Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Plugins: Clean up explicit uses of namespaces in places where they're not necessary.

Browse source 
This commit covers all of the plugin classes.
This commit is contained in:
Tim Wojtulewicz 2020-08-21 09:45:16 -07:00
parent fe0c22c789
commit 70c2397f69
169 changed files with 3139 additions and 3141 deletions
Download patch file Download diff file Expand all files Collapse all files

314
src/analyzer/protocol/irc/IRC.cc
View file

@ -13,8 +13,8 @@ using namespace std;
namespace zeek::analyzer::irc {
IRC_Analyzer::IRC_Analyzer(zeek::Connection* conn)
: zeek::analyzer::tcp::TCP_ApplicationAnalyzer("IRC", conn)
IRC_Analyzer::IRC_Analyzer(Connection* conn)
: analyzer::tcp::TCP_ApplicationAnalyzer("IRC", conn)
{
invalid_msg_count = 0;
invalid_msg_max_count = 20;
@ -23,15 +23,15 @@ IRC_Analyzer::IRC_Analyzer(zeek::Connection* conn)
orig_zip_status = NO_ZIP;
resp_zip_status = NO_ZIP;
starttls = false;
cl_orig = new zeek::analyzer::tcp::ContentLine_Analyzer(conn, true, 1000);
cl_orig = new analyzer::tcp::ContentLine_Analyzer(conn, true, 1000);
AddSupportAnalyzer(cl_orig);
cl_resp = new zeek::analyzer::tcp::ContentLine_Analyzer(conn, false, 1000);
cl_resp = new analyzer::tcp::ContentLine_Analyzer(conn, false, 1000);
AddSupportAnalyzer(cl_resp);
}
void IRC_Analyzer::Done()
{
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::Done();
analyzer::tcp::TCP_ApplicationAnalyzer::Done();
}
inline void IRC_Analyzer::SkipLeadingWhitespace(string& str)
@ -45,9 +45,9 @@ inline void IRC_Analyzer::SkipLeadingWhitespace(string& str)
void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
static auto irc_join_list = zeek::id::find_type<zeek::TableType>("irc_join_list");
static auto irc_join_info = zeek::id::find_type<zeek::RecordType>("irc_join_info");
zeek::analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(length, line, orig);
static auto irc_join_list = id::find_type<TableType>("irc_join_list");
static auto irc_join_info = id::find_type<RecordType>("irc_join_info");
analyzer::tcp::TCP_ApplicationAnalyzer::DeliverStream(length, line, orig);
if ( starttls )
{
@ -239,10 +239,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_network_info,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::val_mgr->Int(users),
zeek::val_mgr->Int(services),
zeek::val_mgr->Int(servers));
val_mgr->Bool(orig),
val_mgr->Int(users),
val_mgr->Int(services),
val_mgr->Int(servers));
}
break;
@ -273,21 +273,21 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts.size() > 0 && parts[0][0] == ':' )
parts[0] = parts[0].substr(1);
auto set = zeek::make_intrusive<zeek::TableVal>(zeek::id::string_set);
auto set = make_intrusive<TableVal>(id::string_set);
for ( auto& part : parts )
{
if ( part[0] == '@' )
part = part.substr(1);
auto idx = zeek::make_intrusive<zeek::StringVal>(part);
auto idx = make_intrusive<StringVal>(part);
set->Assign(std::move(idx), nullptr);
}
EnqueueConnEvent(irc_names_info,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(type.c_str()),
zeek::make_intrusive<zeek::StringVal>(channel.c_str()),
val_mgr->Bool(orig),
make_intrusive<StringVal>(type.c_str()),
make_intrusive<StringVal>(channel.c_str()),
std::move(set));
}
break;
@ -318,10 +318,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_server_info,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::val_mgr->Int(users),
zeek::val_mgr->Int(services),
zeek::val_mgr->Int(servers));
val_mgr->Bool(orig),
val_mgr->Int(users),
val_mgr->Int(services),
val_mgr->Int(servers));
}
break;
@ -339,8 +339,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_channel_info,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::val_mgr->Int(channels));
val_mgr->Bool(orig),
val_mgr->Int(channels));
}
break;
@ -370,9 +370,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_global_users,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(eop - prefix, prefix),
zeek::make_intrusive<zeek::StringVal>(++msg));
val_mgr->Bool(orig),
make_intrusive<StringVal>(eop - prefix, prefix),
make_intrusive<StringVal>(++msg));
break;
}
@ -392,13 +392,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
return;
}
zeek::Args vl;
Args vl;
vl.reserve(6);
vl.emplace_back(ConnVal());
vl.emplace_back(zeek::val_mgr->Bool(orig));
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()));
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[1].c_str()));
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[2].c_str()));
