BifType::Record::PE::OptionalHeader); oh->Assign(0, val_mgr->Count(${h.magic})); oh->Assign(1, val_mgr->Count(${h.major_linker_version})); @@ -166,7 +166,7 @@ refine flow File += { %{ if ( pe_section_header ) { - auto section_header = zeek::make_intrusive(zeek::BifType::Record::PE::SectionHeader); + auto section_header = zeek::make_intrusive(zeek::BifType::Record::PE::SectionHeader); // Strip null characters from the end of the section name. u_char* first_null = (u_char*) memchr(${h.name}.data(), 0, ${h.name}.length()); @@ -175,7 +175,7 @@ refine flow File += { name_len = ${h.name}.length(); else name_len = first_null - ${h.name}.data(); - section_header->Assign(0, zeek::make_intrusive(name_len, (const char*) ${h.name}.data())); + section_header->Assign(0, zeek::make_intrusive(name_len, (const char*) ${h.name}.data())); section_header->Assign(1, val_mgr->Count(${h.virtual_size})); section_header->Assign(2, val_mgr->Count(${h.virtual_addr})); diff --git a/src/file_analysis/analyzer/unified2/Unified2.cc b/src/file_analysis/analyzer/unified2/Unified2.cc index 83674823e8..0fdde8f668 100644 --- a/src/file_analysis/analyzer/unified2/Unified2.cc +++ b/src/file_analysis/analyzer/unified2/Unified2.cc @@ -5,7 +5,7 @@ using namespace file_analysis; -Unified2::Unified2(RecordValPtr args, File* file) +Unified2::Unified2(zeek::RecordValPtr args, File* file) : file_analysis::Analyzer(file_mgr->GetComponentTag("UNIFIED2"), std::move(args), file) { interp = new binpac::Unified2::Unified2_Analyzer(this); @@ -16,7 +16,7 @@ Unified2::~Unified2() delete interp; } -file_analysis::Analyzer* Unified2::Instantiate(RecordValPtr args, File* file) +file_analysis::Analyzer* Unified2::Instantiate(zeek::RecordValPtr args, File* file) { return new Unified2(std::move(args), file); } @@ -27,7 +27,6 @@ bool Unified2::DeliverStream(const u_char* data, uint64_t len) { interp->NewData(true, data, data + len); } - catch ( const binpac::Exception& e ) { printf("Binpac exception: %s\n", e.c_msg()); diff --git a/src/file_analysis/analyzer/unified2/Unified2.h b/src/file_analysis/analyzer/unified2/Unified2.h index 981da3534a..479ac96e84 100644 --- a/src/file_analysis/analyzer/unified2/Unified2.h +++ b/src/file_analysis/analyzer/unified2/Unified2.h @@ -20,10 +20,10 @@ public: bool DeliverStream(const u_char* data, uint64_t len) override; - static file_analysis::Analyzer* Instantiate(RecordValPtr args, File* file); + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file); protected: - Unified2(RecordValPtr args, File* file); + Unified2(zeek::RecordValPtr args, File* file); private: binpac::Unified2::Unified2_Analyzer* interp; diff --git a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac index 06c3f36305..8e1be1312a 100644 --- a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac +++ b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac @@ -8,25 +8,25 @@ %} %code{ -AddrValPtr binpac::Unified2::Flow::unified2_addr_to_bro_addr(std::vector* a) +zeek::AddrValPtr binpac::Unified2::Flow::unified2_addr_to_bro_addr(std::vector* a) { if ( a->size() == 1 ) { - return zeek::make_intrusive(IPAddr(IPv4, &(a->at(0)), IPAddr::Host)); + return zeek::make_intrusive(IPAddr(IPv4, &(a->at(0)), IPAddr::Host)); } else if ( a->size() == 4 ) { uint32 tmp[4] = { a->at(0), a->at(1), a->at(2), a->at(3) }; - return zeek::make_intrusive(IPAddr(IPv6, tmp, IPAddr::Host)); + return zeek::make_intrusive(IPAddr(IPv6, tmp, IPAddr::Host)); } else { // Should never reach here. - return zeek::make_intrusive(1); + return zeek::make_intrusive(1); } } -ValPtr binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p) +zeek::ValPtr binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p) { TransportProto proto = TRANSPORT_UNKNOWN; switch ( p ) { @@ -42,8 +42,8 @@ ValPtr binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p) refine flow Flow += { %member{ - AddrValPtr unified2_addr_to_bro_addr(std::vector* a); - ValPtr to_port(uint16_t n, uint8_t p); + zeek::AddrValPtr unified2_addr_to_bro_addr(std::vector* a); + zeek::ValPtr to_port(uint16_t n, uint8_t p); %} %init{ @@ -71,10 +71,10 @@ refine flow Flow += { %{ if ( ::unified2_event ) { - auto ids_event = zeek::make_intrusive(zeek::BifType::Record::Unified2::IDSEvent); + auto ids_event = zeek::make_intrusive(zeek::BifType::Record::Unified2::IDSEvent); ids_event->Assign(0, val_mgr->Count(${ev.sensor_id})); ids_event->Assign(1, val_mgr->Count(${ev.event_id})); - ids_event->Assign(2, zeek::make_intrusive(ts_to_double(${ev.ts}))); + ids_event->Assign(2, zeek::make_intrusive(ts_to_double(${ev.ts}))); ids_event->Assign(3, val_mgr->Count(${ev.signature_id})); ids_event->Assign(4, val_mgr->Count(${ev.generator_id})); ids_event->Assign(5, val_mgr->Count(${ev.signature_revision})); @@ -97,10 +97,10 @@ refine flow Flow += { %{ if ( ::unified2_event ) { - auto ids_event = zeek::make_intrusive(zeek::BifType::Record::Unified2::IDSEvent); + auto ids_event = zeek::make_intrusive(zeek::BifType::Record::Unified2::IDSEvent); ids_event->Assign(0, val_mgr->Count(${ev.sensor_id})); ids_event->Assign(1, val_mgr->Count(${ev.event_id})); - ids_event->Assign(2, zeek::make_intrusive(ts_to_double(${ev.ts}))); + ids_event->Assign(2, zeek::make_intrusive(ts_to_double(${ev.ts}))); ids_event->Assign(3, val_mgr->Count(${ev.signature_id})); ids_event->Assign(4, val_mgr->Count(${ev.generator_id})); ids_event->Assign(5, val_mgr->Count(${ev.signature_revision})); @@ -128,11 +128,11 @@ refine flow Flow += { %{ if ( ::unified2_packet ) { - auto packet = zeek::make_intrusive(zeek::BifType::Record::Unified2::Packet); + auto packet = zeek::make_intrusive(zeek::BifType::Record::Unified2::Packet); packet->Assign(0, val_mgr->Count(${pkt.sensor_id})); packet->Assign(1, val_mgr->Count(${pkt.event_id})); packet->Assign(2, val_mgr->Count(${pkt.event_second})); - packet->Assign(3, zeek::make_intrusive(ts_to_double(${pkt.packet_ts}))); + packet->Assign(3, zeek::make_intrusive(ts_to_double(${pkt.packet_ts}))); packet->Assign(4, val_mgr->Count(${pkt.link_type})); packet->Assign(5, to_stringval(${pkt.packet_data})); diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc index 3226042c3c..b28cfdc78c 100644 --- a/src/file_analysis/analyzer/x509/OCSP.cc +++ b/src/file_analysis/analyzer/x509/OCSP.cc @@ -92,38 +92,38 @@ static bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, zeek::Args* vl, BIO* bi i2a_ASN1_OBJECT(bio, hash_alg); int len = BIO_read(bio, buf, sizeof(buf)); - vl->emplace_back(zeek::make_intrusive(len, buf)); + vl->emplace_back(zeek::make_intrusive(len, buf)); BIO_reset(bio); i2a_ASN1_STRING(bio, issuer_name_hash, V_ASN1_OCTET_STRING); len = BIO_read(bio, buf, sizeof(buf)); - vl->emplace_back(zeek::make_intrusive(len, buf)); + vl->emplace_back(zeek::make_intrusive(len, buf)); BIO_reset(bio); i2a_ASN1_STRING(bio, issuer_key_hash, V_ASN1_OCTET_STRING); len = BIO_read(bio, buf, sizeof(buf)); - vl->emplace_back(zeek::make_intrusive(len, buf)); + vl->emplace_back(zeek::make_intrusive(len, buf)); BIO_reset(bio); i2a_ASN1_INTEGER(bio, serial_number); len = BIO_read(bio, buf, sizeof(buf)); - vl->emplace_back(zeek::make_intrusive(len, buf)); + vl->emplace_back(zeek::make_intrusive(len, buf)); BIO_reset(bio); return true; } -file_analysis::Analyzer* OCSP::InstantiateRequest(RecordValPtr args, File* file) +file_analysis::Analyzer* OCSP::InstantiateRequest(zeek::RecordValPtr args, File* file) { return new OCSP(std::move(args), file, true); } -file_analysis::Analyzer* OCSP::InstantiateReply(RecordValPtr args, File* file) +file_analysis::Analyzer* OCSP::InstantiateReply(zeek::RecordValPtr args, File* file) { return new OCSP(std::move(args), file, false); } -file_analysis::OCSP::OCSP(RecordValPtr args, file_analysis::File* file, +file_analysis::OCSP::OCSP(zeek::RecordValPtr args, file_analysis::File* file, bool arg_request) : file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("OCSP"), std::move(args), file), @@ -209,9 +209,9 @@ typedef struct ocsp_basic_response_st { STACK_OF(X509) *certs; } OCSP_BASICRESP; */ -static StringValPtr parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp, - BIO* bio, char* buf, - size_t buf_len) +static zeek::StringValPtr parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp, + BIO* bio, char* buf, + size_t buf_len) { int der_basic_resp_len = 0; unsigned char* der_basic_resp_dat = nullptr; @@ -276,14 +276,14 @@ static StringValPtr parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp, auto alg_obj = alg_obj_type->value.object; i2a_ASN1_OBJECT(bio, alg_obj); auto alg_len = BIO_read(bio, buf, buf_len); - auto rval = zeek::make_intrusive(alg_len, buf); + auto rval = zeek::make_intrusive(alg_len, buf); BIO_reset(bio); OPENSSL_free(der_basic_resp_dat); return rval; } -static ValPtr parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp) +static zeek::ValPtr parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp) { int der_basic_resp_len = 0; unsigned char* der_basic_resp_dat = nullptr; @@ -451,14 +451,14 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) const STACK_OF(X509)* certs = nullptr; int resp_count, num_ext = 0; - VectorVal *certs_vector = nullptr; + zeek::VectorVal *certs_vector = nullptr; int len = 0; char buf[OCSP_STRING_BUF_SIZE]; memset(buf, 0, sizeof(buf)); const char *status_str = OCSP_response_status_str(OCSP_response_status(resp)); - auto status_val = zeek::make_intrusive(strlen(status_str), status_str); + auto status_val = zeek::make_intrusive(strlen(status_str), status_str); if ( ocsp_response_status ) mgr.Enqueue(ocsp_response_status, GetFile()->ToVal(), status_val); @@ -501,7 +501,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) if ( OCSP_RESPID_bio(basic_resp, bio) ) { len = BIO_read(bio, buf, sizeof(buf)); - vl.emplace_back(zeek::make_intrusive(len, buf)); + vl.emplace_back(zeek::make_intrusive(len, buf)); BIO_reset(bio); } else @@ -517,7 +517,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) produced_at = OCSP_resp_get0_produced_at(basic_resp); #endif - vl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(produced_at, GetFile(), reporter))); + vl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(produced_at, GetFile(), reporter))); // responses @@ -560,36 +560,36 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) reporter->Weird("OpenSSL failed to find status of OCSP response"); const char* cert_status_str = OCSP_cert_status_str(status); - rvl.emplace_back(zeek::make_intrusive(strlen(cert_status_str), cert_status_str)); + rvl.emplace_back(zeek::make_intrusive(strlen(cert_status_str), cert_status_str)); // revocation time and reason if revoked if ( status == V_OCSP_CERTSTATUS_REVOKED ) { - rvl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(revoke_time, GetFile(), reporter))); + rvl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(revoke_time, GetFile(), reporter))); if ( reason != OCSP_REVOKED_STATUS_NOSTATUS ) { const char* revoke_reason = OCSP_crl_reason_str(reason); - rvl.emplace_back(zeek::make_intrusive(strlen(revoke_reason), revoke_reason)); + rvl.emplace_back(zeek::make_intrusive(strlen(revoke_reason), revoke_reason)); } else - rvl.emplace_back(zeek::make_intrusive(0, "")); + rvl.emplace_back(zeek::make_intrusive(0, "")); } else { - rvl.emplace_back(zeek::make_intrusive(0.0)); - rvl.emplace_back(zeek::make_intrusive(0, "")); + rvl.emplace_back(zeek::make_intrusive(0.0)); + rvl.emplace_back(zeek::make_intrusive(0, "")); } if ( this_update ) - rvl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(this_update, GetFile(), reporter))); + rvl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(this_update, GetFile(), reporter))); else - rvl.emplace_back(zeek::make_intrusive(0.0)); + rvl.emplace_back(zeek::make_intrusive(0.0)); if ( next_update ) - rvl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(next_update, GetFile(), reporter))); + rvl.emplace_back(zeek::make_intrusive(GetTimeFromAsn1(next_update, GetFile(), reporter))); else - rvl.emplace_back(zeek::make_intrusive(0.0)); + rvl.emplace_back(zeek::make_intrusive(0.0)); if ( ocsp_response_certificate ) mgr.Enqueue(ocsp_response_certificate, std::move(rvl)); @@ -608,7 +608,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER) i2a_ASN1_OBJECT(bio, basic_resp->signatureAlgorithm->algorithm); len = BIO_read(bio, buf, sizeof(buf)); - vl.emplace_back(zeek::make_intrusive(len, buf)); + vl.emplace_back(zeek::make_intrusive(len, buf)); BIO_reset(bio); #else vl.emplace_back(parse_basic_resp_sig_alg(basic_resp, bio, buf, sizeof(buf))); @@ -616,10 +616,10 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) //i2a_ASN1_OBJECT(bio, basic_resp->signature); //len = BIO_read(bio, buf, sizeof(buf)); - //ocsp_resp_record->Assign(7, zeek::make_intrusive(len, buf)); + //ocsp_resp_record->Assign(7, zeek::make_intrusive(len, buf)); //BIO_reset(bio); - certs_vector = new VectorVal(zeek::id::find_type("x509_opaque_vector")); + certs_vector = new zeek::VectorVal(zeek::id::find_type("x509_opaque_vector")); vl.emplace_back(zeek::AdoptRef{}, certs_vector); #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER) diff --git a/src/file_analysis/analyzer/x509/OCSP.h b/src/file_analysis/analyzer/x509/OCSP.h index a8d330fb11..e0ebc8eca8 100644 --- a/src/file_analysis/analyzer/x509/OCSP.h +++ b/src/file_analysis/analyzer/x509/OCSP.h @@ -18,13 +18,13 @@ public: bool Undelivered(uint64_t offset, uint64_t len) override; bool EndOfFile() override; - static file_analysis::Analyzer* InstantiateRequest(RecordValPtr args, + static file_analysis::Analyzer* InstantiateRequest(zeek::RecordValPtr args, File* file); - static file_analysis::Analyzer* InstantiateReply(RecordValPtr args, + static file_analysis::Analyzer* InstantiateReply(zeek::RecordValPtr args, File* file); protected: - OCSP(RecordValPtr args, File* file, bool request); + OCSP(zeek::RecordValPtr args, File* file, bool request); private: void ParseResponse(OCSP_RESPONSE*); diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc index b4a6667848..f5239aeeab 100644 --- a/src/file_analysis/analyzer/x509/X509.cc +++ b/src/file_analysis/analyzer/x509/X509.cc @@ -23,7 +23,7 @@ using namespace file_analysis; -file_analysis::X509::X509(RecordValPtr args, file_analysis::File* file) +file_analysis::X509::X509(zeek::RecordValPtr args, file_analysis::File* file) : file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("X509"), std::move(args), file) { @@ -53,7 +53,7 @@ bool file_analysis::X509::EndOfFile() hash_update(ctx, cert_char, cert_data.size()); hash_final(ctx, buf); std::string cert_sha256 = sha256_digest_print(buf); - auto index = zeek::make_intrusive(cert_sha256); + auto index = zeek::make_intrusive(cert_sha256); const auto& entry = certificate_cache->Find(index); if ( entry ) @@ -65,7 +65,7 @@ bool file_analysis::X509::EndOfFile() // yup, let's call the callback. cache_hit_callback->Invoke(GetFile()->ToVal(), entry, - zeek::make_intrusive(cert_sha256)); + zeek::make_intrusive(cert_sha256)); return false; } } @@ -113,25 +113,25 @@ bool file_analysis::X509::EndOfFile() return false; } -RecordValPtr file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f) +zeek::RecordValPtr file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f) { ::X509* ssl_cert = cert_val->GetCertificate(); char buf[2048]; // we need a buffer for some of the openssl functions memset(buf, 0, sizeof(buf)); - auto pX509Cert = zeek::make_intrusive(zeek::BifType::Record::X509::Certificate); + auto pX509Cert = zeek::make_intrusive(zeek::BifType::Record::X509::Certificate); BIO *bio = BIO_new(BIO_s_mem()); pX509Cert->Assign(0, val_mgr->Count((uint64_t) X509_get_version(ssl_cert) + 1)); i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert)); int len = BIO_read(bio, buf, sizeof(buf)); - pX509Cert->Assign(1, zeek::make_intrusive(len, buf)); + pX509Cert->Assign(1, zeek::make_intrusive(len, buf)); BIO_reset(bio); X509_NAME_print_ex(bio, X509_get_subject_name(ssl_cert), 0, XN_FLAG_RFC2253); len = BIO_gets(bio, buf, sizeof(buf)); - pX509Cert->Assign(2, zeek::make_intrusive(len, buf)); + pX509Cert->Assign(2, zeek::make_intrusive(len, buf)); BIO_reset(bio); X509_NAME *subject_name = X509_get_subject_name(ssl_cert); @@ -151,17 +151,17 @@ RecordValPtr file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f) // we found a common name ASN1_STRING_print(bio, X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name, namepos))); len = BIO_gets(bio, buf, sizeof(buf)); - pX509Cert->Assign(4, zeek::make_intrusive(len, buf)); + pX509Cert->Assign(4, zeek::make_intrusive(len, buf)); BIO_reset(bio); } X509_NAME_print_ex(bio, X509_get_issuer_name(ssl_cert), 0, XN_FLAG_RFC2253); len = BIO_gets(bio, buf, sizeof(buf)); - pX509Cert->Assign(3, zeek::make_intrusive(len, buf)); + pX509Cert->Assign(3, zeek::make_intrusive(len, buf)); BIO_free(bio); - pX509Cert->Assign(5, zeek::make_intrusive(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter))); - pX509Cert->Assign(6, zeek::make_intrusive(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter))); + pX509Cert->Assign(5, zeek::make_intrusive(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter))); + pX509Cert->Assign(6, zeek::make_intrusive(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter))); // we only read 255 bytes because byte 256 is always 0. // if the string is longer than 255, that will be our null-termination, @@ -171,7 +171,7 @@ RecordValPtr file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f) if ( ! i2t_ASN1_OBJECT(buf, 255, algorithm) ) buf[0] = 0; - pX509Cert->Assign(7, zeek::make_intrusive(buf)); + pX509Cert->Assign(7, zeek::make_intrusive(buf)); // Special case for RDP server certificates. For some reason some (all?) RDP server // certificates like to specify their key algorithm as md5WithRSAEncryption, which @@ -193,25 +193,25 @@ RecordValPtr file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f) if ( ! i2t_ASN1_OBJECT(buf, 255, OBJ_nid2obj(X509_get_signature_nid(ssl_cert))) ) buf[0] = 0; - pX509Cert->Assign(8, zeek::make_intrusive(buf)); + pX509Cert->Assign(8, zeek::make_intrusive(buf)); // Things we can do when we have the key... EVP_PKEY *pkey = X509_extract_key(ssl_cert); if ( pkey != NULL ) { if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA ) - pX509Cert->Assign(9, zeek::make_intrusive("dsa")); + pX509Cert->Assign(9, zeek::make_intrusive("dsa")); else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA ) { - pX509Cert->Assign(9, zeek::make_intrusive("rsa")); + pX509Cert->Assign(9, zeek::make_intrusive("rsa")); const BIGNUM *e; RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL); char *exponent = BN_bn2dec(e); if ( exponent != NULL ) { - pX509Cert->Assign(11, zeek::make_intrusive(exponent)); + pX509Cert->Assign(11, zeek::make_intrusive(exponent)); OPENSSL_free(exponent); exponent = NULL; } @@ -219,7 +219,7 @@ RecordValPtr file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f) #ifndef OPENSSL_NO_EC else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_EC ) { - pX509Cert->Assign(9, zeek::make_intrusive("ecdsa")); + pX509Cert->Assign(9, zeek::make_intrusive("ecdsa")); pX509Cert->Assign(12, KeyCurve(pkey)); } #endif @@ -240,7 +240,7 @@ RecordValPtr file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f) return pX509Cert; } -X509_STORE* file_analysis::X509::GetRootStore(TableVal* root_certs) +X509_STORE* file_analysis::X509::GetRootStore(zeek::TableVal* root_certs) { // If this certificate store was built previously, just reuse the old one. if ( x509_stores.count(root_certs) > 0 ) @@ -254,7 +254,7 @@ X509_STORE* file_analysis::X509::GetRootStore(TableVal* root_certs) { const auto& key = idxs->Idx(i); auto val = root_certs->FindOrDefault(key); - StringVal* sv = val->AsStringVal(); + zeek::StringVal* sv = val->AsStringVal(); assert(sv); const uint8_t* data = sv->Bytes(); ::X509* x = d2i_X509(NULL, &data, sv->Len()); @@ -290,7 +290,7 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex) { if ( x509_ext_basic_constraints ) { - auto pBasicConstraint = zeek::make_intrusive(zeek::BifType::Record::X509::BasicConstraints); + auto pBasicConstraint = zeek::make_intrusive(zeek::BifType::Record::X509::BasicConstraints); pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca)); if ( constr->pathlen ) @@ -340,10 +340,10 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) return; } - VectorValPtr names; - VectorValPtr emails; - VectorValPtr uris; - VectorValPtr ips; + zeek::VectorValPtr names; + zeek::VectorValPtr emails; + zeek::VectorValPtr uris; + zeek::VectorValPtr ips; bool otherfields = false; @@ -365,27 +365,27 