From 98d94ec7855ebd2af924af59e5bc041649264aaa Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Thu, 19 Mar 2020 11:22:25 -0700 Subject: [PATCH 01/16] Enable leak checks for btests that produce runtime exceptions These were previously reporting leaks due to various allocations not getting cleaned up during the stack unwind, but at the current state of the transition toward IntrusivePtr usage, theses tests no longer leak. --- testing/btest/Baseline/core.div-by-zero/out | 4 +- .../Baseline/core.expr-exception/reporter.log | 18 ++++----- .../core.reporter-error-in-handler/output | 4 +- .../zeek.output | 8 ++-- .../language.expire-expr-error/output | 2 +- .../language.expire-func-undef/output | 38 +++++++++---------- .../language.index-assignment-invalid/out | 6 +-- .../btest/Baseline/language.invalid_index/out | 4 +- .../language.type-cast-error-dynamic/output | 6 +-- .../language.uninitialized-local2/out | 2 +- .../Baseline/plugins.reporter-hook/output | 20 +++++----- .../plugins.reporter-hook/reporter.log | 8 ++-- .../reporter.log | 2 +- .../.stderr | 2 +- .../reporter.log | 2 +- testing/btest/core/div-by-zero.zeek | 3 +- testing/btest/core/expr-exception.zeek | 3 +- .../btest/core/reporter-error-in-handler.zeek | 3 +- .../core/when-interpreter-exceptions.zeek | 3 +- testing/btest/language/common-mistakes.zeek | 7 ++-- testing/btest/language/expire-expr-error.zeek | 3 +- testing/btest/language/expire-func-undef.zeek | 3 +- .../language/index-assignment-invalid.zeek | 3 +- testing/btest/language/invalid_index.zeek | 3 +- testing/btest/language/subnet-errors.zeek | 3 +- .../language/type-cast-error-dynamic.zeek | 3 +- .../btest/language/type-coerce-numerics.zeek | 3 +- .../btest/language/uninitialized-local2.zeek | 3 +- testing/btest/plugins/reporter-hook.zeek | 3 +- .../frameworks/reporter/disable-stderr.zeek | 3 +- .../base/frameworks/reporter/stderr.zeek | 3 +- 31 files changed, 81 insertions(+), 97 deletions(-) diff --git a/testing/btest/Baseline/core.div-by-zero/out b/testing/btest/Baseline/core.div-by-zero/out index d85b92e8d9..702d00c156 100644 --- a/testing/btest/Baseline/core.div-by-zero/out +++ b/testing/btest/Baseline/core.div-by-zero/out @@ -1,5 +1,5 @@ expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.div-by-zero/div-by-zero.zeek, line 6: division by zero (a / b) expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.div-by-zero/div-by-zero.zeek, line 11: division by zero (a / b) expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.div-by-zero/div-by-zero.zeek, line 16: division by zero (a / b) -expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.div-by-zero/div-by-zero.zeek, line 22: modulo by zero (a % b) -expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.div-by-zero/div-by-zero.zeek, line 27: modulo by zero (a % b) +expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.div-by-zero/div-by-zero.zeek, line 21: modulo by zero (a % b) +expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.div-by-zero/div-by-zero.zeek, line 26: modulo by zero (a % b) diff --git a/testing/btest/Baseline/core.expr-exception/reporter.log b/testing/btest/Baseline/core.expr-exception/reporter.log index 65227ce285..e2e1a4103f 100644 --- a/testing/btest/Baseline/core.expr-exception/reporter.log +++ b/testing/btest/Baseline/core.expr-exception/reporter.log @@ -6,13 +6,13 @@ #open 2011-03-18-19-06-08 #fields ts level message location #types time enum string string -1300475168.783842 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475168.915940 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475168.916118 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475168.918295 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475168.952193 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475168.952228 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475168.954761 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475168.962628 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 -1300475169.780331 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 11 +1300475168.783842 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475168.915940 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475168.916118 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475168.918295 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475168.952193 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475168.952228 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475168.954761 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475168.962628 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 +1300475169.780331 Reporter::ERROR field value missing (c$ftp) /da/home/robin/bro/master/testing/btest/.tmp/core.expr-exception/expr-exception.zeek, line 10 #close 2011-03-18-19-06-13 diff --git a/testing/btest/Baseline/core.reporter-error-in-handler/output b/testing/btest/Baseline/core.reporter-error-in-handler/output index 6d46cdaa50..85014657a3 100644 --- a/testing/btest/Baseline/core.reporter-error-in-handler/output +++ b/testing/btest/Baseline/core.reporter-error-in-handler/output @@ -1,3 +1,3 @@ -expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.zeek, line 29: no such index (a[1]) -expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.zeek, line 23: no such index (a[2]) +expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.zeek, line 28: no such index (a[1]) +expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/core.reporter-error-in-handler/reporter-error-in-handler.zeek, line 22: no such index (a[2]) 1st error printed on script level diff --git a/testing/btest/Baseline/core.when-interpreter-exceptions/zeek.output b/testing/btest/Baseline/core.when-interpreter-exceptions/zeek.output index 50463d99e5..3abe7bcfd0 100644 --- a/testing/btest/Baseline/core.when-interpreter-exceptions/zeek.output +++ b/testing/btest/Baseline/core.when-interpreter-exceptions/zeek.output @@ -1,7 +1,7 @@ -expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 48: field value missing (myrecord$notset) -expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 92: field value missing (myrecord$notset) -expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 73: field value missing (myrecord$notset) -expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 104: field value missing (myrecord$notset) +expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 47: field value missing (myrecord$notset) +expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 91: field value missing (myrecord$notset) +expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 72: field value missing (myrecord$notset) +expression error in /Users/jon/Projects/bro/bro/testing/btest/.tmp/core.when-interpreter-exceptions/when-interpreter-exceptions.zeek, line 103: field value missing (myrecord$notset) received termination signal [f(F)] f() done, no exception, T diff --git a/testing/btest/Baseline/language.expire-expr-error/output b/testing/btest/Baseline/language.expire-expr-error/output index 7faceb19e0..5bc22b8202 100644 --- a/testing/btest/Baseline/language.expire-expr-error/output +++ b/testing/btest/Baseline/language.expire-expr-error/output @@ -1,2 +1,2 @@ -expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-expr-error/expire-expr-error.zeek, line 9: no such index (x[kaputt]) +expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-expr-error/expire-expr-error.zeek, line 8: no such index (x[kaputt]) received termination signal diff --git a/testing/btest/Baseline/language.expire-func-undef/output b/testing/btest/Baseline/language.expire-func-undef/output index 0d72390ef3..fb783261be 100644 --- a/testing/btest/Baseline/language.expire-func-undef/output +++ b/testing/btest/Baseline/language.expire-func-undef/output @@ -1,20 +1,20 @@ -1299470395.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299470405.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299473995.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299474005.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299477595.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299477605.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299481195.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299481205.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299484795.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299484805.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299488395.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299488405.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299491995.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299492005.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299495595.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299495605.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299499195.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299499205.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) -1299502795.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 13: value used but not set (segfault::scan_summary) +1299470395.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299470405.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299473995.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299474005.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299477595.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299477605.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299481195.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299481205.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299484795.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299484805.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299488395.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299488405.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299491995.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299492005.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299495595.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299495605.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299499195.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299499205.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) +1299502795.000000 expression error in /home/robin/bro/master/testing/btest/.tmp/language.expire-func-undef/expire-func-undef.zeek, line 12: value used but not set (segfault::scan_summary) orig: 10.0.0.2: peers: {\x0a\x0910.0.0.3\x0a} diff --git a/testing/btest/Baseline/language.index-assignment-invalid/out b/testing/btest/Baseline/language.index-assignment-invalid/out index 1d164cabd9..a30ecf891f 100644 --- a/testing/btest/Baseline/language.index-assignment-invalid/out +++ b/testing/btest/Baseline/language.index-assignment-invalid/out @@ -1,5 +1,5 @@ runtime error in /home/jon/pro/zeek/zeek/scripts/base/utils/queue.zeek, line 152: vector index assignment failed for invalid type 'myrec', value: [a=T, b=hi, c=], expression: Queue::ret[Queue::j], call stack: - #0 Queue::get_vector([initialized=T, vals={[2] = test,[6] = jkl;,[4] = asdf,[1] = goodbye,[5] = 3,[0] = hello,[3] = [a=T, b=hi, c=]}, settings=[max_len=], top=7, bottom=0, size=0], [hello, goodbye, test]) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:20 - #1 bar(55) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:28 - #2 foo(hi, 13) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:40 + #0 Queue::get_vector([initialized=T, vals={[2] = test,[6] = jkl;,[4] = asdf,[1] = goodbye,[5] = 3,[0] = hello,[3] = [a=T, b=hi, c=]}, settings=[max_len=], top=7, bottom=0, size=0], [hello, goodbye, test]) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:19 + #1 bar(55) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:27 + #2 foo(hi, 13) at /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.index-assignment-invalid/index-assignment-invalid.zeek:39 #3 zeek_init() diff --git a/testing/btest/Baseline/language.invalid_index/out b/testing/btest/Baseline/language.invalid_index/out index b8d99f7664..aa3784aa3e 100644 --- a/testing/btest/Baseline/language.invalid_index/out +++ b/testing/btest/Baseline/language.invalid_index/out @@ -1,5 +1,5 @@ -expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.invalid_index/invalid_index.zeek, line 11: no such index (foo[1]) -expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.invalid_index/invalid_index.zeek, line 17: no such index (foo2[1]) +expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.invalid_index/invalid_index.zeek, line 10: no such index (foo[1]) +expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.invalid_index/invalid_index.zeek, line 16: no such index (foo2[1]) foo[0], 42 foo2[0], 13 done diff --git a/testing/btest/Baseline/language.type-cast-error-dynamic/output b/testing/btest/Baseline/language.type-cast-error-dynamic/output index aaf367b3f1..dfac361f11 100644 --- a/testing/btest/Baseline/language.type-cast-error-dynamic/output +++ b/testing/btest/Baseline/language.type-cast-error-dynamic/output @@ -1,4 +1,4 @@ -expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.type-cast-error-dynamic/type-cast-error-dynamic.zeek, line 12: invalid cast of value with type 'count' to type 'string' (a as string) -expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.type-cast-error-dynamic/type-cast-error-dynamic.zeek, line 12: invalid cast of value with type 'record { a:addr; b:port; }' to type 'string' (a as string) -expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.type-cast-error-dynamic/type-cast-error-dynamic.zeek, line 12: invalid cast of value with type 'record { data:opaque of Broker::Data; }' to type 'string' (nil $data field) (a as string) +expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.type-cast-error-dynamic/type-cast-error-dynamic.zeek, line 11: invalid cast of value with type 'count' to type 'string' (a as string) +expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.type-cast-error-dynamic/type-cast-error-dynamic.zeek, line 11: invalid cast of value with type 'record { a:addr; b:port; }' to type 'string' (a as string) +expression error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.type-cast-error-dynamic/type-cast-error-dynamic.zeek, line 11: invalid cast of value with type 'record { data:opaque of Broker::Data; }' to type 'string' (nil $data field) (a as string) data is string, F diff --git a/testing/btest/Baseline/language.uninitialized-local2/out b/testing/btest/Baseline/language.uninitialized-local2/out index 36e9b6bffc..ba668f08ff 100644 --- a/testing/btest/Baseline/language.uninitialized-local2/out +++ b/testing/btest/Baseline/language.uninitialized-local2/out @@ -1,2 +1,2 @@ -expression error in /home/jon/projects/bro/bro/testing/btest/.tmp/language.uninitialized-local2/uninitialized-local2.zeek, line 20: value used but not set (var_b) +expression error in /home/jon/projects/bro/bro/testing/btest/.tmp/language.uninitialized-local2/uninitialized-local2.zeek, line 19: value used but not set (var_b) var_a is, baz diff --git a/testing/btest/Baseline/plugins.reporter-hook/output b/testing/btest/Baseline/plugins.reporter-hook/output index 99f0b789f9..36418d2405 100644 --- a/testing/btest/Baseline/plugins.reporter-hook/output +++ b/testing/btest/Baseline/plugins.reporter-hook/output @@ -1,10 +1,10 @@ - | Hook Some Info <...>/reporter-hook.zeek, line 17 - | Hook error An Error <...>/reporter-hook.zeek, line 19 - | Hook error An Error that does not show up in the log <...>/reporter-hook.zeek, line 20 - | Hook expression error field value missing (b$a) <...>/reporter-hook.zeek, line 24 - | Hook warning A warning <...>/reporter-hook.zeek, line 18 -<...>/reporter-hook.zeek, line 17: Some Info -error in <...>/reporter-hook.zeek, line 19: An Error -error in <...>/reporter-hook.zeek, line 20: An Error that does not show up in the log -expression error in <...>/reporter-hook.zeek, line 24: field value missing (b$a) -warning in <...>/reporter-hook.zeek, line 18: A warning + | Hook Some Info <...>/reporter-hook.zeek, line 16 + | Hook error An Error <...>/reporter-hook.zeek, line 18 + | Hook error An Error that does not show up in the log <...>/reporter-hook.zeek, line 19 + | Hook expression error field value missing (b$a) <...>/reporter-hook.zeek, line 23 + | Hook warning A warning <...>/reporter-hook.zeek, line 17 +<...>/reporter-hook.zeek, line 16: Some Info +error in <...>/reporter-hook.zeek, line 18: An Error +error in <...>/reporter-hook.zeek, line 19: An Error that does not show up in the log +expression error in <...