vl.emplace_back(val_mgr->Bool(orig));
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
parts.erase(parts.begin(), parts.begin() + 4);
@ -409,7 +409,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( real_name[0] == ':' )
real_name = real_name.substr(1);
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(real_name.c_str()));
vl.emplace_back(make_intrusive<StringVal>(real_name.c_str()));
EnqueueConnEvent(irc_whois_user_line, std::move(vl));
}
@ -434,8 +434,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_whois_operator_line,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()));
val_mgr->Bool(orig),
make_intrusive<StringVal>(parts[0].c_str()));
}
break;
@ -461,18 +461,18 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts.size() > 0 && parts[0][0] == ':' )
parts[0] = parts[0].substr(1);
auto set = zeek::make_intrusive<zeek::TableVal>(zeek::id::string_set);
auto set = make_intrusive<TableVal>(id::string_set);
for ( const auto& part : parts )
{
auto idx = zeek::make_intrusive<zeek::StringVal>(part);
auto idx = make_intrusive<StringVal>(part);
set->Assign(std::move(idx), nullptr);
}
EnqueueConnEvent(irc_whois_channel_line,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(nick.c_str()),
val_mgr->Bool(orig),
make_intrusive<StringVal>(nick.c_str()),
std::move(set));
}
break;
@ -501,9 +501,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_channel_topic,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(parts[1].c_str()),
zeek::make_intrusive<zeek::StringVal>(t));
val_mgr->Bool(orig),
make_intrusive<StringVal>(parts[1].c_str()),
make_intrusive<StringVal>(t));
}
else
{
@ -534,16 +534,16 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_who_line,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[1].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[2].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[3].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[4].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[5].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[6].c_str()),
zeek::val_mgr->Int(atoi(parts[7].c_str())),
zeek::make_intrusive<zeek::StringVal>(parts[8].c_str()));
val_mgr->Bool(orig),
make_intrusive<StringVal>(parts[0].c_str()),
make_intrusive<StringVal>(parts[1].c_str()),
make_intrusive<StringVal>(parts[2].c_str()),
make_intrusive<StringVal>(parts[3].c_str()),
make_intrusive<StringVal>(parts[4].c_str()),
make_intrusive<StringVal>(parts[5].c_str()),
make_intrusive<StringVal>(parts[6].c_str()),
val_mgr->Int(atoi(parts[7].c_str())),
make_intrusive<StringVal>(parts[8].c_str()));
}
break;
@ -555,7 +555,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( irc_invalid_nick )
EnqueueConnEvent(irc_invalid_nick,
ConnVal(),
zeek::val_mgr->Bool(orig));
val_mgr->Bool(orig));
break;
// Operator responses.
@ -564,8 +564,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( irc_oper_response )
EnqueueConnEvent(irc_oper_response,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::val_mgr->Bool(code == 381));
val_mgr->Bool(orig),
val_mgr->Bool(code == 381));
break;
case 670:
@ -578,10 +578,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( irc_reply )
EnqueueConnEvent(irc_reply,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::val_mgr->Count(code),
zeek::make_intrusive<zeek::StringVal>(params.c_str()));
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
val_mgr->Count(code),
make_intrusive<StringVal>(params.c_str()));
break;
}
return;
@ -648,14 +648,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( irc_dcc_message )
EnqueueConnEvent(irc_dcc_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(target.c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[1].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[2].c_str()),
zeek::make_intrusive<zeek::AddrVal>(htonl(raw_ip)),
zeek::val_mgr->Count(atoi(parts[4].c_str())),
parts.size() >= 6 ? zeek::val_mgr->Count(atoi(parts[5].c_str())) : zeek::val_mgr->Count(0)
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(parts[1].c_str()),
make_intrusive<StringVal>(parts[2].c_str()),
make_intrusive<AddrVal>(htonl(raw_ip)),
val_mgr->Count(atoi(parts[4].c_str())),
parts.size() >= 6 ? val_mgr->Count(atoi(parts[5].c_str())) : val_mgr->Count(0)
);
}
@ -664,10 +664,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( irc_privmsg_message )
EnqueueConnEvent(irc_privmsg_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(target.c_str()),