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) #else const char* name = (const char*) ASN1_STRING_get0_data(gen->d.ia5); #endif - auto bs = zeek::make_intrusive(name); + auto bs = zeek::make_intrusive(name); switch ( gen->type ) { case GEN_DNS: if ( names == nullptr ) - names = zeek::make_intrusive(zeek::id::string_vec); + names = zeek::make_intrusive(zeek::id::string_vec); names->Assign(names->Size(), std::move(bs)); break; case GEN_URI: if ( uris == nullptr ) - uris = zeek::make_intrusive(zeek::id::string_vec); + uris = zeek::make_intrusive(zeek::id::string_vec); uris->Assign(uris->Size(), std::move(bs)); break; case GEN_EMAIL: if ( emails == nullptr ) - emails = zeek::make_intrusive(zeek::id::string_vec); + emails = zeek::make_intrusive(zeek::id::string_vec); emails->Assign(emails->Size(), std::move(bs)); break; @@ -395,15 +395,15 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) else if ( gen->type == GEN_IPADD ) { if ( ips == nullptr ) - ips = zeek::make_intrusive(zeek::id::find_type("addr_vec")); + ips = zeek::make_intrusive(zeek::id::find_type("addr_vec")); uint32_t* addr = (uint32_t*) gen->d.ip->data; if( gen->d.ip->length == 4 ) - ips->Assign(ips->Size(), zeek::make_intrusive(*addr)); + ips->Assign(ips->Size(), zeek::make_intrusive(*addr)); else if ( gen->d.ip->length == 16 ) - ips->Assign(ips->Size(), zeek::make_intrusive(addr)); + ips->Assign(ips->Size(), zeek::make_intrusive(addr)); else { @@ -421,7 +421,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) } } - auto sanExt = zeek::make_intrusive(zeek::BifType::Record::X509::SubjectAlternativeName); + auto sanExt = zeek::make_intrusive(zeek::BifType::Record::X509::SubjectAlternativeName); if ( names != nullptr ) sanExt->Assign(0, names); @@ -443,7 +443,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) GENERAL_NAMES_free(altname); } -StringValPtr file_analysis::X509::KeyCurve(EVP_PKEY* key) +zeek::StringValPtr file_analysis::X509::KeyCurve(EVP_PKEY* key) { assert(key != nullptr); @@ -472,7 +472,7 @@ StringValPtr file_analysis::X509::KeyCurve(EVP_PKEY* key) if ( curve_name == nullptr ) return nullptr; - return zeek::make_intrusive(curve_name); + return zeek::make_intrusive(curve_name); #endif } @@ -543,7 +543,7 @@ X509Val::~X509Val() X509_free(certificate); } -ValPtr X509Val::DoClone(CloneState* state) +zeek::ValPtr X509Val::DoClone(CloneState* state) { auto copy = zeek::make_intrusive(); if ( certificate ) diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h index 965b4eef4b..fb3a6c2af9 100644 --- a/src/file_analysis/analyzer/x509/X509.h +++ b/src/file_analysis/analyzer/x509/X509.h @@ -86,9 +86,9 @@ public: * @param Returns the new record value and passes ownership to * caller. */ - static RecordValPtr ParseCertificate(X509Val* cert_val, File* file = nullptr); + static zeek::RecordValPtr ParseCertificate(X509Val* cert_val, File* file = nullptr); - static file_analysis::Analyzer* Instantiate(RecordValPtr args, + static file_analysis::Analyzer* Instantiate(zeek::RecordValPtr args, File* file) { return new X509(std::move(args), file); } @@ -102,7 +102,7 @@ public: * * @return OpenSSL's X509 store associated with the table value. */ - static X509_STORE* GetRootStore(TableVal* root_certs); + static X509_STORE* GetRootStore(zeek::TableVal* root_certs); /** * Frees memory obtained from OpenSSL that is associated with the global @@ -117,7 +117,7 @@ public: /** * Sets the table[string] that used as the certificate cache inside of Zeek. */ - static void SetCertificateCache(TableValPtr cache) + static void SetCertificateCache(zeek::TableValPtr cache) { certificate_cache = std::move(cache); } /** @@ -127,7 +127,7 @@ public: { cache_hit_callback = std::move(func); } protected: - X509(RecordValPtr args, File* file); + X509(zeek::RecordValPtr args, File* file); private: void ParseBasicConstraints(X509_EXTENSION* ex); @@ -137,11 +137,11 @@ private: std::string cert_data; // Helpers for ParseCertificate. - static StringValPtr KeyCurve(EVP_PKEY* key); + static zeek::StringValPtr KeyCurve(EVP_PKEY* key); static unsigned int KeyLength(EVP_PKEY *key); /** X509 stores associated with global script-layer values */ - inline static std::map x509_stores = std::map(); - inline static TableValPtr certificate_cache = nullptr; + inline static std::map x509_stores = std::map(); + inline static zeek::TableValPtr certificate_cache = nullptr; inline static FuncPtr cache_hit_callback = nullptr; }; @@ -152,7 +152,7 @@ private: * script-land. Otherwise, we cannot verify certificates from Bro * scriptland */ -class X509Val : public OpaqueVal { +class X509Val : public zeek::OpaqueVal { public: /** * Construct an X509Val. @@ -170,7 +170,7 @@ public: * * @return A cloned X509Val. */ - ValPtr DoClone(CloneState* state) override; + zeek::ValPtr DoClone(CloneState* state) override; /** * Destructor. diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc index 3d57df810e..75f6a4689c 100644 --- a/src/file_analysis/analyzer/x509/X509Common.cc +++ b/src/file_analysis/analyzer/x509/X509Common.cc @@ -17,7 +17,7 @@ using namespace file_analysis; X509Common::X509Common(const file_analysis::Tag& arg_tag, - RecordValPtr arg_args, File* arg_file) + zeek::RecordValPtr arg_args, File* arg_file) : file_analysis::Analyzer(arg_tag, std::move(arg_args), arg_file) { } @@ -268,15 +268,15 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa } if ( ! ext_val ) - ext_val = zeek::make_intrusive(0, ""); + ext_val = zeek::make_intrusive(0, ""); - auto pX509Ext = zeek::make_intrusive(zeek::BifType::Record::X509::Extension); - pX509Ext->Assign(0, zeek::make_intrusive(name)); + auto pX509Ext = zeek::make_intrusive(zeek::BifType::Record::X509::Extension); + pX509Ext->Assign(0, zeek::make_intrusive(name)); if ( short_name and strlen(short_name) > 0 ) - pX509Ext->Assign(1, zeek::make_intrusive(short_name)); + pX509Ext->Assign(1, zeek::make_intrusive(short_name)); - pX509Ext->Assign(2, zeek::make_intrusive(oid)); + pX509Ext->Assign(2, zeek::make_intrusive(oid)); pX509Ext->Assign(3, val_mgr->Bool(critical)); pX509Ext->Assign(4, ext_val); @@ -298,7 +298,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa ParseExtensionsSpecific(ex, global, ext_asn, oid); } -StringValPtr file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f) +zeek::StringValPtr file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f) { BIO_flush(bio); ERR_clear_error(); @@ -331,7 +331,7 @@ StringValPtr file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f) } BIO_read(bio, (void*) buffer, length); - auto ext_val = zeek::make_intrusive(length, buffer); + auto ext_val = zeek::make_intrusive(length, buffer); free(buffer); BIO_free_all(bio); diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h index 02a74f0589..677d886363 100644 --- a/src/file_analysis/analyzer/x509/X509Common.h +++ b/src/file_analysis/analyzer/x509/X509Common.h @@ -12,10 +12,12 @@ class EventHandlerPtr; class Reporter; -template class IntrusivePtr; -class StringVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(StringVal, zeek); +namespace zeek { +template class IntrusivePtr; using StringValPtr = zeek::IntrusivePtr; +} namespace file_analysis { @@ -37,13 +39,13 @@ public: * * @return The X509 extension value. */ - static StringValPtr GetExtensionFromBIO(BIO* bio, File* f = nullptr); + static zeek::StringValPtr GetExtensionFromBIO(BIO* bio, File* f = nullptr); static double GetTimeFromAsn1(const ASN1_TIME* atime, File* f, Reporter* reporter); protected: X509Common(const file_analysis::Tag& arg_tag, - RecordValPtr arg_args, File* arg_file); + zeek::RecordValPtr arg_args, File* arg_file); void ParseExtension(X509_EXTENSION* ex, const EventHandlerPtr& h, bool global); void ParseSignedCertificateTimestamps(X509_EXTENSION* ext); diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif index 84a0716ac6..8cc74a847f 100644 --- a/src/file_analysis/analyzer/x509/functions.bif +++ b/src/file_analysis/analyzer/x509/functions.bif @@ -11,12 +11,12 @@ #include // construct an error record -static RecordValPtr x509_result_record(uint64_t num, const char* reason, ValPtr chainVector = nullptr) +static zeek::RecordValPtr x509_result_record(uint64_t num, const char* reason, zeek::ValPtr chainVector = nullptr) { - auto rrecord = zeek::make_intrusive(zeek::BifType::Record::X509::Result); + auto rrecord = zeek::make_intrusive(zeek::BifType::Record::X509::Result); rrecord->Assign(0, val_mgr->Int(num)); - rrecord->Assign(1, zeek::make_intrusive(reason)); + rrecord->Assign(1, zeek::make_intrusive(reason)); if ( chainVector ) rrecord->Assign(2, std::move(chainVector)); @@ -24,7 +24,7 @@ static RecordValPtr x509_result_record(uint64_t num, const char* reason, ValPtr } // get all cretificates starting at the second one (assuming the first one is the host certificate) -STACK_OF(X509)* x509_get_untrusted_stack(VectorVal* certs_vec) +STACK_OF(X509)* x509_get_untrusted_stack(zeek::VectorVal* certs_vec) { STACK_OF(X509)* untrusted_certs = sk_X509_new_null(); if ( ! untrusted_certs ) @@ -215,13 +215,13 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F ## x509_get_certificate_string x509_verify function x509_ocsp_verify%(certs: x509_opaque_vector, ocsp_reply: string, root_certs: table_string_of_string, verify_time: time &default=network_time()%): X509::Result %{ - RecordValPtr rval; + zeek::RecordValPtr rval; X509_STORE* ctx = ::file_analysis::X509::GetRootStore(root_certs->AsTableVal()); if ( ! ctx ) return x509_result_record(-1, "Problem initializing root store"); - VectorVal *certs_vec = certs->AsVectorVal(); + zeek::VectorVal *certs_vec = certs->AsVectorVal(); if ( certs_vec->Size() < 1 ) { reporter->Error("No certificates given in vector"); @@ -507,7 +507,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str return x509_result_record(-1, "Problem initializing root store"); - VectorVal *certs_vec = certs->AsVectorVal(); + zeek::VectorVal *certs_vec = certs->AsVectorVal(); if ( ! certs_vec || certs_vec->Size() < 1 ) { reporter->Error("No certificates given in vector"); @@ -542,7 +542,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str int result = X509_verify_cert(csc); - VectorValPtr chainVector; + zeek::VectorValPtr chainVector; if ( result == 1 ) // we have a valid chain. try to get it... { @@ -556,7 +556,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str } int num_certs = sk_X509_num(chain); - chainVector = zeek::make_intrusive(zeek::id::find_type("x509_opaque_vector")); + chainVector = zeek::make_intrusive(zeek::id::find_type("x509_opaque_vector")); for ( int i = 0; i < num_certs; i++ ) { @@ -761,7 +761,7 @@ sct_verify_err: * 1 -> issuer name * 2 -> pubkey */ -StringValPtr x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int hash_alg, unsigned int type) +zeek::StringValPtr x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int hash_alg, unsigned int type) { assert(cert_handle); @@ -824,7 +824,7 @@ StringValPtr x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int assert( len <= sizeof(md) ); - return zeek::make_intrusive(len, reinterpret_cast(md)); + return zeek::make_intrusive(len, reinterpret_cast(md)); } %%} diff --git a/src/file_analysis/analyzer/x509/x509-extension.pac b/src/file_analysis/analyzer/x509/x509-extension.pac index 3eeed377ae..f9dabd3ee1 100644 --- a/src/file_analysis/analyzer/x509/x509-extension.pac +++ b/src/file_analysis/analyzer/x509/x509-extension.pac @@ -41,11 +41,11 @@ refine connection MockConnection += { mgr.Enqueue(x509_ocsp_ext_signed_certificate_timestamp, bro_analyzer()->GetFile()->ToVal(), val_mgr->Count(version), - zeek::make_intrusive(logid.length(), reinterpret_cast(logid.begin())), + zeek::make_intrusive(logid.length(), reinterpret_cast(logid.begin())), val_mgr->Count(timestamp), val_mgr->Count(digitally_signed_algorithms->HashAlgorithm()), val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm()), - zeek::make_intrusive(digitally_signed_signature.length(), reinterpret_cast(digitally_signed_signature.begin())) + zeek::make_intrusive(digitally_signed_signature.length(), reinterpret_cast(digitally_signed_signature.begin())) ); return true; diff --git a/src/file_analysis/file_analysis.bif b/src/file_analysis/file_analysis.bif index 26956a0b11..b43388993b 100644 --- a/src/file_analysis/file_analysis.bif +++ b/src/file_analysis/file_analysis.bif @@ -71,7 +71,7 @@ function Files::__stop%(file_id: string%): bool function Files::__analyzer_name%(tag: Files::Tag%) : string %{ const auto& n = file_mgr->GetComponentName(zeek::IntrusivePtr{zeek::NewRef{}, tag->AsEnumVal()}); - return zeek::make_intrusive(n); + return zeek::make_intrusive(n); %} ## :zeek:see:`Files::file_exists`. diff --git a/src/input/Manager.cc b/src/input/Manager.cc index c81e949f0b..0517bcd9fd 100644 --- a/src/input/Manager.cc +++ b/src/input/Manager.cc @@ -61,12 +61,12 @@ public: StreamType stream_type; // to distinguish between event and table streams - EnumVal* type; + zeek::EnumVal* type; ReaderFrontend* reader; - TableVal* config; + zeek::TableVal* config; EventHandlerPtr error_event; - RecordVal* description; + zeek::RecordVal* description; virtual ~Stream(); @@ -95,7 +95,7 @@ public: unsigned int num_val_fields; bool want_record; - TableVal* tab; + zeek::TableVal* tab; zeek::RecordType* rtype; zeek::RecordType* itype; @@ -198,7 +198,7 @@ Manager::~Manager() } -ReaderBackend* Manager::CreateBackend(ReaderFrontend* frontend, EnumVal* tag) +ReaderBackend* Manager::CreateBackend(ReaderFrontend* frontend, zeek::EnumVal* tag) { Component* c = Lookup(tag); @@ -215,7 +215,7 @@ ReaderBackend* Manager::CreateBackend(ReaderFrontend* frontend, EnumVal* tag) } // Create a new input reader object to be used at whomevers leisure later on. -bool Manager::CreateStream(Stream* info, RecordVal* description) +bool Manager::CreateStream(Stream* info, zeek::RecordVal* description) { zeek::RecordType* rtype = description->GetType()->AsRecordType(); if ( ! ( same_type(rtype, zeek::BifType::Record::Input::TableDescription, false) @@ -275,7 +275,7 @@ bool Manager::CreateStream(Stream* info, RecordVal* description) HashKey* k; IterCookie* c = info->config->AsTable()->InitForIteration(); - TableEntryVal* v; + zeek::TableEntryVal* v; while ( (v = info->config->AsTable()->NextEntry(k, c)) ) { auto index = info->config->RecreateIndex(*k); @@ -303,7 +303,7 @@ bool Manager::CreateStream(Stream* info, RecordVal* description) return true; } -bool Manager::CreateEventStream(RecordVal* fval) +bool Manager::CreateEventStream(zeek::RecordVal* fval) { zeek::RecordType* rtype = fval->GetType()->AsRecordType(); if ( ! same_type(rtype, zeek::BifType::Record::Input::EventDescription, false) ) @@ -457,7 +457,7 @@ bool Manager::CreateEventStream(RecordVal* fval) return true; } -bool Manager::CreateTableStream(RecordVal* fval) +bool Manager::CreateTableStream(zeek::RecordVal* fval) { zeek::RecordType* rtype = fval->GetType()->AsRecordType(); if ( ! same_type(rtype, zeek::BifType::Record::Input::TableDescription, false) ) @@ -739,7 +739,7 @@ bool Manager::CheckErrorEventTypes(const std::string& stream_name, const Func* e return true; } -bool Manager::CreateAnalysisStream(RecordVal* fval) +bool Manager::CreateAnalysisStream(zeek::RecordVal* fval) { zeek::RecordType* rtype = fval->GetType()->AsRecordType(); @@ -929,7 +929,7 @@ bool Manager::UnrollRecordType(vector *fields, const zeek::RecordType *r { string name = nameprepend + rec->FieldName(i); const char* secondary = nullptr; - ValPtr c; + zeek::ValPtr c; zeek::TypeTag ty = rec->GetFieldType(i)->Tag(); zeek::TypeTag st = zeek::TYPE_VOID; bool optional = false; @@ -989,9 +989,9 @@ bool Manager::ForceUpdate(const string &name) } -Val* Manager::RecordValToIndexVal(RecordVal *r) const +zeek::Val* Manager::RecordValToIndexVal(zeek::RecordVal* r) const { - ValPtr idxval; + zeek::ValPtr idxval; zeek::RecordType *type = r->GetType()->AsRecordType(); @@ -1002,7 +1002,7 @@ Val* Manager::RecordValToIndexVal(RecordVal *r) const else { - auto l = zeek::make_intrusive(zeek::TYPE_ANY); + auto l = zeek::make_intrusive(zeek::TYPE_ANY); for ( int j = 0 ; j < num_fields; j++ ) l->Append(r->GetFieldOrDefault(j)); @@ -1014,12 +1014,12 @@ Val* Manager::RecordValToIndexVal(RecordVal *r) const } -Val* Manager::ValueToIndexVal(const Stream* i, int num_fields, const zeek::RecordType *type, const Value* const *vals, bool& have_error) const +zeek::Val* Manager::ValueToIndexVal(const Stream* i, int num_fields, const zeek::RecordType *type, + const Value* const *vals, bool& have_error) const { - Val* idxval; + zeek::Val* idxval; int position = 0; - if ( num_fields == 1 && type->GetFieldType(0)->Tag() != zeek::TYPE_RECORD ) { idxval = ValueToVal(i, vals[0], type->GetFieldType(0).get(), have_error); @@ -1027,7 +1027,7 @@ Val* Manager::ValueToIndexVal(const Stream* i, int num_fields, const zeek::Recor } else { - ListVal *l = new ListVal(zeek::TYPE_ANY); + auto* l = new zeek::ListVal(zeek::TYPE_ANY); for ( int j = 0 ; j < type->NumFields(); j++ ) { if ( type->GetFieldType(j)->Tag() == zeek::TYPE_RECORD ) @@ -1140,8 +1140,8 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals) } - Val* valval; - RecordVal* predidx = nullptr; + zeek::Val* valval; + zeek::RecordVal* predidx = nullptr; int position = stream->num_idx_fields; @@ -1159,7 +1159,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals) // call stream first to determine if we really add / change the entry if ( stream->pred && ! convert_error ) { - EnumValPtr ev; + zeek::EnumValPtr ev; int startpos = 0; bool pred_convert_error = false; predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, pred_convert_error); @@ -1208,7 +1208,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals) delete h; h = nullptr; - Val* idxval; + zeek::Val* idxval; if ( predidx != nullptr ) { idxval = RecordValToIndexVal(predidx); @@ -1230,7 +1230,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals) assert(idxval); - ValPtr oldval; + zeek::ValPtr oldval; if ( updated == true ) { assert(stream->num_val_fields > 0); @@ -1259,7 +1259,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals) if ( stream->event ) { int startpos = 0; - Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, convert_error); + zeek::Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, convert_error); if ( convert_error ) { @@ -1326,9 +1326,9 @@ void Manager::EndCurrentSend(ReaderFrontend* reader) while ( ( ih = stream->lastDict->NextEntry(lastDictIdxKey, c) ) ) { - ValPtr val; - ValPtr predidx; - EnumValPtr ev; + zeek::ValPtr val; + zeek::ValPtr predidx; + zeek::EnumValPtr ev; int startpos = 0; if ( stream->pred || stream->event ) @@ -1404,8 +1404,8 @@ void Manager::SendEndOfData(const Stream *i) DBG_LOG(DBG_INPUT, "SendEndOfData for stream %s", i->name.c_str()); #endif - SendEvent(end_of_data, 2, new StringVal(i->name.c_str()), - new StringVal(i->reader->Info().source)); + SendEvent(end_of_data, 2, new zeek::StringVal(i->name.c_str()), + new zeek::StringVal(i->reader->Info().source)); if ( i->stream_type == ANALYSIS_STREAM ) file_mgr->EndOfFile(static_cast(i)->file_id); @@ -1451,14 +1451,14 @@ void Manager::Put(ReaderFrontend* reader, Value* *vals) Value::delete_value_ptr_array(vals, readFields); } -int Manager::SendEventStreamEvent(Stream* i, EnumVal* type, const Value* const *vals) +int Manager::SendEventStreamEvent(Stream* i, zeek::EnumVal* type, const Value* const *vals) { assert(i); assert(i->stream_type == EVENT_STREAM); EventStream* stream = (EventStream*) i; - list out_vals; + list out_vals; Ref(stream->description); out_vals.push_back(stream->description); // no tracking, send everything with a new event... @@ -1470,7 +1470,7 @@ int Manager::SendEventStreamEvent(Stream* i, EnumVal* type, const Value* const * if ( stream->want_record ) { - RecordVal * r = ValueToRecordVal(i, vals, stream->fields, &position, convert_error); + zeek::RecordVal * r = ValueToRecordVal(i, vals, stream->fields, &position, convert_error); out_vals.push_back(r); } @@ -1478,7 +1478,7 @@ int Manager::SendEventStreamEvent(Stream* i, EnumVal* type, const Value* const * { for ( int j = 0; j < stream->fields->NumFields(); j++) { - Val* val = nullptr; + zeek::Val* val = nullptr; if ( stream->fields->GetFieldType(j)->Tag() == zeek::TYPE_RECORD ) val = ValueToRecordVal(i, vals, @@ -1498,7 +1498,7 @@ int Manager::SendEventStreamEvent(Stream* i, EnumVal* type, const Value* const * if ( convert_error ) { // we have an error somewhere in our out_vals. Just delete all of them. - for ( list::const_iterator it = out_vals.begin(), end = out_vals.end(); it != end; ++it ) + for ( list::const_iterator it = out_vals.begin(), end = out_vals.end(); it != end; ++it ) Unref(*it); } else @@ -1516,8 +1516,8 @@ int Manager::PutTable(Stream* i, const Value* const *vals) bool convert_error = false; - Val* idxval = ValueToIndexVal(i, stream->num_idx_fields, stream->itype, vals, convert_error); - Val* valval; + zeek::Val* idxval = ValueToIndexVal(i, stream->num_idx_fields, stream->itype, vals, convert_error); + zeek::Val* valval; int position = stream->num_idx_fields; @@ -1541,7 +1541,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals) if ( stream->pred || stream->event ) { bool updated = false; - ValPtr oldval; + zeek::ValPtr oldval; if ( stream->num_val_fields > 0 ) { @@ -1559,10 +1559,10 @@ int Manager::PutTable(Stream* i, const Value* const *vals) // predicate if we want the update or not if ( stream->pred ) { - EnumValPtr ev; + zeek::EnumValPtr ev; int startpos = 0; bool pred_convert_error = false; - Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, pred_convert_error); + zeek::Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, pred_convert_error); if ( pred_convert_error ) Unref(predidx); @@ -1599,7 +1599,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals) { int startpos = 0; bool event_convert_error = false; - Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, event_convert_error); + zeek::Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, event_convert_error); if ( event_convert_error ) Unref(predidx); @@ -1677,7 +1677,7 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals) { TableStream* stream = (TableStream*) i; bool convert_error = false; - Val* idxval = ValueToIndexVal(i, stream->num_idx_fields, stream->itype, vals, convert_error); + zeek::Val* idxval = ValueToIndexVal(i, stream->num_idx_fields, stream->itype, vals, convert_error); assert(idxval != nullptr); readVals = stream->num_idx_fields + stream->num_val_fields; bool streamresult = true; @@ -1695,7 +1695,7 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals) if ( stream->pred ) { int startpos = 0; - Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, convert_error); + zeek::Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, convert_error); if ( convert_error ) Unref(predidx); @@ -1765,7 +1765,7 @@ bool Manager::CallPred(Func* pred_func, const int numvals, ...) const va_list lP; va_start(lP, numvals); for ( int i = 0; i < numvals; i++ ) - vl.emplace_back(zeek::AdoptRef{}, va_arg(lP, Val*)); + vl.emplace_back(zeek::AdoptRef{}, va_arg(lP, zeek::Val*)); va_end(lP); @@ -1790,7 +1790,7 @@ void Manager::SendEvent(EventHandlerPtr ev, const int numvals, ...) const va_list lP; va_start(lP, numvals); for ( int i = 0; i < numvals; i++ ) - vl.emplace_back(zeek::AdoptRef{}, va_arg(lP, Val*)); + vl.emplace_back(zeek::AdoptRef{}, va_arg(lP, zeek::Val*)); va_end(lP); @@ -1798,7 +1798,7 @@ void Manager::SendEvent(EventHandlerPtr ev, const int numvals, ...) const mgr.Enqueue(ev, std::move(vl), SOURCE_LOCAL); } -void Manager::SendEvent(EventHandlerPtr ev, list events) const +void Manager::SendEvent(EventHandlerPtr ev, list events) const { zeek::Args vl; vl.reserve(events.size()); @@ -1808,7 +1808,7 @@ void Manager::SendEvent(EventHandlerPtr ev, list events) const events.size()); #endif - for ( list::iterator i = events.begin(); i != events.end(); i++ ) + for ( list::iterator i = events.begin(); i != events.end(); i++ ) vl.emplace_back(zeek::AdoptRef{}, *i); if ( ev ) @@ -1817,11 +1817,11 @@ void Manager::SendEvent(EventHandlerPtr ev, list events) const // Convert a bro list value to a bro record value. // I / we could think about moving this functionality to val.cc -RecordVal* Manager::ListValToRecordVal(ListVal* list, zeek::RecordType *request_type, int* position) const +zeek::RecordVal* Manager::ListValToRecordVal(zeek::ListVal* list, zeek::RecordType *request_type, int* position) const { assert(position != nullptr); // we need the pointer to point to data; - RecordVal* rec = new RecordVal({zeek::NewRef{}, request_type}); + auto* rec = new zeek::RecordVal({zeek::NewRef{}, request_type}); assert(list != nullptr); int maxpos = list->Length(); @@ -1830,7 +1830,7 @@ RecordVal* Manager::ListValToRecordVal(ListVal* list, zeek::RecordType *request_ { assert ( (*position) <= maxpos ); - Val* fieldVal = nullptr; + zeek::Val* fieldVal = nullptr; if ( request_type->GetFieldType(i)->Tag() == zeek::TYPE_RECORD ) fieldVal = ListValToRecordVal(list, request_type->GetFieldType(i)->AsRecordType(), position); else @@ -1846,15 +1846,15 @@ RecordVal* Manager::ListValToRecordVal(ListVal* list, zeek::RecordType *request_ } // Convert a threading value to a record value -RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const *vals, - zeek::RecordType *request_type, int* position, bool& have_error) const +zeek::RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const *vals, + zeek::RecordType *request_type, int* position, bool& have_error) const { assert(position != nullptr); // we need the pointer to point to data. - RecordVal* rec = new RecordVal({zeek::NewRef{}, request_type}); + auto* rec = new zeek::RecordVal({zeek::NewRef{}, request_type}); for ( int i = 0; i < request_type->NumFields(); i++ ) { - Val* fieldVal = nullptr; + zeek::Val* fieldVal = nullptr; if ( request_type->GetFieldType(i)->Tag() == zeek::TYPE_RECORD ) fieldVal = ValueToRecordVal(stream, vals, request_type->GetFieldType(i)->AsRecordType(), position, have_error); else if ( request_type->GetFieldType(i)->Tag() == zeek::TYPE_FILE || @@ -2159,7 +2159,7 @@ HashKey* Manager::HashValues(const int num_elements, const Value* const *vals) c // have_error is a reference to a boolean which is set to true as soon as an error occurs. // When have_error is set to true at the beginning of the function, it is assumed that // an error already occurred in the past and processing is aborted. -Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_type, bool& have_error) const +zeek::Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_type, bool& have_error) const { if ( have_error ) return nullptr; @@ -2185,18 +2185,18 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_ return val_mgr->Count(val->val.int_val).release(); case zeek::TYPE_DOUBLE: - return new DoubleVal(val->val.double_val); + return new zeek::DoubleVal(val->val.double_val); case zeek::TYPE_TIME: - return new TimeVal(val->val.double_val); + return new zeek::TimeVal(val->val.double_val); case zeek::TYPE_INTERVAL: - return new IntervalVal(val->val.double_val); + return new zeek::IntervalVal(val->val.double_val); case zeek::TYPE_STRING: { BroString *s = new BroString((const u_char*)val->val.string_val.data, val->val.string_val.length, true); - return new StringVal(s); + return new zeek::StringVal(s); } case zeek::TYPE_PORT: @@ -2218,7 +2218,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_ assert(false); } - AddrVal* addrval = new AddrVal(*addr); + auto* addrval = new zeek::AddrVal(*addr); delete addr; return addrval; } @@ -2239,7 +2239,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_ assert(false); } - SubNetVal* subnetval = new SubNetVal(*addr, val->val.subnet_val.length); + auto* subnetval = new zeek::SubNetVal(*addr, val->val.subnet_val.length); delete addr; return subnetval; } @@ -2248,7 +2248,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_ { RE_Matcher* re = new RE_Matcher(val->val.pattern_text_val); re->Compile(); - return new PatternVal(re); + return new zeek::PatternVal(re); } case zeek::TYPE_TABLE: @@ -2258,10 +2258,10 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_ auto set_index = zeek::make_intrusive(type); set_index->Append(type); auto s = zeek::make_intrusive(std::move(set_index), nullptr); - TableVal* t = new TableVal(std::move(s)); + auto* t = new zeek::TableVal(std::move(s)); for ( int j = 0; j < val->val.set_val.size; j++ ) { - Val* assignval = ValueToVal(i, val->val.set_val.vals[j], type.get(), have_error); + zeek::Val* assignval = ValueToVal(i, val->val.set_val.vals[j], type.get(), have_error); t->Assign({zeek::AdoptRef{}, assignval}, nullptr); } @@ -2274,7 +2274,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, zeek::Type* request_ // all entries have to have the same type... const auto& type = request_type->AsVectorType()->Yield(); auto vt = zeek::make_intrusive(type); - auto v = zeek::make_intrusive(std::move(vt)); + auto v = zeek::make_intrusive(std::move(vt)); for ( int j = 0; j < val->val.vector_val.size; j++ ) { @@ -2435,7 +2435,7 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co // send our script level error event if ( i->error_event ) { - EnumValPtr ev; + zeek::EnumValPtr ev; switch (et) { case ErrorType::INFO: @@ -2455,7 +2455,7 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co __builtin_unreachable(); } - StringVal* message = new StringVal(buf); + auto* message = new zeek::StringVal(buf); SendEvent(i->error_event, 3, i->description->Ref(), message, ev.release()); } diff --git a/src/input/Manager.h b/src/input/Manager.h index 8f5d7df3f6..3745c3b9b8 100644 --- a/src/input/Manager.h +++ b/src/input/Manager.h @@ -12,7 +12,7 @@ #include "threading/SerialTypes.h" #include "Tag.h" -class RecordVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); namespace input { @@ -44,7 +44,7 @@ public: * This method corresponds directly to the internal BiF defined in * input.bif, which just forwards here. */ - bool CreateTableStream(RecordVal* description); + bool CreateTableStream(zeek::RecordVal* description); /** * Creates a new input stream which sends events for read input data. @@ -55,7 +55,7 @@ public: * This method corresponds directly to the internal BiF defined in * input.bif, which just forwards here. */ - bool CreateEventStream(RecordVal* description); + bool CreateEventStream(zeek::RecordVal* description); /** * Creates a new input stream which will forward the data from the data @@ -67,7 +67,7 @@ public: * @param description A record of the script type \c * Input::AnalysisDescription */ - bool CreateAnalysisStream(RecordVal* description); + bool CreateAnalysisStream(zeek::RecordVal* description); /** * Force update on a input stream. Forces a re-read of the whole @@ -143,7 +143,7 @@ protected: // Instantiates a new ReaderBackend of the given type (note that // doing so creates a new thread!). - ReaderBackend* CreateBackend(ReaderFrontend* frontend, EnumVal* tag); + ReaderBackend* CreateBackend(ReaderFrontend* frontend, zeek::EnumVal* tag); // Function called from the ReaderBackend to notify the manager that // a stream has been removed or a stream has been closed. Used to @@ -180,7 +180,7 @@ private: // protected definitions are wrappers around this function. bool RemoveStream(Stream* i); - bool CreateStream(Stream*, RecordVal* description); + bool CreateStream(Stream*, zeek::RecordVal* description); // Check if the types of the error_ev event are correct. If table is // true, check for tablestream type, otherwhise check for eventstream @@ -194,7 +194,7 @@ private: int PutTable(Stream* i, const threading::Value* const *vals); // SendEntry and Put implementation for Event stream. - int SendEventStreamEvent(Stream* i, EnumVal* type, const threading::Value* const *vals); + int SendEventStreamEvent(Stream* i, zeek::EnumVal* type, const threading::Value* const *vals); // Check if a record is made up of compatible types and return a list // of all fields that are in the record in order. Recursively unrolls @@ -203,7 +203,7 @@ private: // Send events void SendEvent(EventHandlerPtr ev, const int numvals, ...) const; - void SendEvent(EventHandlerPtr ev, std::list events) const; + void SendEvent(EventHandlerPtr ev, std::list events) const; // Implementation of SendEndOfData (send end_of_data event). void SendEndOfData(const Stream *i); @@ -222,19 +222,19 @@ private: int CopyValue(char *data, const int startpos, const threading::Value* val) const; // Convert Threading::Value to an internal Bro Type (works with Records). - Val* ValueToVal(const Stream* i, const threading::Value* val, zeek::Type* request_type, bool& have_error) const; + zeek::Val* ValueToVal(const Stream* i, const threading::Value* val, zeek::Type* request_type, bool& have_error) const; // Convert Threading::Value to an internal Bro list type. - Val* ValueToIndexVal(const Stream* i, int num_fields, const zeek::RecordType* type, const threading::Value* const *vals, bool& have_error) const; + zeek::Val* ValueToIndexVal(const Stream* i, int num_fields, const zeek::RecordType* type, const threading::Value* const *vals, bool& have_error) const; // Converts a threading::value to a record type. Mostly used by // ValueToVal. - RecordVal* ValueToRecordVal(const Stream* i, const threading::Value* const *vals, zeek::RecordType *request_type, int* position, bool& have_error) const; + zeek::RecordVal* ValueToRecordVal(const Stream* i, const threading::Value* const *vals, zeek::RecordType *request_type, int* position, bool& have_error) const; - Val* RecordValToIndexVal(RecordVal *r) const; + zeek::Val* RecordValToIndexVal(zeek::RecordVal *r) const; // Converts a Bro ListVal to a RecordVal given the record type. - RecordVal* ListValToRecordVal(ListVal* list, zeek::RecordType *request_type, int* position) const; + zeek::RecordVal* ListValToRecordVal(zeek::ListVal* list, zeek::RecordType *request_type, int* position) const; // Internally signal errors, warnings, etc. // These are sent on to input scriptland and reporter.log diff --git a/src/input/ReaderFrontend.cc b/src/input/ReaderFrontend.cc index e634570d85..17d3f6ff49 100644 --- a/src/input/ReaderFrontend.cc +++ b/src/input/ReaderFrontend.cc @@ -34,7 +34,7 @@ public: bool Process() override { return Object()->Update(); } }; -ReaderFrontend::ReaderFrontend(const ReaderBackend::ReaderInfo& arg_info, EnumVal* type) +ReaderFrontend::ReaderFrontend(const ReaderBackend::ReaderInfo& arg_info, zeek::EnumVal* type) { disabled = initialized = false; info = new ReaderBackend::ReaderInfo(arg_info); diff --git a/src/input/ReaderFrontend.h b/src/input/ReaderFrontend.h index 9a30995ada..9a6392adbe 100644 --- a/src/input/ReaderFrontend.h +++ b/src/input/ReaderFrontend.h @@ -5,7 +5,7 @@ #include "ReaderBackend.h" #include "threading/SerialTypes.h" -class EnumVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek); namespace input { @@ -33,7 +33,7 @@ public: * * Frontends must only be instantiated by the main thread. */ - ReaderFrontend(const ReaderBackend::ReaderInfo& info, EnumVal* type); + ReaderFrontend(const ReaderBackend::ReaderInfo& info, zeek::EnumVal* type); /** * Destructor. diff --git a/src/input/Tag.cc b/src/input/Tag.cc index ab2f4823d4..86c481d843 100644 --- a/src/input/Tag.cc +++ b/src/input/Tag.cc @@ -16,20 +16,20 @@ input::Tag& input::Tag::operator=(const input::Tag& other) return *this; } -const EnumValPtr& input::Tag::AsVal() const +const zeek::EnumValPtr& input::Tag::AsVal() const { return ::Tag::AsVal(input_mgr->GetTagType()); } -EnumVal* input::Tag::AsEnumVal() const +zeek::EnumVal* input::Tag::AsEnumVal() const { return AsVal().get(); } -input::Tag::Tag(EnumValPtr val) +input::Tag::Tag(zeek::EnumValPtr val) : ::Tag(std::move(val)) { } -input::Tag::Tag(EnumVal* val) +input::Tag::Tag(zeek::EnumVal* val) : ::Tag({zeek::NewRef{}, val}) { } diff --git a/src/input/Tag.h b/src/input/Tag.h index 436ca66d4a..534314fbc0 100644 --- a/src/input/Tag.h +++ b/src/input/Tag.h @@ -5,7 +5,7 @@ #include "zeek-config.h" #include "../Tag.h" -class EnumVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek); namespace zeek::plugin { template class TaggedComponent; @@ -89,10 +89,10 @@ public: * * @param etype the script-layer enum type associated with the tag. */ - const EnumValPtr& AsVal() const; + const zeek::EnumValPtr& AsVal() const; [[deprecated("Remove in v4.1. Use AsVal() instead.")]] - EnumVal* AsEnumVal() const; + zeek::EnumVal* AsEnumVal() const; static const Tag Error; @@ -117,10 +117,10 @@ protected: * * @param val An enum value of script type \c Input::Reader. */ - explicit Tag(EnumValPtr val); + explicit Tag(zeek::EnumValPtr val); [[deprecated("Remove in v4.1. Construct from IntrusivePtr isntead.")]] - explicit Tag(EnumVal* val); + explicit Tag(zeek::EnumVal* val); }; } diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc index 12e089c2ad..4d28b5ee9b 100644 --- a/src/iosource/Packet.cc +++ b/src/iosource/Packet.cc @@ -591,12 +591,12 @@ void Packet::ProcessLayer2() hdr_size = (pdata - data); } -RecordValPtr Packet::ToRawPktHdrVal() const +zeek::RecordValPtr Packet::ToRawPktHdrVal() const { static auto raw_pkt_hdr_type = zeek::id::find_type("raw_pkt_hdr"); static auto l2_hdr_type = zeek::id::find_type("l2_hdr"); - auto pkt_hdr = zeek::make_intrusive(raw_pkt_hdr_type); - auto l2_hdr = zeek::make_intrusive(l2_hdr_type); + auto pkt_hdr = zeek::make_intrusive(raw_pkt_hdr_type); + auto l2_hdr = zeek::make_intrusive(l2_hdr_type); bool is_ethernet = link_type == DLT_EN10MB; @@ -668,17 +668,17 @@ RecordValPtr Packet::ToRawPktHdrVal() const return pkt_hdr; } -RecordVal* Packet::BuildPktHdrVal() const +zeek::RecordVal* Packet::BuildPktHdrVal() const { return ToRawPktHdrVal().release(); } -ValPtr Packet::FmtEUI48(const u_char* mac) const +zeek::ValPtr Packet::FmtEUI48(const u_char* mac) const { char buf[20]; snprintf(buf, sizeof buf, "%02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); - return zeek::make_intrusive(buf); + return zeek::make_intrusive(buf); } void Packet::Describe(ODesc* d) const diff --git a/src/iosource/Packet.h b/src/iosource/Packet.h index 9ada3be841..5d2e927d99 100644 --- a/src/iosource/Packet.h +++ b/src/iosource/Packet.h @@ -1,6 +1,7 @@ - #pragma once +#include "zeek-config.h" + #include #include @@ -13,17 +14,17 @@ typedef struct bpf_timeval pkt_timeval; typedef struct timeval pkt_timeval; #endif +ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); + namespace zeek { template class IntrusivePtr; +using ValPtr = zeek::IntrusivePtr; +using RecordValPtr = zeek::IntrusivePtr; } -class Val; class ODesc; class IP_Hdr; -class RecordVal; - -using ValPtr = zeek::IntrusivePtr; -using RecordValPtr = zeek::IntrusivePtr; /** * The Layer 3 type of a packet, as determined by the parsing code in Packet. @@ -135,10 +136,10 @@ public: * Returns a \c raw_pkt_hdr RecordVal, which includes layer 2 and * also everything in IP_Hdr (i.e., IP4/6 + TCP/UDP/ICMP). */ - RecordValPtr ToRawPktHdrVal() const; + zeek::RecordValPtr ToRawPktHdrVal() const; [[deprecated("Remove in v4.1. Use ToRawPktHdrval() instead.")]] - RecordVal* BuildPktHdrVal() const; + zeek::RecordVal* BuildPktHdrVal() const; /** * Static method returning the link-layer header size for a given @@ -232,7 +233,7 @@ private: void Weird(const char* name); // Renders an MAC address into its ASCII representation. - ValPtr FmtEUI48(const u_char* mac) const; + zeek::ValPtr FmtEUI48(const u_char* mac) const; // True if we need to delete associated packet memory upon // destruction. diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc index b29a096c2e..a35e65b83a 100644 --- a/src/iosource/pcap/Source.cc +++ b/src/iosource/pcap/Source.cc @@ -47,7 +47,7 @@ void PcapSource::Close() Closed(); if ( Pcap::file_done ) - mgr.Enqueue(Pcap::file_done, zeek::make_intrusive(props.path)); + mgr.Enqueue(Pcap::file_done, zeek::make_intrusive(props.path)); } void PcapSource::OpenLive() diff --git a/src/iosource/pcap/pcap.bif b/src/iosource/pcap/pcap.bif index 11bc904af8..3b16e14f15 100644 --- a/src/iosource/pcap/pcap.bif +++ b/src/iosource/pcap/pcap.bif @@ -96,8 +96,8 @@ function error%(%): string { const char* err = ps->ErrorMsg(); if ( *err ) - return zeek::make_intrusive(err); + return zeek::make_intrusive(err); } - return zeek::make_intrusive("no error"); + return zeek::make_intrusive("no error"); %} diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc index 4c22072382..a90e73081a 100644 --- a/src/logging/Manager.cc +++ b/src/logging/Manager.cc @@ -31,16 +31,16 @@ using namespace std; using namespace logging; struct Manager::Filter { - Val* fval; + zeek::Val* fval; string name; - EnumVal* id; + zeek::EnumVal* id; Func* pred; Func* path_func; string path; - Val* path_val; - EnumVal* writer; - TableVal* config; - TableVal* field_name_map; + zeek::Val* path_val; + zeek::EnumVal* writer; + zeek::TableVal* config; + zeek::TableVal* field_name_map; string scope_sep; string ext_prefix; Func* ext_func; @@ -62,7 +62,7 @@ struct Manager::Filter { }; struct Manager::WriterInfo { - EnumVal* type; + zeek::EnumVal* type; double open_time; Timer* rotation_timer; double interval; @@ -75,7 +75,7 @@ struct Manager::WriterInfo { }; struct Manager::Stream { - EnumVal* id; + zeek::EnumVal* id; bool