>/reporter-hook.zeek, line 23: field value missing (b$a) +warning in <...>/reporter-hook.zeek, line 17: A warning diff --git a/testing/btest/Baseline/plugins.reporter-hook/reporter.log b/testing/btest/Baseline/plugins.reporter-hook/reporter.log index acd2200291..fc5a79bc86 100644 --- a/testing/btest/Baseline/plugins.reporter-hook/reporter.log +++ b/testing/btest/Baseline/plugins.reporter-hook/reporter.log @@ -6,8 +6,8 @@ #open 2017-07-26-17-58-52 #fields ts level message location #types time enum string string -0.000000 Reporter::INFO Some Info /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 17 -0.000000 Reporter::WARNING A warning /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 18 -0.000000 Reporter::ERROR An Error /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 19 -0.000000 Reporter::ERROR field value missing (b$a) /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 24 +0.000000 Reporter::INFO Some Info /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 16 +0.000000 Reporter::WARNING A warning /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 17 +0.000000 Reporter::ERROR An Error /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 18 +0.000000 Reporter::ERROR field value missing (b$a) /Users/johanna/corelight/bro/testing/btest/.tmp/plugins.reporter-hook/reporter-hook.zeek, line 23 #close 2017-07-26-17-58-52 diff --git a/testing/btest/Baseline/scripts.base.frameworks.reporter.disable-stderr/reporter.log b/testing/btest/Baseline/scripts.base.frameworks.reporter.disable-stderr/reporter.log index 823afde707..744f050046 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.reporter.disable-stderr/reporter.log +++ b/testing/btest/Baseline/scripts.base.frameworks.reporter.disable-stderr/reporter.log @@ -6,5 +6,5 @@ #open 2012-08-10-20-09-16 #fields ts level message location #types time enum string string -0.000000 Reporter::ERROR no such index (test[3]) /da/home/robin/bro/master/testing/btest/.tmp/scripts.base.frameworks.reporter.disable-stderr/disable-stderr.zeek, line 13 +0.000000 Reporter::ERROR no such index (test[3]) /da/home/robin/bro/master/testing/btest/.tmp/scripts.base.frameworks.reporter.disable-stderr/disable-stderr.zeek, line 12 #close 2012-08-10-20-09-16 diff --git a/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/.stderr b/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/.stderr index bce0629fd3..b01cfa1e84 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/.stderr +++ b/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/.stderr @@ -1 +1 @@ -expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/scripts.base.frameworks.reporter.stderr/stderr.zeek, line 10: no such index (test[3]) +expression error in /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/scripts.base.frameworks.reporter.stderr/stderr.zeek, line 9: no such index (test[3]) diff --git a/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/reporter.log b/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/reporter.log index 1c45222ee7..705bb357fa 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/reporter.log +++ b/testing/btest/Baseline/scripts.base.frameworks.reporter.stderr/reporter.log @@ -6,5 +6,5 @@ #open 2013-01-18-18-29-30 #fields ts level message location #types time enum string string -0.000000 Reporter::ERROR no such index (test[3]) /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/scripts.base.frameworks.reporter.stderr/stderr.zeek, line 10 +0.000000 Reporter::ERROR no such index (test[3]) /Users/jsiwek/Projects/bro/bro/testing/btest/.tmp/scripts.base.frameworks.reporter.stderr/stderr.zeek, line 9 #close 2013-01-18-18-29-30 diff --git a/testing/btest/core/div-by-zero.zeek b/testing/btest/core/div-by-zero.zeek index 56feb278d6..d1c95db88c 100644 --- a/testing/btest/core/div-by-zero.zeek +++ b/testing/btest/core/div-by-zero.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1 +# @TEST-EXEC: zeek -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out event div_int(a: int, b: int) diff --git a/testing/btest/core/expr-exception.zeek b/testing/btest/core/expr-exception.zeek index 27fcbad5a2..79f460b1e4 100644 --- a/testing/btest/core/expr-exception.zeek +++ b/testing/btest/core/expr-exception.zeek @@ -1,8 +1,7 @@ # Expressions in an event handler that raise interpreter exceptions # shouldn't abort Zeek entirely, but just return from the function body. # -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -r $TRACES/wikipedia.trace %INPUT >output +# @TEST-EXEC: zeek -r $TRACES/wikipedia.trace %INPUT >output # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log # @TEST-EXEC: btest-diff output diff --git a/testing/btest/core/reporter-error-in-handler.zeek b/testing/btest/core/reporter-error-in-handler.zeek index 2de37a225c..398c275c32 100644 --- a/testing/btest/core/reporter-error-in-handler.zeek +++ b/testing/btest/core/reporter-error-in-handler.zeek @@ -2,8 +2,7 @@ # This test procudes a recursive error: the error handler is itself broken. Rather # than looping indefinitly, the error inside the handler should reported to stderr. # -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >output 2>&1 +# @TEST-EXEC: zeek -b %INPUT >output 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output global a: table[count] of count; diff --git a/testing/btest/core/when-interpreter-exceptions.zeek b/testing/btest/core/when-interpreter-exceptions.zeek index ba6c6a1aa6..d9d37e7318 100644 --- a/testing/btest/core/when-interpreter-exceptions.zeek +++ b/testing/btest/core/when-interpreter-exceptions.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" btest-bg-run zeek "zeek -b %INPUT >output 2>&1" +# @TEST-EXEC: btest-bg-run zeek "zeek -b %INPUT >output 2>&1" # @TEST-EXEC: btest-bg-wait 30 # @TEST-EXEC: TEST_DIFF_CANONIFIER="grep -v 'already queued for removal' | $SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps | $SCRIPTS/diff-sort" btest-diff zeek/output diff --git a/testing/btest/language/common-mistakes.zeek b/testing/btest/language/common-mistakes.zeek index 694dbe3ad2..b829b5315b 100644 --- a/testing/btest/language/common-mistakes.zeek +++ b/testing/btest/language/common-mistakes.zeek @@ -2,14 +2,13 @@ # handled internally by way of throwing an exception to unwind out # of the current event handler body. -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b 1.zeek >1.out 2>&1 +# @TEST-EXEC: zeek -b 1.zeek >1.out 2>&1 # @TEST-EXEC: btest-diff 1.out -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b 2.zeek >2.out 2>&1 +# @TEST-EXEC: zeek -b 2.zeek >2.out 2>&1 # @TEST-EXEC: btest-diff 2.out -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b 3.zeek >3.out 2>&1 +# @TEST-EXEC: zeek -b 3.zeek >3.out 2>&1 # @TEST-EXEC: btest-diff 3.out @TEST-START-FILE 1.zeek diff --git a/testing/btest/language/expire-expr-error.zeek b/testing/btest/language/expire-expr-error.zeek index ac47d37d41..5e6f0b4e6f 100644 --- a/testing/btest/language/expire-expr-error.zeek +++ b/testing/btest/language/expire-expr-error.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT +# @TEST-EXEC: zeek -b %INPUT # @TEST-EXEC: cp .stderr output # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output diff --git a/testing/btest/language/expire-func-undef.zeek b/testing/btest/language/expire-func-undef.zeek index 9828fc886c..9198edc6c4 100644 --- a/testing/btest/language/expire-func-undef.zeek +++ b/testing/btest/language/expire-func-undef.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -r $TRACES/rotation.trace -b %INPUT >output 2>&1 +# @TEST-EXEC: zeek -r $TRACES/rotation.trace -b %INPUT >output 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output module segfault; diff --git a/testing/btest/language/index-assignment-invalid.zeek b/testing/btest/language/index-assignment-invalid.zeek index 947168f64c..a42c81320b 100644 --- a/testing/btest/language/index-assignment-invalid.zeek +++ b/testing/btest/language/index-assignment-invalid.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >output 2>&1 +# @TEST-EXEC: zeek -b %INPUT >output 2>&1 # @TEST-EXEC: grep "error" output >output2 # @TEST-EXEC: for i in 1 2 3 4 5; do cat output2 | cut -d'|' -f$i >>out; done # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out diff --git a/testing/btest/language/invalid_index.zeek b/testing/btest/language/invalid_index.zeek index a1cbe4c868..80f294c68b 100644 --- a/testing/btest/language/invalid_index.zeek +++ b/testing/btest/language/invalid_index.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1 +# @TEST-EXEC: zeek -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out global foo: vector of count = { 42 }; diff --git a/testing/btest/language/subnet-errors.zeek b/testing/btest/language/subnet-errors.zeek index d0c9fd6aa4..875817c433 100644 --- a/testing/btest/language/subnet-errors.zeek +++ b/testing/btest/language/subnet-errors.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1 +# @TEST-EXEC: zeek -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out event zeek_init() diff --git a/testing/btest/language/type-cast-error-dynamic.zeek b/testing/btest/language/type-cast-error-dynamic.zeek index 443cd1acc8..1edf9e3d2a 100644 --- a/testing/btest/language/type-cast-error-dynamic.zeek +++ b/testing/btest/language/type-cast-error-dynamic.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >output 2>&1 +# @TEST-EXEC: zeek -b %INPUT >output 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output type X: record { diff --git a/testing/btest/language/type-coerce-numerics.zeek b/testing/btest/language/type-coerce-numerics.zeek index 2c1a2eb241..996326361b 100644 --- a/testing/btest/language/type-coerce-numerics.zeek +++ b/testing/btest/language/type-coerce-numerics.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b first_set.zeek >first_set.out 2>&1 +# @TEST-EXEC: zeek -b first_set.zeek >first_set.out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff first_set.out # @TEST-EXEC-FAIL: zeek -b double_convert_failure1.zeek >double_convert_failure1.out 2>&1 diff --git a/testing/btest/language/uninitialized-local2.zeek b/testing/btest/language/uninitialized-local2.zeek index d5f8eb7cec..4b8f0c8275 100644 --- a/testing/btest/language/uninitialized-local2.zeek +++ b/testing/btest/language/uninitialized-local2.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek -b %INPUT >out 2>&1 +# @TEST-EXEC: zeek -b %INPUT >out 2>&1 # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out event test() diff --git a/testing/btest/plugins/reporter-hook.zeek b/testing/btest/plugins/reporter-hook.zeek index 6619d98224..01229b3d49 100644 --- a/testing/btest/plugins/reporter-hook.zeek +++ b/testing/btest/plugins/reporter-hook.zeek @@ -1,8 +1,7 @@ # @TEST-EXEC: ${DIST}/aux/zeek-aux/plugin-support/init-plugin -u . Reporter Hook # @TEST-EXEC: cp -r %DIR/reporter-hook-plugin/* . # @TEST-EXEC: ./configure --zeek-dist=${DIST} && make -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" ZEEK_PLUGIN_ACTIVATE="Reporter::Hook" ZEEK_PLUGIN_PATH=`pwd` zeek -b %INPUT 2>&1 | $SCRIPTS/diff-remove-abspath | sort | uniq >output +# @TEST-EXEC: ZEEK_PLUGIN_ACTIVATE="Reporter::Hook" ZEEK_PLUGIN_PATH=`pwd` zeek -b %INPUT 2>&1 | $SCRIPTS/diff-remove-abspath | sort | uniq >output # @TEST-EXEC: btest-diff output # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log diff --git a/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek b/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek index 803308dbb6..1395f20807 100644 --- a/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek +++ b/testing/btest/scripts/base/frameworks/reporter/disable-stderr.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek %INPUT +# @TEST-EXEC: zeek %INPUT # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log diff --git a/testing/btest/scripts/base/frameworks/reporter/stderr.zeek b/testing/btest/scripts/base/frameworks/reporter/stderr.zeek index c1af87d9ad..5c3793b435 100644 --- a/testing/btest/scripts/base/frameworks/reporter/stderr.zeek +++ b/testing/btest/scripts/base/frameworks/reporter/stderr.zeek @@ -1,5 +1,4 @@ -# TODO: interpreter exceptions currently may cause memory leaks, so disable leak checks -# @TEST-EXEC: ASAN_OPTIONS="$ASAN_OPTIONS,detect_leaks=0" zeek %INPUT +# @TEST-EXEC: zeek %INPUT # @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr # @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff reporter.log From 7a4ce9fb511bc99b97678280cf1f1373a758b43e Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Mon, 23 Mar 2020 11:41:37 -0700 Subject: [PATCH 02/16] Fix memory leak when runtime error occurs in a Zeek for-loop --- src/Stmt.cc | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/Stmt.cc b/src/Stmt.cc index 4c6fc82520..7f884fe3e4 100644 --- a/src/Stmt.cc +++ b/src/Stmt.cc @@ -1198,7 +1198,7 @@ IntrusivePtr ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const IterCookie* c = loop_vals->InitForIteration(); while ( (current_tev = loop_vals->NextEntry(k, c)) ) { - ListVal* ind_lv = tv->RecoverIndex(k); + IntrusivePtr ind_lv{AdoptRef{}, tv->RecoverIndex(k)}; delete k; if ( value_var ) @@ -1206,10 +1206,18 @@ IntrusivePtr ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const for ( int i = 0; i < ind_lv->Length(); i++ ) f->SetElement((*loop_vars)[i], ind_lv->Index(i)->Ref()); - Unref(ind_lv); flow = FLOW_NEXT; - ret = body->Exec(f, flow); + + try + { + ret = body->Exec(f, flow); + } + catch ( InterpreterException& ) + { + loop_vals->StopIteration(c); + throw; + } if ( flow == FLOW_BREAK || flow == FLOW_RETURN ) { From 0b5a18495d377098d376095baceb3182da01f08a Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Mon, 23 Mar 2020 12:07:11 -0700 Subject: [PATCH 03/16] Use IntrusivePtr in TableVal::CallExpireFunc --- src/Val.cc | 23 +++++------------------ src/Val.h | 3 +-- 2 files changed, 6 insertions(+), 20 deletions(-) diff --git a/src/Val.cc b/src/Val.cc index 38c952a294..f6c0e2ec18 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -2348,7 +2348,7 @@ void TableVal::DoExpire(double t) if ( expire_func ) { idx = RecoverIndex(k); - double secs = CallExpireFunc(idx->Ref()); + double secs = CallExpireFunc({NewRef{}, idx}); // It's possible that the user-provided // function modified or deleted the table @@ -2439,13 +2439,10 @@ double TableVal::GetExpireTime() return -1; } -double TableVal::CallExpireFunc(Val* idx) +double TableVal::CallExpireFunc(IntrusivePtr idx) { if ( ! expire_func ) - { - Unref(idx); return 0; - } double secs = 0; @@ -2454,16 +2451,12 @@ double TableVal::CallExpireFunc(Val* idx) auto vf = expire_func->Eval(nullptr); if ( ! vf ) - { // Will have been reported already. - Unref(idx); return 0; - } if ( vf->Type()->Tag() != TYPE_FUNC ) { vf->Error("not a function"); - Unref(idx); return 0; } @@ -2481,25 +2474,19 @@ double TableVal::CallExpireFunc(Val* idx) { for ( const auto& v : *idx->AsListVal()->Vals() ) vl.append(v->Ref()); - - Unref(idx); } else { ListVal* idx_list = idx->AsListVal(); // Flatten if only one element if ( idx_list->Length() == 1 ) - { - Val* old = idx; - idx = idx_list->Index(0)->Ref(); - Unref(old); - } + idx = {NewRef{}, idx_list->Index(0)}; - vl.append(idx); + vl.append(idx.release()); } } else - vl.append(idx); + vl.append(idx.release()); auto result = f->Call(&vl); diff --git a/src/Val.h b/src/Val.h index bc2f440eac..7b8aad5e26 100644 --- a/src/Val.h +++ b/src/Val.h @@ -851,8 +851,7 @@ protected: double GetExpireTime(); // Calls &expire_func and returns its return interval; - // takes ownership of the reference. - double CallExpireFunc(Val *idx); + double CallExpireFunc(IntrusivePtr idx); // Enum for the different kinds of changes an &on_change handler can see enum OnChangeType { ELEMENT_NEW, ELEMENT_CHANGED, ELEMENT_REMOVED, ELEMENT_EXPIRED }; From b045ce4bb38b9bc0df9332bebaaaf6ccdb523051 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Mon, 23 Mar 2020 12:48:21 -0700 Subject: [PATCH 04/16] Change TableVal::RecoverIndex() to return IntrusivePtr --- src/CompHash.cc | 11 +----- src/Reporter.cc | 1 - src/Stmt.cc | 2 +- src/Val.cc | 74 ++++++++++++++---------------------- src/Val.h | 4 +- src/broker/Data.cc | 23 ++--------- src/broker/messaging.bif | 1 - src/input/Manager.cc | 13 +++---- src/logging/Manager.cc | 3 +- src/reporter.bif | 1 - src/supervisor/Supervisor.cc | 2 +- 11 files changed, 45 insertions(+), 90 deletions(-) diff --git a/src/CompHash.cc b/src/CompHash.cc index 7406410b7d..935d0ade93 100644 --- a/src/CompHash.cc +++ b/src/CompHash.cc @@ -207,7 +207,7 @@ char* CompositeHash::SingleValHash(int type_check, char* kp0, auto tbl = tv->AsTable(); auto it = tbl->InitForIteration(); - ListVal* lv = new ListVal(TYPE_ANY); + auto lv = make_intrusive(TYPE_ANY); struct HashKeyComparer { bool operator()(const HashKey* a, const HashKey* b) const @@ -229,7 +229,7 @@ char* CompositeHash::SingleValHash(int type_check, char* kp0, while ( tbl->NextEntry(k, it) ) { hashkeys[k] = idx++; - lv->Append(tv->RecoverIndex(k)); + lv->Append(tv->RecoverIndex(k).release()); } for ( auto& kv : hashkeys ) @@ -242,10 +242,7 @@ char* CompositeHash::SingleValHash(int type_check, char* kp0, if ( ! (kp1 = SingleValHash(type_check, kp1, key->Type(), key, false)) ) - { - Unref(lv); return 0; - } if ( ! v->Type()->IsSet() ) { @@ -253,14 +250,10 @@ char* CompositeHash::SingleValHash(int type_check, char* kp0, if ( ! (kp1 = SingleValHash(type_check, kp1, val->Type(), val.get(), false)) ) - { - Unref(lv); return 0; - } } } - Unref(lv); } break; diff --git a/src/Reporter.cc b/src/Reporter.cc index 978a0a8a39..ddd141ebd4 100644 --- a/src/Reporter.cc +++ b/src/Reporter.cc @@ -80,7 +80,6 @@ void Reporter::InitOptions() auto index = wl_val->RecoverIndex(k); string key = index->Index(0)->AsString()->CheckString(); weird_sampling_whitelist.emplace(move(key)); - Unref(index); delete k; } } diff --git a/src/Stmt.cc b/src/Stmt.cc index 7f884fe3e4..172f54014b 100644 --- a/src/Stmt.cc +++ b/src/Stmt.cc @@ -1198,7 +1198,7 @@ IntrusivePtr ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const IterCookie* c = loop_vals->InitForIteration(); while ( (current_tev = loop_vals->NextEntry(k, c)) ) { - IntrusivePtr ind_lv{AdoptRef{}, tv->RecoverIndex(k)}; + auto ind_lv = tv->RecoverIndex(k); delete k; if ( value_var ) diff --git a/src/Val.cc b/src/Val.cc index f6c0e2ec18..b72d9d7e95 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -532,12 +532,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* { auto lv = tval->RecoverIndex(k); delete k; - - Val* entry_key; - if ( lv->Length() == 1 ) - entry_key = lv->Index(0)->Ref(); - else - entry_key = lv->Ref(); + Val* entry_key = lv->Length() == 1 ? lv->Index(0) : lv.get(); if ( tval->Type()->IsSet() ) BuildJSON(writer, entry_key, only_loggable, re); @@ -556,9 +551,6 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val* BuildJSON(writer, entry->Value(), only_loggable, re, key_str); } - - Unref(entry_key); - Unref(lv); } if ( tval->Type()->IsSet() ) @@ -1537,9 +1529,8 @@ int TableVal::Assign(Val* index, HashKey* k, IntrusivePtr new_val) { if ( ! index ) { - Val* v = RecoverIndex(&k_copy); - subnets->Insert(v, new_entry_val); - Unref(v); + auto v = RecoverIndex(&k_copy); + subnets->Insert(v.get(), new_entry_val); } else subnets->Insert(index, new_entry_val); @@ -1553,10 +1544,10 @@ int TableVal::Assign(Val* index, HashKey* k, IntrusivePtr new_val) if ( change_func ) { - Val* change_index = index ? index->Ref() : RecoverIndex(&k_copy); + auto change_index = index ? IntrusivePtr{NewRef{}, index} + : RecoverIndex(&k_copy); Val* v = old_entry_val ? old_entry_val->Value() : new_val.get(); - CallChangeFunc(change_index, v, old_entry_val ? ELEMENT_CHANGED : ELEMENT_NEW); - Unref(change_index); + CallChangeFunc(change_index.get(), v, old_entry_val ? ELEMENT_CHANGED : ELEMENT_NEW); } delete old_entry_val; @@ -1991,9 +1982,9 @@ bool TableVal::UpdateTimestamp(Val* index) return true; } -ListVal* TableVal::RecoverIndex(const HashKey* k) const +IntrusivePtr TableVal::RecoverIndex(const HashKey* k) const { - return table_hash->RecoverVals(k).release(); + return table_hash->RecoverVals(k); } void TableVal::CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe) @@ -2344,11 +2335,12 @@ void TableVal::DoExpire(double t) else if ( v->ExpireAccessTime() + timeout < t ) { - Val* idx = nullptr; + IntrusivePtr idx = nullptr; + if ( expire_func ) { idx = RecoverIndex(k); - double secs = CallExpireFunc({NewRef{}, idx}); + double secs = CallExpireFunc(idx); // It's possible that the user-provided // function modified or deleted the table @@ -2359,7 +2351,6 @@ void TableVal::DoExpire(double t) if ( ! v ) { // user-provided function deleted it v = v_saved; - Unref(idx); delete k; continue; } @@ -2369,7 +2360,6 @@ void TableVal::DoExpire(double t) // User doesn't want us to expire // this now. v->SetExpireAccess(network_time - timeout + secs); - Unref(idx); delete k; continue; } @@ -2380,7 +2370,7 @@ void TableVal::DoExpire(double t) { if ( ! idx ) idx = RecoverIndex(k); - if ( ! subnets->Remove(idx) ) + if ( ! subnets->Remove(idx.get()) ) reporter->InternalWarning("index not in prefix table"); } @@ -2389,9 +2379,9 @@ void TableVal::DoExpire(double t) { if ( ! idx ) idx = RecoverIndex(k); - CallChangeFunc(idx, v->Value(), ELEMENT_EXPIRED); + CallChangeFunc(idx.get(), v->Value(), ELEMENT_EXPIRED); } - Unref(idx); + delete v; modified = true; } @@ -2439,7 +2429,7 @@ double TableVal::GetExpireTime() return -1; } -double TableVal::CallExpireFunc(IntrusivePtr idx) +double TableVal::CallExpireFunc(IntrusivePtr idx) { if ( ! expire_func ) return 0; @@ -2468,25 +2458,20 @@ double TableVal::CallExpireFunc(IntrusivePtr idx) // backwards compatibility with idx: any idiom bool any_idiom = func_args->length() == 2 && func_args->back()->Tag() == TYPE_ANY; - if ( idx->Type()->Tag() == TYPE_LIST ) + if ( ! any_idiom ) { - if ( ! any_idiom ) - { - for ( const auto& v : *idx->AsListVal()->Vals() ) - vl.append(v->Ref()); - } - else - { - ListVal* idx_list = idx->AsListVal(); - // Flatten if only one element - if ( idx_list->Length() == 1 ) - idx = {NewRef{}, idx_list->Index(0)}; - - vl.append(idx.release()); - } + for ( const auto& v : *idx->AsListVal()->Vals() ) + vl.append(v->Ref()); } else - vl.append(idx.release()); + { + ListVal* idx_list = idx->AsListVal(); + // Flatten if only one element + if ( idx_list->Length() == 1 ) + vl.append(idx_list->Index(0)->Ref()); + else + vl.append(idx.release()); + } auto result = f->Call(&vl); @@ -2518,9 +2503,8 @@ IntrusivePtr TableVal::DoClone(CloneState* state) if ( subnets ) { - Val* idx = RecoverIndex(key); - tv->subnets->Insert(idx, nval); - Unref(idx); + auto idx = RecoverIndex(key); + tv->subnets->Insert(idx.get(), nval); } delete key; @@ -2609,7 +2593,7 @@ TableVal::ParseTimeTableState TableVal::DumpTableState() while ( (val = tbl->NextEntry(key, cookie)) ) { - rval.emplace_back(IntrusivePtr{AdoptRef{}, RecoverIndex(key)}, + rval.emplace_back(RecoverIndex(key), IntrusivePtr{NewRef{}, val->Value()}); delete key; diff --git a/src/Val.h b/src/Val.h index 7b8aad5e26..7d944e9760 100644 --- a/src/Val.h +++ b/src/Val.h @@ -766,7 +766,7 @@ public: bool UpdateTimestamp(Val* index); // Returns the index corresponding to the given HashKey. - ListVal* RecoverIndex(const HashKey* k) const; + IntrusivePtr RecoverIndex(const HashKey* k) const; // Returns the element if it was in the table, false otherwise. IntrusivePtr Delete(const Val* index); @@ -851,7 +851,7 @@ protected: double GetExpireTime(); // Calls &expire_func and returns its return interval; - double CallExpireFunc(IntrusivePtr idx); + double CallExpireFunc(IntrusivePtr idx); // Enum for the different kinds of changes an &on_change handler can see enum OnChangeType { ELEMENT_NEW, ELEMENT_CHANGED, ELEMENT_REMOVED, ELEMENT_EXPIRED }; diff --git a/src/broker/Data.cc b/src/broker/Data.cc index f8de5c4415..7459c8f3ac 100644 --- a/src/broker/Data.cc +++ b/src/broker/Data.cc @@ -898,29 +898,14 @@ broker::expected bro_broker::val_to_data(const Val* v) else rval = broker::table(); - struct iter_guard { - iter_guard(HashKey* arg_k, ListVal* arg_lv) - : k(arg_k), lv(arg_lv) - {} - - ~iter_guard() - { - delete k; - Unref(lv); - } - - HashKey* k; - ListVal* lv; - }; - - HashKey* k; + HashKey* hk; TableEntryVal* entry; auto c = table->InitForIteration(); - while ( (entry = table->NextEntry(k, c)) ) + while ( (entry = table->NextEntry(hk, c)) ) { - auto vl = table_val->RecoverIndex(k); - iter_guard ig(k, vl); + auto vl = table_val->RecoverIndex(hk); + delete hk; broker::vector composite_key; composite_key.reserve(vl->Length()); diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif index 1e1ef1eabd..95fe80c0a1 100644 --- a/src/broker/messaging.bif +++ b/src/broker/messaging.bif @@ -40,7 +40,6 @@ std::set val_to_topic_set(Val* val) { auto index = val->AsTableVal()->RecoverIndex(k); rval.emplace(index->Index(0)->AsString()->CheckString()); - Unref(index); delete k; } } diff --git a/src/input/Manager.cc b/src/input/Manager.cc index 2f21725956..5408a51d85 100644 --- a/src/input/Manager.cc +++ b/src/input/Manager.cc @@ -283,11 +283,10 @@ bool Manager::CreateStream(Stream* info, RecordVal* description) TableEntryVal* v; while ( (v = info->config->AsTable()->NextEntry(k, c)) ) { - ListVal* index = info->config->RecoverIndex(k); + auto index = info->config->RecoverIndex(k); string key = index->Index(0)->AsString()->CheckString(); string value = v->Value()->AsString()->CheckString(); rinfo.config.insert(std::make_pair(copy_string(key.c_str()), copy_string(value.c_str()))); - Unref(index); delete k; } } @@ -1335,7 +1334,6 @@ void Manager::EndCurrentSend(ReaderFrontend* reader) while ( ( ih = stream->lastDict->NextEntry(lastDictIdxKey, c) ) ) { - ListVal * idx = 0; IntrusivePtr val; Val* predidx = 0; @@ -1344,12 +1342,11 @@ void Manager::EndCurrentSend(ReaderFrontend* reader) if ( stream->pred || stream->event ) { - idx = stream->tab->RecoverIndex(ih->idxkey); - assert(idx != 0); - val = stream->tab->Lookup(idx); + auto idx = stream->tab->RecoverIndex(ih->idxkey); + assert(idx != nullptr); + val = stream->tab->Lookup(idx.get()); assert(val != 0); - predidx = ListValToRecordVal(idx, stream->itype, &startpos); - Unref(idx); + predidx = ListValToRecordVal(idx.get(), stream->itype, &startpos); ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release(); } diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc index cdcfda73f9..87eac0e066 100644 --- a/src/logging/Manager.cc +++ b/src/logging/Manager.cc @@ -868,11 +868,10 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) TableEntryVal* v; while ( (v = filter->config->AsTable()->NextEntry(k, c)) ) { - ListVal* index = filter->config->RecoverIndex(k); + auto index = filter->config->RecoverIndex(k); string key = index->Index(0)->AsString()->CheckString(); string value = v->Value()->AsString()->CheckString(); info->config.insert(std::make_pair(copy_string(key.c_str()), copy_string(value.c_str()))); - Unref(index); delete k; } diff --git a/src/reporter.bif b/src/reporter.bif index 00635947fb..426ba99f93 100644 --- a/src/reporter.bif +++ b/src/reporter.bif @@ -182,7 +182,6 @@ function Reporter::set_weird_sampling_whitelist%(weird_sampling_whitelist: strin auto index = wl_val->RecoverIndex(k); string key = index->Index(0)->AsString()->CheckString(); whitelist_set.emplace(move(key)); - Unref(index); delete k; } reporter->SetWeirdSamplingWhitelist(whitelist_set); diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc index 3f511816c4..a8af880138 100644 --- a/src/supervisor/Supervisor.cc +++ b/src/supervisor/Supervisor.cc @@ -1024,7 +1024,7 @@ Supervisor::NodeConfig Supervisor::NodeConfig::FromRecord(const RecordVal* node) while ( (v = cluster_table->NextEntry(k, c)) ) { - IntrusivePtr key{AdoptRef{}, cluster_table_val->RecoverIndex(k)}; + auto key = cluster_table_val->RecoverIndex(k); delete k; auto name = key->Index(0)->AsStringVal()->ToStdString(); auto rv = v->Value()->AsRecordVal(); From 94656c2308f6d0fb2316e8cd38821511ce949620 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Mon, 23 Mar 2020 21:50:00 -0700 Subject: [PATCH 05/16] Fix memory leak in Zeek when-statement bodies with runtime errors --- src/Trigger.cc | 19 +++++++++++++++---- src/Trigger.h | 6 ++++-- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/src/Trigger.cc b/src/Trigger.cc index b962e449c1..ae2127f791 100644 --- a/src/Trigger.cc +++ b/src/Trigger.cc @@ -321,9 +321,14 @@ bool Trigger::Eval() delete [] pname; #endif - trigger->Cache(frame->GetCall(), v.get()); + auto queued = trigger->Cache(frame->GetCall(), v.get()); trigger->Release(); frame->ClearTrigger(); + + if ( ! queued && trigger->TimeoutValue() < 0 ) + // Usually the parent-trigger would get unref'd either by + // its Eval() or its eventual Timeout(), but has neither + Unref(trigger); } Unref(f); @@ -368,9 +373,14 @@ void Trigger::Timeout() DBG_LOG(DBG_NOTIFIERS, "%s: trigger has parent %s, caching timeout result", Name(), pname); delete [] pname; #endif - trigger->Cache(frame->GetCall(), v.get()); + auto queued = trigger->Cache(frame->GetCall(), v.get()); trigger->Release(); frame->ClearTrigger(); + + if ( ! queued && trigger->TimeoutValue() < 0 ) + // Usually the parent-trigger would get unref'd either by + // its Eval() or its eventual Timeout(), but has neither + Unref(trigger); } } @@ -429,10 +439,10 @@ void Trigger::Attach(Trigger *trigger) Hold(); } -void Trigger::Cache(const CallExpr* expr, Val* v) +bool Trigger::Cache(const CallExpr* expr, Val* v) { if ( disabled || ! v ) - return; + return false; ValCache::iterator i = cache.find(expr); @@ -448,6 +458,7 @@ void Trigger::Cache(const CallExpr* expr, Val* v) Ref(v); trigger_mgr->Queue(this); + return true; } diff --git a/src/Trigger.h b/src/Trigger.h index 685f8ec129..5d91b17aa0 100644 --- a/src/Trigger.h +++ b/src/Trigger.h @@ -59,8 +59,10 @@ public: // to the given trigger. Note, automatically calls Hold(). void Attach(Trigger* trigger); - // Cache for return values of delayed function calls. - void Cache(const CallExpr* expr, Val* val); + // Cache for return values of delayed function calls. Returns whether + // the trigger is queued for later evaluation -- it may not be queued + // if the Val is null or it's disabled. + bool Cache(const CallExpr* expr, Val* val); Val* Lookup(const CallExpr*); // Disable this trigger completely. Needed because Unref'ing the trigger From 4e1ac4e1247d23d6050fd4eb7719ded51dd54235 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Fri, 20 Mar 2020 18:03:04 -0700 Subject: [PATCH 06/16] Use vector> for Func::Call and Event queuing args This change may break BIFs that use @ARGS@, @ARG@, or @ARGC@ since their types have changed. --- NEWS | 6 ++- aux/bifcl | 2 +- src/CMakeLists.txt | 1 + src/Event.cc | 50 +++++++++++++++------ src/Event.h | 55 ++++++++++++++--------- src/EventHandler.cc | 29 +++++------- src/EventHandler.h | 5 ++- src/Expr.cc | 51 +++++++-------------- src/Expr.h | 15 ++++--- src/File.cc | 2 +- src/Frame.cc | 2 +- src/Frame.h | 7 +-- src/Func.cc | 84 ++++++++++++++++------------------ src/Func.h | 22 +++++---- src/OpaqueVal.cc | 97 +++++++++------------------------------- src/OpaqueVal.h | 41 ++++++++++++++--- src/Stats.cc | 4 +- src/Stmt.cc | 40 +++++++---------- src/Stmt.h | 7 +-- src/Val.cc | 18 ++++++++ src/Val.h | 2 + src/ZeekArgs.cc | 15 +++++++ src/ZeekArgs.h | 27 +++++++++++ src/broker/messaging.bif | 32 +++++++------ src/main.cc | 2 +- src/plugin/Manager.cc | 21 +++++++-- src/plugin/Manager.h | 4 +- src/plugin/Plugin.h | 1 + src/zeek.bif | 30 ++++++------- 29 files changed, 367 insertions(+), 305 deletions(-) create mode 100644 src/ZeekArgs.cc create mode 100644 src/ZeekArgs.h diff --git a/NEWS b/NEWS index 16389dd9b7..a1ff0dca04 100644 --- a/NEWS +++ b/NEWS @@ -27,10 +27,14 @@ Changed Functionality --------------------- - Several C++ functions have been changed to pass smart pointers - (`class IntrusivePtr<>`) instead of raw pointers. This makes the + (``class IntrusivePtr<>``) instead of raw pointers. This makes the code more robust. External plugins may need to be updated to this API change. +- BIFs that use @ARG@, @ARGS@, or @ARGC@ may break since their type has + changed: BIF arguments are now passed as a ``std::vector>`` + rather than a ``val_list`` (i.e. ``List``). + Removed Functionality --------------------- diff --git a/aux/bifcl b/aux/bifcl index b3a5d01c04..75f645ac9b 160000 --- a/aux/bifcl +++ b/aux/bifcl @@ -1 +1 @@ -Subproject commit b3a5d01c041b78a9e50544ac891c5e0d35c116f7 +Subproject commit 75f645ac9bdfd141f549b7e1a197459f2ad518be diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index f1b4e19b9f..a423f69ed5 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -282,6 +282,7 @@ set(MAIN_SRCS Val.cc Var.cc WeirdState.cc + ZeekArgs.cc bsd-getopt-long.c bro_inet_ntop.c cq.c diff --git a/src/Event.cc b/src/Event.cc index 6c7db7faaa..f3665cf54d 100644 --- a/src/Event.cc +++ b/src/Event.cc @@ -18,7 +18,7 @@ EventMgr mgr; uint64_t num_events_queued = 0; uint64_t