zeek::make_intrusive<zeek::StringVal>(message.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
}
@ -689,10 +689,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_notice_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(target.c_str()),
zeek::make_intrusive<zeek::StringVal>(message.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
@ -713,10 +713,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_squery_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(target.c_str()),
zeek::make_intrusive<zeek::StringVal>(message.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(target.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
@ -724,22 +724,22 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
// extract username and real name
vector<string> parts = SplitWords(params, ' ');
zeek::Args vl;
Args vl;
vl.reserve(6);
vl.emplace_back(ConnVal());
vl.emplace_back(zeek::val_mgr->Bool(orig));
vl.emplace_back(val_mgr->Bool(orig));
if ( parts.size() > 0 )
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()));
else vl.emplace_back(zeek::val_mgr->EmptyString());
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
else vl.emplace_back(val_mgr->EmptyString());
if ( parts.size() > 1 )
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[1].c_str()));
else vl.emplace_back(zeek::val_mgr->EmptyString());
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
else vl.emplace_back(val_mgr->EmptyString());
if ( parts.size() > 2 )
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[2].c_str()));
else vl.emplace_back(zeek::val_mgr->EmptyString());
vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
else vl.emplace_back(val_mgr->EmptyString());
string realname;
for ( size_t i = 3; i < parts.size(); i++ )
@ -750,7 +750,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
}
const char* name = realname.c_str();
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(*name == ':' ? name + 1 : name));
vl.emplace_back(make_intrusive<StringVal>(*name == ':' ? name + 1 : name));
EnqueueConnEvent(irc_user_message, std::move(vl));
}
@ -762,9 +762,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( parts.size() == 2 )
EnqueueConnEvent(irc_oper_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[1].c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(parts[0].c_str()),
make_intrusive<StringVal>(parts[1].c_str())
);
else
@ -781,13 +781,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
return;
}
zeek::Args vl;
Args vl;
vl.reserve(6);
vl.emplace_back(ConnVal());
vl.emplace_back(zeek::val_mgr->Bool(orig));
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(prefix.c_str()));
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()));
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(parts[1].c_str()));
vl.emplace_back(val_mgr->Bool(orig));
vl.emplace_back(make_intrusive<StringVal>(prefix.c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
if ( parts.size() > 2 )
{
@ -798,10 +798,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( comment[0] == ':' )
comment = comment.substr(1);
vl.emplace_back(zeek::make_intrusive<zeek::StringVal>(comment.c_str()));
vl.emplace_back(make_intrusive<StringVal>(comment.c_str()));
}
else
vl.emplace_back(zeek::val_mgr->EmptyString());
vl.emplace_back(val_mgr->EmptyString());
EnqueueConnEvent(irc_kick_message, std::move(vl));
}
@ -827,7 +827,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
nickname = prefix.substr(0, pos);
}
auto list = zeek::make_intrusive<zeek::TableVal>(irc_join_list);
auto list = make_intrusive<TableVal>(irc_join_list);
vector<string> channels = SplitWords(parts[0], ',');
vector<string> passwords;
@ -838,21 +838,21 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
string empty_string = "";
for ( size_t i = 0; i < channels.size(); ++i )
{
auto info = zeek::make_intrusive<zeek::RecordVal>(irc_join_info);
info->Assign(0, zeek::make_intrusive<zeek::StringVal>(nickname.c_str()));
info->Assign(1, zeek::make_intrusive<zeek::StringVal>(channels[i].c_str()));
auto info = make_intrusive<RecordVal>(irc_join_info);
info->Assign(0, make_intrusive<StringVal>(nickname.c_str()));
info->Assign(1, make_intrusive<StringVal>(channels[i].c_str()));
if ( i < passwords.size() )
info->Assign(2, zeek::make_intrusive<zeek::StringVal>(passwords[i].c_str()));
info->Assign(2, make_intrusive<StringVal>(passwords[i].c_str()));
else
info->Assign(2, zeek::make_intrusive<zeek::StringVal>(empty_string.c_str()));
info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
// User mode.