enabled; string name; zeek::RecordType* columns; @@ -142,7 +142,7 @@ Manager::~Manager() delete *s; } -WriterBackend* Manager::CreateBackend(WriterFrontend* frontend, EnumVal* tag) +WriterBackend* Manager::CreateBackend(WriterFrontend* frontend, zeek::EnumVal* tag) { Component* c = Lookup(tag); @@ -158,7 +158,7 @@ WriterBackend* Manager::CreateBackend(WriterFrontend* frontend, EnumVal* tag) return backend; } -Manager::Stream* Manager::FindStream(EnumVal* id) +Manager::Stream* Manager::FindStream(zeek::EnumVal* id) { unsigned int idx = id->AsEnum(); @@ -228,7 +228,7 @@ void Manager::RemoveDisabledWriters(Stream* stream) stream->writers.erase(*j); } -bool Manager::CreateStream(EnumVal* id, RecordVal* sval) +bool Manager::CreateStream(zeek::EnumVal* id, zeek::RecordVal* sval) { if ( ! same_type(sval->GetType(), zeek::BifType::Record::Log::Stream, false) ) { @@ -320,7 +320,7 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval) return true; } -bool Manager::RemoveStream(EnumVal* id) +bool Manager::RemoveStream(zeek::EnumVal* id) { unsigned int idx = id->AsEnum(); @@ -353,7 +353,7 @@ bool Manager::RemoveStream(EnumVal* id) return true; } -bool Manager::EnableStream(EnumVal* id) +bool Manager::EnableStream(zeek::EnumVal* id) { Stream* stream = FindStream(id); @@ -369,7 +369,7 @@ bool Manager::EnableStream(EnumVal* id) return true; } -bool Manager::DisableStream(EnumVal* id) +bool Manager::DisableStream(zeek::EnumVal* id) { Stream* stream = FindStream(id); @@ -387,7 +387,8 @@ bool Manager::DisableStream(EnumVal* id) // Helper for recursive record field unrolling. bool Manager::TraverseRecord(Stream* stream, Filter* filter, zeek::RecordType* rt, - TableVal* include, TableVal* exclude, const string& path, const list& indices) + zeek::TableVal* include, zeek::TableVal* exclude, + const string& path, const list& indices) { // Only include extensions for the outer record. int num_ext_fields = (indices.size() == 0) ? filter->num_ext_fields : 0; @@ -476,7 +477,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, zeek::RecordType* r // If include fields are specified, only include if explicitly listed. if ( include ) { - auto new_path_val = zeek::make_intrusive(new_path.c_str()); + auto new_path_val = zeek::make_intrusive(new_path.c_str()); bool result = (bool)include->FindOrDefault(new_path_val); if ( ! result ) @@ -486,7 +487,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, zeek::RecordType* r // If exclude fields are specified, do not only include if listed. if ( exclude ) { - auto new_path_val = zeek::make_intrusive(new_path.c_str()); + auto new_path_val = zeek::make_intrusive(new_path.c_str()); bool result = (bool)exclude->FindOrDefault(new_path_val); if ( result ) @@ -525,7 +526,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, zeek::RecordType* r return true; } -bool Manager::AddFilter(EnumVal* id, RecordVal* fval) +bool Manager::AddFilter(zeek::EnumVal* id, zeek::RecordVal* fval) { if ( ! same_type(fval->GetType(), zeek::BifType::Record::Log::Filter, false) ) { @@ -538,7 +539,7 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval) return false; // Find the right writer type. - auto writer = fval->GetFieldOrDefault("writer"); + auto writer = fval->GetFieldOrDefault("writer"); // Create a new Filter instance. @@ -654,12 +655,12 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval) return true; } -bool Manager::RemoveFilter(EnumVal* id, StringVal* name) +bool Manager::RemoveFilter(zeek::EnumVal* id, zeek::StringVal* name) { return RemoveFilter(id, name->AsString()->CheckString()); } -bool Manager::RemoveFilter(EnumVal* id, const string& name) +bool Manager::RemoveFilter(zeek::EnumVal* id, const string& name) { Stream* stream = FindStream(id); if ( ! stream ) @@ -686,7 +687,7 @@ bool Manager::RemoveFilter(EnumVal* id, const string& name) return true; } -bool Manager::Write(EnumVal* id, RecordVal* columns_arg) +bool Manager::Write(zeek::EnumVal* id, zeek::RecordVal* columns_arg) { Stream* stream = FindStream(id); if ( ! stream ) @@ -730,14 +731,14 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) if ( filter->path_func ) { - ValPtr path_arg; + zeek::ValPtr path_arg; if ( filter->path_val ) path_arg = {zeek::NewRef{}, filter->path_val}; else path_arg = val_mgr->EmptyString(); - ValPtr rec_arg; + zeek::ValPtr rec_arg; const auto& rt = filter->path_func->GetType()->Params()->GetFieldType("rec"); if ( rt->Tag() == zeek::TYPE_RECORD ) @@ -796,7 +797,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) CheckFilterWriterConflict(w->second, filter) ); Unref(filter->path_val); - filter->path_val = new StringVal(new_path.c_str()); + filter->path_val = new zeek::StringVal(new_path.c_str()); reporter->Warning("Write using filter '%s' on path '%s' changed to" " use new path '%s' to avoid conflict with filter '%s'", @@ -842,7 +843,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) if ( filter->field_name_map ) { const char* name = filter->fields[j]->name; - auto fn = zeek::make_intrusive(name); + auto fn = zeek::make_intrusive(name); if ( const auto& val = filter->field_name_map->Find(fn) ) { @@ -860,7 +861,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) HashKey* k; IterCookie* c = filter->config->AsTable()->InitForIteration(); - TableEntryVal* v; + zeek::TableEntryVal* v; while ( (v = filter->config->AsTable()->NextEntry(k, c)) ) { auto index = filter->config->RecreateIndex(*k); @@ -913,7 +914,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) return true; } -threading::Value* Manager::ValToLogVal(Val* val, zeek::Type* ty) +threading::Value* Manager::ValToLogVal(zeek::Val* val, zeek::Type* ty) { if ( ! ty ) ty = val->GetType().get(); @@ -1010,7 +1011,7 @@ threading::Value* Manager::ValToLogVal(Val* val, zeek::Type* ty) if ( ! set ) // ToPureListVal has reported an internal warning // already. Just keep going by making something up. - set = zeek::make_intrusive(zeek::TYPE_INT); + set = zeek::make_intrusive(zeek::TYPE_INT); lval->val.set_val.size = set->Length(); lval->val.set_val.vals = new threading::Value* [lval->val.set_val.size]; @@ -1023,7 +1024,7 @@ threading::Value* Manager::ValToLogVal(Val* val, zeek::Type* ty) case zeek::TYPE_VECTOR: { - VectorVal* vec = val->AsVectorVal(); + zeek::VectorVal* vec = val->AsVectorVal(); lval->val.vector_val.size = vec->Size(); lval->val.vector_val.vals = new threading::Value* [lval->val.vector_val.size]; @@ -1046,9 +1047,9 @@ threading::Value* Manager::ValToLogVal(Val* val, zeek::Type* ty) } threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter, - RecordVal* columns) + zeek::RecordVal* columns) { - RecordValPtr ext_rec; + zeek::RecordValPtr ext_rec; if ( filter->num_ext_fields > 0 ) { @@ -1062,7 +1063,7 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter, for ( int i = 0; i < filter->num_fields; ++i ) { - Val* val; + zeek::Val* val; if ( i < filter->num_ext_fields ) { if ( ! ext_rec ) @@ -1100,7 +1101,7 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter, return vals; } -bool Manager::CreateWriterForRemoteLog(EnumVal* id, EnumVal* writer, WriterBackend::WriterInfo* info, +bool Manager::CreateWriterForRemoteLog(zeek::EnumVal* id, zeek::EnumVal* writer, WriterBackend::WriterInfo* info, int num_fields, const threading::Field* const* fields) { return CreateWriter(id, writer, info, num_fields, fields, true, false, true); @@ -1115,9 +1116,9 @@ static void delete_info_and_fields(WriterBackend::WriterInfo* info, int num_fiel delete info; } -WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBackend::WriterInfo* info, - int num_fields, const threading::Field* const* fields, bool local, bool remote, bool from_remote, - const string& instantiating_filter) +WriterFrontend* Manager::CreateWriter(zeek::EnumVal* id, zeek::EnumVal* writer, WriterBackend::WriterInfo* info, + int num_fields, const threading::Field* const* fields, bool local, + bool remote, bool from_remote, const string& instantiating_filter) { WriterFrontend* result = nullptr; @@ -1187,7 +1188,7 @@ WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBacken // Still need to set the WriterInfo's rotation parameters, which we // computed above. - static auto log_rotate_base_time = zeek::id::find_val("log_rotate_base_time"); + static auto log_rotate_base_time = zeek::id::find_val("log_rotate_base_time"); static auto base_time = log_rotate_base_time->AsString()->CheckString(); winfo->info->rotation_interval = winfo->interval; @@ -1219,8 +1220,8 @@ void Manager::DeleteVals(int num_fields, threading::Value** vals) delete [] vals; } -bool Manager::WriteFromRemote(EnumVal* id, EnumVal* writer, const string& path, int num_fields, - threading::Value** vals) +bool Manager::WriteFromRemote(zeek::EnumVal* id, zeek::EnumVal* writer, const string& path, int num_fields, + threading::Value** vals) { Stream* stream = FindStream(id); @@ -1295,7 +1296,7 @@ void Manager::SendAllWritersTo(const broker::endpoint_info& ei) } } -bool Manager::SetBuf(EnumVal* id, bool enabled) +bool Manager::SetBuf(zeek::EnumVal* id, bool enabled) { Stream* stream = FindStream(id); if ( ! stream ) @@ -1310,7 +1311,7 @@ bool Manager::SetBuf(EnumVal* id, bool enabled) return true; } -bool Manager::Flush(EnumVal* id) +bool Manager::Flush(zeek::EnumVal* id) { Stream* stream = FindStream(id); if ( ! stream ) @@ -1341,7 +1342,7 @@ void Manager::Terminate() } } -bool Manager::EnableRemoteLogs(EnumVal* stream_id) +bool Manager::EnableRemoteLogs(zeek::EnumVal* stream_id) { auto stream = FindStream(stream_id); @@ -1352,7 +1353,7 @@ bool Manager::EnableRemoteLogs(EnumVal* stream_id) return true; } -bool Manager::DisableRemoteLogs(EnumVal* stream_id) +bool Manager::DisableRemoteLogs(zeek::EnumVal* stream_id) { auto stream = FindStream(stream_id); @@ -1363,7 +1364,7 @@ bool Manager::DisableRemoteLogs(EnumVal* stream_id) return true; } -bool Manager::RemoteLogsAreEnabled(EnumVal* stream_id) +bool Manager::RemoteLogsAreEnabled(zeek::EnumVal* stream_id) { auto stream = FindStream(stream_id); @@ -1373,7 +1374,7 @@ bool Manager::RemoteLogsAreEnabled(EnumVal* stream_id) return stream->enable_remote; } -zeek::RecordType* Manager::StreamColumns(EnumVal* stream_id) +zeek::RecordType* Manager::StreamColumns(zeek::EnumVal* stream_id) { auto stream = FindStream(stream_id); @@ -1447,7 +1448,7 @@ void Manager::InstallRotationTimer(WriterInfo* winfo) if ( ! winfo->open_time ) winfo->open_time = network_time; - static auto log_rotate_base_time = zeek::id::find_val("log_rotate_base_time"); + static auto log_rotate_base_time = zeek::id::find_val("log_rotate_base_time"); static auto base_time = log_rotate_base_time->AsString()->CheckString(); double base = parse_rotate_base_time(base_time); @@ -1508,12 +1509,12 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con return true; // Create the RotationInfo record. - auto info = zeek::make_intrusive(zeek::BifType::Record::Log::RotationInfo); + auto info = zeek::make_intrusive(zeek::BifType::Record::Log::RotationInfo); info->Assign(0, {zeek::NewRef{}, winfo->type}); - info->Assign(1, zeek::make_intrusive(new_name)); - info->Assign(2, zeek::make_intrusive(winfo->writer->Info().path)); - info->Assign(3, zeek::make_intrusive(open)); - info->Assign(4, zeek::make_intrusive(close)); + info->Assign(1, zeek::make_intrusive(new_name)); + info->Assign(2, zeek::make_intrusive(winfo->writer->Info().path)); + info->Assign(3, zeek::make_intrusive(open)); + info->Assign(4, zeek::make_intrusive(close)); info->Assign(5, val_mgr->Bool(terminating)); Func* func = winfo->postprocessor; diff --git a/src/logging/Manager.h b/src/logging/Manager.h index 23a61f9d69..620680938d 100644 --- a/src/logging/Manager.h +++ b/src/logging/Manager.h @@ -46,7 +46,7 @@ public: * This method corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool CreateStream(EnumVal* id, RecordVal* stream); + bool CreateStream(zeek::EnumVal* id, zeek::RecordVal* stream); /** * Remove a log stream, stopping all threads. @@ -56,7 +56,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool RemoveStream(EnumVal* id); + bool RemoveStream(zeek::EnumVal* id); /** * Enables a log log stream. @@ -66,7 +66,7 @@ public: * This method corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool EnableStream(EnumVal* id); + bool EnableStream(zeek::EnumVal* id); /** * Disables a log stream. @@ -76,7 +76,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool DisableStream(EnumVal* id); + bool DisableStream(zeek::EnumVal* id); /** * Adds a filter to a log stream. @@ -88,7 +88,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool AddFilter(EnumVal* id, RecordVal* filter); + bool AddFilter(zeek::EnumVal* id, zeek::RecordVal* filter); /** * Removes a filter from a log stream. @@ -100,7 +100,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool RemoveFilter(EnumVal* id, StringVal* name); + bool RemoveFilter(zeek::EnumVal* id, zeek::StringVal* name); /** * Removes a filter from a log stream. @@ -112,7 +112,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool RemoveFilter(EnumVal* id, const std::string& name); + bool RemoveFilter(zeek::EnumVal* id, const std::string& name); /** * Write a record to a log stream. @@ -125,7 +125,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool Write(EnumVal* id, RecordVal* columns); + bool Write(zeek::EnumVal* id, zeek::RecordVal* columns); /** * Create a new log writer frontend. This is exposed so that the @@ -146,8 +146,8 @@ public: * * @return Returns true if the writer was successfully created. */ - bool CreateWriterForRemoteLog(EnumVal* id, EnumVal* writer, WriterBackend::WriterInfo* info, - int num_fields, const threading::Field* const* fields); + bool CreateWriterForRemoteLog(zeek::EnumVal* id, zeek::EnumVal* writer, WriterBackend::WriterInfo* info, + int num_fields, const threading::Field* const* fields); /** * Writes out log entries that have already passed through all @@ -165,8 +165,8 @@ public: * @param vals An array of log values to write, of size num_fields. * The method takes ownership of the array. */ - bool WriteFromRemote(EnumVal* stream, EnumVal* writer, const std::string& path, - int num_fields, threading::Value** vals); + bool WriteFromRemote(zeek::EnumVal* stream, zeek::EnumVal* writer, const std::string& path, + int num_fields, threading::Value** vals); /** * Announces all instantiated writers to a given Broker peer. @@ -184,7 +184,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool SetBuf(EnumVal* id, bool enabled); + bool SetBuf(zeek::EnumVal* id, bool enabled); /** * Flushes a log stream. This flushed all associated writers. @@ -194,7 +194,7 @@ public: * This methods corresponds directly to the internal BiF defined in * logging.bif, which just forwards here. */ - bool Flush(EnumVal* id); + bool Flush(zeek::EnumVal* id); /** * Signals the manager to shutdown at Bro's termination. @@ -206,25 +206,25 @@ public: * @param stream_id the stream to enable remote logs for. * @return true if remote logs are enabled. */ - bool EnableRemoteLogs(EnumVal* stream_id); + bool EnableRemoteLogs(zeek::EnumVal* stream_id); /** * Disable remote logs for a given stream. * @param stream_id the stream to disable remote logs for. * @return true if remote logs are disabled. */ - bool DisableRemoteLogs(EnumVal* stream_id); + bool DisableRemoteLogs(zeek::EnumVal* stream_id); /** * @return true if remote logs are enabled for a given stream. */ - bool RemoteLogsAreEnabled(EnumVal* stream_id); + bool RemoteLogsAreEnabled(zeek::EnumVal* stream_id); /** * @return the type which corresponds to the columns in a log entry for * a given log stream. */ - zeek::RecordType* StreamColumns(EnumVal* stream_id); + zeek::RecordType* StreamColumns(zeek::EnumVal* stream_id); protected: friend class WriterFrontend; @@ -234,18 +234,19 @@ protected: // Instantiates a new WriterBackend of the given type (note that // doing so creates a new thread!). - WriterBackend* CreateBackend(WriterFrontend* frontend, EnumVal* tag); + WriterBackend* CreateBackend(WriterFrontend* frontend, zeek::EnumVal* tag); //// Function also used by the RemoteSerializer. // Takes ownership of fields and info. - WriterFrontend* CreateWriter(EnumVal* id, EnumVal* writer, WriterBackend::WriterInfo* info, - int num_fields, const threading::Field* const* fields, - bool local, bool remote, bool from_remote, const std::string& instantiating_filter=""); + WriterFrontend* CreateWriter(zeek::EnumVal* id, zeek::EnumVal* writer, WriterBackend::WriterInfo* info, + int num_fields, const threading::Field* const* fields, + bool local, bool remote, bool from_remote, + const std::string& instantiating_filter=""); // Signals that a file has been rotated. bool FinishedRotation(WriterFrontend* writer, const char* new_name, const char* old_name, - double open, double close, bool success, bool terminating); + double open, double close, bool success, bool terminating); // Deletes the values as passed into Write(). void DeleteVals(int num_fields, threading::Value** vals); @@ -256,13 +257,14 @@ private: struct WriterInfo; bool TraverseRecord(Stream* stream, Filter* filter, zeek::RecordType* rt, - TableVal* include, TableVal* exclude, const std::string& path, const std::list& indices); + zeek::TableVal* include, zeek::TableVal* exclude, + const std::string& path, const std::list& indices); threading::Value** RecordToFilterVals(Stream* stream, Filter* filter, - RecordVal* columns); + zeek::RecordVal* columns); - threading::Value* ValToLogVal(Val* val, zeek::Type* ty = nullptr); - Stream* FindStream(EnumVal* id); + threading::Value* ValToLogVal(zeek::Val* val, zeek::Type* ty = nullptr); + Stream* FindStream(zeek::EnumVal* id); void RemoveDisabledWriters(Stream* stream); void InstallRotationTimer(WriterInfo* winfo); void Rotate(WriterInfo* info); diff --git a/src/logging/Tag.cc b/src/logging/Tag.cc index 07165f561a..03b7131bf7 100644 --- a/src/logging/Tag.cc +++ b/src/logging/Tag.cc @@ -22,20 +22,20 @@ logging::Tag& logging::Tag::operator=(const logging::Tag&& other) noexcept return *this; } -const EnumValPtr& logging::Tag::AsVal() const +const zeek::EnumValPtr& logging::Tag::AsVal() const { return ::Tag::AsVal(log_mgr->GetTagType()); } -EnumVal* logging::Tag::AsEnumVal() const +zeek::EnumVal* logging::Tag::AsEnumVal() const { return AsVal().get(); } -logging::Tag::Tag(EnumValPtr val) +logging::Tag::Tag(zeek::EnumValPtr val) : ::Tag(std::move(val)) { } -logging::Tag::Tag(EnumVal* val) +logging::Tag::Tag(zeek::EnumVal* val) : ::Tag({zeek::NewRef{}, val}) { } diff --git a/src/logging/Tag.h b/src/logging/Tag.h index 25baaa0635..144789c5ef 100644 --- a/src/logging/Tag.h +++ b/src/logging/Tag.h @@ -5,7 +5,7 @@ #include "zeek-config.h" #include "../Tag.h" -class EnumVal; +ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek); namespace zeek::plugin { template class TaggedComponent; @@ -94,10 +94,10 @@ public: * * @param etype the script-layer enum type associated with the tag. */ - const EnumValPtr& AsVal() const; + const zeek::EnumValPtr& AsVal() const; [[deprecated("Remove in v4.1. Use AsVal() instead.")]] - EnumVal* AsEnumVal() const; + zeek::EnumVal* AsEnumVal() const; static const Tag Error; @@ -122,10 +122,10 @@ protected: * * @param val An enum value of script type \c Log::Writer. */ - explicit Tag(EnumValPtr val); + explicit Tag(zeek::EnumValPtr val); [[deprecated("Remove in v4.1. Construct from IntrusivePtr instead.")]] - explicit Tag(EnumVal* val); + explicit Tag(zeek::EnumVal* val); }; } diff --git a/src/logging/WriterFrontend.cc b/src/logging/WriterFrontend.cc index 307b121e17..15432117c3 100644 --- a/src/logging/WriterFrontend.cc +++ b/src/logging/WriterFrontend.cc @@ -98,7 +98,8 @@ private: using namespace logging; -WriterFrontend::WriterFrontend(const WriterBackend::WriterInfo& arg_info, EnumVal* arg_stream, EnumVal* arg_writer, bool arg_local, bool arg_remote) +WriterFrontend::WriterFrontend(const WriterBackend::WriterInfo& arg_info, zeek::EnumVal* arg_stream, + zeek::EnumVal* arg_writer, bool arg_local, bool arg_remote) { stream = arg_stream; writer = arg_writer; diff --git a/src/logging/WriterFrontend.h b/src/logging/WriterFrontend.h index 9a78ecf7db..d2e5b846d6 100644 --- a/src/logging/WriterFrontend.h +++ b/src/logging/WriterFrontend.h @@ -38,7 +38,8 @@ public: * * Frontends must only be instantiated by the main thread. */ - WriterFrontend(const WriterBackend::WriterInfo& info, EnumVal* stream, EnumVal* writer, bool local, bool remote); + WriterFrontend(const WriterBackend::WriterInfo& info, zeek::EnumVal* stream, + zeek::EnumVal* writer, bool local, bool remote); /** * Destructor. @@ -187,8 +188,8 @@ protected: void DeleteVals(int num_fields, threading::Value** vals); - EnumVal* stream; - EnumVal* writer; + zeek::EnumVal* stream; + zeek::EnumVal* writer; WriterBackend* backend; // The backend we have instantiated. bool disabled; // True if disabled. diff --git a/src/option.bif b/src/option.bif index 94287978b4..03944a802c 100644 --- a/src/option.bif +++ b/src/option.bif @@ -7,8 +7,8 @@ module Option; #include "NetVar.h" #include "broker/Data.h" -static bool call_option_handlers_and_set_value(StringVal* name, const zeek::detail::IDPtr& i, - ValPtr val, StringVal* location) +static bool call_option_handlers_and_set_value(zeek::StringVal* name, const zeek::detail::IDPtr& i, + zeek::ValPtr val, zeek::StringVal* location) { if ( i->HasOptionHandlers() ) { @@ -101,7 +101,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool val->GetType()->AsTableType()->IsUnspecifiedTable() ) { // Just coerce an empty/unspecified table to the right type. - auto tv = zeek::make_intrusive( + auto tv = zeek::make_intrusive( zeek::cast_intrusive(i->GetType()), i->GetVal()->AsTableVal()->GetAttrs()); auto rval = call_option_handlers_and_set_value(ID, i, std::move(tv), location); diff --git a/src/parse.y b/src/parse.y index f240c88813..760d7de9be 100644 --- a/src/parse.y +++ b/src/parse.y @@ -234,7 +234,7 @@ static bool expr_is_table_type_name(const zeek::detail::Expr* expr) zeek::detail::ID* id; id_list* id_l; zeek::detail::InitClass ic; - Val* val; + zeek::Val* val; RE_Matcher* re; zeek::detail::Expr* expr; zeek::detail::EventExpr* event_expr; @@ -722,7 +722,7 @@ expr: re->MakeCaseInsensitive(); re->Compile(); - $$ = new zeek::detail::ConstExpr(zeek::make_intrusive(re)); + $$ = new zeek::detail::ConstExpr(zeek::make_intrusive(re)); } | '|' expr '|' %prec '(' @@ -1879,7 +1879,7 @@ opt_no_test_block: opt_deprecated: TOK_ATTR_DEPRECATED - { $$ = new zeek::detail::ConstExpr(zeek::make_intrusive("")); } + { $$ = new zeek::detail::ConstExpr(zeek::make_intrusive("")); } | TOK_ATTR_DEPRECATED '=' TOK_CONSTANT { @@ -1891,7 +1891,7 @@ opt_deprecated: $3->Describe(&d); reporter->Error("'&deprecated=%s' must use a string literal", d.Description()); - $$ = new zeek::detail::ConstExpr(zeek::make_intrusive("")); + $$ = new zeek::detail::ConstExpr(zeek::make_intrusive("")); } } | diff --git a/src/plugin/Manager.cc b/src/plugin/Manager.cc index cea23645fc..5d91efe4de 100644 --- a/src/plugin/Manager.cc +++ b/src/plugin/Manager.cc @@ -616,7 +616,7 @@ int Manager::HookLoadFile(const Plugin::LoadType type, const string& file, const return rc; } -std::pair +std::pair Manager::HookCallFunction(const Func* func, Frame* parent, zeek::Args* vecargs) const { @@ -638,7 +638,7 @@ Manager::HookCallFunction(const Func* func, Frame* parent, hook_list* l = hooks[zeek::plugin::HOOK_CALL_FUNCTION]; - std::pair rval{false, nullptr}; + std::pair rval{false, nullptr}; if ( l ) { diff --git a/src/plugin/Plugin.cc b/src/plugin/Plugin.cc index 59284a2474..179d2c7bbc 100644 --- a/src/plugin/Plugin.cc +++ b/src/plugin/Plugin.cc @@ -375,7 +375,7 @@ int Plugin::HookLoadFile(const LoadType type, const std::string& file, const std return -1; } -std::pair +std::pair Plugin::HookFunctionCall(const Func* func, Frame* parent, zeek::Args* args) { @@ -395,9 +395,9 @@ Plugin::HookFunctionCall(const Func* func, Frame* parent, return {handled, {zeek::AdoptRef{}, result}}; } -std::pair Plugin::HookCallFunction(const Func* func, Frame *parent, val_list* args) +std::pair Plugin::HookCallFunction(const Func* func, Frame *parent, val_list* args) { - std::pair result(false, NULL); + std::pair result(false, NULL); return result; } diff --git a/src/plugin/Plugin.h b/src/plugin/Plugin.h index 7c60937017..e2f687e254 100644 --- a/src/plugin/Plugin.h +++ b/src/plugin/Plugin.h @@ -21,10 +21,9 @@ class Frame; class Func; class Event; -using ValPtr = zeek::IntrusivePtr; - namespace zeek { template class IntrusivePtr; +using ValPtr = zeek::IntrusivePtr; } namespace threading { diff --git a/src/probabilistic/Hasher.cc b/src/probabilistic/Hasher.cc index d1765c4fdf..835cb7e5d7 100644 --- a/src/probabilistic/Hasher.cc +++ b/src/probabilistic/Hasher.cc @@ -23,7 +23,7 @@ Hasher::seed_t Hasher::MakeSeed(const void* data, size_t size) assert(sizeof(tmpseed) == 16); - static auto global_hash_seed = zeek::id::find_val("global_hash_seed"); + static auto global_hash_seed = zeek::id::find_val("global_hash_seed"); if ( data ) hash_update(ctx, data, size); @@ -178,4 +178,3 @@ bool DoubleHasher::Equals(const Hasher* other) const const DoubleHasher* o = static_cast(other); return h1 == o->h1 && h2 == o->h2; } - diff --git a/src/probabilistic/Topk.cc b/src/probabilistic/Topk.cc index 40b7d3d10a..794d39f5ff 100644 --- a/src/probabilistic/Topk.cc +++ b/src/probabilistic/Topk.cc @@ -175,14 +175,14 @@ void TopkVal::Merge(const TopkVal* value, bool doPrune) } } -ValPtr TopkVal::DoClone(CloneState* state) +zeek::ValPtr TopkVal::DoClone(CloneState* state) { auto clone = zeek::make_intrusive(size); clone->Merge(this); return state->NewClone(this, std::move(clone)); } -VectorValPtr TopkVal::GetTopK(int k) const // returns vector +zeek::VectorValPtr TopkVal::GetTopK(int k) const // returns vector { if ( numElements == 0 ) { @@ -191,7 +191,7 @@ VectorValPtr TopkVal::GetTopK(int k) const // returns vector } auto v = zeek::make_intrusive(type); - auto t = zeek::make_intrusive(std::move(v)); + auto t = zeek::make_intrusive(std::move(v)); // this does no estimation if the results is correct! // in any case - just to make this future-proof (and I am lazy) - this can return more than k. @@ -268,7 +268,7 @@ uint64_t TopkVal::GetSum() const return sum; } -void TopkVal::Encountered(ValPtr encountered) +void TopkVal::Encountered(zeek::ValPtr encountered) { // ok, let's see if we already know this one. diff --git a/src/probabilistic/Topk.h b/src/probabilistic/Topk.h index 2f7bd883dd..0b3c1c84ca 100644 --- a/src/probabilistic/Topk.h +++ b/src/probabilistic/Topk.h @@ -27,11 +27,11 @@ struct Bucket { struct Element { uint64_t epsilon; - ValPtr value; + zeek::ValPtr value; Bucket* parent; }; -class TopkVal : public OpaqueVal { +class TopkVal : public zeek::OpaqueVal { public: /** @@ -55,7 +55,7 @@ public: * * @param value The encountered element */ - void Encountered(ValPtr value); + void Encountered(zeek::ValPtr value); /** * Get the first *k* elements of the result vector. At the moment, @@ -66,7 +66,7 @@ public: * * @returns The top-k encountered elements */ - VectorValPtr GetTopK(int k) const; + zeek::VectorValPtr GetTopK(int k) const; /** * Get the current count tracked in the top-k data structure for a @@ -125,7 +125,7 @@ public: * * @returns cloned TopkVal */ - ValPtr DoClone(CloneState* state) override; + zeek::ValPtr DoClone(CloneState* state) override; DECLARE_OPAQUE_VALUE(TopkVal) @@ -153,7 +153,7 @@ private: * @returns HashKey for value */ HashKey* GetHash(Val* v) const; // this probably should go somewhere else. - HashKey* GetHash(const ValPtr& v) const + HashKey* GetHash(const zeek::ValPtr& v) const { return GetHash(v.get()); } /** diff --git a/src/probabilistic/bloom-filter.bif b/src/probabilistic/bloom-filter.bif index f9cfc56885..02c4744bb5 100644 --- a/src/probabilistic/bloom-filter.bif +++ b/src/probabilistic/bloom-filter.bif @@ -46,7 +46,7 @@ function bloomfilter_basic_init%(fp: double, capacity: count, name->Len()); const Hasher* h = new DoubleHasher(optimal_k, seed); - return zeek::make_intrusive(new BasicBloomFilter(h, cells)); + return zeek::make_intrusive(new BasicBloomFilter(h, cells)); %} ## Creates a basic Bloom filter. This function serves as a low-level @@ -86,7 +86,7 @@ function bloomfilter_basic_init2%(k: count, cells: count, name->Len()); const Hasher* h = new DoubleHasher(k, seed); - return zeek::make_intrusive(new BasicBloomFilter(h, cells)); + return zeek::make_intrusive(new BasicBloomFilter(h, cells)); %} ## Creates a counting Bloom filter. @@ -130,7 +130,7 @@ function bloomfilter_counting_init%(k: count, cells: count, max: count, while ( max >>= 1 ) ++width; - return zeek::make_intrusive(new CountingBloomFilter(h, cells, width)); + return zeek::make_intrusive(new CountingBloomFilter(h, cells, width)); %} ## Adds an element to a Bloom filter. @@ -245,5 +245,5 @@ function bloomfilter_merge%(bf1: opaque of bloomfilter, function bloomfilter_internal_state%(bf: opaque of bloomfilter%): string %{ BloomFilterVal* bfv = static_cast(bf); - return zeek::make_intrusive(bfv->InternalState()); + return zeek::make_intrusive(bfv->InternalState()); %} diff --git a/src/probabilistic/cardinality-counter.bif b/src/probabilistic/cardinality-counter.bif index a8f67bed87..59f756e51f 100644 --- a/src/probabilistic/cardinality-counter.bif +++ b/src/probabilistic/cardinality-counter.bif @@ -23,7 +23,7 @@ module GLOBAL; function hll_cardinality_init%(err: double, confidence: double%): opaque of cardinality %{ CardinalityCounter* c = new CardinalityCounter(err, confidence); - auto cv = zeek::make_intrusive(c); + auto cv = zeek::make_intrusive(c); return cv; %} @@ -113,7 +113,7 @@ function hll_cardinality_estimate%(handle: opaque of cardinality%): double double estimate = h->Size(); - return zeek::make_intrusive(estimate); + return zeek::make_intrusive(estimate); %} ## Copy a HLL cardinality counter. @@ -129,7 +129,7 @@ function hll_cardinality_copy%(handle: opaque of cardinality%): opaque of cardin CardinalityVal* cv = static_cast(handle); CardinalityCounter* h = cv->Get(); CardinalityCounter* h2 = new CardinalityCounter(*h); - auto out = zeek::make_intrusive(h2); + auto out = zeek::make_intrusive(h2); return out; %} diff --git a/src/reporter.bif b/src/reporter.bif index 49008aafec..aa83c37653 100644 --- a/src/reporter.bif +++ b/src/reporter.bif @@ -163,10 +163,10 @@ function Reporter::file_weird%(name: string, f: fa_file, addl: string &default=" ## Returns: Current weird sampling whitelist function Reporter::get_weird_sampling_whitelist%(%): string_set %{ - auto set = zeek::make_intrusive(zeek::id::string_set); + auto set = zeek::make_intrusive(zeek::id::string_set); for ( auto el : reporter->GetWeirdSamplingWhitelist() ) { - auto idx = zeek::make_intrusive(el); + auto idx = zeek::make_intrusive(el); set->Assign(std::move(idx), nullptr); } return set; @@ -242,7 +242,7 @@ function Reporter::set_weird_sampling_rate%(weird_sampling_rate: count%) : bool ## Returns: weird sampling duration. function Reporter::get_weird_sampling_duration%(%) : interval %{ - return zeek::make_intrusive(reporter->GetWeirdSamplingDuration()); + return zeek::make_intrusive(reporter->GetWeirdSamplingDuration()); %} ## Sets the current weird sampling duration. Please note that diff --git a/src/scan.l b/src/scan.l index 34e05f4b05..63a2c2bfb5 100644 --- a/src/scan.l +++ b/src/scan.l @@ -203,22 +203,22 @@ ESCSEQ (\\([^\n]|[0-7]+|x[[:xdigit:]]+)) /* IPv6 literal constant patterns */ {IP6} { - RET_CONST(new AddrVal(extract_ip(yytext))) + RET_CONST(new zeek::AddrVal(extract_ip(yytext))) } {IP6}{OWS}"/"{OWS}{D} { int len = 0; std::string ip = extract_ip_and_len(yytext, &len); - RET_CONST(new SubNetVal(IPPrefix(IPAddr(ip), len, true))) + RET_CONST(new zeek::SubNetVal(IPPrefix(IPAddr(ip), len, true))) } /* IPv4 literal constant patterns */ -({D}"."){3}{D} RET_CONST(new AddrVal(yytext)) +({D}"."){3}{D} RET_CONST(new zeek::AddrVal(yytext)) ({D}"."){3}{D}{OWS}"/"{OWS}{D} { int len = 0; std::string ip = extract_ip_and_len(yytext, &len); - RET_CONST(new SubNetVal(IPPrefix(IPAddr(ip), len))) + RET_CONST(new zeek::SubNetVal(IPPrefix(IPAddr(ip), len))) } [!%*/+\-,:;<=>?()\[\]{}~$|&^] return yytext[0]; @@ -346,11 +346,11 @@ when return TOK_WHEN; rval = std::string(path) + "/" + rval; } - RET_CONST(new StringVal(rval.c_str())); + RET_CONST(new zeek::StringVal(rval.c_str())); } @FILENAME { - RET_CONST(new StringVal(SafeBasename(::filename).result)); + RET_CONST(new zeek::StringVal(SafeBasename(::filename).result)); } @load{WS}{FILE} { @@ -480,7 +480,7 @@ F RET_CONST(val_mgr->False()->Ref()) {D} { RET_CONST(val_mgr->Count(static_cast(strtoull(yytext, (char**) NULL, 10))).release()) } -{FLOAT} RET_CONST(new DoubleVal(atof(yytext))) +{FLOAT} RET_CONST(new zeek::DoubleVal(atof(yytext))) {D}"/tcp" { uint32_t p = atoi(yytext); @@ -519,12 +519,12 @@ F RET_CONST(val_mgr->False()->Ref()) RET_CONST(val_mgr->Port(p, TRANSPORT_UNKNOWN)->Ref()) } -{FLOAT}{OWS}day(s?) RET_CONST(new IntervalVal(atof(yytext),Days)) -{FLOAT}{OWS}hr(s?) RET_CONST(new IntervalVal(atof(yytext),Hours)) -{FLOAT}{OWS}min(s?) RET_CONST(new IntervalVal(atof(yytext),Minutes)) -{FLOAT}{OWS}sec(s?) RET_CONST(new IntervalVal(atof(yytext),Seconds)) -{FLOAT}{OWS}msec(s?) RET_CONST(new IntervalVal(atof(yytext),Milliseconds)) -{FLOAT}{OWS}usec(s?) RET_CONST(new IntervalVal(atof(yytext),Microseconds)) +{FLOAT}{OWS}day(s?) RET_CONST(new zeek::IntervalVal(atof(yytext),Days)) +{FLOAT}{OWS}hr(s?) RET_CONST(new zeek::IntervalVal(atof(yytext),Hours)) +{FLOAT}{OWS}min(s?) RET_CONST(new zeek::IntervalVal(atof(yytext),Minutes)) +{FLOAT}{OWS}sec(s?) RET_CONST(new zeek::IntervalVal(atof(yytext),Seconds)) +{FLOAT}{OWS}msec(s?) RET_CONST(new zeek::IntervalVal(atof(yytext),Milliseconds)) +{FLOAT}{OWS}usec(s?) RET_CONST(new zeek::IntervalVal(atof(yytext),Microseconds)) "0x"{HEX}+ RET_CONST(val_mgr->Count(static_cast(strtoull(yytext, 0, 16))).release()) @@ -560,7 +560,7 @@ F RET_CONST(val_mgr->False()->Ref()) s[i-1] = '\0'; - RET_CONST(new StringVal(new BroString(1, (byte_vec) s, i-1))) + RET_CONST(new zeek::StringVal(new BroString(1, (byte_vec) s, i-1))) } ([^/\\\n]|{ESCSEQ})+ { @@ -749,7 +749,7 @@ void do_atif(zeek::detail::Expr* expr) LocalNameFinder cb; expr->Traverse(&cb); - ValPtr val; + zeek::ValPtr val; if ( cb.local_names.empty() ) val = expr->Eval(nullptr); diff --git a/src/stats.bif b/src/stats.bif index d1a6295211..fac5282a1a 100644 --- a/src/stats.bif +++ b/src/stats.bif @@ -54,7 +54,7 @@ function get_net_stats%(%): NetStats bytes_recv += stat.bytes_received; } - auto r = zeek::make_intrusive(NetStats); + auto r = zeek::make_intrusive(NetStats); int n = 0; r->Assign(n++, val_mgr->Count(recv)); @@ -83,7 +83,7 @@ function get_net_stats%(%): NetStats ## get_reporter_stats function get_conn_stats%(%): ConnStats %{ - auto r = zeek::make_intrusive(ConnStats); + auto r = zeek::make_intrusive(ConnStats); int n = 0; r->Assign(n++, val_mgr->Count(Connection::TotalConnections())); @@ -137,7 +137,7 @@ function get_proc_stats%(%): ProcStats if ( getrusage(RUSAGE_SELF, &ru) < 0 ) reporter->InternalError("getrusage() failed in get_proc_stats()"); - auto r = zeek::make_intrusive(ProcStats); + auto r = zeek::make_intrusive(ProcStats); int n = 0; double elapsed_time = current_time() - bro_start_time; @@ -152,11 +152,11 @@ function get_proc_stats%(%): ProcStats r->Assign(n++, val_mgr->Count(0)); #endif - r->Assign(n++, zeek::make_intrusive(bro_start_time)); + r->Assign(n++, zeek::make_intrusive(bro_start_time)); - r->Assign(n++, zeek::make_intrusive(elapsed_time, Seconds)); - r->Assign(n++, zeek::make_intrusive(user_time, Seconds)); - r->Assign(n++, zeek::make_intrusive(system_time, Seconds)); + r->Assign(n++, zeek::make_intrusive(elapsed_time, Seconds)); + r->Assign(n++, zeek::make_intrusive(user_time, Seconds)); + r->Assign(n++, zeek::make_intrusive(system_time, Seconds)); uint64_t total_mem; get_memory_usage(&total_mem, NULL); @@ -190,7 +190,7 @@ function get_proc_stats%(%): ProcStats ## get_reporter_stats function get_event_stats%(%): EventStats %{ - auto r = zeek::make_intrusive(EventStats); + auto r = zeek::make_intrusive(EventStats); int n = 0; r->Assign(n++, val_mgr->Count(num_events_queued)); @@ -217,7 +217,7 @@ function get_event_stats%(%): EventStats ## get_reporter_stats function get_reassembler_stats%(%): ReassemblerStats %{ - auto r = zeek::make_intrusive(ReassemblerStats); + auto r = zeek::make_intrusive(ReassemblerStats); int n = 0; r->Assign(n++, val_mgr->Count(Reassembler::MemoryAllocation(REASSEM_FILE))); @@ -246,7 +246,7 @@ function get_reassembler_stats%(%): ReassemblerStats ## get_reporter_stats function get_dns_stats%(%): DNSStats %{ - auto r = zeek::make_intrusive(DNSStats); + auto r = zeek::make_intrusive(DNSStats); int n = 0; DNS_Mgr::Stats dstats; @@ -280,7 +280,7 @@ function get_dns_stats%(%): DNSStats ## get_reporter_stats function get_timer_stats%(%): TimerStats %{ - auto r = zeek::make_intrusive(TimerStats); + auto r = zeek::make_intrusive(TimerStats); int n = 0; r->Assign(n++, val_mgr->Count(unsigned(timer_mgr->Size()))); @@ -308,7 +308,7 @@ function get_timer_stats%(%): TimerStats ## get_reporter_stats function get_file_analysis_stats%(%): FileAnalysisStats %{ - auto r = zeek::make_intrusive(FileAnalysisStats); + auto r = zeek::make_intrusive(FileAnalysisStats); int n = 0; r->Assign(n++, val_mgr->Count(file_mgr->CurrentFiles())); @@ -336,7 +336,7 @@ function get_file_analysis_stats%(%): FileAnalysisStats ## get_reporter_stats function get_thread_stats%(%): ThreadStats %{ - auto r = zeek::make_intrusive(ThreadStats); + auto r = zeek::make_intrusive(ThreadStats); int n = 0; r->Assign(n++, val_mgr->Count(thread_mgr->NumThreads())); @@ -362,7 +362,7 @@ function get_thread_stats%(%): ThreadStats ## get_reporter_stats function get_gap_stats%(%): GapStats %{ - auto r = zeek::make_intrusive(GapStats); + auto r = zeek::make_intrusive(GapStats); int n = 0; r->Assign(n++, val_mgr->Count(tot_ack_events)); @@ -394,7 +394,7 @@ function get_gap_stats%(%): GapStats ## get_reporter_stats function get_matcher_stats%(%): MatcherStats %{ - auto r = zeek::make_intrusive(MatcherStats); + auto r = zeek::make_intrusive(MatcherStats); int n = 0; RuleMatcher::Stats s; @@ -432,7 +432,7 @@ function get_matcher_stats%(%): MatcherStats ## get_reporter_stats function get_broker_stats%(%): BrokerStats %{ - auto r = zeek::make_intrusive(BrokerStats); + auto r = zeek::make_intrusive(BrokerStats); int n = 0; auto cs = broker_mgr->GetStatistics(); @@ -467,14 +467,14 @@ function get_broker_stats%(%): BrokerStats ## get_broker_stats function get_reporter_stats%(%): ReporterStats %{ - auto r = zeek::make_intrusive(ReporterStats); + auto r = zeek::make_intrusive(ReporterStats); int n = 0; - auto weirds_by_type = zeek::make_intrusive(zeek::id::find_type("table_string_of_count")); + auto weirds_by_type = zeek::make_intrusive(zeek::id::find_type("table_string_of_count")); for ( auto& kv : reporter->GetWeirdsByType() ) { - auto weird = zeek::make_intrusive(kv.first); + auto weird = zeek::make_intrusive(kv.first); weirds_by_type->Assign(std::move(weird), val_mgr->Count(kv.second)); } diff --git a/src/strings.bif b/src/strings.bif index 7520726f44..6a0f8ce808 100644 --- a/src/strings.bif +++ b/src/strings.bif @@ -75,7 +75,7 @@ function string_cat%(...