num_events_dispatched = 0; -Event::Event(EventHandlerPtr arg_handler, val_list arg_args, +Event::Event(EventHandlerPtr arg_handler, zeek::Args arg_args, SourceID arg_src, analyzer::ID arg_aid, TimerMgr* arg_mgr, BroObj* arg_obj) : handler(arg_handler), @@ -33,14 +33,6 @@ Event::Event(EventHandlerPtr arg_handler, val_list arg_args, Ref(obj); } -Event::Event(EventHandlerPtr arg_handler, val_list* arg_args, - SourceID arg_src, analyzer::ID arg_aid, TimerMgr* arg_mgr, - BroObj* arg_obj) - : Event(arg_handler, std::move(*arg_args), arg_src, arg_aid, arg_mgr, arg_obj) - { - delete arg_args; - } - void Event::Describe(ODesc* d) const { if ( d->IsReadable() ) @@ -53,7 +45,7 @@ void Event::Describe(ODesc* d) const if ( ! d->IsBinary() ) d->Add("("); - describe_vals(&args, d); + describe_vals(args, d); if ( ! d->IsBinary() ) d->Add("("); } @@ -68,7 +60,7 @@ void Event::Dispatch(bool no_remote) try { - handler->Call(&args, no_remote); + handler->Call(args, no_remote); } catch ( InterpreterException& e ) @@ -106,12 +98,19 @@ EventMgr::~EventMgr() Unref(src_val); } +void EventMgr::QueueEventFast(const EventHandlerPtr &h, val_list vl, + SourceID src, analyzer::ID aid, TimerMgr* mgr, + BroObj* obj) + { + QueueEvent(new Event(h, zeek::val_list_to_args(&vl), src, aid, mgr, obj)); + } + void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list vl, - SourceID src, analyzer::ID aid, - TimerMgr* mgr, BroObj* obj) + SourceID src, analyzer::ID aid, + TimerMgr* mgr, BroObj* obj) { if ( h ) - QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj)); + QueueEvent(new Event(h, zeek::val_list_to_args(&vl), src, aid, mgr, obj)); else { for ( const auto& v : vl ) @@ -119,6 +118,29 @@ void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list vl, } } +void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list* vl, + SourceID src, analyzer::ID aid, + TimerMgr* mgr, BroObj* obj) + { + QueueEvent(h, std::move(*vl), src, aid, mgr, obj); + delete vl; + } + +void EventMgr::QueueCheckedEvent(const EventHandlerPtr& h, zeek::Args vl, + SourceID src, analyzer::ID aid, + TimerMgr* mgr, BroObj* obj) + { + QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj)); + } + +void EventMgr::QueueUncheckedEvent(const EventHandlerPtr& h, zeek::Args vl, + SourceID src, analyzer::ID aid, + TimerMgr* mgr, BroObj* obj) + { + if ( h ) + QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj)); + } + void EventMgr::QueueEvent(Event* event) { bool done = PLUGIN_HOOK_WITH_RESULT(HOOK_QUEUE_EVENT, HookQueueEvent(event), false); diff --git a/src/Event.h b/src/Event.h index ce15cc5f52..46d166c1a3 100644 --- a/src/Event.h +++ b/src/Event.h @@ -6,20 +6,15 @@ #include "analyzer/Analyzer.h" #include "iosource/IOSource.h" #include "Flare.h" +#include "ZeekArgs.h" class EventMgr; -// We don't Unref() the individual arguments by using delete_vals() -// in a dtor because Func::Call already does that. class Event : public BroObj { public: - Event(EventHandlerPtr handler, val_list args, - SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = 0, BroObj* obj = 0); - - Event(EventHandlerPtr handler, val_list* args, - SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = 0, BroObj* obj = 0); + Event(EventHandlerPtr handler, zeek::Args args, + SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, + TimerMgr* mgr = nullptr, BroObj* obj = nullptr); void SetNext(Event* n) { next_event = n; } Event* NextEvent() const { return next_event; } @@ -28,7 +23,7 @@ public: analyzer::ID Analyzer() const { return aid; } TimerMgr* Mgr() const { return mgr; } EventHandlerPtr Handler() const { return handler; } - const val_list* Args() const { return &args; } + const zeek::Args& Args() const { return args; } void Describe(ODesc* d) const override; @@ -40,7 +35,7 @@ protected: void Dispatch(bool no_remote = false); EventHandlerPtr handler; - val_list args; + zeek::Args args; SourceID src; analyzer::ID aid; TimerMgr* mgr; @@ -64,12 +59,11 @@ public: // against the case where there's no handlers (one usually also does that // because it would be a waste of effort to construct all the event // arguments when there's no handlers to consume them). + // TODO: deprecate + /* [[deprecated("Remove in v4.1. Use IntrusivePtr overload instead.")]] */ void QueueEventFast(const EventHandlerPtr &h, val_list vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = 0, BroObj* obj = 0) - { - QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj)); - } + TimerMgr* mgr = 0, BroObj* obj = 0); // Queues an event if there's an event handler (or remote consumer). This // function always takes ownership of decrementing the reference count of @@ -77,6 +71,8 @@ public: // checked for event handler existence, you may wish to call // QueueEventFast() instead of this function to prevent the redundant // existence check. + // TODO: deprecate + /* [[deprecated("Remove in v4.1. Use IntrusivePtr overload instead.")]] */ void QueueEvent(const EventHandlerPtr &h, val_list vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, TimerMgr* mgr = 0, BroObj* obj = 0); @@ -85,13 +81,32 @@ public: // pointer instead of by value. This function takes ownership of the // memory pointed to by 'vl' as well as decrementing the reference count of // each of its elements. + // TODO: deprecate + /* [[deprecated("Remove in v4.1. Use IntrusivePtr overload instead.")]] */ void QueueEvent(const EventHandlerPtr &h, val_list* vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = 0, BroObj* obj = 0) - { - QueueEvent(h, std::move(*vl), src, aid, mgr, obj); - delete vl; - } + TimerMgr* mgr = 0, BroObj* obj = 0); + + /** + * Queues an event without first checking if there's an event handler + * remote consumer. If there are actually no handlers/consumers upon + * dispatching the event, nothing happens besides having wasted a bit of + * time and resources. This method is mostly useful from a performance + * standpoint: usually callers have already checked that the event will + * consumed so they don't waste time creating an argument list that will + * only be discarded, so there's no need to do the same check again when + * going to queue the event. + */ + void QueueUncheckedEvent(const EventHandlerPtr& h, zeek::Args vl, + SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, + TimerMgr* mgr = nullptr, BroObj* obj = nullptr); + + /** + * Queues an event if it has an event handler or remote consumer. + */ + void QueueCheckedEvent(const EventHandlerPtr& h, zeek::Args vl, + SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, + TimerMgr* mgr = nullptr, BroObj* obj = nullptr); void Dispatch(Event* event, bool no_remote = false); diff --git a/src/EventHandler.cc b/src/EventHandler.cc index 9a5cba56b1..8f35d47ed5 100644 --- a/src/EventHandler.cc +++ b/src/EventHandler.cc @@ -60,7 +60,7 @@ void EventHandler::SetLocalHandler(Func* f) local = f; } -void EventHandler::Call(val_list* vl, bool no_remote) +void EventHandler::Call(const zeek::Args& vl, bool no_remote) { #ifdef PROFILE_BRO_FUNCTIONS DEBUG_MSG("Event: %s\n", Name()); @@ -75,12 +75,12 @@ void EventHandler::Call(val_list* vl, bool no_remote) { // Send event in form [name, xs...] where xs represent the arguments. broker::vector xs; - xs.reserve(vl->length()); + xs.reserve(vl.size()); bool valid_args = true; - for ( auto i = 0; i < vl->length(); ++i ) + for ( auto i = 0u; i < vl.size(); ++i ) { - auto opt_data = bro_broker::val_to_data((*vl)[i]); + auto opt_data = bro_broker::val_to_data(vl[i].get()); if ( opt_data ) xs.emplace_back(move(*opt_data)); @@ -115,14 +115,9 @@ void EventHandler::Call(val_list* vl, bool no_remote) if ( local ) // No try/catch here; we pass exceptions upstream. local->Call(vl); - else - { - for ( auto v : *vl ) - Unref(v); - } } -void EventHandler::NewEvent(val_list* vl) +void EventHandler::NewEvent(const zeek::Args& vl) { if ( ! new_event ) return; @@ -132,7 +127,7 @@ void EventHandler::NewEvent(val_list* vl) return; RecordType* args = FType()->Args(); - VectorVal* vargs = new VectorVal(call_argument_vector); + auto vargs = make_intrusive(call_argument_vector); for ( int i = 0; i < args->NumFields(); i++ ) { @@ -151,19 +146,15 @@ void EventHandler::NewEvent(val_list* vl) if ( fdefault ) rec->Assign(2, std::move(fdefault)); - if ( i < vl->length() && (*vl)[i] ) - { - Val* val = (*vl)[i]; - Ref(val); - rec->Assign(3, val); - } + if ( i < static_cast(vl.size()) && vl[i] ) + rec->Assign(3, vl[i]); vargs->Assign(i, std::move(rec)); } Event* ev = new Event(new_event, { - new StringVal(name), - vargs, + make_intrusive(name), + std::move(vargs), }); mgr.Dispatch(ev); } diff --git a/src/EventHandler.h b/src/EventHandler.h index ed01bf18a3..effafb134e 100644 --- a/src/EventHandler.h +++ b/src/EventHandler.h @@ -3,6 +3,7 @@ #pragma once #include "BroList.h" +#include "ZeekArgs.h" #include #include @@ -31,7 +32,7 @@ public: auto_publish.erase(topic); } - void Call(val_list* vl, bool no_remote = false); + void Call(const zeek::Args& vl, bool no_remote = false); // Returns true if there is at least one local or remote handler. explicit operator bool() const; @@ -52,7 +53,7 @@ public: bool GenerateAlways() { return generate_always; } private: - void NewEvent(val_list* vl); // Raise new_event() meta event. + void NewEvent(const zeek::Args& vl); // Raise new_event() meta event. const char* name; Func* local; diff --git a/src/Expr.cc b/src/Expr.cc index ad6c18432c..09a0c63fc0 100644 --- a/src/Expr.cc +++ b/src/Expr.cc @@ -3884,12 +3884,11 @@ IntrusivePtr FlattenExpr::Fold(Val* v) const return l; } -ScheduleTimer::ScheduleTimer(EventHandlerPtr arg_event, val_list* arg_args, +ScheduleTimer::ScheduleTimer(EventHandlerPtr arg_event, zeek::Args arg_args, double t, TimerMgr* arg_tmgr) : Timer(t, TIMER_SCHEDULE), - event(arg_event), args(std::move(*arg_args)), tmgr(arg_tmgr) + event(arg_event), args(std::move(arg_args)), tmgr(arg_tmgr) { - delete arg_args; } ScheduleTimer::~ScheduleTimer() @@ -3898,7 +3897,7 @@ ScheduleTimer::~ScheduleTimer() void ScheduleTimer::Dispatch(double /* t */, int /* is_expire */) { - mgr.QueueEvent(event, std::move(args), SOURCE_LOCAL, 0, tmgr); + mgr.QueueUncheckedEvent(event, std::move(args), SOURCE_LOCAL, 0, tmgr); } ScheduleExpr::ScheduleExpr(IntrusivePtr arg_when, @@ -3937,7 +3936,7 @@ IntrusivePtr ScheduleExpr::Eval(Frame* f) const if ( when->Type()->Tag() == TYPE_INTERVAL ) dt += network_time; - val_list* args = eval_list(f, event->Args()); + auto args = eval_list(f, event->Args()); if ( args ) { @@ -3946,7 +3945,7 @@ IntrusivePtr ScheduleExpr::Eval(Frame* f) const if ( ! tmgr ) tmgr = timer_mgr; - tmgr->Add(new ScheduleTimer(event->Handler(), args, dt, tmgr)); + tmgr->Add(new ScheduleTimer(event->Handler(), std::move(*args), dt, tmgr)); } return nullptr; @@ -4236,7 +4235,7 @@ IntrusivePtr CallExpr::Eval(Frame* f) const IntrusivePtr ret; auto func_val = func->Eval(f); - val_list* v = eval_list(f, args.get()); + auto v = eval_list(f, args.get()); if ( func_val && v ) { @@ -4246,16 +4245,11 @@ IntrusivePtr CallExpr::Eval(Frame* f) const if ( f ) f->SetCall(this); - ret = func->Call(v, f); + ret = func->Call(*v, f); if ( f ) f->SetCall(current_call); - - // Don't Unref() the arguments, as Func::Call already did that. - delete v; } - else - delete_vals(v); return ret; } @@ -4448,10 +4442,8 @@ IntrusivePtr EventExpr::Eval(Frame* f) const if ( IsError() ) return nullptr; - val_list* v = eval_list(f, args.get()); - mgr.QueueEvent(handler, std::move(*v)); - delete v; - + auto v = eval_list(f, args.get()); + mgr.QueueUncheckedEvent(handler, std::move(*v)); return nullptr; } @@ -5176,36 +5168,23 @@ int check_and_promote_exprs_to_type(ListExpr* const elements, BroType* type) return 1; } -val_list* eval_list(Frame* f, const ListExpr* l) +std::optional>> eval_list(Frame* f, const ListExpr* l) { const expr_list& e = l->Exprs(); - val_list* v = new val_list(e.length()); - bool success = true; + auto rval = std::make_optional>>(); + rval->reserve(e.length()); for ( const auto& expr : e ) { auto ev = expr->Eval(f); if ( ! ev ) - { - success = false; - break; - } + return {}; - v->push_back(ev.release()); + rval->emplace_back(std::move(ev)); } - if ( ! success ) - { - for ( const auto& val : *v ) - Unref(val); - - delete v; - return nullptr; - } - - else - return v; + return rval; } bool expr_greater(const Expr* e1, const Expr* e2) diff --git a/src/Expr.h b/src/Expr.h index 95c1167abe..48f02cd90e 100644 --- a/src/Expr.h +++ b/src/Expr.h @@ -9,10 +9,13 @@ #include "EventHandler.h" #include "TraverseTypes.h" #include "Val.h" +#include "ZeekArgs.h" #include #include +#include #include +#include using std::string; @@ -737,15 +740,15 @@ protected: class ScheduleTimer : public Timer { public: - ScheduleTimer(EventHandlerPtr event, val_list* args, double t, - TimerMgr* tmgr); + ScheduleTimer(EventHandlerPtr event, zeek::Args args, + double t, TimerMgr* tmgr); ~ScheduleTimer() override; void Dispatch(double t, int is_expire) override; protected: EventHandlerPtr event; - val_list args; + zeek::Args args; TimerMgr* tmgr; }; @@ -936,9 +939,9 @@ extern int check_and_promote_exprs(ListExpr* elements, TypeList* types); extern int check_and_promote_args(ListExpr* args, RecordType* types); extern int check_and_promote_exprs_to_type(ListExpr* elements, BroType* type); -// Returns a ListExpr simplified down to a list a values, or a nil -// pointer if they couldn't all be reduced. -val_list* eval_list(Frame* f, const ListExpr* l); +// Returns a ListExpr simplified down to a list a values, or nil +// if they couldn't all be reduced. +std::optional>> eval_list(Frame* f, const ListExpr* l); // Returns true if e1 is "greater" than e2 - here "greater" is just // a heuristic, used with commutative operators to put them into diff --git a/src/File.cc b/src/File.cc index 27702f0658..9e01c144ff 100644 --- a/src/File.cc +++ b/src/File.cc @@ -325,7 +325,7 @@ void BroFile::RaiseOpenEvent() return; Ref(this); - Event* event = new ::Event(::file_opened, {new Val(this)}); + Event* event = new ::Event(::file_opened, {make_intrusive(this)}); mgr.Dispatch(event, true); } diff --git a/src/Frame.cc b/src/Frame.cc index 88a60e3b1f..1c093398dc 100644 --- a/src/Frame.cc +++ b/src/Frame.cc @@ -14,7 +14,7 @@ vector g_frame_stack; -Frame::Frame(int arg_size, const BroFunc* func, const val_list* fn_args) +Frame::Frame(int arg_size, const BroFunc* func, const zeek::Args* fn_args) { size = arg_size; frame = new Val*[size]; diff --git a/src/Frame.h b/src/Frame.h index d999b6f3ed..0961290ab1 100644 --- a/src/Frame.h +++ b/src/Frame.h @@ -5,6 +5,7 @@ #include "BroList.h" // for typedef val_list #include "Obj.h" #include "IntrusivePtr.h" +#include "ZeekArgs.h" #include #include @@ -28,7 +29,7 @@ public: * @param func the function that is creating this frame * @param fn_args the arguments being passed to that function. */ - Frame(int size, const BroFunc* func, const val_list *fn_args); + Frame(int size, const BroFunc* func, const zeek::Args* fn_args); /** * Deletes the frame. Unrefs its trigger, the values that it @@ -100,7 +101,7 @@ public: * @return the arguments passed to the function that this frame * is associated with. */ - const val_list* GetFuncArgs() const { return func_args; } + const zeek::Args* GetFuncArgs() const { return func_args; } /** * Change the function that the frame is associated with. @@ -283,7 +284,7 @@ private: /** The function this frame is associated with. */ const BroFunc* function; /** The arguments to the function that this Frame is associated with. */ - const val_list* func_args; + const zeek::Args* func_args; /** The next statement to be evaluted in the context of this frame. */ Stmt* next_stmt; diff --git a/src/Func.cc b/src/Func.cc index e54a4c4ac4..0f4b9ca376 100644 --- a/src/Func.cc +++ b/src/Func.cc @@ -79,19 +79,16 @@ std::string render_call_stack() auto name = ci.func->Name(); std::string arg_desc; - if ( ci.args ) + for ( const auto& arg : ci.args ) { - for ( const auto& arg : *ci.args ) - { - ODesc d; - d.SetShort(); - arg->Describe(&d); + ODesc d; + d.SetShort(); + arg->Describe(&d); - if ( ! arg_desc.empty() ) - arg_desc += ", "; + if ( ! arg_desc.empty() ) + arg_desc += ", "; - arg_desc += d.Description(); - } + arg_desc += d.Description(); } rval += fmt("#%d %s(%s)", lvl, name, arg_desc.data()); @@ -143,7 +140,7 @@ IntrusivePtr Func::DoClone() return {NewRef{}, this}; } -void Func::DescribeDebug(ODesc* d, const val_list* args) const +void Func::DescribeDebug(ODesc* d, const zeek::Args* args) const { d->Add(Name()); @@ -153,10 +150,10 @@ void Func::DescribeDebug(ODesc* d, const val_list* args) const { d->Add("("); - for ( int i = 0; i < args->length(); ++i ) + for ( auto i = 0u; i < args->size(); ++i ) { // Handle varargs case (more args than formals). - if ( i >= func_args->NumFields() ) + if ( i >= static_cast(func_args->NumFields()) ) { d->Add("vararg"); d->Add(i - func_args->NumFields()); @@ -167,7 +164,7 @@ void Func::DescribeDebug(ODesc* d, const val_list* args) const d->Add(" = '"); (*args)[i]->Describe(d); - if ( i < args->length() - 1 ) + if ( i < args->size() - 1 ) d->Add("', "); else d->Add("'"); @@ -217,7 +214,7 @@ void Func::CopyStateInto(Func* other) const other->unique_id = unique_id; } -std::pair Func::HandlePluginResult(std::pair plugin_result, val_list* args, function_flavor flavor) const +std::pair Func::HandlePluginResult(std::pair plugin_result, function_flavor flavor) const { // Helper function factoring out this code from BroFunc:Call() for // better readability. @@ -265,9 +262,6 @@ std::pair Func::HandlePluginResult(std::pair plugin_resu } } - for ( const auto& arg : *args ) - Unref(arg); - return plugin_result; } @@ -300,7 +294,12 @@ int BroFunc::IsPure() const [](const Body& b) { return b.stmts->IsPure(); }); } -IntrusivePtr BroFunc::Call(val_list* args, Frame* parent) const +IntrusivePtr Func::Call(val_list* args, Frame* parent) const + { + return Call(zeek::val_list_to_args(args), parent); + } + +IntrusivePtr BroFunc::Call(const zeek::Args& args, Frame* parent) const { #ifdef PROFILE_BRO_FUNCTIONS DEBUG_MSG("Function: %s\n", Name()); @@ -312,7 +311,7 @@ IntrusivePtr BroFunc::Call(val_list* args, Frame* parent) const std::pair plugin_result = PLUGIN_HOOK_WITH_RESULT(HOOK_CALL_FUNCTION, HookCallFunction(this, parent, args), empty_hook_result); - plugin_result = HandlePluginResult(plugin_result, args, Flavor()); + plugin_result = HandlePluginResult(plugin_result, Flavor()); if( plugin_result.first ) return {AdoptRef{}, plugin_result.second}; @@ -321,13 +320,10 @@ IntrusivePtr BroFunc::Call(val_list* args, Frame* parent) const { // Can only happen for events and hooks. assert(Flavor() == FUNC_FLAVOR_EVENT || Flavor() == FUNC_FLAVOR_HOOK); - for ( const auto& arg : *args ) - Unref(arg); - return Flavor() == FUNC_FLAVOR_HOOK ? IntrusivePtr{AdoptRef{}, val_mgr->GetTrue()} : nullptr; } - auto f = make_intrusive(frame_size, this, args); + auto f = make_intrusive(frame_size, this, &args); if ( closure ) f->CaptureClosure(closure, outer_ids); @@ -346,7 +342,7 @@ IntrusivePtr BroFunc::Call(val_list* args, Frame* parent) const if ( g_trace_state.DoTrace() ) { ODesc d; - DescribeDebug(&d, args); + DescribeDebug(&d, &args); g_trace_state.LogTrace("%s called: %s\n", FType()->FlavorString().c_str(), d.Description()); @@ -362,19 +358,16 @@ IntrusivePtr BroFunc::Call(val_list* args, Frame* parent) const body.stmts->GetLocationInfo()); // Fill in the rest of the frame with the function's arguments. - loop_over_list(*args, j) + for ( auto j = 0u; j < args.size(); ++j ) { - Val* arg = (*args)[j]; + Val* arg = args[j].get(); if ( f->NthElement(j) != arg ) - { // Either not yet set, or somebody reassigned the frame slot. - Ref(arg); - f->SetElement(j, arg); - } + f->SetElement(j, arg->Ref()); } - f->Reset(args->length()); + f->Reset(args.size()); try { @@ -421,11 +414,6 @@ IntrusivePtr BroFunc::Call(val_list* args, Frame* parent) const call_stack.pop_back(); - // We have an extra Ref for each argument (so that they don't get - // deleted between bodies), release that. - for ( const auto& arg : *args ) - Unref(arg); - if ( Flavor() == FUNC_FLAVOR_HOOK ) { if ( ! result ) @@ -612,7 +600,7 @@ int BuiltinFunc::IsPure() const return is_pure; } -IntrusivePtr BuiltinFunc::Call(val_list* args, Frame* parent) const +IntrusivePtr BuiltinFunc::Call(const zeek::Args& args, Frame* parent) const { #ifdef PROFILE_BRO_FUNCTIONS DEBUG_MSG("Function: %s\n", Name()); @@ -624,7 +612,7 @@ IntrusivePtr BuiltinFunc::Call(val_list* args, Frame* parent) const std::pair plugin_result = PLUGIN_HOOK_WITH_RESULT(HOOK_CALL_FUNCTION, HookCallFunction(this, parent, args), empty_hook_result); - plugin_result = HandlePluginResult(plugin_result, args, FUNC_FLAVOR_FUNCTION); + plugin_result = HandlePluginResult(plugin_result, FUNC_FLAVOR_FUNCTION); if ( plugin_result.first ) return {AdoptRef{}, plugin_result.second}; @@ -632,20 +620,16 @@ IntrusivePtr BuiltinFunc::Call(val_list* args, Frame* parent) const if ( g_trace_state.DoTrace() ) { ODesc d; - DescribeDebug(&d, args); + DescribeDebug(&d, &args); g_trace_state.LogTrace("\tBuiltin Function called: %s\n", d.Description()); } const CallExpr* call_expr = parent ? parent->GetCall() : nullptr; call_stack.emplace_back(CallInfo{call_expr, this, args}); - IntrusivePtr result{AdoptRef{}, func(parent, args)}; + IntrusivePtr result{AdoptRef{}, func(parent, &args)}; call_stack.pop_back(); - for ( const auto& arg : *args ) - Unref(arg); - - // Don't Unref() args, that's the caller's responsibility. if ( result && g_trace_state.DoTrace() ) { ODesc d; @@ -663,6 +647,16 @@ void BuiltinFunc::Describe(ODesc* d) const d->AddCount(is_pure); } +void builtin_error(const char* msg) + { + builtin_error(msg, IntrusivePtr{}); + } + +void builtin_error(const char* msg, IntrusivePtr arg) + { + builtin_error(msg, arg.get()); + } + void builtin_error(const char* msg, BroObj* arg) { auto emit = [=](const CallExpr* ce) diff --git a/src/Func.h b/src/Func.h index 2bed2f2d94..a5ac9f3454 100644 --- a/src/Func.h +++ b/src/Func.h @@ -7,6 +7,7 @@ #include "IntrusivePtr.h" #include "Type.h" /* for function_flavor */ #include "TraverseTypes.h" +#include "ZeekArgs.h" #include #include @@ -30,7 +31,6 @@ class Scope; class Func : public BroObj { public: - enum Kind { BRO_FUNC, BUILTIN_FUNC }; explicit Func(Kind arg_kind); @@ -50,7 +50,9 @@ public: const vector& GetBodies() const { return bodies; } bool HasBodies() const { return bodies.size(); } - virtual IntrusivePtr Call(val_list* args, Frame* parent = 0) const = 0; + // TODO: deprecate + virtual IntrusivePtr Call(val_list* args, Frame* parent = nullptr) const; + virtual IntrusivePtr Call(const zeek::Args& args, Frame* parent = nullptr) const = 0; // Add a new event handler to an existing function (event). virtual void AddBody(IntrusivePtr new_body, id_list* new_inits, @@ -67,7 +69,7 @@ public: void SetName(const char* arg_name) { name = arg_name; } void Describe(ODesc* d) const override = 0; - virtual void DescribeDebug(ODesc* d, const val_list* args) const; + virtual void DescribeDebug(ODesc* d, const zeek::Args* args) const; virtual IntrusivePtr DoClone(); @@ -84,7 +86,7 @@ protected: void CopyStateInto(Func* other) const; // Helper function for handling result of plugin hook. - std::pair HandlePluginResult(std::pair plugin_result, val_list* args, function_flavor flavor) const; + std::pair HandlePluginResult(std::pair plugin_result, function_flavor flavor) const; vector bodies; IntrusivePtr scope; @@ -102,7 +104,7 @@ public: ~BroFunc() override; int IsPure() const override; - IntrusivePtr Call(val_list* args, Frame* parent) const override; + IntrusivePtr Call(const zeek::Args& args, Frame* parent) const override; /** * Adds adds a closure to the function. Closures are cloned and @@ -169,7 +171,7 @@ private: bool weak_closure_ref = false; }; -typedef Val* (*built_in_func)(Frame* frame, val_list* args); +using built_in_func = Val* (*)(Frame* frame, const zeek::Args* args); class BuiltinFunc : public Func { public: @@ -177,7 +179,7 @@ public: ~BuiltinFunc() override; int IsPure() const override; - IntrusivePtr Call(val_list* args, Frame* parent) const override; + IntrusivePtr Call(const zeek::Args& args, Frame* parent) const override; built_in_func TheFunc() const { return func; } void Describe(ODesc* d) const override; @@ -190,7 +192,9 @@ protected: }; -extern void builtin_error(const char* msg, BroObj* arg = 0); +extern void builtin_error(const char* msg); +extern void builtin_error(const char* msg, IntrusivePtr); +extern void builtin_error(const char* msg, BroObj* arg); extern void init_builtin_funcs(); extern void init_builtin_funcs_subdirs(); @@ -199,7 +203,7 @@ extern bool check_built_in_call(BuiltinFunc* f, CallExpr* call); struct CallInfo { const CallExpr* call; const Func* func; - const val_list* args; + const zeek::Args& args; }; // Struct that collects all the specifics defining a Func. Used for BroFuncs diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc index 0d2d0a8887..ecaa245fb7 100644 --- a/src/OpaqueVal.cc +++ b/src/OpaqueVal.cc @@ -221,6 +221,26 @@ MD5Val::~MD5Val() EVP_MD_CTX_free(ctx); } +void HashVal::digest_one(EVP_MD_CTX* h, const Val* v) + { + if ( v->Type()->Tag() == TYPE_STRING ) + { + const BroString* str = v->AsString(); + hash_update(h, str->Bytes(), str->Len()); + } + else + { + ODesc d(DESC_BINARY); + v->Describe(&d); + hash_update(h, (const u_char *) d.Bytes(), d.Len()); + } + } + +void HashVal::digest_one(EVP_MD_CTX* h, const IntrusivePtr& v) + { + digest_one(h, v.get()); + } + IntrusivePtr MD5Val::DoClone(CloneState* state) { auto out = make_intrusive(); @@ -236,39 +256,6 @@ IntrusivePtr MD5Val::DoClone(CloneState* state) return state->NewClone(this, std::move(out)); } -void MD5Val::digest(val_list& vlist, u_char result[MD5_DIGEST_LENGTH]) - { - EVP_MD_CTX* h = hash_init(Hash_MD5); - - for ( const auto& v : vlist ) - { - if ( v->Type()->Tag() == TYPE_STRING ) - { - const BroString* str = v->AsString(); - hash_update(h, str->Bytes(), str->Len()); - } - else - { - ODesc d(DESC_BINARY); - v->Describe(&d); - hash_update(h, (const u_char *) d.Bytes(), d.Len()); - } - } - - hash_final(h, result); - } - -void MD5Val::hmac(val_list& vlist, - u_char key[MD5_DIGEST_LENGTH], - u_char result[MD5_DIGEST_LENGTH]) - { - digest(vlist, result); - for ( int i = 0; i < MD5_DIGEST_LENGTH; ++i ) - result[i] ^= key[i]; - - internal_md5(result, MD5_DIGEST_LENGTH, result); - } - bool MD5Val::DoInit() { assert(! IsValid()); @@ -389,28 +376,6 @@ IntrusivePtr SHA1Val::DoClone(CloneState* state) return state->NewClone(this, std::move(out)); } -void SHA1Val::digest(val_list& vlist, u_char result[SHA_DIGEST_LENGTH]) - { - EVP_MD_CTX* h = hash_init(Hash_SHA1); - - for ( const auto& v : vlist ) - { - if ( v->Type()->Tag() == TYPE_STRING ) - { - const BroString* str = v->AsString(); - hash_update(h, str->Bytes(), str->Len()); - } - else - { - ODesc d(DESC_BINARY); - v->Describe(&d); - hash_update(h, (const u_char *) d.Bytes(), d.Len()); - } - } - - hash_final(h, result); - } - bool SHA1Val::DoInit() { assert(! IsValid()); @@ -535,28 +500,6 @@ IntrusivePtr SHA256Val::DoClone(CloneState* state) return state->NewClone(this, std::move(out)); } -void SHA256Val::digest(val_list& vlist, u_char result[SHA256_DIGEST_LENGTH]) - { - EVP_MD_CTX* h = hash_init(Hash_SHA256); - - for ( const auto& v : vlist ) - { - if ( v->Type()->Tag() == TYPE_STRING ) - { - const BroString* str = v->AsString(); - hash_update(h, str->Bytes(), str->Len()); - } - else - { - ODesc d(DESC_BINARY); - v->Describe(&d); - hash_update(h, (const u_char *) d.Bytes(), d.Len()); - } - } - - hash_final(h, result); - } - bool SHA256Val::DoInit() { assert( ! IsValid() ); diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h index ff90344954..288e94a7db 100644 --- a/src/OpaqueVal.h +++ b/src/OpaqueVal.h @@ -162,12 +162,26 @@ namespace probabilistic { class HashVal : public OpaqueVal { public: + template + static void digest_all(HashAlgorithm alg, const T& vlist, u_char* result) + { + auto h = hash_init(alg); + + for ( const auto& v : vlist ) + digest_one(h, v); + + hash_final(h, result); + } + bool IsValid() const; bool Init(); bool Feed(const void* data, size_t size); IntrusivePtr Get(); protected: + static void digest_one(EVP_MD_CTX* h, const Val* v); + static void digest_one(EVP_MD_CTX* h, const IntrusivePtr& v); + HashVal() { valid = false; } explicit HashVal(OpaqueType* t); @@ -182,11 +196,22 @@ private: class MD5Val : public HashVal { public: - static void digest(val_list& vlist, u_char result[MD5_DIGEST_LENGTH]); + template + static void digest(const T& vlist, u_char result[MD5_DIGEST_LENGTH]) + { digest_all(Hash_MD5, vlist, result); } - static void hmac(val_list& vlist, - u_char key[MD5_DIGEST_LENGTH], - u_char result[MD5_DIGEST_LENGTH]); + template + static void hmac(const T& vlist, + u_char key[MD5_DIGEST_LENGTH], + u_char result[MD5_DIGEST_LENGTH]) + { + digest(vlist, result); + + for ( int i = 0; i < MD5_DIGEST_LENGTH; ++i ) + result[i] ^= key[i]; + + internal_md5(result, MD5_DIGEST_LENGTH, result); + } MD5Val(); ~MD5Val(); @@ -207,7 +232,9 @@ private: class SHA1Val : public HashVal { public: - static void digest(val_list& vlist, u_char result[SHA_DIGEST_LENGTH]); + template + static void digest(const T& vlist, u_char result[SHA_DIGEST_LENGTH]) + { digest_all(Hash_SHA1, vlist, result); } SHA1Val(); ~SHA1Val(); @@ -228,7 +255,9 @@ private: class SHA256Val : public HashVal { public: - static void digest(val_list& vlist, u_char result[SHA256_DIGEST_LENGTH]); + template + static void digest(const T& vlist, u_char result[SHA256_DIGEST_LENGTH]) + { digest_all(Hash_SHA256, vlist, result); } SHA256Val(); ~SHA256Val(); diff --git a/src/Stats.cc b/src/Stats.cc index 4ab911507e..f584ed7a23 100644 --- a/src/Stats.cc +++ b/src/Stats.cc @@ -314,8 +314,8 @@ void ProfileLogger::Log() { Ref(file); mgr.Dispatch(new Event(profiling_update, { - new Val(file), - val_mgr->GetBool(expensive), + make_intrusive(file), + {AdoptRef{}, val_mgr->GetBool(expensive)}, })); } } diff --git a/src/Stmt.cc b/src/Stmt.cc index 172f54014b..2e90592dd6 100644 --- a/src/Stmt.cc +++ b/src/Stmt.cc @@ -151,15 +151,12 @@ IntrusivePtr ExprListStmt::Exec(Frame* f, stmt_flow_type& flow) const last_access = network_time; flow = FLOW_NEXT; - val_list* vals = eval_list(f, l.get()); + auto vals = eval_list(f, l.get()); + if ( vals ) - { - auto result = DoExec(vals, flow); - delete_vals(vals); - return result; - } - else - return nullptr; + return DoExec(std::move(*vals), flow); + + return nullptr; } void ExprListStmt::Describe(ODesc* d) const @@ -169,11 +166,6 @@ void ExprListStmt::Describe(ODesc* d) const DescribeDone(d); } -void ExprListStmt::PrintVals(ODesc* d, val_list* vals, int offset) const - { - describe_vals(vals, d, offset); - } - TraversalCode ExprListStmt::Traverse(TraversalCallback* cb) const { TraversalCode tc = cb->PreStmt(this); @@ -206,13 +198,13 @@ static IntrusivePtr lookup_enum_val(const char* module_name, const char return et->GetVal(index); } -static void print_log(val_list* vals) +static void print_log(const std::vector>& vals) { auto plval = lookup_enum_val("Log", "PRINTLOG"); auto record = make_intrusive(internal_type("Log::PrintLogInfo")->AsRecordType()); auto vec = make_intrusive(internal_type("string_vec")->AsVectorType()); - for ( const auto& val : *vals ) + for ( const auto& val : vals ) { ODesc d(DESC_READABLE); val->Describe(&d); @@ -224,7 +216,8 @@ static void print_log(val_list* vals) log_mgr->Write(plval.get(), record.get()); } -IntrusivePtr PrintStmt::DoExec(val_list* vals, stmt_flow_type& /* flow */) const +IntrusivePtr PrintStmt::DoExec(std::vector> vals, + stmt_flow_type& /* flow */) const { RegisterAccess(); @@ -234,9 +227,9 @@ IntrusivePtr PrintStmt::DoExec(val_list* vals, stmt_flow_type& /* flow */) BroFile* f = print_stdout; int offset = 0; - if ( vals->length() > 0 && (*vals)[0]->Type()->Tag() == TYPE_FILE ) + if ( vals.size() > 0 && (vals)[0]->Type()->Tag() == TYPE_FILE ) { - f = (*vals)[0]->AsFile(); + f = (vals)[0]->AsFile(); if ( ! f->IsOpen() ) return nullptr; @@ -277,7 +270,7 @@ IntrusivePtr PrintStmt::DoExec(val_list* vals, stmt_flow_type& /* flow */) d.SetFlush(0); d.SetStyle(style); - PrintVals(&d, vals, offset); + describe_vals(vals, &d, offset); f->Write(d.Description(), d.Len()); } else @@ -286,7 +279,7 @@ IntrusivePtr PrintStmt::DoExec(val_list* vals, stmt_flow_type& /* flow */) d.SetFlush(0); d.SetStyle(style); - PrintVals(&d, vals, offset); + describe_vals(vals, &d, offset); f->Write("\n", 1); } @@ -966,13 +959,10 @@ EventStmt::EventStmt(IntrusivePtr arg_e) IntrusivePtr EventStmt::Exec(Frame* f, stmt_flow_type& flow) const { RegisterAccess(); - val_list* args = eval_list(f, event_expr->Args()); + auto args = eval_list(f, event_expr->Args()); if ( args ) - { - mgr.QueueEvent(event_expr->Handler(), std::move(*args)); - delete args; - } + mgr.QueueUncheckedEvent(event_expr->Handler(), std::move(*args)); flow = FLOW_NEXT; return nullptr; diff --git a/src/Stmt.h b/src/Stmt.h index 950d733d78..78cb91ae29 100644 --- a/src/Stmt.h +++ b/src/Stmt.h @@ -95,10 +95,10 @@ protected: ~ExprListStmt() override; IntrusivePtr Exec(Frame* f, stmt_flow_type& flow) const override; - virtual IntrusivePtr DoExec(val_list* vals, stmt_flow_type& flow) const = 0; + virtual IntrusivePtr DoExec(std::vector> vals, + stmt_flow_type& flow) const = 0; void Describe(ODesc* d) const override; - void PrintVals(ODesc* d, val_list* vals, int offset) const; IntrusivePtr l; }; @@ -109,7 +109,8 @@ public: explicit PrintStmt(L&& l) : ExprListStmt(STMT_PRINT, std::forward(l)) { } protected: - IntrusivePtr DoExec(val_list* vals, stmt_flow_type& flow) const override; + IntrusivePtr DoExec(std::vector> vals, + stmt_flow_type& flow) const override; }; class ExprStmt : public Stmt { diff --git a/src/Val.cc b/src/Val.cc index b72d9d7e95..a366b8bcd7 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -3292,6 +3292,24 @@ void describe_vals(const val_list* vals, ODesc* d, int offset) } } +void describe_vals(const std::vector>& vals, + ODesc* d, size_t offset) + { + if ( ! d->IsReadable() ) + { + d->Add(vals.size()); + d->SP(); + } + + for ( auto i = offset; i < vals.size(); ++i ) + { + if ( i > offset && d->IsReadable() && d->Style() != RAW_STYLE ) + d->Add(", "); + + vals[i]->Describe(d); + } + } + void delete_vals(val_list* vals) { if ( vals ) diff --git a/src/Val.h b/src/Val.h index 7d944e9760..da5d9afba5 100644 --- a/src/Val.h +++ b/src/Val.h @@ -1042,6 +1042,8 @@ extern int same_val(const Val* v1, const Val* v2); extern int same_atomic_val(const Val* v1, const Val* v2); extern bool is_atomic_val(const Val* v); extern void describe_vals(const val_list* vals, ODesc* d, int offset=0); +extern void describe_vals(const std::vector>& vals, + ODesc* d, size_t offset = 0); extern void delete_vals(val_list* vals); // True if the given Val* has a vector type. diff --git a/src/ZeekArgs.cc b/src/ZeekArgs.cc new file mode 100644 index 0000000000..810da7f1dc --- /dev/null +++ b/src/ZeekArgs.cc @@ -0,0 +1,15 @@ +#include "ZeekArgs.h" +#include "IntrusivePtr.h" +#include "Val.h" + +zeek::Args zeek::val_list_to_args(const val_list* vl) + { + zeek::Args rval; + rval.reserve(vl->length()); + + for ( auto& v : *vl ) + rval.emplace_back(AdoptRef{}, v); + + return rval; + } + diff --git a/src/ZeekArgs.h b/src/ZeekArgs.h new file mode 100644 index 0000000000..a18d186863 --- /dev/null +++ b/src/ZeekArgs.h @@ -0,0 +1,27 @@ +// See the file "COPYING" in the main distribution directory for copyright. + +#pragma once + +#include "BroList.h" + +#include + +class Val; +template class IntrusivePtr; + +namespace zeek { + +using Args = std::vector>; + +/** + * Converts a legacy-style argument list for use in modern Zeek function + * calling or event queueing APIs. + * @param vl the argument list to convert, the returned value takes ownership + * of a reference to each element in the list, but not ownership of the list + * itself. + * @return the converted argument list + * + */ +Args val_list_to_args(const val_list* vl); + +} // namespace zeek diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif index 95fe80c0a1..6217facb41 100644 --- a/src/broker/messaging.bif +++ b/src/broker/messaging.bif @@ -83,7 +83,13 @@ type Broker::Event: record; function Broker::make_event%(...%): Broker::Event %{ bro_broker::Manager::ScriptScopeGuard ssg; - auto rval = broker_mgr->MakeEvent(@ARGS@, frame); + const auto& bif_args = @ARGS@; + val_list args(bif_args->size()); + + for ( auto i = 0u; i < bif_args->size(); ++i ) + args.push_back((*bif_args)[i].get()); + + auto rval = broker_mgr->MakeEvent(&args, frame); return rval; %} @@ -98,11 +104,11 @@ function Broker::make_event%(...%): Broker::Event ## Returns: true if the message is sent. function Broker::publish%(topic: string, ...%): bool %{ - val_list* bif_args = @ARGS@; - val_list args(bif_args->length() - 1); + const auto& bif_args = @ARGS@; + val_list args(bif_args->size() - 1); - for ( auto i = 1; i < bif_args->length(); ++i ) - args.push_back((*bif_args)[i]); + for ( auto i = 1u; i < bif_args->size(); ++i ) + args.push_back((*bif_args)[i].get()); auto rval = publish_event_args(args, topic->AsString(), frame); return val_mgr->GetBool(rval); @@ -188,11 +194,11 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool if ( ! topic->AsString()->Len() ) return val_mgr->GetFalse(); - val_list* bif_args = @ARGS@; - val_list args(bif_args->length() - 2); + const auto& bif_args = @ARGS@; + val_list args(bif_args->size() - 2); - for ( auto i = 2; i < bif_args->length(); ++i ) - args.push_back((*bif_args)[i]); + for ( auto i = 2u; i < bif_args->size(); ++i ) + args.push_back((*bif_args)[i].get()); auto rval = publish_event_args(args, topic->AsString(), frame); return val_mgr->GetBool(rval); @@ -225,11 +231,11 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool if ( ! topic->AsString()->Len() ) return val_mgr->GetFalse(); - val_list* bif_args = @ARGS@; - val_list args(bif_args->length() - 2); + const auto& bif_args = @ARGS@; + val_list args(bif_args->size() - 2); - for ( auto i = 2; i < bif_args->length(); ++i ) - args.push_back((*bif_args)[i]); + for ( auto i = 2u; i < bif_args->size(); ++i ) + args.push_back((*bif_args)[i].get()); auto rval = publish_event_args(args, topic->AsString(), frame); return val_mgr->GetBool(rval); diff --git a/src/main.cc b/src/main.cc index 0c4e22e28a..76be15b2d7 100644 --- a/src/main.cc +++ b/src/main.cc @@ -218,7 +218,7 @@ void done_with_network() mgr.Drain(); // Don't propagate this event to remote clients. mgr.Dispatch(new Event(net_done, - {new Val(timer_mgr->Time(), TYPE_TIME)}), + {make_intrusive(timer_mgr->Time(), TYPE_TIME)}), true); } diff --git a/src/plugin/Manager.cc b/src/plugin/Manager.cc index c7d52a3100..60be0212d7 100644 --- a/src/plugin/Manager.cc +++ b/src/plugin/Manager.cc @@ -1,5 +1,6 @@ // See the file "COPYING" in the main distribution directory for copyright. +#include #include #include #include @@ -619,15 +620,21 @@ int Manager::HookLoadFile(const Plugin::LoadType type, const string& file, const return rc; } -std::pair Manager::HookCallFunction(const Func* func, Frame* parent, val_list* vargs) const +std::pair Manager::HookCallFunction(const Func* func, Frame* parent, const zeek::Args& vecargs) const { HookArgumentList args; + std::optional vargs; if ( HavePluginForHook(META_HOOK_PRE) ) { + vargs = val_list(vecargs.size()); + + for ( const auto& v : vecargs ) + vargs->push_back(v.get()); + args.push_back(HookArgument(func)); args.push_back(HookArgument(parent)); - args.push_back(HookArgument(vargs)); + args.push_back(HookArgument(&vargs.value())); MetaHookPre(HOOK_CALL_FUNCTION, args); } @@ -637,11 +644,19 @@ std::pair Manager::HookCallFunction(const Func* func, Frame* parent, if ( l ) { + if ( ! vargs ) + { + vargs = val_list(vecargs.size()); + + for ( const auto& v : vecargs ) + vargs->push_back(v.get()); + } + for ( hook_list::iterator i = l->begin(); i != l->end(); ++i ) { Plugin* p = (*i).second; - v = p->HookCallFunction(func, parent, vargs); + v = p->HookCallFunction(func, parent, &vargs.value()); if ( v.first ) break; diff --git a/src/plugin/Manager.h b/src/plugin/Manager.h index 8127a77369..25c0235ebf 100644 --- a/src/plugin/Manager.h +++ b/src/plugin/Manager.h @@ -6,11 +6,11 @@ #include #include - #include "Plugin.h" #include "Component.h" #include "../Reporter.h" +#include "../ZeekArgs.h" namespace plugin { @@ -253,7 +253,7 @@ public: * functions and events, it may be any Val and must be ignored). If no * plugin handled the call, the method returns null. */ - std::pair HookCallFunction(const Func* func, Frame *parent, val_list* args) const; + std::pair HookCallFunction(const Func* func, Frame* parent, const zeek::Args& args) const; /** * Hook that filters the queuing of an event. diff --git a/src/plugin/Plugin.h b/src/plugin/Plugin.h index 7e8a35427c..b218c693d7 100644 --- a/src/plugin/Plugin.h +++ b/src/plugin/Plugin.h @@ -19,6 +19,7 @@ class ODesc; class Frame; class Func; class Event; +template class IntrusivePtr; namespace threading { struct Field; diff --git a/src/zeek.bif b/src/zeek.bif index cbd7bc0b54..9b41b98397 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -267,7 +267,7 @@ static void do_fmt(const char*& fmt, Val* v, ODesc* d) ++fmt; } -static int next_fmt(const char*& fmt, val_list* args, ODesc* d, int& n) +static int next_fmt(const char*& fmt, const zeek::Args* args, ODesc* d, int& n) { const char* fp = fmt; @@ -290,10 +290,10 @@ static int next_fmt(const char*& fmt, val_list* args, ODesc* d, int& n) return next_fmt(fmt, args, d, n); } - if ( ++n >= args->length() ) + if ( ++n >= static_cast(args->size()) ) return 0; - do_fmt(fmt, (*args)[n], d); + do_fmt(fmt, (*args)[n].get(), d); return *fmt != '\0'; } @@ -1413,12 +1413,12 @@ function sort%(v: any, ...%) : any BroType* elt_type = v->Type()->YieldType(); Func* comp = 0; - if ( @ARG@.length() > 2 ) + if ( @ARG@.size() > 2 ) builtin_error("sort() called with extraneous argument"); - if ( @ARG@.length() == 2 ) + if ( @ARG@.size() == 2 ) { - Val* comp_val = @ARG@[1]; + Val* comp_val = @ARG@[1].get(); if ( ! IsFunc(comp_val->Type()->Tag()) ) { builtin_error("second argument to sort() needs to be comparison function"); @@ -1483,12 +1483,12 @@ function order%(v: any, ...%) : index_vec BroType* elt_type = v->Type()->YieldType(); Func* comp = 0; - if ( @ARG@.length() > 2 ) + if ( @ARG@.size() > 2 ) builtin_error("order() called with extraneous argument"); - if ( @ARG@.length() == 2 ) + if ( @ARG@.size() == 2 ) { - Val* comp_val = @ARG@[1]; + Val* comp_val = @ARG@[1].get(); if ( ! IsFunc(comp_val->Type()->Tag()) ) { builtin_error("second argument to order() needs to be comparison function"); @@ -1595,7 +1595,7 @@ function cat_sep%(sep: string, def: string, ...%): string int pre_size = 0; - loop_over_list(@ARG@, i) + for ( auto i = 0u; i < @ARG@.size(); ++i ) { // Skip named parameters. if ( i < 2 ) @@ -1604,7 +1604,7 @@ function cat_sep%(sep: string, def: string, ...%): string if ( i > 2 ) d.Add(sep->CheckString(), 0); - Val* v = @ARG@[i]; + Val* v = @ARG@[i].get(); if ( v->Type()->Tag() == TYPE_STRING && ! v->AsString()->Len() ) v = def; @@ -1660,7 +1660,7 @@ function fmt%(...%): string if ( @ARGC@ == 0 ) return val_mgr->GetEmptyString(); - Val* fmt_v = @ARG@[0]; + Val* fmt_v = @ARG@[0].get(); // Type of fmt_v will be string here, check_built_in_call() in Func.cc // checks that. @@ -1674,13 +1674,13 @@ function fmt%(...%): string while ( next_fmt(fmt, @ARGS@, &d, n) ) ; - if ( n < @ARGC@ - 1 ) + if ( n < static_cast(@ARGC@) - 1 ) { builtin_error("too many arguments for format", fmt_v); return val_mgr->GetEmptyString(); } - else if ( n >= @ARGC@ ) + else if ( n >= static_cast(@ARGC@) ) { builtin_error("too few arguments for format", fmt_v); return val_mgr->GetEmptyString(); @@ -1703,7 +1703,7 @@ function print_raw%(...%): bool %{ ODesc d(DESC_READABLE); d.SetStyle(RAW_STYLE); - describe_vals(&@ARG@, &d, 0); + describe_vals(@ARG@, &d, 0); printf("%.*s", d.Len(), d.Description()); return val_mgr->GetBool(true); %} From b667c637dfa23960c6d0dae0cd22f71c012cbb79 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Tue, 24 Mar 2020 20:38:26 -0700 Subject: [PATCH 07/16] Deprecate Func::Call(val_list*, ...) The version taking a vector of intrusive pointers should be used instead. A variadic version is also added that forwards all arguments. --- NEWS | 5 +++ src/Discard.cc | 24 +++++------ src/Func.h | 22 +++++++++- src/RuleCondition.cc | 11 ++--- src/Val.cc | 57 ++++++++++++++----------- src/broker/Manager.cc | 8 +--- src/broker/messaging.bif | 8 ++-- src/file_analysis/analyzer/x509/X509.cc | 8 ++-- src/input/Manager.cc | 8 ++-- src/logging/Manager.cc | 35 +++++++-------- src/option.bif | 11 ++--- src/zeek.bif | 7 +-- 12 files changed, 114 insertions(+), 90 deletions(-) diff --git a/NEWS b/NEWS index a1ff0dca04..6fec41925f 100644 --- a/NEWS +++ b/NEWS @@ -47,6 +47,11 @@ Removed Functionality Deprecated Functionality ------------------------ +- The ``Func::Call(val_list*, ...)`` method is now deprecated. The alternate + overload taking a ``zeek::Args`` (``std::vector>``) should + be used instead. There's also now a variadic template that forwards all + arguments. + Zeek 3.1.0 ========== diff --git a/src/Discard.cc b/src/Discard.cc index 7ba0d2e7a5..b08d454bed 100644 --- a/src/Discard.cc +++ b/src/Discard.cc @@ -39,11 +39,11 @@ int Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen) if ( check_ip ) { - val_list args{ip->BuildPktHdrVal()}; + zeek::Args args{{AdoptRef{}, ip->BuildPktHdrVal()}}; try { - discard_packet = check_ip->Call(&args)->AsBool(); + discard_packet = check_ip->Call(args)->AsBool(); } catch ( InterpreterException& e ) @@ -91,14 +91,14 @@ int Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen) const struct tcphdr* tp = (const struct tcphdr*) data; int th_len = tp->th_off * 4; - val_list args{ - ip->BuildPktHdrVal(), - BuildData(data, th_len, len, caplen), + zeek::Args args{ + {AdoptRef{}, ip->BuildPktHdrVal()}, + {AdoptRef{}, BuildData(data, th_len, len, caplen)}, }; try { - discard_packet = check_tcp->Call(&args)->AsBool(); + discard_packet = check_tcp->Call(args)->AsBool(); } catch ( InterpreterException& e ) @@ -115,14 +115,14 @@ int Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen) const struct udphdr* up = (const struct udphdr*) data; int uh_len = sizeof (struct udphdr); - val_list args{ - ip->BuildPktHdrVal(), - BuildData(data, uh_len, len, caplen), + zeek::Args args{ + {AdoptRef{}, ip->BuildPktHdrVal()}, + {AdoptRef{}, BuildData(data, uh_len, len, caplen)}, }; try { - discard_packet = check_udp->Call(&args)->AsBool(); + discard_packet = check_udp->Call(args)->AsBool(); } catch ( InterpreterException& e ) @@ -138,11 +138,11 @@ int Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen) { const struct icmp* ih = (const struct icmp*) data; - val_list args{ip->BuildPktHdrVal()}; + zeek::Args args{{AdoptRef{}, ip->BuildPktHdrVal()}}; try { - discard_packet = check_icmp->Call(&args)->AsBool(); + discard_packet = check_icmp->Call(args)->AsBool(); } catch ( InterpreterException& e ) diff --git a/src/Func.h b/src/Func.h index a5ac9f3454..e790f71cdf 100644 --- a/src/Func.h +++ b/src/Func.h @@ -13,6 +13,8 @@ #include #include #include +#include +#include #include #include @@ -50,10 +52,28 @@ public: const vector& GetBodies() const { return bodies; } bool HasBodies() const { return bodies.size(); } - // TODO: deprecate + [[deprecated("Remove in v4.1. Use zeek::Args overload instead.")]] virtual IntrusivePtr Call(val_list* args, Frame* parent = nullptr) const; + + /** + * Calls a Zeek function. + * @param args the list of arguments to the function call. + * @param parent the frame from which the function is being called. + * @return the return value of the function call. + */ virtual IntrusivePtr Call(const zeek::Args& args, Frame* parent = nullptr) const = 0; + /** + * A version of Call() taking a variable number of individual arguments. + */ + template + std::enable_if_t< + std::is_convertible_v>, + IntrusivePtr>, + IntrusivePtr> + Call(Args&&... args) const + { return Call(zeek::Args{std::forward(args)...