info->Assign(3, zeek::make_intrusive<zeek::StringVal>(empty_string.c_str()));
info->Assign(3, make_intrusive<StringVal>(empty_string.c_str()));
list->Assign(std::move(info), nullptr);
}
EnqueueConnEvent(irc_join_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
val_mgr->Bool(orig),
std::move(list)
);
}
@ -871,13 +871,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
parts[1] = parts[1].substr(1);
vector<string> users = SplitWords(parts[1], ',');
auto list = zeek::make_intrusive<zeek::TableVal>(irc_join_list);
auto list = make_intrusive<TableVal>(irc_join_list);
string empty_string = "";
for ( unsigned int i = 0; i < users.size(); ++i )
{
auto info = zeek::make_intrusive<zeek::RecordVal>(irc_join_info);
auto info = make_intrusive<RecordVal>(irc_join_info);
string nick = users[i];
string mode = "none";
@ -901,18 +901,18 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
mode = "voice";
}
info->Assign(0, zeek::make_intrusive<zeek::StringVal>(nick.c_str()));
info->Assign(1, zeek::make_intrusive<zeek::StringVal>(channel.c_str()));
info->Assign(0, make_intrusive<StringVal>(nick.c_str()));
info->Assign(1, make_intrusive<StringVal>(channel.c_str()));
// Password:
info->Assign(2, zeek::make_intrusive<zeek::StringVal>(empty_string.c_str()));
info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
// User mode:
info->Assign(3, zeek::make_intrusive<zeek::StringVal>(mode.c_str()));
info->Assign(3, make_intrusive<StringVal>(mode.c_str()));
list->Assign(std::move(info), nullptr);
}
EnqueueConnEvent(irc_join_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
val_mgr->Bool(orig),
std::move(list)
);
}
@ -941,20 +941,20 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
nick = nick.substr(0, pos);
vector<string> channelList = SplitWords(channels, ',');
auto set = zeek::make_intrusive<zeek::TableVal>(zeek::id::string_set);
auto set = make_intrusive<TableVal>(id::string_set);
for ( const auto& channel : channelList )
{
auto idx = zeek::make_intrusive<zeek::StringVal>(channel);
auto idx = make_intrusive<StringVal>(channel);
set->Assign(std::move(idx), nullptr);
}
EnqueueConnEvent(irc_part_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(nick.c_str()),
val_mgr->Bool(orig),
make_intrusive<StringVal>(nick.c_str()),
std::move(set),
zeek::make_intrusive<zeek::StringVal>(message.c_str())
make_intrusive<StringVal>(message.c_str())
);
}
@ -974,9 +974,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_quit_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(nickname.c_str()),
zeek::make_intrusive<zeek::StringVal>(message.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(nickname.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
@ -988,9 +988,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_nick_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(nick.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(nick.c_str())
);
}
@ -1013,11 +1013,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_who_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
val_mgr->Bool(orig),
parts.size() > 0 ?
zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()) :
zeek::val_mgr->EmptyString(),
zeek::val_mgr->Bool(oper)
make_intrusive<StringVal>(parts[0].c_str()) :
val_mgr->EmptyString(),
val_mgr->Bool(oper)
);
}
@ -1043,9 +1043,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_whois_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(server.c_str()),
zeek::make_intrusive<zeek::StringVal>(users.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(server.c_str()),
make_intrusive<StringVal>(users.c_str())
);
}
@ -1056,9 +1056,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_error_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(params.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(params.c_str())
);
}
@ -1072,10 +1072,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_invite_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[0].c_str()),
zeek::make_intrusive<zeek::StringVal>(parts[1].c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(parts[0].c_str()),
make_intrusive<StringVal>(parts[1].c_str())
);
}
else
@ -1087,9 +1087,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( params.size() > 0 )
EnqueueConnEvent(irc_mode_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(params.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(params.c_str())
);
else
@ -1100,8 +1100,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
EnqueueConnEvent(irc_password_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(params.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(params.c_str())
);
}
@ -1122,10 +1122,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
EnqueueConnEvent(irc_squit_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(server.c_str()),
zeek::make_intrusive<zeek::StringVal>(message.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(server.c_str()),
make_intrusive<StringVal>(message.c_str())
);
}
@ -1136,10 +1136,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
EnqueueConnEvent(irc_request,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(command.c_str()),
zeek::make_intrusive<zeek::StringVal>(params.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(command.c_str()),
make_intrusive<StringVal>(params.c_str())
);
}
}
@ -1150,10 +1150,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
EnqueueConnEvent(irc_message,
ConnVal(),
zeek::val_mgr->Bool(orig),
zeek::make_intrusive<zeek::StringVal>(prefix.c_str()),
zeek::make_intrusive<zeek::StringVal>(command.c_str()),
zeek::make_intrusive<zeek::StringVal>(params.c_str())
val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()),
make_intrusive<StringVal>(command.c_str()),
make_intrusive<StringVal>(params.c_str())
);
}
}
@ -1163,8 +1163,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
orig_zip_status = ZIP_LOADED;
resp_zip_status = ZIP_LOADED;
AddSupportAnalyzer(new zeek::analyzer::zip::ZIP_Analyzer(Conn(), true));
AddSupportAnalyzer(new zeek::analyzer::zip::ZIP_Analyzer(Conn(), false));
AddSupportAnalyzer(new analyzer::zip::ZIP_Analyzer(Conn(), true));
AddSupportAnalyzer(new analyzer::zip::ZIP_Analyzer(Conn(), false));
}
return;
@ -1179,7 +1179,7 @@ void IRC_Analyzer::StartTLS()
RemoveSupportAnalyzer(cl_orig);
RemoveSupportAnalyzer(cl_resp);
Analyzer* ssl = zeek::analyzer_mgr->InstantiateAnalyzer("SSL", Conn());
Analyzer* ssl = analyzer_mgr->InstantiateAnalyzer("SSL", Conn());
if ( ssl )
AddChildAnalyzer(ssl);