%): string } *b = 0; - return zeek::make_intrusive(s); + return zeek::make_intrusive(s); %} ## Joins all values in the given vector of strings with a separator placed @@ -95,7 +95,7 @@ function join_string_vec%(vec: string_vec, sep: string%): string ODesc d; d.SetStyle(RAW_STYLE); - VectorVal *v = vec->AsVectorVal(); + zeek::VectorVal *v = vec->AsVectorVal(); for ( unsigned i = 0; i < v->Size(); ++i ) { @@ -114,7 +114,7 @@ function join_string_vec%(vec: string_vec, sep: string%): string BroString* s = new BroString(1, d.TakeBytes(), d.Len()); s->SetUseFreeToDelete(true); - return zeek::make_intrusive(s); + return zeek::make_intrusive(s); %} ## Returns an edited version of a string that applies a special @@ -162,7 +162,7 @@ function edit%(arg_s: string, arg_edit_char: string%): string new_s[ind] = '\0'; - return zeek::make_intrusive(new BroString(1, byte_vec(new_s), ind)); + return zeek::make_intrusive(new BroString(1, byte_vec(new_s), ind)); %} ## Get a substring from a string, given a starting position and length. @@ -185,7 +185,7 @@ function sub_bytes%(s: string, start: count, n: int%): string if ( ! ss ) ss = new BroString(""); - return zeek::make_intrusive(ss); + return zeek::make_intrusive(ss); %} %%{ @@ -199,12 +199,12 @@ static int match_prefix(int s_len, const char* s, int t_len, const char* t) return 1; } -static VectorValPtr do_split_string(StringVal* str_val, - RE_Matcher* re, int incl_sep, - int max_num_sep) +static zeek::VectorValPtr do_split_string(zeek::StringVal* str_val, + RE_Matcher* re, int incl_sep, + int max_num_sep) { // string_vec is used early in the version script - do not use the NetVar. - auto rval = zeek::make_intrusive(zeek::id::find_type("string_vec")); + auto rval = zeek::make_intrusive(zeek::id::find_type("string_vec")); const u_char* s = str_val->Bytes(); int n = str_val->Len(); const u_char* end_of_s = s + n; @@ -231,7 +231,7 @@ static VectorValPtr do_split_string(StringVal* str_val, n=0; } - rval->Assign(num++, zeek::make_intrusive(offset, (const char*) s)); + rval->Assign(num++, zeek::make_intrusive(offset, (const char*) s)); // No more separators will be needed if this is the end of string. if ( n <= 0 ) @@ -239,7 +239,7 @@ static VectorValPtr do_split_string(StringVal* str_val, if ( incl_sep ) { // including the part that matches the pattern - rval->Assign(num++, zeek::make_intrusive(end_of_match, (const char*) s+offset)); + rval->Assign(num++, zeek::make_intrusive(end_of_match, (const char*) s+offset)); } if ( max_num_sep && num_sep >= max_num_sep ) @@ -257,9 +257,9 @@ static VectorValPtr do_split_string(StringVal* str_val, return rval; } -Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep) +zeek::Val* do_split(zeek::StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep) { - TableVal* a = new TableVal(zeek::id::string_array); + auto* a = new zeek::TableVal(zeek::id::string_array); const u_char* s = str_val->Bytes(); int n = str_val->Len(); const u_char* end_of_s = s + n; @@ -287,7 +287,7 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep) } auto ind = val_mgr->Count(++num); - a->Assign(std::move(ind), zeek::make_intrusive(offset, (const char*) s)); + a->Assign(std::move(ind), zeek::make_intrusive(offset, (const char*) s)); // No more separators will be needed if this is the end of string. if ( n <= 0 ) @@ -296,7 +296,7 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep) if ( incl_sep ) { // including the part that matches the pattern ind = val_mgr->Count(++num); - a->Assign(std::move(ind), zeek::make_intrusive(end_of_match, (const char*) s+offset)); + a->Assign(std::move(ind), zeek::make_intrusive(end_of_match, (const char*) s+offset)); } if ( max_num_sep && num_sep >= max_num_sep ) @@ -512,7 +512,7 @@ function subst_string%(s: string, from: string, to: string%): string vs.push_back(dc); } - return zeek::make_intrusive(concatenate(vs)); + return zeek::make_intrusive(concatenate(vs)); %} ## Replaces all uppercase letters in a string with their lowercase counterpart. @@ -541,7 +541,7 @@ function to_lower%(str: string%): string *ls++ = '\0'; - return zeek::make_intrusive(new BroString(1, lower_s, n)); + return zeek::make_intrusive(new BroString(1, lower_s, n)); %} ## Replaces all lowercase letters in a string with their uppercase counterpart. @@ -570,7 +570,7 @@ function to_upper%(str: string%): string *us++ = '\0'; - return zeek::make_intrusive(new BroString(1, upper_s, n)); + return zeek::make_intrusive(new BroString(1, upper_s, n)); %} ## Replaces non-printable characters in a string with escaped sequences. The @@ -590,7 +590,7 @@ function to_upper%(str: string%): string function clean%(str: string%): string %{ char* s = str->AsString()->Render(); - return zeek::make_intrusive(new BroString(1, byte_vec(s), strlen(s))); + return zeek::make_intrusive(new BroString(1, byte_vec(s), strlen(s))); %} ## Replaces non-printable characters in a string with escaped sequences. The @@ -608,7 +608,7 @@ function clean%(str: string%): string function to_string_literal%(str: string%): string %{ char* s = str->AsString()->Render(BroString::BRO_STRING_LITERAL); - return zeek::make_intrusive(new BroString(1, byte_vec(s), strlen(s))); + return zeek::make_intrusive(new BroString(1, byte_vec(s), strlen(s))); %} ## Determines whether a given string contains only ASCII characters. @@ -647,7 +647,7 @@ function is_ascii%(str: string%): bool function escape_string%(s: string%): string %{ char* escstr = s->AsString()->Render(BroString::ESC_HEX | BroString::ESC_ESC); - auto val = zeek::make_intrusive(escstr); + auto val = zeek::make_intrusive(escstr); delete [] escstr; return val; %} @@ -666,7 +666,7 @@ function string_to_ascii_hex%(s: string%): string for ( int i = 0; i < s->Len(); ++i ) sprintf(x + i * 2, "%02x", sp[i]); - return zeek::make_intrusive(new BroString(1, (u_char*) x, s->Len() * 2)); + return zeek::make_intrusive(new BroString(1, (u_char*) x, s->Len() * 2)); %} ## Uses the Smith-Waterman algorithm to find similar/overlapping substrings. @@ -686,7 +686,7 @@ function str_smith_waterman%(s1: string, s2: string, params: sw_params%) : sw_su BroSubstring::Vec* subseq = smith_waterman(s1->AsString(), s2->AsString(), sw_params); - auto result = VectorValPtr{zeek::AdoptRef{}, BroSubstring::VecToPolicy(subseq)}; + auto result = zeek::VectorValPtr{zeek::AdoptRef{}, BroSubstring::VecToPolicy(subseq)}; delete_each(subseq); delete subseq; @@ -713,7 +713,7 @@ function str_split%(s: string, idx: index_vec%): string_vec indices[i] = (*idx_v)[i]->AsCount(); BroString::Vec* result = s->AsString()->Split(indices); - auto result_v = zeek::make_intrusive(zeek::id::string_vec); + auto result_v = zeek::make_intrusive(zeek::id::string_vec); if ( result ) { @@ -721,7 +721,7 @@ function str_split%(s: string, idx: index_vec%): string_vec for ( BroString::VecIt it = result->begin(); it != result->end(); ++it, ++i ) - result_v->Assign(i, zeek::make_intrusive(*it)); + result_v->Assign(i, zeek::make_intrusive(*it)); // StringVal now possesses string. delete result; @@ -744,7 +744,7 @@ function strip%(str: string%): string if ( n == 0 ) // Empty string. - return zeek::make_intrusive(new BroString(s, n, 1)); + return zeek::make_intrusive(new BroString(s, n, 1)); const u_char* sp = s; @@ -757,7 +757,7 @@ function strip%(str: string%): string while ( isspace(*sp) && sp <= e ) ++sp; - return zeek::make_intrusive(new BroString(sp, (e - sp + 1), 1)); + return zeek::make_intrusive(new BroString(sp, (e - sp + 1), 1)); %} %%{ @@ -792,7 +792,7 @@ function lstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string // empty input string if ( n == 0 ) - return zeek::make_intrusive(new BroString(s, n, 1)); + return zeek::make_intrusive(new BroString(s, n, 1)); int i; auto bs_chars = chars->AsString(); @@ -801,7 +801,7 @@ function lstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string if ( ! should_strip(s[i], bs_chars) ) break; - return zeek::make_intrusive(new BroString(s + i, n - i, 1)); + return zeek::make_intrusive(new BroString(s + i, n - i, 1)); %} ## Removes all combinations of characters in the *chars* argument @@ -823,7 +823,7 @@ function rstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string // empty input string if ( n == 0 ) - return zeek::make_intrusive(new BroString(s, n, 1)); + return zeek::make_intrusive(new BroString(s, n, 1)); int n_to_remove; auto bs_chars = chars->AsString(); @@ -832,7 +832,7 @@ function rstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string if ( ! should_strip(s[n - n_to_remove - 1], bs_chars) ) break; - return zeek::make_intrusive(new BroString(s, n - n_to_remove, 1)); + return zeek::make_intrusive(new BroString(s, n - n_to_remove, 1)); %} ## Generates a string of a given size and fills it with repetitions of a source @@ -854,7 +854,7 @@ function string_fill%(len: int, source: string%): string dst[len - 1] = 0; - return zeek::make_intrusive(new BroString(1, byte_vec(dst), len)); + return zeek::make_intrusive(new BroString(1, byte_vec(dst), len)); %} ## Takes a string and escapes characters that would allow execution of @@ -894,7 +894,7 @@ function safe_shell_quote%(source: string%): string dst[j++] = '"'; dst[j] = '\0'; - return zeek::make_intrusive(new BroString(1, dst, j)); + return zeek::make_intrusive(new BroString(1, dst, j)); %} ## Finds all occurrences of a pattern in a string. @@ -908,7 +908,7 @@ function safe_shell_quote%(source: string%): string ## .. zeek:see: find_last strstr function find_all%(str: string, re: pattern%) : string_set %{ - auto a = zeek::make_intrusive(zeek::id::string_set); + auto a = zeek::make_intrusive(zeek::id::string_set); const u_char* s = str->Bytes(); const u_char* e = s + str->Len(); @@ -918,7 +918,7 @@ function find_all%(str: string, re: pattern%) : string_set int n = re->MatchPrefix(t, e - t); if ( n >= 0 ) { - auto idx = zeek::make_intrusive(n, (const char*) t); + auto idx = zeek::make_intrusive(n, (const char*) t); a->Assign(std::move(idx), 0); t += n - 1; } @@ -948,7 +948,7 @@ function find_last%(str: string, re: pattern%) : string { int n = re->MatchPrefix(t, e - t); if ( n >= 0 ) - return zeek::make_intrusive(n, (const char*) t); + return zeek::make_intrusive(n, (const char*) t); } return val_mgr->EmptyString(); @@ -1066,7 +1066,7 @@ function hexdump%(data_str: string%) : string *ascii_ptr++ = '\n'; *ascii_ptr = 0; - auto result = zeek::make_intrusive((const char*) hex_data); + auto result = zeek::make_intrusive((const char*) hex_data); delete [] hex_data; return result; @@ -1082,5 +1082,5 @@ function reverse%(str: string%) : string %{ string s = string((const char*)str->Bytes(), str->Len()); reverse(s.begin(), s.end()); - return zeek::make_intrusive(s.length(), (const char*)s.c_str()); + return zeek::make_intrusive(s.length(), (const char*)s.c_str()); %} diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc index f4beb97069..c7bf9f5fa9 100644 --- a/src/supervisor/Supervisor.cc +++ b/src/supervisor/Supervisor.cc @@ -1105,50 +1105,50 @@ std::string Supervisor::NodeConfig::ToJSON() const RecordValPtr Supervisor::NodeConfig::ToRecord() const { const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig; - auto rval = zeek::make_intrusive(rt); - rval->Assign(rt->FieldOffset("name"), zeek::make_intrusive(name)); + auto rval = zeek::make_intrusive(rt); + rval->Assign(rt->FieldOffset("name"), zeek::make_intrusive(name)); if ( interface ) - rval->Assign(rt->FieldOffset("interface"), zeek::make_intrusive(*interface)); + rval->Assign(rt->FieldOffset("interface"), zeek::make_intrusive(*interface)); if ( directory ) - rval->Assign(rt->FieldOffset("directory"), zeek::make_intrusive(*directory)); + rval->Assign(rt->FieldOffset("directory"), zeek::make_intrusive(*directory)); if ( stdout_file ) - rval->Assign(rt->FieldOffset("stdout_file"), zeek::make_intrusive(*stdout_file)); + rval->Assign(rt->FieldOffset("stdout_file"), zeek::make_intrusive(*stdout_file)); if ( stderr_file ) - rval->Assign(rt->FieldOffset("stderr_file"), zeek::make_intrusive(*stderr_file)); + rval->Assign(rt->FieldOffset("stderr_file"), zeek::make_intrusive(*stderr_file)); if ( cpu_affinity ) rval->Assign(rt->FieldOffset("cpu_affinity"), val_mgr->Int(*cpu_affinity)); auto st = rt->GetFieldType("scripts"); - auto scripts_val = zeek::make_intrusive(std::move(st)); + auto scripts_val = zeek::make_intrusive(std::move(st)); for ( const auto& s : scripts ) - scripts_val->Assign(scripts_val->Size(), zeek::make_intrusive(s)); + scripts_val->Assign(scripts_val->Size(), zeek::make_intrusive(s)); rval->Assign(rt->FieldOffset("scripts"), std::move(scripts_val)); auto tt = rt->GetFieldType("cluster"); - auto cluster_val = zeek::make_intrusive(std::move(tt)); + auto cluster_val = zeek::make_intrusive(std::move(tt)); rval->Assign(rt->FieldOffset("cluster"), cluster_val); for ( const auto& e : cluster ) { auto& name = e.first; auto& ep = e.second; - auto key = zeek::make_intrusive(name); + auto key = zeek::make_intrusive(name); const auto& ept = zeek::BifType::Record::Supervisor::ClusterEndpoint; - auto val = zeek::make_intrusive(ept); + auto val = zeek::make_intrusive(ept); val->Assign(ept->FieldOffset("role"), zeek::BifType::Enum::Supervisor::ClusterRole->GetVal(ep.role)); - val->Assign(ept->FieldOffset("host"), zeek::make_intrusive(ep.host)); + val->Assign(ept->FieldOffset("host"), zeek::make_intrusive(ep.host)); val->Assign(ept->FieldOffset("p"), val_mgr->Port(ep.port, TRANSPORT_TCP)); if ( ep.interface ) - val->Assign(ept->FieldOffset("interface"), zeek::make_intrusive(*ep.interface)); + val->Assign(ept->FieldOffset("interface"), zeek::make_intrusive(*ep.interface)); cluster_val->Assign(std::move(key), std::move(val)); } @@ -1159,7 +1159,7 @@ RecordValPtr Supervisor::NodeConfig::ToRecord() const RecordValPtr Supervisor::Node::ToRecord() const { const auto& rt = zeek::BifType::Record::Supervisor::NodeStatus; - auto rval = zeek::make_intrusive(rt); + auto rval = zeek::make_intrusive(rt); rval->Assign(rt->FieldOffset("node"), config.ToRecord()); @@ -1212,21 +1212,21 @@ bool Supervisor::SupervisedNode::InitCluster() const { const auto& node_name = e.first; const auto& ep = e.second; - auto key = zeek::make_intrusive(node_name); - auto val = zeek::make_intrusive(cluster_node_type); + auto key = zeek::make_intrusive(node_name); + auto val = zeek::make_intrusive(cluster_node_type); auto node_type = supervisor_role_to_cluster_node_type(ep.role); val->Assign(cluster_node_type->FieldOffset("node_type"), std::move(node_type)); - val->Assign(cluster_node_type->FieldOffset("ip"), zeek::make_intrusive(ep.host)); + val->Assign(cluster_node_type->FieldOffset("ip"), zeek::make_intrusive(ep.host)); val->Assign(cluster_node_type->FieldOffset("p"), val_mgr->Port(ep.port, TRANSPORT_TCP)); if ( ep.interface ) val->Assign(cluster_node_type->FieldOffset("interface"), - zeek::make_intrusive(*ep.interface)); + zeek::make_intrusive(*ep.interface)); if ( manager_name && ep.role != BifEnum::Supervisor::MANAGER ) val->Assign(cluster_node_type->FieldOffset("manager"), - zeek::make_intrusive(*manager_name)); + zeek::make_intrusive(*manager_name)); cluster_nodes->Assign(std::move(key), std::move(val)); } @@ -1314,9 +1314,9 @@ void Supervisor::SupervisedNode::Init(zeek::Options* options) const RecordValPtr Supervisor::Status(std::string_view node_name) { - auto rval = zeek::make_intrusive(zeek::BifType::Record::Supervisor::Status); + auto rval = zeek::make_intrusive(zeek::BifType::Record::Supervisor::Status); const auto& tt = zeek::BifType::Record::Supervisor::Status->GetFieldType("nodes"); - auto node_table_val = zeek::make_intrusive(zeek::cast_intrusive(tt)); + auto node_table_val = zeek::make_intrusive(zeek::cast_intrusive(tt)); rval->Assign(0, node_table_val); if ( node_name.empty() ) @@ -1325,7 +1325,7 @@ RecordValPtr Supervisor::Status(std::string_view node_name) { const auto& name = n.first; const auto& node = n.second; - auto key = zeek::make_intrusive(name); + auto key = zeek::make_intrusive(name); auto val = node.ToRecord(); node_table_val->Assign(std::move(key), std::move(val)); } @@ -1339,7 +1339,7 @@ RecordValPtr Supervisor::Status(std::string_view node_name) const auto& name = it->first; const auto& node = it->second; - auto key = zeek::make_intrusive(name); + auto key = zeek::make_intrusive(name); auto val = node.ToRecord(); node_table_val->Assign(std::move(key), std::move(val)); } diff --git a/src/supervisor/supervisor.bif b/src/supervisor/supervisor.bif index 4f100812b1..2aaed7a222 100644 --- a/src/supervisor/supervisor.bif +++ b/src/supervisor/supervisor.bif @@ -24,7 +24,7 @@ function Supervisor::__status%(node: string%): Supervisor::Status if ( ! zeek::supervisor_mgr ) { builtin_error("supervisor mode not enabled"); - return zeek::make_intrusive(zeek::BifType::Record::Supervisor::Status); + return zeek::make_intrusive(zeek::BifType::Record::Supervisor::Status); } return zeek::supervisor_mgr->Status(node->CheckString()); @@ -35,11 +35,11 @@ function Supervisor::__create%(node: Supervisor::NodeConfig%): string if ( ! zeek::supervisor_mgr ) { builtin_error("supervisor mode not enabled"); - return zeek::make_intrusive("supervisor mode not enabled"); + return zeek::make_intrusive("supervisor mode not enabled"); } auto rval = zeek::supervisor_mgr->Create(node->AsRecordVal()); - return zeek::make_intrusive(rval); + return zeek::make_intrusive(rval); %} function Supervisor::__destroy%(node: string%): bool @@ -85,8 +85,8 @@ function Supervisor::__node%(%): Supervisor::NodeConfig { builtin_error("not a supervised process"); const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig; - auto rval = zeek::make_intrusive(rt); - rval->Assign(rt->FieldOffset("name"), ""); + auto rval = zeek::make_intrusive(rt); + rval->Assign(rt->FieldOffset("name"), ""); return rval; } diff --git a/src/threading/Manager.cc b/src/threading/Manager.cc index 31bc6d57d7..416716d02c 100644 --- a/src/threading/Manager.cc +++ b/src/threading/Manager.cc @@ -164,7 +164,7 @@ bool Manager::SendEvent(MsgThread* thread, const std::string& name, const int nu for ( int j = 0; j < num_vals; j++) { - Val* v = Value::ValueToVal(std::string("thread ") + thread->Name(), vals[j], convert_error); + zeek::Val* v = Value::ValueToVal(std::string("thread ") + thread->Name(), vals[j], convert_error); vl.emplace_back(zeek::AdoptRef{}, v); if ( v && ! convert_error && ! same_type(type->GetFieldType(j), v->GetType()) ) diff --git a/src/threading/SerialTypes.cc b/src/threading/SerialTypes.cc index c6e95c18fc..1c2cb36b3e 100644 --- a/src/threading/SerialTypes.cc +++ b/src/threading/SerialTypes.cc @@ -436,7 +436,7 @@ void Value::delete_value_ptr_array(Value** vals, int num_fields) delete [] vals; } -Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_error) +zeek::Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_error) { if ( have_error ) return nullptr; @@ -456,18 +456,18 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e return val_mgr->Count(val->val.int_val).release(); case zeek::TYPE_DOUBLE: - return new DoubleVal(val->val.double_val); + return new zeek::DoubleVal(val->val.double_val); case zeek::TYPE_TIME: - return new TimeVal(val->val.double_val); + return new zeek::TimeVal(val->val.double_val); case zeek::TYPE_INTERVAL: - return new IntervalVal(val->val.double_val); + return new zeek::IntervalVal(val->val.double_val); case zeek::TYPE_STRING: { - BroString *s = new BroString((const u_char*)val->val.string_val.data, val->val.string_val.length, true); - return new StringVal(s); + auto* s = new BroString((const u_char*)val->val.string_val.data, val->val.string_val.length, true); + return new zeek::StringVal(s); } case zeek::TYPE_PORT: @@ -489,7 +489,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e assert(false); } - AddrVal* addrval = new AddrVal(*addr); + auto* addrval = new zeek::AddrVal(*addr); delete addr; return addrval; } @@ -510,7 +510,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e assert(false); } - SubNetVal* subnetval = new SubNetVal(*addr, val->val.subnet_val.length); + auto* subnetval = new zeek::SubNetVal(*addr, val->val.subnet_val.length); delete addr; return subnetval; } @@ -519,7 +519,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e { RE_Matcher* re = new RE_Matcher(val->val.pattern_text_val); re->Compile(); - return new PatternVal(re); + return new zeek::PatternVal(re); } case zeek::TYPE_TABLE: @@ -563,10 +563,10 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e } auto s = zeek::make_intrusive(std::move(set_index), nullptr); - TableVal* t = new TableVal(std::move(s)); + auto* t = new zeek::TableVal(std::move(s)); for ( int j = 0; j < val->val.set_val.size; j++ ) { - Val* assignval = ValueToVal(source, val->val.set_val.vals[j], have_error); + zeek::Val* assignval = ValueToVal(source, val->val.set_val.vals[j], have_error); t->Assign({zeek::AdoptRef{}, assignval}, nullptr); } @@ -590,7 +590,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e } auto vt = zeek::make_intrusive(std::move(type)); - auto v = zeek::make_intrusive(std::move(vt)); + auto v = zeek::make_intrusive(std::move(vt)); for ( int j = 0; j < val->val.vector_val.size; j++ ) { diff --git a/src/threading/SerialTypes.h b/src/threading/SerialTypes.h index 954ed1e26f..87d4f70505 100644 --- a/src/threading/SerialTypes.h +++ b/src/threading/SerialTypes.h @@ -207,7 +207,7 @@ struct Value { * immediately aborts. * @return Val representation of the threading::Value. nullptr on error. */ - static Val* ValueToVal(const std::string& source, const threading::Value* val, bool& have_error); + static zeek::Val* ValueToVal(const std::string& source, const threading::Value* val, bool& have_error); private: friend class ::IPAddr; diff --git a/src/util.cc b/src/util.cc index 1273b047df..b54f9d5ade 100644 --- a/src/util.cc +++ b/src/util.cc @@ -1813,7 +1813,7 @@ string find_script_file(const string& filename, const string& path_set) return string(); } -FILE* rotate_file(const char* name, RecordVal* rotate_info) +FILE* rotate_file(const char* name, zeek::RecordVal* rotate_info) { // Build file names. const int buflen = strlen(name) + 128; @@ -1859,10 +1859,10 @@ FILE* rotate_file(const char* name, RecordVal* rotate_info) // Init rotate_info. if ( rotate_info ) { - rotate_info->Assign(0, name); - rotate_info->Assign(1, newname); - rotate_info->Assign(2, network_time); - rotate_info->Assign(3, network_time); + rotate_info->Assign(0, name); + rotate_info->Assign(1, newname); + rotate_info->Assign(2, network_time); + rotate_info->Assign(3, network_time); } return