}); } + // Add a new event handler to an existing function (event). virtual void AddBody(IntrusivePtr new_body, id_list* new_inits, size_t new_frame_size, int priority = 0); diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc index 656d4d5cf7..b5331d5be1 100644 --- a/src/RuleCondition.cc +++ b/src/RuleCondition.cc @@ -167,19 +167,20 @@ bool RuleConditionEval::DoMatch(Rule* rule, RuleEndpointState* state, return id->ID_Val()->AsBool(); // Call function with a signature_state value as argument. - val_list args(2); - args.push_back(rule_matcher->BuildRuleStateValue(rule, state)); + zeek::Args args; + args.reserve(2); + args.emplace_back(AdoptRef{}, rule_matcher->BuildRuleStateValue(rule, state)); if ( data ) - args.push_back(new StringVal(len, (const char*) data)); + args.emplace_back(make_intrusive(len, (const char*) data)); else - args.push_back(val_mgr->GetEmptyString()); + args.emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); bool result = false; try { - auto val = id->ID_Val()->AsFunc()->Call(&args); + auto val = id->ID_Val()->AsFunc()->Call(args); result = val && val->AsBool(); } diff --git a/src/Val.cc b/src/Val.cc index a366b8bcd7..4b5e7db313 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -1835,25 +1835,24 @@ IntrusivePtr TableVal::Default(Val* index) } const Func* f = def_val->AsFunc(); - val_list vl; + zeek::Args vl; if ( index->Type()->Tag() == TYPE_LIST ) { const val_list* vl0 = index->AsListVal()->Vals(); - vl = val_list(vl0->length()); + vl.reserve(vl0->length()); + for ( const auto& v : *vl0 ) - vl.push_back(v->Ref()); + vl.emplace_back(NewRef{}, v); } else - { - vl = val_list{index->Ref()}; - } + vl.emplace_back(NewRef{}, index); IntrusivePtr result; try { - result = f->Call(&vl); + result = f->Call(vl); } catch ( InterpreterException& e ) @@ -2011,34 +2010,35 @@ void TableVal::CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe } const Func* f = thefunc->AsFunc(); - val_list vl { Ref() }; - IntrusivePtr type; + const auto& index_list = *index->AsListVal()->Vals(); + + zeek::Args vl; + vl.reserve(2 + index_list.length() + table_type->IsTable()); + vl.emplace_back(NewRef{}, this); switch ( tpe ) { case ELEMENT_NEW: - type = BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_NEW); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_NEW)); break; case ELEMENT_CHANGED: - type = BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_CHANGED); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_CHANGED)); break; case ELEMENT_REMOVED: - type = BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_REMOVED); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_REMOVED)); break; case ELEMENT_EXPIRED: - type = BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_EXPIRED); + vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_EXPIRED)); } - vl.append(type.release()); - for ( const auto& v : *index->AsListVal()->Vals() ) - vl.append(v->Ref()); + vl.emplace_back(NewRef{}, v); - if ( ! table_type->IsSet() ) - vl.append(old_value->Ref()); + if ( table_type->IsTable() ) + vl.emplace_back(NewRef{}, old_value); in_change_func = true; - f->Call(&vl); + f->Call(vl); } catch ( InterpreterException& e ) { @@ -2451,7 +2451,7 @@ double TableVal::CallExpireFunc(IntrusivePtr idx) } const Func* f = vf->AsFunc(); - val_list vl { Ref() }; + zeek::Args vl; const auto func_args = f->FType()->ArgTypes()->Types(); @@ -2460,20 +2460,27 @@ double TableVal::CallExpireFunc(IntrusivePtr idx) if ( ! any_idiom ) { - for ( const auto& v : *idx->AsListVal()->Vals() ) - vl.append(v->Ref()); + const auto& index_list = *idx->AsListVal()->Vals(); + vl.reserve(1 + index_list.length()); + vl.emplace_back(NewRef{}, this); + + for ( const auto& v : index_list ) + vl.emplace_back(NewRef{}, v); } else { + vl.reserve(2); + vl.emplace_back(NewRef{}, this); + ListVal* idx_list = idx->AsListVal(); // Flatten if only one element if ( idx_list->Length() == 1 ) - vl.append(idx_list->Index(0)->Ref()); + vl.emplace_back(NewRef{}, idx_list->Index(0)); else - vl.append(idx.release()); + vl.emplace_back(std::move(idx)); } - auto result = f->Call(&vl); + auto result = f->Call(vl); if ( result ) secs = result->AsInterval(); diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index 6fbf0f06f4..f99e35a445 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -545,12 +545,8 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int std::string serial_data(data, len); free(data); - val_list vl{ - stream->Ref(), - new StringVal(path), - }; - - auto v = log_topic_func->Call(&vl); + auto v = log_topic_func->Call(IntrusivePtr{NewRef{}, stream}, + make_intrusive(path)); if ( ! v ) { diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif index 6217facb41..125710865a 100644 --- a/src/broker/messaging.bif +++ b/src/broker/messaging.bif @@ -188,8 +188,8 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool if ( ! topic_func ) topic_func = global_scope()->Lookup("Cluster::rr_topic")->ID_Val()->AsFunc(); - val_list vl{pool->Ref(), key->Ref()}; - auto topic = topic_func->Call(&vl); + zeek::Args vl{{NewRef{}, pool}, {NewRef{}, key}}; + auto topic = topic_func->Call(vl); if ( ! topic->AsString()->Len() ) return val_mgr->GetFalse(); @@ -225,8 +225,8 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool if ( ! topic_func ) topic_func = global_scope()->Lookup("Cluster::hrw_topic")->ID_Val()->AsFunc(); - val_list vl{pool->Ref(), key->Ref()}; - auto topic = topic_func->Call(&vl); + zeek::Args vl{{NewRef{}, pool}, {NewRef{}, key}}; + auto topic = topic_func->Call(vl); if ( ! topic->AsString()->Len() ) return val_mgr->GetFalse(); diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc index f25ea7c177..30ddee9042 100644 --- a/src/file_analysis/analyzer/x509/X509.cc +++ b/src/file_analysis/analyzer/x509/X509.cc @@ -60,11 +60,9 @@ bool file_analysis::X509::EndOfFile() return false; // yup, let's call the callback. - val_list vl(3); - vl.push_back(GetFile()->GetVal()->Ref()); - vl.push_back(entry.release()); - vl.push_back(new StringVal(cert_sha256)); - cache_hit_callback->Call(&vl); + cache_hit_callback->Call(IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + std::move(entry), + make_intrusive(cert_sha256)); return false; } } diff --git a/src/input/Manager.cc b/src/input/Manager.cc index 5408a51d85..f20c9a3bae 100644 --- a/src/input/Manager.cc +++ b/src/input/Manager.cc @@ -1782,16 +1782,18 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals) bool Manager::CallPred(Func* pred_func, const int numvals, ...) const { bool result = false; - val_list vl(numvals); + zeek::Args vl; + vl.reserve(numvals); va_list lP; va_start(lP, numvals); for ( int i = 0; i < numvals; i++ ) - vl.push_back( va_arg(lP, Val*) ); + vl.emplace_back(AdoptRef{}, va_arg(lP, Val*)); va_end(lP); - auto v = pred_func->Call(&vl); + auto v = pred_func->Call(vl); + if ( v ) result = v->AsBool(); diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc index 87eac0e066..1a2125585b 100644 --- a/src/logging/Manager.cc +++ b/src/logging/Manager.cc @@ -723,11 +723,9 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) { // See whether the predicates indicates that we want // to log this record. - val_list vl{columns->Ref()}; - int result = 1; + auto v = filter->pred->Call(columns); - auto v = filter->pred->Call(&vl); if ( v ) result = v->AsBool(); @@ -737,23 +735,25 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) if ( filter->path_func ) { - Val* path_arg; - if ( filter->path_val ) - path_arg = filter->path_val->Ref(); - else - path_arg = val_mgr->GetEmptyString(); + IntrusivePtr path_arg; - Val* rec_arg; + if ( filter->path_val ) + path_arg = {NewRef{}, filter->path_val}; + else + path_arg = {AdoptRef{}, val_mgr->GetEmptyString()}; + + IntrusivePtr rec_arg; BroType* rt = filter->path_func->FType()->Args()->FieldType("rec"); if ( rt->Tag() == TYPE_RECORD ) - rec_arg = columns->CoerceTo(rt->AsRecordType(), true).release(); + rec_arg = columns->CoerceTo(rt->AsRecordType(), true); else // Can be TYPE_ANY here. - rec_arg = columns->Ref(); + rec_arg = columns; - val_list vl{id->Ref(), path_arg, rec_arg}; - auto v = filter->path_func->Call(&vl); + auto v = filter->path_func->Call(IntrusivePtr{NewRef{}, id}, + std::move(path_arg), + std::move(rec_arg)); if ( ! v ) return false; @@ -1058,8 +1058,7 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter, if ( filter->num_ext_fields > 0 ) { - val_list vl{filter->path_val->Ref()}; - auto res = filter->ext_func->Call(&vl); + auto res = filter->ext_func->Call(IntrusivePtr{NewRef{}, filter->path_val}); if ( res ) ext_rec = {AdoptRef{}, res.release()->AsRecordVal()}; @@ -1515,7 +1514,7 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con return true; // Create the RotationInfo record. - RecordVal* info = new RecordVal(BifType::Record::Log::RotationInfo); + auto info = make_intrusive(BifType::Record::Log::RotationInfo); info->Assign(0, winfo->type->Ref()); info->Assign(1, make_intrusive(new_name)); info->Assign(2, make_intrusive(winfo->writer->Info().path)); @@ -1534,11 +1533,9 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con assert(func); // Call the postprocessor function. - val_list vl{info}; - int result = 0; - auto v = func->Call(&vl); + auto v = func->Call(std::move(info)); if ( v ) result = v->AsBool(); diff --git a/src/option.bif b/src/option.bif index 13b2215923..a897618483 100644 --- a/src/option.bif +++ b/src/option.bif @@ -16,14 +16,15 @@ static bool call_option_handlers_and_set_value(StringVal* name, ID* i, for ( auto handler_function : i->GetOptionHandlers() ) { bool add_loc = handler_function->FType()->AsFuncType()->ArgTypes()->Types()->length() == 3; - val_list vl(2 + add_loc); - vl.push_back(name->Ref()); - vl.push_back(val->Ref()); + zeek::Args vl; + vl.reserve(2 + add_loc); + vl.emplace_back(NewRef{}, name); + vl.emplace_back(val); if ( add_loc ) - vl.push_back(location->Ref()); + vl.emplace_back(NewRef{}, location); - val = handler_function->Call(&vl); // consumed by next call. + val = handler_function->Call(vl); // consumed by next call. if ( ! val ) { diff --git a/src/zeek.bif b/src/zeek.bif index 9b41b98397..8a957165a4 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -1335,11 +1335,8 @@ bool sort_function(Val* a, Val* b) if ( ! b ) return 1; - val_list sort_func_args; - sort_func_args.push_back(a->Ref()); - sort_func_args.push_back(b->Ref()); - - auto result = sort_function_comp->Call(&sort_func_args); + auto result = sort_function_comp->Call(IntrusivePtr{NewRef{}, a}, + IntrusivePtr{NewRef{}, b}); int int_result = result->CoerceToInt(); return int_result < 0; From 0db484cc7aa4f8320c5cb39f89155c0d08bbbac3 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Wed, 25 Mar 2020 13:07:30 -0700 Subject: [PATCH 08/16] Deprecate EventMgr::QueueEvent() and update usages to Enqueue() --- NEWS | 3 + src/Conn.cc | 16 +++- src/Conn.h | 10 +++ src/Event.cc | 28 +++---- src/Event.h | 46 ++++++----- src/Expr.cc | 8 +- src/Sessions.cc | 3 +- src/Stmt.cc | 5 +- src/file_analysis/analyzer/x509/OCSP.cc | 81 ++++++++++--------- src/file_analysis/analyzer/x509/X509.cc | 19 +++-- src/file_analysis/analyzer/x509/X509Common.cc | 33 ++++---- src/file_analysis/analyzer/x509/X509Common.h | 3 +- src/file_analysis/analyzer/x509/functions.bif | 6 +- src/input/Manager.cc | 31 +++---- 14 files changed, 164 insertions(+), 128 deletions(-) diff --git a/NEWS b/NEWS index 6fec41925f..ae171789fd 100644 --- a/NEWS +++ b/NEWS @@ -52,6 +52,9 @@ Deprecated Functionality be used instead. There's also now a variadic template that forwards all arguments. +- The ``EventMgr::QueueEvent()`` and EventMgr::QueueEventFast()`` methods + are now deprecated, use ``EventMgr::Enqueue()`` instead. + Zeek 3.1.0 ========== diff --git a/src/Conn.cc b/src/Conn.cc index 99d1b22933..d512f32166 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -497,15 +497,15 @@ void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_l } // "this" is passed as a cookie for the event - mgr.QueueEvent(f, std::move(vl), SOURCE_LOCAL, - a ? a->GetID() : 0, timer_mgr, this); + mgr.Enqueue(f, zeek::val_list_to_args(&vl), SOURCE_LOCAL, + a ? a->GetID() : 0, timer_mgr, this); } void Connection::ConnectionEventFast(EventHandlerPtr f, analyzer::Analyzer* a, val_list vl) { // "this" is passed as a cookie for the event - mgr.QueueEventFast(f, std::move(vl), SOURCE_LOCAL, - a ? a->GetID() : 0, timer_mgr, this); + mgr.Enqueue(f, zeek::val_list_to_args(&vl), SOURCE_LOCAL, + a ? a->GetID() : 0, timer_mgr, this); } void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_list* vl) @@ -514,6 +514,14 @@ void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_l delete vl; } +void Connection::EnqueueEvent(EventHandlerPtr f, zeek::Args args, + analyzer::Analyzer* a) + { + // "this" is passed as a cookie for the event + mgr.Enqueue(f, std::move(args), SOURCE_LOCAL, a ? a->GetID() : 0, + timer_mgr, this); + } + void Connection::Weird(const char* name, const char* addl) { weird = 1; diff --git a/src/Conn.h b/src/Conn.h index 1468d7041e..53f8ff74a7 100644 --- a/src/Conn.h +++ b/src/Conn.h @@ -12,6 +12,7 @@ #include "IPAddr.h" #include "UID.h" #include "WeirdState.h" +#include "ZeekArgs.h" #include "iosource/Packet.h" #include "analyzer/Tag.h" @@ -187,6 +188,7 @@ public: // If a handler exists for 'f', an event will be generated. In any case, // reference count for each element in the 'vl' list are decremented. The // arguments used for the event are whatevever is provided in 'vl'. + // TODO: deprecate void ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* analyzer, val_list vl); @@ -194,6 +196,7 @@ public: // pointer instead of by value. This function takes ownership of the // memory pointed to by 'vl' and also for decrementing the reference count // of each of its elements. + // TODO: deprecate void ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* analyzer, val_list* vl); @@ -205,9 +208,16 @@ public: // the case where there's no handlers (one usually also does that because // it would be a waste of effort to construct all the event arguments when // there's no handlers to consume them). + // TODO: deprecate void ConnectionEventFast(EventHandlerPtr f, analyzer::Analyzer* analyzer, val_list vl); + /** + * Enqueues an event associated with this connection and given analyzer. + */ + void EnqueueEvent(EventHandlerPtr f, zeek::Args args, + analyzer::Analyzer* analyzer = nullptr); + void Weird(const char* name, const char* addl = ""); bool DidWeird() const { return weird != 0; } diff --git a/src/Event.cc b/src/Event.cc index f3665cf54d..621b03c45b 100644 --- a/src/Event.cc +++ b/src/Event.cc @@ -109,38 +109,30 @@ void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list vl, SourceID src, analyzer::ID aid, TimerMgr* mgr, BroObj* obj) { + auto args = zeek::val_list_to_args(&vl); + if ( h ) - QueueEvent(new Event(h, zeek::val_list_to_args(&vl), src, aid, mgr, obj)); - else - { - for ( const auto& v : vl ) - Unref(v); - } + Enqueue(h, std::move(args), src, aid, mgr, obj); } void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list* vl, SourceID src, analyzer::ID aid, TimerMgr* mgr, BroObj* obj) { - QueueEvent(h, std::move(*vl), src, aid, mgr, obj); + auto args = zeek::val_list_to_args(vl); delete vl; + + if ( h ) + Enqueue(h, std::move(args), src, aid, mgr, obj); } -void EventMgr::QueueCheckedEvent(const EventHandlerPtr& h, zeek::Args vl, - SourceID src, analyzer::ID aid, - TimerMgr* mgr, BroObj* obj) +void EventMgr::Enqueue(const EventHandlerPtr& h, zeek::Args vl, + SourceID src, analyzer::ID aid, + TimerMgr* mgr, BroObj* obj) { QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj)); } -void EventMgr::QueueUncheckedEvent(const EventHandlerPtr& h, zeek::Args vl, - SourceID src, analyzer::ID aid, - TimerMgr* mgr, BroObj* obj) - { - if ( h ) - QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj)); - } - void EventMgr::QueueEvent(Event* event) { bool done = PLUGIN_HOOK_WITH_RESULT(HOOK_QUEUE_EVENT, HookQueueEvent(event), false); diff --git a/src/Event.h b/src/Event.h index 46d166c1a3..327b186f1d 100644 --- a/src/Event.h +++ b/src/Event.h @@ -8,6 +8,9 @@ #include "Flare.h" #include "ZeekArgs.h" +#include +#include + class EventMgr; class Event : public BroObj { @@ -60,7 +63,7 @@ public: // because it would be a waste of effort to construct all the event // arguments when there's no handlers to consume them). // TODO: deprecate - /* [[deprecated("Remove in v4.1. Use IntrusivePtr overload instead.")]] */ + /* [[deprecated("Remove in v4.1. Use Enqueue() instead.")]] */ void QueueEventFast(const EventHandlerPtr &h, val_list vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, TimerMgr* mgr = 0, BroObj* obj = 0); @@ -71,8 +74,7 @@ public: // checked for event handler existence, you may wish to call // QueueEventFast() instead of this function to prevent the redundant // existence check. - // TODO: deprecate - /* [[deprecated("Remove in v4.1. Use IntrusivePtr overload instead.")]] */ + [[deprecated("Remove in v4.1. Use Enqueue() instead.")]] void QueueEvent(const EventHandlerPtr &h, val_list vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, TimerMgr* mgr = 0, BroObj* obj = 0); @@ -81,32 +83,36 @@ public: // pointer instead of by value. This function takes ownership of the // memory pointed to by 'vl' as well as decrementing the reference count of // each of its elements. - // TODO: deprecate - /* [[deprecated("Remove in v4.1. Use IntrusivePtr overload instead.")]] */ + [[deprecated("Remove in v4.1. Use Enqueue() instead.")]] void QueueEvent(const EventHandlerPtr &h, val_list* vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, TimerMgr* mgr = 0, BroObj* obj = 0); /** - * Queues an event without first checking if there's an event handler - * remote consumer. If there are actually no handlers/consumers upon - * dispatching the event, nothing happens besides having wasted a bit of - * time and resources. This method is mostly useful from a performance - * standpoint: usually callers have already checked that the event will - * consumed so they don't waste time creating an argument list that will - * only be discarded, so there's no need to do the same check again when - * going to queue the event. + * Adds an event to the queue. If no handler is found for the event + * when later going to call it, nothing happens except for having + * wasted a bit of time/resources, so callers may want to first check + * if any handler/consumer exists before enqueuing an event. + * @param h reference to the event handler to later call. + * @param vl the argument list to the event handler call. + * @param src indicates the origin of the event (local versus remote). + * @param aid identifies the protocol analyzer generating the event. + * @param obj an arbitrary object to use as a "cookie" or just hold a + * reference to until dispatching the event. */ - void QueueUncheckedEvent(const EventHandlerPtr& h, zeek::Args vl, - SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = nullptr, BroObj* obj = nullptr); + void Enqueue(const EventHandlerPtr& h, zeek::Args vl, + SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, + TimerMgr* mgr = nullptr, BroObj* obj = nullptr); /** - * Queues an event if it has an event handler or remote consumer. + * A version of Enqueue() taking a variable number of arguments. */ - void QueueCheckedEvent(const EventHandlerPtr& h, zeek::Args vl, - SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = nullptr, BroObj* obj = nullptr); + template + std::enable_if_t< + std::is_convertible_v< + std::tuple_element_t<0, std::tuple>, IntrusivePtr>> + Enqueue(const EventHandlerPtr& h, Args&&... args) + { return Enqueue(h, zeek::Args{std::forward(args)...