newf; diff --git a/src/util.h b/src/util.h index 1b94bc2fc5..3bfee23e6e 100644 --- a/src/util.h +++ b/src/util.h @@ -381,8 +381,8 @@ FILE* open_package(std::string& path, const std::string& mode = "r"); // Renames the given file to a new temporary name, and opens a new file with // the original name. Returns new file or NULL on error. Inits rotate_info if // given (open time is set network time). -class RecordVal; -extern FILE* rotate_file(const char* name, RecordVal* rotate_info); +ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek); +extern FILE* rotate_file(const char* name, zeek::RecordVal* rotate_info); // This mimics the script-level function with the same name. const char* log_file_name(const char* tag); diff --git a/src/zeek-setup.cc b/src/zeek-setup.cc index aa637a8f79..36120688bb 100644 --- a/src/zeek-setup.cc +++ b/src/zeek-setup.cc @@ -87,7 +87,8 @@ int perftools_profile = 0; DNS_Mgr* dns_mgr; TimerMgr* timer_mgr; -ValManager* val_mgr = nullptr; +zeek::ValManager* zeek::val_mgr = nullptr; +zeek::ValManager*& val_mgr = zeek::val_mgr; logging::Manager* log_mgr = nullptr; threading::Manager* thread_mgr = nullptr; input::Manager* input_mgr = nullptr; @@ -220,7 +221,7 @@ void done_with_network() mgr.Drain(); // Don't propagate this event to remote clients. mgr.Dispatch(new Event(net_done, - {zeek::make_intrusive(timer_mgr->Time())}), + {zeek::make_intrusive(timer_mgr->Time())}), true); } @@ -689,7 +690,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv, if ( ! id ) reporter->InternalError("global cmd_line_bpf_filter not defined"); - id->SetVal(zeek::make_intrusive(*options.pcap_filter)); + id->SetVal(zeek::make_intrusive(*options.pcap_filter)); } auto all_signature_files = options.signature_files; @@ -843,9 +844,8 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv, continue; mgr.Enqueue(zeek_script_loaded, - zeek::make_intrusive(i->name.c_str()), - val_mgr->Count(i->include_level) - ); + zeek::make_intrusive(i->name.c_str()), + val_mgr->Count(i->include_level)); } } diff --git a/src/zeek.bif b/src/zeek.bif index 046b0c3b96..f1e3dadb0f 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -66,7 +66,7 @@ static int check_fmt_type(zeek::TypeTag t, zeek::TypeTag ok[]) return 0; } -static void do_fmt(const char*& fmt, Val* v, ODesc* d) +static void do_fmt(const char*& fmt, zeek::Val* v, ODesc* d) { zeek::TypeTag t = v->GetType()->Tag(); zeek::InternalTypeTag it = v->GetType()->InternalType(); @@ -319,7 +319,7 @@ static int next_fmt(const char*& fmt, const zeek::Args* args, ODesc* d, int& n) ## .. zeek:see:: network_time function current_time%(%): time %{ - return zeek::make_intrusive(current_time()); + return zeek::make_intrusive(current_time()); %} ## Returns the timestamp of the last packet processed. This function returns @@ -331,7 +331,7 @@ function current_time%(%): time ## .. zeek:see:: current_time function network_time%(%): time %{ - return zeek::make_intrusive(network_time); + return zeek::make_intrusive(network_time); %} ## Returns a system environment variable. @@ -347,7 +347,7 @@ function getenv%(var: string%): string const char* env_val = zeekenv(var->CheckString()); if ( ! env_val ) env_val = ""; // ### - return zeek::make_intrusive(env_val); + return zeek::make_intrusive(env_val); %} ## Sets a system environment variable. @@ -399,7 +399,7 @@ function terminate%(%): bool // Turns the table into environment variables (if 'set' is true) or removes // all environment variables previously generated from this table (if 'set' // is false). -static bool prepare_environment(TableVal* tbl, bool set) +static bool prepare_environment(zeek::TableVal* tbl, bool set) { auto idxs = tbl->ToPureListVal(); @@ -561,7 +561,7 @@ function md5_hash%(...%): string %{ unsigned char digest[MD5_DIGEST_LENGTH]; MD5Val::digest(@ARG@, digest); - return zeek::make_intrusive(md5_digest_print(digest)); + return zeek::make_intrusive(md5_digest_print(digest)); %} ## Computes the SHA1 hash value of the provided list of arguments. @@ -581,7 +581,7 @@ function sha1_hash%(...%): string %{ unsigned char digest[SHA_DIGEST_LENGTH]; SHA1Val::digest(@ARG@, digest); - return zeek::make_intrusive(sha1_digest_print(digest)); + return zeek::make_intrusive(sha1_digest_print(digest)); %} ## Computes the SHA256 hash value of the provided list of arguments. @@ -601,7 +601,7 @@ function sha256_hash%(...%): string %{ unsigned char digest[SHA256_DIGEST_LENGTH]; SHA256Val::digest(@ARG@, digest); - return zeek::make_intrusive(sha256_digest_print(digest)); + return zeek::make_intrusive(sha256_digest_print(digest)); %} ## Computes an HMAC-MD5 hash value of the provided list of arguments. The HMAC @@ -617,7 +617,7 @@ function md5_hmac%(...%): string %{ unsigned char hmac[MD5_DIGEST_LENGTH]; MD5Val::hmac(@ARG@, KeyedHash::shared_hmac_md5_key, hmac); - return zeek::make_intrusive(md5_digest_print(hmac)); + return zeek::make_intrusive(md5_digest_print(hmac)); %} ## Constructs an MD5 handle to enable incremental hash computation. You can @@ -640,7 +640,7 @@ function md5_hmac%(...%): string ## sha256_hash sha256_hash_init sha256_hash_update sha256_hash_finish function md5_hash_init%(%): opaque of md5 %{ - auto digest = zeek::make_intrusive(); + auto digest = zeek::make_intrusive(); digest->Init(); return digest; %} @@ -665,7 +665,7 @@ function md5_hash_init%(%): opaque of md5 ## sha256_hash sha256_hash_init sha256_hash_update sha256_hash_finish function sha1_hash_init%(%): opaque of sha1 %{ - auto digest = zeek::make_intrusive(); + auto digest = zeek::make_intrusive(); digest->Init(); return digest; %} @@ -690,7 +690,7 @@ function sha1_hash_init%(%): opaque of sha1 ## sha256_hash sha256_hash_update sha256_hash_finish function sha256_hash_init%(%): opaque of sha256 %{ - auto digest = zeek::make_intrusive(); + auto digest = zeek::make_intrusive(); digest->Init(); return digest; %} @@ -822,7 +822,7 @@ function paraglob_init%(v: any%) : opaque of paraglob try { std::unique_ptr p (new paraglob::Paraglob(patterns)); - return zeek::make_intrusive(std::move(p)); + return zeek::make_intrusive(std::move(p)); } // Thrown if paraglob fails to add a pattern. catch (const paraglob::add_error& e) @@ -983,9 +983,9 @@ function identify_data%(data: string, return_mime: bool &default=T%): string string strongest_match = file_mgr->DetectMIME(data->Bytes(), data->Len()); if ( strongest_match.empty() ) - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); - return zeek::make_intrusive(strongest_match); + return zeek::make_intrusive(strongest_match); %} ## Determines the MIME type of a piece of data using Zeek's file magic @@ -1052,12 +1052,12 @@ function find_entropy%(data: string%): entropy_test_result e.Get(&ent, &chisq, &mean, &montepi, &scc); static auto entropy_test_result = zeek::id::find_type("entropy_test_result"); - auto ent_result = zeek::make_intrusive(entropy_test_result); - ent_result->Assign(0, zeek::make_intrusive(ent)); - ent_result->Assign(1, zeek::make_intrusive(chisq)); - ent_result->Assign(2, zeek::make_intrusive(mean)); - ent_result->Assign(3, zeek::make_intrusive(montepi)); - ent_result->Assign(4, zeek::make_intrusive(scc)); + auto ent_result = zeek::make_intrusive(entropy_test_result); + ent_result->Assign(0, zeek::make_intrusive(ent)); + ent_result->Assign(1, zeek::make_intrusive(chisq)); + ent_result->Assign(2, zeek::make_intrusive(mean)); + ent_result->Assign(3, zeek::make_intrusive(montepi)); + ent_result->Assign(4, zeek::make_intrusive(scc)); return ent_result; %} @@ -1068,7 +1068,7 @@ function find_entropy%(data: string%): entropy_test_result ## .. zeek:see:: find_entropy entropy_test_add entropy_test_finish function entropy_test_init%(%): opaque of entropy %{ - return zeek::make_intrusive(); + return zeek::make_intrusive(); %} ## Adds data to an incremental entropy calculation. @@ -1104,12 +1104,12 @@ function entropy_test_finish%(handle: opaque of entropy%): entropy_test_result static_cast(handle)->Get(&ent, &chisq, &mean, &montepi, &scc); static auto entropy_test_result = zeek::id::find_type("entropy_test_result"); - auto ent_result = zeek::make_intrusive(entropy_test_result); - ent_result->Assign(0, zeek::make_intrusive(ent)); - ent_result->Assign(1, zeek::make_intrusive(chisq)); - ent_result->Assign(2, zeek::make_intrusive(mean)); - ent_result->Assign(3, zeek::make_intrusive(montepi)); - ent_result->Assign(4, zeek::make_intrusive(scc)); + auto ent_result = zeek::make_intrusive(entropy_test_result); + ent_result->Assign(0, zeek::make_intrusive(ent)); + ent_result->Assign(1, zeek::make_intrusive(chisq)); + ent_result->Assign(2, zeek::make_intrusive(mean)); + ent_result->Assign(3, zeek::make_intrusive(montepi)); + ent_result->Assign(4, zeek::make_intrusive(scc)); return ent_result; %} @@ -1124,7 +1124,7 @@ function unique_id%(prefix: string%) : string %{ char tmp[20]; uint64_t uid = calculate_unique_id(UID_POOL_DEFAULT_SCRIPT); - return zeek::make_intrusive(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString())); + return zeek::make_intrusive(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString())); %} ## Creates an identifier that is unique with high probability. @@ -1142,7 +1142,7 @@ function unique_id_from%(pool: int, prefix: string%) : string char tmp[20]; uint64_t uid = calculate_unique_id(pool); - return zeek::make_intrusive(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString())); + return zeek::make_intrusive(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString())); %} # =========================================================================== @@ -1328,9 +1328,9 @@ function all_set%(v: any%) : bool %%{ static Func* sort_function_comp = nullptr; -static std::vector index_map; // used for indirect sorting to support order() +static std::vector index_map; // used for indirect sorting to support order() -bool sort_function(const ValPtr& a, const ValPtr& b) +bool sort_function(const zeek::ValPtr& a, const zeek::ValPtr& b) { // Sort missing values as "high". if ( ! a ) @@ -1349,7 +1349,7 @@ bool indirect_sort_function(size_t a, size_t b) return sort_function(*index_map[a], *index_map[b]); } -bool signed_sort_function (const ValPtr& a, const ValPtr& b) +bool signed_sort_function (const zeek::ValPtr& a, const zeek::ValPtr& b) { if ( ! a ) return 0; @@ -1362,7 +1362,7 @@ bool signed_sort_function (const ValPtr& a, const ValPtr& b) return ia < ib; } -bool unsigned_sort_function (const ValPtr& a, const ValPtr& b) +bool unsigned_sort_function (const zeek::ValPtr& a, const zeek::ValPtr& b) { if ( ! a ) return 0; @@ -1401,7 +1401,7 @@ bool indirect_unsigned_sort_function(size_t a, size_t b) ## .. zeek:see:: order function sort%(v: any, ...%) : any %{ - ValPtr rval{zeek::NewRef{}, v}; + zeek::ValPtr rval{zeek::NewRef{}, v}; if ( v->GetType()->Tag() != zeek::TYPE_VECTOR ) { @@ -1471,7 +1471,7 @@ function sort%(v: any, ...%) : any ## .. zeek:see:: sort function order%(v: any, ...%) : index_vec %{ - auto result_v = zeek::make_intrusive(zeek::id::index_vec); + auto result_v = zeek::make_intrusive(zeek::id::index_vec); if ( v->GetType()->Tag() != zeek::TYPE_VECTOR ) { @@ -1491,7 +1491,7 @@ function order%(v: any, ...%) : index_vec if ( ! IsFunc(comp_val->GetType()->Tag()) ) { builtin_error("second argument to order() needs to be comparison function"); - return ValPtr{zeek::NewRef{}, v}; + return zeek::ValPtr{zeek::NewRef{}, v}; } comp = comp_val->AsFunc(); @@ -1521,7 +1521,7 @@ function order%(v: any, ...%) : index_vec ! comp_type->ParamList()->AllMatch(elt_type, 0) ) { builtin_error("invalid comparison function in call to order()"); - return ValPtr{zeek::NewRef{}, v}; + return zeek::ValPtr{zeek::NewRef{}, v}; } sort_function_comp = comp; @@ -1570,7 +1570,7 @@ function cat%(...%): string BroString* s = new BroString(1, d.TakeBytes(), d.Len()); s->SetUseFreeToDelete(true); - return zeek::make_intrusive(s); + return zeek::make_intrusive(s); %} ## Concatenates all arguments, with a separator placed between each one. This @@ -1612,7 +1612,7 @@ function cat_sep%(sep: string, def: string, ...%): string BroString* s = new BroString(1, d.TakeBytes(), d.Len()); s->SetUseFreeToDelete(true); - return zeek::make_intrusive(s); + return zeek::make_intrusive(s); %} ## Produces a formatted string à la ``printf``. The first argument is the @@ -1687,7 +1687,7 @@ function fmt%(...%): string BroString* s = new BroString(1, d.TakeBytes(), d.Len()); s->SetUseFreeToDelete(true); - return zeek::make_intrusive(s); + return zeek::make_intrusive(s); %} ## Renders a sequence of values to a string of bytes and outputs them directly @@ -1723,7 +1723,7 @@ function print_raw%(...%): bool ## .. zeek:see:: sqrt exp ln log10 function floor%(d: double%): double %{ - return zeek::make_intrusive(floor(d)); + return zeek::make_intrusive(floor(d)); %} ## Computes the square root of a :zeek:type:`double`. @@ -1738,10 +1738,10 @@ function sqrt%(x: double%): double if ( x < 0 ) { reporter->Error("negative sqrt argument"); - return zeek::make_intrusive(-1.0); + return zeek::make_intrusive(-1.0); } - return zeek::make_intrusive(sqrt(x)); + return zeek::make_intrusive(sqrt(x)); %} ## Computes the exponential function. @@ -1753,7 +1753,7 @@ function sqrt%(x: double%): double ## .. zeek:see:: floor sqrt ln log10 function exp%(d: double%): double %{ - return zeek::make_intrusive(exp(d)); + return zeek::make_intrusive(exp(d)); %} ## Computes the natural logarithm of a number. @@ -1765,7 +1765,7 @@ function exp%(d: double%): double ## .. zeek:see:: exp floor sqrt log10 function ln%(d: double%): double %{ - return zeek::make_intrusive(log(d)); + return zeek::make_intrusive(log(d)); %} ## Computes the common logarithm of a number. @@ -1777,7 +1777,7 @@ function ln%(d: double%): double ## .. zeek:see:: exp floor sqrt ln function log10%(d: double%): double %{ - return zeek::make_intrusive(log10(d)); + return zeek::make_intrusive(log10(d)); %} # =========================================================================== @@ -1812,7 +1812,7 @@ extern const char* zeek_version(); ## Returns: Zeek's version, e.g., 2.0-beta-47-debug. function zeek_version%(%): string %{ - return zeek::make_intrusive(zeek_version()); + return zeek::make_intrusive(zeek_version()); %} ## Converts a record type name to a vector of strings, where each element is @@ -1823,12 +1823,12 @@ function zeek_version%(%): string ## Returns: A string vector with the field names of *rt*. function record_type_to_vector%(rt: string%): string_vec %{ - auto result = zeek::make_intrusive(zeek::id::string_vec); + auto result = zeek::make_intrusive(zeek::id::string_vec); zeek::RecordType* type = zeek::id::find_type(rt->CheckString())->AsRecordType(); for ( int i = 0; i < type->NumFields(); ++i ) - result->Assign(i+1, zeek::make_intrusive(type->FieldName(i))); + result->Assign(i+1, zeek::make_intrusive(type->FieldName(i))); return result; %} @@ -1846,17 +1846,17 @@ function type_name%(t: any%): string BroString* s = new BroString(1, d.TakeBytes(), d.Len()); s->SetUseFreeToDelete(true); - return zeek::make_intrusive(s); + return zeek::make_intrusive(s); %} ## Returns: list of command-line arguments (``argv``) used to run Zeek. function zeek_args%(%): string_vec %{ auto sv = zeek::id::string_vec; - auto rval = zeek::make_intrusive(std::move(sv)); + auto rval = zeek::make_intrusive(std::move(sv)); for ( auto i = 0; i < bro_argc; ++i ) - rval->Assign(rval->Size(), zeek::make_intrusive(bro_argv[i])); + rval->Assign(rval->Size(), zeek::make_intrusive(bro_argv[i])); return rval; %} @@ -1892,12 +1892,12 @@ function packet_source%(%): PacketSource %{ static auto ps_type = zeek::id::find_type("PacketSource"); auto ps = iosource_mgr->GetPktSrc(); - auto r = zeek::make_intrusive(ps_type); + auto r = zeek::make_intrusive(ps_type); if ( ps ) { r->Assign(0, val_mgr->Bool(ps->IsLive())); - r->Assign(1, zeek::make_intrusive(ps->Path())); + r->Assign(1, zeek::make_intrusive(ps->Path())); r->Assign(2, val_mgr->Int(ps->LinkType())); r->Assign(3, val_mgr->Count(ps->Netmask())); } @@ -1913,7 +1913,7 @@ function packet_source%(%): PacketSource ## .. zeek:see:: global_ids function global_sizes%(%): var_sizes %{ - auto sizes = zeek::make_intrusive(IntrusivePtr{zeek::NewRef{}, var_sizes}); + auto sizes = zeek::make_intrusive(IntrusivePtr{zeek::NewRef{}, var_sizes}); const auto& globals = global_scope()->Vars(); for ( const auto& global : globals ) @@ -1921,7 +1921,7 @@ function global_sizes%(%): var_sizes auto& id = global.second; if ( id->HasVal() ) { - auto id_name = zeek::make_intrusive(id->Name()); + auto id_name = zeek::make_intrusive(id->Name()); auto id_size = val_mgr->Count(id->GetVal()->MemoryAllocation()); sizes->Assign(std::move(id_name), std::move(id_size)); } @@ -1941,15 +1941,15 @@ function global_sizes%(%): var_sizes function global_ids%(%): id_table %{ static auto id_table = zeek::id::find_type("id_table"); - auto ids = zeek::make_intrusive(id_table); + auto ids = zeek::make_intrusive(id_table); const auto& globals = global_scope()->Vars(); for ( const auto& global : globals ) { const auto& id = global.second; static auto script_id = zeek::id::find_type("script_id"); - auto rec = zeek::make_intrusive(script_id); - rec->Assign(0, zeek::make_intrusive(type_name(id->GetType()->Tag()))); + auto rec = zeek::make_intrusive(script_id); + rec->Assign(0, zeek::make_intrusive(type_name(id->GetType()->Tag()))); rec->Assign(1, val_mgr->Bool(id->IsExport())); rec->Assign(2, val_mgr->Bool(id->IsConst())); rec->Assign(3, val_mgr->Bool(id->IsEnumConst())); @@ -1959,7 +1959,7 @@ function global_ids%(%): id_table if ( id->HasVal() ) rec->Assign(6, id->GetVal()); - auto id_name = zeek::make_intrusive(id->Name()); + auto id_name = zeek::make_intrusive(id->Name()); ids->Assign(std::move(id_name), std::move(rec)); } @@ -1976,10 +1976,10 @@ function lookup_ID%(id: string%) : any %{ const auto& i = global_scope()->Find(id->CheckString()); if ( ! i ) - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); if ( ! i->GetVal() ) - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); return i->GetVal(); %} @@ -2002,7 +2002,7 @@ function record_fields%(rec: any%): record_field_table if ( ! id || ! id->IsType() || id->GetType()->Tag() != zeek::TYPE_RECORD ) { reporter->Error("record_fields string argument does not name a record type"); - return zeek::make_intrusive(record_field_table); + return zeek::make_intrusive(record_field_table); } return id->GetType()->AsRecordType()->GetRecordFieldsVal(); @@ -2117,7 +2117,7 @@ function gethostname%(%) : string strcpy(buffer, ""); buffer[MAXHOSTNAMELEN-1] = '\0'; - return zeek::make_intrusive(buffer); + return zeek::make_intrusive(buffer); %} ## Returns whether an address is IPv4 or not. @@ -2188,7 +2188,7 @@ function is_v6_subnet%(s: subnet%): bool ## Returns: The vector of addresses contained in the routing header data. function routing0_data_to_addrs%(s: string%): addr_vec %{ - auto rval = zeek::make_intrusive(zeek::id::find_type("addr_vec")); + auto rval = zeek::make_intrusive(zeek::id::find_type("addr_vec")); int len = s->Len(); const u_char* bytes = s->Bytes(); @@ -2201,7 +2201,7 @@ function routing0_data_to_addrs%(s: string%): addr_vec while ( len > 0 ) { IPAddr a(IPv6, (const uint32_t*) bytes, IPAddr::Network); - rval->Assign(rval->Size(), zeek::make_intrusive(a)); + rval->Assign(rval->Size(), zeek::make_intrusive(a)); bytes += 16; len -= 16; } @@ -2219,7 +2219,7 @@ function routing0_data_to_addrs%(s: string%): addr_vec ## .. zeek:see:: counts_to_addr function addr_to_counts%(a: addr%): index_vec %{ - auto rval = zeek::make_intrusive(zeek::id::index_vec); + auto rval = zeek::make_intrusive(zeek::id::index_vec); const uint32_t* bytes; int len = a->AsAddr().GetBytes(&bytes); @@ -2241,21 +2241,21 @@ function counts_to_addr%(v: index_vec%): addr %{ if ( v->AsVector()->size() == 1 ) { - return zeek::make_intrusive(htonl((*v->AsVector())[0]->AsCount())); + return zeek::make_intrusive(htonl((*v->AsVector())[0]->AsCount())); } else if ( v->AsVector()->size() == 4 ) { uint32_t bytes[4]; for ( int i = 0; i < 4; ++i ) bytes[i] = htonl((*v->AsVector())[i]->AsCount()); - return zeek::make_intrusive(bytes); + return zeek::make_intrusive(bytes); } else { builtin_error("invalid vector size", @ARG@[0]); uint32_t bytes[4]; memset(bytes, 0, sizeof(bytes)); - return zeek::make_intrusive(bytes); + return zeek::make_intrusive(bytes); } %} @@ -2363,7 +2363,7 @@ function to_count%(str: string%): count ## .. zeek:see:: double_to_interval function interval_to_double%(i: interval%): double %{ - return zeek::make_intrusive(i); + return zeek::make_intrusive(i); %} ## Converts a :zeek:type:`time` value to a :zeek:type:`double`. @@ -2375,7 +2375,7 @@ function interval_to_double%(i: interval%): double ## .. zeek:see:: double_to_time function time_to_double%(t: time%): double %{ - return zeek::make_intrusive(t); + return zeek::make_intrusive(t); %} ## Converts a :zeek:type:`double` value to a :zeek:type:`time`. @@ -2387,7 +2387,7 @@ function time_to_double%(t: time%): double ## .. zeek:see:: time_to_double double_to_count function double_to_time%(d: double%): time %{ - return zeek::make_intrusive(d); + return zeek::make_intrusive(d); %} ## Converts a :zeek:type:`double` to an :zeek:type:`interval`. @@ -2399,7 +2399,7 @@ function double_to_time%(d: double%): time ## .. zeek:see:: interval_to_double function double_to_interval%(d: double%): interval %{ - return zeek::make_intrusive(d); + return zeek::make_intrusive(d); %} ## Converts a :zeek:type:`port` to a :zeek:type:`count`. @@ -2440,14 +2440,14 @@ function count_to_port%(num: count, proto: transport_proto%): port function to_addr%(ip: string%): addr %{ char* s = ip->AsString()->Render(); - ValPtr ret; + zeek::ValPtr ret; in6_addr tmp; if ( IPAddr::ConvertString(s, &tmp) ) - ret = zeek::make_intrusive(IPAddr(tmp)); + ret = zeek::make_intrusive(IPAddr(tmp)); else { - ret = zeek::make_intrusive(IPAddr()); + ret = zeek::make_intrusive(IPAddr()); builtin_error("failed converting string to IP address", ip); } @@ -2485,7 +2485,7 @@ function to_subnet%(sn: string%): subnet if ( ! IPPrefix::ConvertString(s, &tmp) ) builtin_error("failed converting string to IP prefix", sn); - auto ret = zeek::make_intrusive(tmp); + auto ret = zeek::make_intrusive(tmp); delete [] s; return ret; %} @@ -2500,7 +2500,7 @@ function to_subnet%(sn: string%): subnet function addr_to_subnet%(a: addr%): subnet %{ int width = (a->AsAddr().GetFamily() == IPv4 ? 32 : 128); - return zeek::make_intrusive(a->AsAddr(), width); + return zeek::make_intrusive(a->AsAddr(), width); %} ## Converts a :zeek:type:`subnet` to an :zeek:type:`addr` by @@ -2513,7 +2513,7 @@ function addr_to_subnet%(a: addr%): subnet ## .. zeek:see:: to_subnet function subnet_to_addr%(sn: subnet%): addr %{ - return zeek::make_intrusive(sn->Prefix()); + return zeek::make_intrusive(sn->Prefix()); %} ## Returns the width of a :zeek:type:`subnet`. @@ -2548,7 +2548,7 @@ function to_double%(str: string%): double d = 0; } - return zeek::make_intrusive(d); + return zeek::make_intrusive(d); %} ## Converts a :zeek:type:`count` to an :zeek:type:`addr`. @@ -2563,10 +2563,10 @@ function count_to_v4_addr%(ip: count%): addr if ( ip > 4294967295LU ) { builtin_error("conversion of non-IPv4 count to addr", @ARG@[0]); - return zeek::make_intrusive(uint32_t(0)); + return zeek::make_intrusive(uint32_t(0)); } - return zeek::make_intrusive(htonl(uint32_t(ip))); + return zeek::make_intrusive(htonl(uint32_t(ip))); %} ## Converts a :zeek:type:`string` of bytes into an IPv4 address. In particular, @@ -2591,7 +2591,7 @@ function raw_bytes_to_v4_addr%(b: string%): addr a = (bp[0] << 24) | (bp[1] << 16) | (bp[2] << 8) | bp[3]; } - return zeek::make_intrusive(htonl(a)); + return zeek::make_intrusive(htonl(a)); %} ## Converts a :zeek:type:`string` to a :zeek:type:`port`. @@ -2637,13 +2637,13 @@ function bytestring_to_double%(s: string%): double if ( s->Len() != sizeof(double) ) { builtin_error("bad conversion to double"); - return zeek::make_intrusive(0.0); + return zeek::make_intrusive(0.0); } // See #908 for a discussion of portability. double d; memcpy(&d, s->Bytes(), sizeof(double)); - return zeek::make_intrusive(ntohd(d)); + return zeek::make_intrusive(ntohd(d)); %} ## Converts a string of bytes to a :zeek:type:`count`. @@ -2764,7 +2764,7 @@ function ptr_name_to_addr%(s: string%): addr else addr = (a[3] << 24) | (a[2] << 16) | (a[1] << 8) | a[0]; - return zeek::make_intrusive(htonl(addr)); + return zeek::make_intrusive(htonl(addr)); } else { @@ -2797,7 +2797,7 @@ function ptr_name_to_addr%(s: string%): addr } } - return zeek::make_intrusive(addr6); + return zeek::make_intrusive(addr6); } %} @@ -2811,7 +2811,7 @@ function ptr_name_to_addr%(s: string%): addr ## .. zeek:see:: ptr_name_to_addr to_addr function addr_to_ptr_name%(a: addr%): string %{ - return zeek::make_intrusive(a->AsAddr().PtrName().c_str()); + return zeek::make_intrusive(a->AsAddr().PtrName().c_str()); %} ## Converts a string of bytes into its hexadecimal representation. @@ -2833,7 +2833,7 @@ function bytestring_to_hexstr%(bytestring: string%): string for ( bro_uint_t i = 0; i < len; ++i ) snprintf(hexstr + (2 * i), 3, "%.2hhx", bytes[i]); - return zeek::make_intrusive(hexstr); + return zeek::make_intrusive(hexstr); %} ## Converts a hex-string into its binary representation. @@ -2880,7 +2880,7 @@ function hexstr_to_bytestring%(hexstr: string%): string } - return zeek::make_intrusive(outlen, bytestring); + return zeek::make_intrusive(outlen, bytestring); %} ## Encodes a Base64-encoded string. @@ -2897,7 +2897,7 @@ function encode_base64%(s: string, a: string &default=""%): string %{ BroString* t = encode_base64(s->AsString(), a->AsString()); if ( t ) - return zeek::make_intrusive(t); + return zeek::make_intrusive(t); else { reporter->Error("Broker query has an invalid data store"); @@ -2919,7 +2919,7 @@ function decode_base64%(s: string, a: string &default=""%): string %{ BroString* t = decode_base64(s->AsString(), a->AsString()); if ( t ) - return zeek::make_intrusive(t); + return zeek::make_intrusive(t); else { reporter->Error("error in decoding string %s", s->CheckString()); @@ -2952,7 +2952,7 @@ function decode_base64_conn%(cid: conn_id, s: string, a: string &default=""%): s BroString* t = decode_base64(s->AsString(), a->AsString(), conn); if ( t ) - return zeek::make_intrusive(t); + return zeek::make_intrusive(t); else { reporter->Error("error in decoding string %s", s->CheckString()); @@ -2982,7 +2982,7 @@ typedef struct { function uuid_to_string%(uuid: string%): string %{ if ( uuid->Len() != 16 ) - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); bro_uuid_t* id = (bro_uuid_t*) uuid->Bytes(); @@ -3000,7 +3000,7 @@ function uuid_to_string%(uuid: string%): string id->node[4], id->node[5]); - return zeek::make_intrusive(s); + return zeek::make_intrusive(s); %} %%{ @@ -3040,7 +3040,7 @@ char* to_pat_str(int sn, const char* ss) function convert_for_pattern%(s: string%): string %{ char* t = to_pat_str(s->Len(), (const char*)(s->Bytes())); - auto ret = zeek::make_intrusive(t); + auto ret = zeek::make_intrusive(t); delete [] t; return ret; %} @@ -3074,7 +3074,7 @@ function string_to_pattern%(s: string, convert: bool%): pattern RE_Matcher* re = new RE_Matcher(pat); delete [] pat; re->Compile(); - return zeek::make_intrusive(re); + return zeek::make_intrusive(re); %} ## Formats a given time value according to a format string. @@ -3093,9 +3093,9 @@ function strftime%(fmt: string, d: time%) : string if ( ! localtime_r(&timeval, &t) || ! strftime(buffer, 128, fmt->CheckString(), &t) ) - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); - return zeek::make_intrusive(buffer); + return zeek::make_intrusive(buffer); %} @@ -3116,11 +3116,11 @@ function strptime%(fmt: string, d: string%) : time ! strptime(d->CheckString(), fmt->CheckString(), &t) ) { reporter->Warning("strptime conversion failed: fmt:%s d:%s", fmt->CheckString(), d->CheckString()); - return zeek::make_intrusive(0.0); + return zeek::make_intrusive(0.0); } double ret = mktime(&t); - return zeek::make_intrusive(ret); + return zeek::make_intrusive(ret); %} @@ -3143,7 +3143,7 @@ function strptime%(fmt: string, d: string%) : time ## .. zeek:see:: remask_addr function mask_addr%(a: addr, top_bits_to_keep: count%): subnet %{ - return zeek::make_intrusive(a->AsAddr(), top_bits_to_keep); + return zeek::make_intrusive(a->AsAddr(), top_bits_to_keep); %} ## Takes some top bits (such as a subnet address) from one address and the other @@ -3169,7 +3169,7 @@ function remask_addr%(a1: addr, a2: addr, top_bits_from_a1: count%): addr addr1.Mask(top_bits_from_a1); IPAddr addr2(a2->AsAddr()); addr2.ReverseMask(top_bits_from_a1); - return zeek::make_intrusive(addr1|addr2); + return zeek::make_intrusive(addr1|addr2); %} ## Checks whether a given :zeek:type:`port` has TCP as transport protocol. @@ -3209,7 +3209,7 @@ function is_icmp_port%(p: port%): bool %} %%{ -static EnumValPtr map_conn_type(TransportProto tp) +static zeek::EnumValPtr map_conn_type(TransportProto tp) { switch ( tp ) { case TRANSPORT_UNKNOWN: @@ -3300,36 +3300,36 @@ function lookup_connection%(cid: conn_id%): connection builtin_error("connection ID not a known connection", cid); // Return a dummy connection record. - auto c = zeek::make_intrusive(zeek::id::connection); + auto c = zeek::make_intrusive(zeek::id::connection); - auto id_val = zeek::make_intrusive(zeek::id::conn_id); - id_val->Assign(0, zeek::make_intrusive((unsigned int) 0)); + auto id_val = zeek::make_intrusive(zeek::id::conn_id); + id_val->Assign(0, zeek::make_intrusive((unsigned int) 0)); id_val->Assign(1, val_mgr->Port(ntohs(0), TRANSPORT_UDP)); - id_val->Assign(2, zeek::make_intrusive((unsigned int) 0)); + id_val->Assign(2, zeek::make_intrusive((unsigned int) 0)); id_val->Assign(3, val_mgr->Port(ntohs(0), TRANSPORT_UDP)); c->Assign(0, std::move(id_val)); - auto orig_endp = zeek::make_intrusive(zeek::id::endpoint); + auto orig_endp = zeek::make_intrusive(zeek::id::endpoint); orig_endp->Assign(0, val_mgr->Count(0)); orig_endp->Assign(1, val_mgr->Count(int(0))); - auto resp_endp = zeek::make_intrusive(zeek::id::endpoint); + auto resp_endp = zeek::make_intrusive(zeek::id::endpoint); resp_endp->Assign(0, val_mgr->Count(0)); resp_endp->Assign(1, val_mgr->Count(int(0))); c->Assign(1, std::move(orig_endp)); c->Assign(2, std::move(resp_endp)); - c->Assign(3, zeek::make_intrusive(network_time)); - c->Assign(4, zeek::make_intrusive(0.0)); - c->Assign(5, zeek::make_intrusive(zeek::id::string_set)); // service + c->Assign(3, zeek::make_intrusive(network_time)); + c->Assign(4, zeek::make_intrusive(0.0)); + c->Assign(5, zeek::make_intrusive(zeek::id::string_set)); // service c->Assign(6, val_mgr->EmptyString()); // history return c; %} %%{ -const char* conn_id_string(Val* c) +const char* conn_id_string(zeek::Val* c) { const auto& id = (*(c->AsRecord()))[0]; auto vl = id->AsRecord(); @@ -3386,7 +3386,7 @@ function get_current_packet%(%) : pcap_packet %{ static auto pcap_packet = zeek::id::find_type("pcap_packet"); const Packet* p; - auto pkt = zeek::make_intrusive(pcap_packet); + auto pkt = zeek::make_intrusive(pcap_packet); if ( ! current_pktsrc || ! current_pktsrc->GetCurrentPacket(&p) ) @@ -3404,7 +3404,7 @@ function get_current_packet%(%) : pcap_packet pkt->Assign(1, val_mgr->Count(uint32_t(p->ts.tv_usec))); pkt->Assign(2, val_mgr->Count(p->cap_len)); pkt->Assign(3, val_mgr->Count(p->len)); - pkt->Assign(4, zeek::make_intrusive(p->cap_len, (const char*)p->data)); + pkt->Assign(4, zeek::make_intrusive(p->cap_len, (const char*)p->data)); pkt->Assign(5, zeek::BifType::Enum::link_encap->GetVal(p->link_type)); return pkt; @@ -3427,7 +3427,7 @@ function get_current_packet_header%(%) : raw_pkt_hdr } static auto raw_pkt_hdr_type = zeek::id::find_type("raw_pkt_hdr"); - auto hdr = zeek::make_intrusive(raw_pkt_hdr_type); + auto hdr = zeek::make_intrusive(raw_pkt_hdr_type); return hdr; %} @@ -3496,13 +3496,13 @@ public: // Overridden from DNS_Mgr:Lookup:Callback. virtual void Resolved(const char* name) { - Val* result = new StringVal(name); + zeek::Val* result = new zeek::StringVal(name); trigger->Cache(call, result); Unref(result); trigger->Release(); } - virtual void Resolved(TableVal* addrs) + virtual void Resolved(zeek::TableVal* addrs) { // No Ref() for addrs. trigger->Cache(call, addrs); @@ -3513,15 +3513,15 @@ public: { if ( lookup_name ) { - Val* result = new StringVal("<\?\?\?>"); + zeek::Val* result = new zeek::StringVal("<\?\?\?>"); trigger->Cache(call, result); Unref(result); } else { - ListVal* lv = new ListVal(zeek::TYPE_ADDR); - lv->Append(zeek::make_intrusive("0.0.0.0")); + auto* lv = new zeek::ListVal(zeek::TYPE_ADDR); + lv->Append(zeek::make_intrusive("0.0.0.0")); auto result = lv->ToSetVal(); trigger->Cache(call, result.get()); Unref(lv); @@ -3555,7 +3555,7 @@ function lookup_addr%(host: addr%) : string if ( ! trigger) { builtin_error("lookup_addr() can only be called inside a when-condition"); - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); } frame->SetDelayed(); @@ -3584,7 +3584,7 @@ function lookup_hostname_txt%(host: string%) : string if ( ! trigger) { builtin_error("lookup_hostname_txt() can only be called inside a when-condition"); - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); } frame->SetDelayed(); @@ -3613,7 +3613,7 @@ function lookup_hostname%(host: string%) : addr_set if ( ! trigger) { builtin_error("lookup_hostname() can only be called inside a when-condition"); - return zeek::make_intrusive(""); + return zeek::make_intrusive(""); } frame->SetDelayed(); @@ -3862,7 +3862,7 @@ static bool mmdb_lookup_asn(const IPAddr& addr, MMDB_lookup_result_s& result) return mmdb_lookup(addr, result, true); } -static ValPtr mmdb_getvalue(MMDB_entry_data_s* entry_data, int status, +static zeek::ValPtr mmdb_getvalue(MMDB_entry_data_s* entry_data, int status, int data_type ) { switch (status) @@ -3873,12 +3873,12 @@ static ValPtr mmdb_getvalue(MMDB_entry_data_s* entry_data, int status, switch (data_type) { case MMDB_DATA_TYPE_UTF8_STRING: - return zeek::make_intrusive( + return zeek::make_intrusive( entry_data->data_size, entry_data->utf8_string); break; case MMDB_DATA_TYPE_DOUBLE: - return zeek::make_intrusive(entry_data->double_value); + return zeek::make_intrusive(entry_data->double_value); break; case MMDB_DATA_TYPE_UINT32: @@ -3998,7 +3998,7 @@ function mmdb_open_asn_db%(f: string%) : bool function lookup_location%(a: addr%) : geo_location %{ static auto geo_location = zeek::id::find_type("geo_location"); - auto location = zeek::make_intrusive(geo_location); + auto location = zeek::make_intrusive(geo_location); #ifdef USE_GEOIP mmdb_check_loc(); @@ -4155,7 +4155,7 @@ function haversine_distance%(lat1: double, long1: double, lat2: double, long2: d double a = s1 * s1 + cos(lat1 * PI/180) * cos(lat2 * PI/180) * s2 * s2; double distance = 2 * RADIUS * asin(sqrt(a)); - return zeek::make_intrusive(distance); + return zeek::make_intrusive(distance); %} ## Converts UNIX file permissions given by a mode to an ASCII string. @@ -4247,7 +4247,7 @@ function file_mode%(mode: count%): string *p = '\0'; - return zeek::make_intrusive(str); + return zeek::make_intrusive(str); %} # =========================================================================== @@ -4368,12 +4368,12 @@ function set_inactivity_timeout%(cid: conn_id, t: interval%): interval %{ Connection* c = sessions->FindConnection(cid); if ( ! c ) - return zeek::make_intrusive(0.0); + return zeek::make_intrusive(0.0); double old_timeout = c->InactivityTimeout(); c->SetInactivityTimeout(t); - return zeek::make_intrusive(old_timeout); + return zeek::make_intrusive(old_timeout); %} # =========================================================================== @@ -4397,9 +4397,9 @@ function open%(f: string%): file const char* file = f->CheckString(); if ( streq(file, "-") ) - return zeek::make_intrusive(zeek::make_intrusive(stdout, "-", "w")); + return zeek::make_intrusive(zeek::make_intrusive(stdout, "-", "w")); else - return zeek::make_intrusive(zeek::make_intrusive(file, "w")); + return zeek::make_intrusive(zeek::make_intrusive(file, "w")); %} ## Opens a file for writing or appending. If a file with the same name already @@ -4414,7 +4414,7 @@ function open%(f: string%): file ## rmdir unlink rename function open_for_append%(f: string%): file %{ - return zeek::make_intrusive(zeek::make_intrusive(f->CheckString(), "a")); + return zeek::make_intrusive(zeek::make_intrusive(f->CheckString(), "a")); %} ## Closes an open file and flushes any buffered content. @@ -4610,7 +4610,7 @@ function get_file_name%(f: file%): string if ( ! f ) return val_mgr->EmptyString(); - return zeek::make_intrusive(f->Name()); + return zeek::make_intrusive(f->Name()); %} ## Rotates a file. @@ -4623,18 +4623,18 @@ function get_file_name%(f: file%): string ## .. zeek:see:: rotate_file_by_name calc_next_rotate function rotate_file%(f: file%): rotate_info %{ - RecordValPtr info{zeek::AdoptRef{}, f->Rotate()}; + zeek::RecordValPtr info{zeek::AdoptRef{}, f->Rotate()}; if ( info ) return info; // Record indicating error. static auto rotate_info = zeek::id::find_type("rotate_info"); - info = zeek::make_intrusive(rotate_info); + info = zeek::make_intrusive(rotate_info); info->Assign(0, val_mgr->EmptyString()); info->Assign(1, val_mgr->EmptyString()); - info->Assign(2, zeek::make_intrusive(0.0)); - info->Assign(3, zeek::make_intrusive(0.0)); + info->Assign(2, zeek::make_intrusive(0.0)); + info->Assign(3, zeek::make_intrusive(0.0)); return info; %} @@ -4650,7 +4650,7 @@ function rotate_file%(f: file%): rotate_info function rotate_file_by_name%(f: string%): rotate_info %{ static auto rotate_info = zeek::id::find_type("rotate_info"); - auto info = zeek::make_intrusive(rotate_info); + auto info = zeek::make_intrusive(rotate_info); bool is_pkt_dumper = false; bool is_addl_pkt_dumper = false; @@ -4675,8 +4675,8 @@ function rotate_file_by_name%(f: string%): rotate_info // Record indicating error. info->Assign(0, val_mgr->EmptyString()); info->Assign(1, val_mgr->EmptyString()); - info->Assign(2, zeek::make_intrusive(0.0)); - info->Assign(3, zeek::make_intrusive(0.0)); + info->Assign(2, zeek::make_intrusive(0.0)); + info->Assign(3, zeek::make_intrusive(0.0)); return info; } @@ -4684,12 +4684,12 @@ function rotate_file_by_name%(f: string%): rotate_info if ( is_pkt_dumper ) { - info->Assign(2, zeek::make_intrusive(pkt_dumper->OpenTime())); + info->Assign(2, zeek::make_intrusive(pkt_dumper->OpenTime())); pkt_dumper->Open(); } if ( is_addl_pkt_dumper ) - info->Assign(2, zeek::make_intrusive(addl_pkt_dumper->OpenTime())); + info->Assign(2, zeek::make_intrusive(addl_pkt_dumper->OpenTime())); return info; %} @@ -4704,11 +4704,11 @@ function rotate_file_by_name%(f: string%): rotate_info ## .. zeek:see:: rotate_file rotate_file_by_name function calc_next_rotate%(i: interval%) : interval %{ - static auto log_rotate_base_time = zeek::id::find_val("log_rotate_base_time"); + static auto log_rotate_base_time = zeek::id::find_val("log_rotate_base_time"); static auto base_time = log_rotate_base_time->AsString()->CheckString(); double base = parse_rotate_base_time(base_time); - return zeek::make_intrusive(calc_next_rotate(network_time, i, base)); + return zeek::make_intrusive(calc_next_rotate(network_time, i, base)); %} ## Returns the size of a given file. @@ -4721,9 +4721,9 @@ function file_size%(f: string%) : double struct stat s; if ( stat(f->CheckString(), &s) < 0 ) - return zeek::make_intrusive(-1.0); + return zeek::make_intrusive(-1.0); - return zeek::make_intrusive(double(s.st_size)); + return zeek::make_intrusive(double(s.st_size)); %} ## Prevents escaping of non-ASCII characters when writing to a file. @@ -5098,7 +5098,7 @@ function anonymize_addr%(a: addr, cl: IPAddrAnonymizationClass%): addr { const uint32_t* bytes; a->AsAddr().GetBytes(&bytes); - return zeek::make_intrusive(zeek::detail::anonymize_ip(*bytes, + return zeek::make_intrusive(zeek::detail::anonymize_ip(*bytes, static_cast(anon_class))); } %} diff --git a/src/zeekygen/IdentifierInfo.h b/src/zeekygen/IdentifierInfo.h index 77dad0488d..9e5819b84e 100644 --- a/src/zeekygen/IdentifierInfo.h +++ b/src/zeekygen/IdentifierInfo.h @@ -42,7 +42,7 @@ public: /** * Returns the initial value of the identifier. */ - const ValPtr& InitialVal() const + const zeek::ValPtr& InitialVal() const { return initial_val; } /** @@ -175,7 +175,7 @@ private: std::vector comments; zeek::detail::IDPtr id; - ValPtr initial_val; + zeek::ValPtr initial_val; redef_list redefs; record_field_map fields; RecordField* last_field_seen; diff --git a/src/zeekygen/zeekygen.bif b/src/zeekygen/zeekygen.bif index f7a84c840e..35b003a5c2 100644 --- a/src/zeekygen/zeekygen.bif +++ b/src/zeekygen/zeekygen.bif @@ -9,9 +9,9 @@ #include "zeekygen/ScriptInfo.h" #include "util.h" -static StringValPtr comments_to_val(const vector& comments) +static zeek::StringValPtr comments_to_val(const vector& comments) { - return zeek::make_intrusive(implode_string_vector(comments)); + return zeek::make_intrusive(implode_string_vector(comments)); } %%}