}); } void Dispatch(Event* event, bool no_remote = false); diff --git a/src/Expr.cc b/src/Expr.cc index 09a0c63fc0..693ff316c2 100644 --- a/src/Expr.cc +++ b/src/Expr.cc @@ -3897,7 +3897,8 @@ ScheduleTimer::~ScheduleTimer() void ScheduleTimer::Dispatch(double /* t */, int /* is_expire */) { - mgr.QueueUncheckedEvent(event, std::move(args), SOURCE_LOCAL, 0, tmgr); + if ( event ) + mgr.Enqueue(event, std::move(args), SOURCE_LOCAL, 0, tmgr); } ScheduleExpr::ScheduleExpr(IntrusivePtr arg_when, @@ -4443,7 +4444,10 @@ IntrusivePtr EventExpr::Eval(Frame* f) const return nullptr; auto v = eval_list(f, args.get()); - mgr.QueueUncheckedEvent(handler, std::move(*v)); + + if ( handler ) + mgr.Enqueue(handler, std::move(*v)); + return nullptr; } diff --git a/src/Sessions.cc b/src/Sessions.cc index 5eb83ffcd8..d39fa9f8e6 100644 --- a/src/Sessions.cc +++ b/src/Sessions.cc @@ -330,7 +330,8 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr } if ( mobile_ipv6_message ) - mgr.QueueEvent(mobile_ipv6_message, {ip_hdr->BuildPktHdrVal()}); + mgr.Enqueue(mobile_ipv6_message, + IntrusivePtr{AdoptRef{}, ip_hdr->BuildPktHdrVal()}); if ( ip_hdr->NextProto() != IPPROTO_NONE ) Weird("mobility_piggyback", pkt, encapsulation); diff --git a/src/Stmt.cc b/src/Stmt.cc index 2e90592dd6..1cfc0c93df 100644 --- a/src/Stmt.cc +++ b/src/Stmt.cc @@ -960,9 +960,10 @@ IntrusivePtr EventStmt::Exec(Frame* f, stmt_flow_type& flow) const { RegisterAccess(); auto args = eval_list(f, event_expr->Args()); + auto h = event_expr->Handler(); - if ( args ) - mgr.QueueUncheckedEvent(event_expr->Handler(), std::move(*args)); + if ( args && h ) + mgr.Enqueue(h, std::move(*args)); flow = FLOW_NEXT; return nullptr; diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc index 30b7e4283c..801dd50f12 100644 --- a/src/file_analysis/analyzer/x509/OCSP.cc +++ b/src/file_analysis/analyzer/x509/OCSP.cc @@ -75,7 +75,7 @@ static bool OCSP_RESPID_bio(OCSP_BASICRESP* basic_resp, BIO* bio) return true; } -bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, val_list* vl, BIO* bio) +static bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, zeek::Args* vl, BIO* bio) { ASN1_OBJECT* hash_alg = nullptr; ASN1_OCTET_STRING* issuer_name_hash = nullptr; @@ -89,10 +89,10 @@ bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, val_list* vl, BIO* bio) if ( ! res ) { reporter->Weird("OpenSSL failed to get OCSP_CERTID info"); - vl->push_back(val_mgr->GetEmptyString()); - vl->push_back(val_mgr->GetEmptyString()); - vl->push_back(val_mgr->GetEmptyString()); - vl->push_back(val_mgr->GetEmptyString()); + vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); + vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); + vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); + vl->emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); return false; } @@ -101,22 +101,22 @@ bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, val_list* vl, BIO* bio) i2a_ASN1_OBJECT(bio, hash_alg); int len = BIO_read(bio, buf, sizeof(buf)); - vl->push_back(new StringVal(len, buf)); + vl->emplace_back(make_intrusive(len, buf)); BIO_reset(bio); i2a_ASN1_STRING(bio, issuer_name_hash, V_ASN1_OCTET_STRING); len = BIO_read(bio, buf, sizeof(buf)); - vl->push_back(new StringVal(len, buf)); + vl->emplace_back(make_intrusive(len, buf)); BIO_reset(bio); i2a_ASN1_STRING(bio, issuer_key_hash, V_ASN1_OCTET_STRING); len = BIO_read(bio, buf, sizeof(buf)); - vl->push_back(new StringVal(len, buf)); + vl->emplace_back(make_intrusive(len, buf)); BIO_reset(bio); i2a_ASN1_INTEGER(bio, serial_number); len = BIO_read(bio, buf, sizeof(buf)); - vl->push_back(new StringVal(len, buf)); + vl->emplace_back(make_intrusive(len, buf)); BIO_reset(bio); return true; @@ -430,14 +430,17 @@ void file_analysis::OCSP::ParseRequest(OCSP_REQUEST* req) int req_count = OCSP_request_onereq_count(req); for ( int i=0; iGetVal()->Ref()); + zeek::Args rvl; + rvl.reserve(5); + rvl.emplace_back(NewRef{}, GetFile()->GetVal()); OCSP_ONEREQ *one_req = OCSP_request_onereq_get0(req, i); OCSP_CERTID *cert_id = OCSP_onereq_get0_id(one_req); ocsp_add_cert_id(cert_id, &rvl, bio); - mgr.QueueEvent(ocsp_request_certificate, std::move(rvl)); + + if ( ocsp_request_certificate ) + mgr.Enqueue(ocsp_request_certificate, std::move(rvl)); } BIO_free(bio); @@ -479,7 +482,8 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) //int len = BIO_read(bio, buf, sizeof(buf)); //BIO_reset(bio); - val_list vl(8); + zeek::Args vl; + vl.reserve(8); // get the basic response basic_resp = OCSP_response_get1_basic(resp); @@ -498,26 +502,26 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) } #endif - vl.push_back(GetFile()->GetVal()->Ref()); - vl.push_back(status_val); + vl.emplace_back(NewRef{}, GetFile()->GetVal()); + vl.emplace_back(AdoptRef{}, status_val); #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER) - vl.push_back(val_mgr->GetCount((uint64_t)ASN1_INTEGER_get(resp_data->version))); + vl.emplace_back(AdoptRef{}, val_mgr->GetCount((uint64_t)ASN1_INTEGER_get(resp_data->version))); #else - vl.push_back(parse_basic_resp_data_version(basic_resp)); + vl.emplace_back(AdoptRef{}, parse_basic_resp_data_version(basic_resp)); #endif // responderID if ( OCSP_RESPID_bio(basic_resp, bio) ) { len = BIO_read(bio, buf, sizeof(buf)); - vl.push_back(new StringVal(len, buf)); + vl.emplace_back(make_intrusive(len, buf)); BIO_reset(bio); } else { reporter->Weird("OpenSSL failed to get OCSP responder id"); - vl.push_back(val_mgr->GetEmptyString()); + vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); } // producedAt @@ -527,7 +531,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) produced_at = OCSP_resp_get0_produced_at(basic_resp); #endif - vl.push_back(new Val(GetTimeFromAsn1(produced_at, GetFile(), reporter), TYPE_TIME)); + vl.emplace_back(make_intrusive(GetTimeFromAsn1(produced_at, GetFile(), reporter), TYPE_TIME)); // responses @@ -540,8 +544,9 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) if ( !single_resp ) continue; - val_list rvl(10); - rvl.push_back(GetFile()->GetVal()->Ref()); + zeek::Args rvl; + rvl.reserve(10); + rvl.emplace_back(NewRef{}, GetFile()->GetVal()); // cert id const OCSP_CERTID* cert_id = nullptr; @@ -569,38 +574,39 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) reporter->Weird("OpenSSL failed to find status of OCSP response"); const char* cert_status_str = OCSP_cert_status_str(status); - rvl.push_back(new StringVal(strlen(cert_status_str), cert_status_str)); + rvl.emplace_back(make_intrusive(strlen(cert_status_str), cert_status_str)); // revocation time and reason if revoked if ( status == V_OCSP_CERTSTATUS_REVOKED ) { - rvl.push_back(new Val(GetTimeFromAsn1(revoke_time, GetFile(), reporter), TYPE_TIME)); + rvl.emplace_back(make_intrusive(GetTimeFromAsn1(revoke_time, GetFile(), reporter), TYPE_TIME)); if ( reason != OCSP_REVOKED_STATUS_NOSTATUS ) { const char* revoke_reason = OCSP_crl_reason_str(reason); - rvl.push_back(new StringVal(strlen(revoke_reason), revoke_reason)); + rvl.emplace_back(make_intrusive(strlen(revoke_reason), revoke_reason)); } else - rvl.push_back(new StringVal(0, "")); + rvl.emplace_back(make_intrusive(0, "")); } else { - rvl.push_back(new Val(0.0, TYPE_TIME)); - rvl.push_back(new StringVal(0, "")); + rvl.emplace_back(make_intrusive(0.0, TYPE_TIME)); + rvl.emplace_back(make_intrusive(0, "")); } if ( this_update ) - rvl.push_back(new Val(GetTimeFromAsn1(this_update, GetFile(), reporter), TYPE_TIME)); + rvl.emplace_back(make_intrusive(GetTimeFromAsn1(this_update, GetFile(), reporter), TYPE_TIME)); else - rvl.push_back(new Val(0.0, TYPE_TIME)); + rvl.emplace_back(make_intrusive(0.0, TYPE_TIME)); if ( next_update ) - rvl.push_back(new Val(GetTimeFromAsn1(next_update, GetFile(), reporter), TYPE_TIME)); + rvl.emplace_back(make_intrusive(GetTimeFromAsn1(next_update, GetFile(), reporter), TYPE_TIME)); else - rvl.push_back(new Val(0.0, TYPE_TIME)); + rvl.emplace_back(make_intrusive(0.0, TYPE_TIME)); - mgr.QueueEvent(ocsp_response_certificate, std::move(rvl)); + if ( ocsp_response_certificate ) + mgr.Enqueue(ocsp_response_certificate, std::move(rvl)); num_ext = OCSP_SINGLERESP_get_ext_count(single_resp); for ( int k = 0; k < num_ext; ++k ) @@ -616,10 +622,10 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER) i2a_ASN1_OBJECT(bio, basic_resp->signatureAlgorithm->algorithm); len = BIO_read(bio, buf, sizeof(buf)); - vl.push_back(new StringVal(len, buf)); + vl.emplace_back(make_intrusive(len, buf)); BIO_reset(bio); #else - vl.push_back(parse_basic_resp_sig_alg(basic_resp, bio, buf, sizeof(buf))); + vl.emplace_back(AdoptRef{}, parse_basic_resp_sig_alg(basic_resp, bio, buf, sizeof(buf))); #endif //i2a_ASN1_OBJECT(bio, basic_resp->signature); @@ -628,7 +634,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) //BIO_reset(bio); certs_vector = new VectorVal(internal_type("x509_opaque_vector")->AsVectorType()); - vl.push_back(certs_vector); + vl.emplace_back(AdoptRef{}, certs_vector); #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER) certs = basic_resp->certs; @@ -650,7 +656,8 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) } } - mgr.QueueEvent(ocsp_response_bytes, std::move(vl)); + if ( ocsp_response_bytes ) + mgr.Enqueue(ocsp_response_bytes, std::move(vl)); // ok, now that we are done with the actual certificate - let's parse extensions :) num_ext = OCSP_BASICRESP_get_ext_count(basic_resp); diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc index 30ddee9042..cc1173d7f2 100644 --- a/src/file_analysis/analyzer/x509/X509.cc +++ b/src/file_analysis/analyzer/x509/X509.cc @@ -82,11 +82,11 @@ bool file_analysis::X509::EndOfFile() RecordVal* cert_record = ParseCertificate(cert_val, GetFile()); // and send the record on to scriptland - mgr.QueueEvent(x509_certificate, { - GetFile()->GetVal()->Ref(), - cert_val->Ref(), - cert_record->Ref(), // we Ref it here, because we want to keep a copy around for now... - }); + if ( x509_certificate ) + mgr.Enqueue(x509_certificate, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + IntrusivePtr{NewRef{}, cert_val}, + IntrusivePtr{NewRef{}, cert_record}); // after parsing the certificate - parse the extensions... @@ -420,7 +420,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) } } - RecordVal* sanExt = new RecordVal(BifType::Record::X509::SubjectAlternativeName); + auto sanExt = make_intrusive(BifType::Record::X509::SubjectAlternativeName); if ( names != 0 ) sanExt->Assign(0, names); @@ -436,10 +436,9 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) sanExt->Assign(4, val_mgr->GetBool(otherfields)); - mgr.QueueEvent(x509_ext_subject_alternative_name, { - GetFile()->GetVal()->Ref(), - sanExt, - }); + mgr.Enqueue(x509_ext_subject_alternative_name, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + std::move(sanExt)); GENERAL_NAMES_free(altname); } diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc index a2eb1d7d9a..86ab607707 100644 --- a/src/file_analysis/analyzer/x509/X509Common.cc +++ b/src/file_analysis/analyzer/x509/X509Common.cc @@ -257,12 +257,19 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa } } - StringVal* ext_val = GetExtensionFromBIO(bio, GetFile()); + auto ext_val = GetExtensionFromBIO(bio, GetFile()); + + if ( ! h ) + { + // let individual analyzers parse more. + ParseExtensionsSpecific(ex, global, ext_asn, oid); + return; + } if ( ! ext_val ) - ext_val = new StringVal(0, ""); + ext_val = make_intrusive(0, ""); - RecordVal* pX509Ext = new RecordVal(BifType::Record::X509::Extension); + auto pX509Ext = make_intrusive(BifType::Record::X509::Extension); pX509Ext->Assign(0, make_intrusive(name)); if ( short_name and strlen(short_name) > 0 ) @@ -280,22 +287,18 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa // but I am not sure if there is a better way to do it... if ( h == ocsp_extension ) - mgr.QueueEvent(h, { - GetFile()->GetVal()->Ref(), - pX509Ext, - val_mgr->GetBool(global ? 1 : 0), - }); + mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + std::move(pX509Ext), + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(global)}); else - mgr.QueueEvent(h, { - GetFile()->GetVal()->Ref(), - pX509Ext, - }); + mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + std::move(pX509Ext)); // let individual analyzers parse more. ParseExtensionsSpecific(ex, global, ext_asn, oid); } -StringVal* file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f) +IntrusivePtr file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f) { BIO_flush(bio); ERR_clear_error(); @@ -313,7 +316,7 @@ StringVal* file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f) if ( length == 0 ) { BIO_free_all(bio); - return val_mgr->GetEmptyString(); + return {AdoptRef{}, val_mgr->GetEmptyString()}; } char* buffer = (char*) malloc(length); @@ -328,7 +331,7 @@ StringVal* file_analysis::X509Common::GetExtensionFromBIO(BIO* bio, File* f) } BIO_read(bio, (void*) buffer, length); - StringVal* ext_val = new StringVal(length, buffer); + auto ext_val = make_intrusive(length, buffer); free(buffer); BIO_free_all(bio); diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h index 2fd69c17ee..f8f934093e 100644 --- a/src/file_analysis/analyzer/x509/X509Common.h +++ b/src/file_analysis/analyzer/x509/X509Common.h @@ -13,6 +13,7 @@ class EventHandlerPtr; class Reporter; class StringVal; +template class IntrusivePtr; namespace file_analysis { @@ -34,7 +35,7 @@ public: * * @return The X509 extension value. */ - static StringVal* GetExtensionFromBIO(BIO* bio, File* f = 0); + static IntrusivePtr GetExtensionFromBIO(BIO* bio, File* f = 0); static double GetTimeFromAsn1(const ASN1_TIME* atime, File* f, Reporter* reporter); diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif index 85a1af2fa8..7b4819e213 100644 --- a/src/file_analysis/analyzer/x509/functions.bif +++ b/src/file_analysis/analyzer/x509/functions.bif @@ -189,12 +189,12 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F else i2d_X509_bio(bio, h->GetCertificate()); - StringVal* ext_val = file_analysis::X509::GetExtensionFromBIO(bio); + auto ext_val = file_analysis::X509::GetExtensionFromBIO(bio); if ( ! ext_val ) - ext_val = val_mgr->GetEmptyString(); + ext_val = {AdoptRef{}, val_mgr->GetEmptyString()}; - return ext_val; + return ext_val.release(); %} ## Verifies an OCSP reply. diff --git a/src/input/Manager.cc b/src/input/Manager.cc index f20c9a3bae..010d4f88fa 100644 --- a/src/input/Manager.cc +++ b/src/input/Manager.cc @@ -1837,12 +1837,14 @@ bool Manager::SendEvent(ReaderFrontend* reader, const string& name, const int nu bool convert_error = false; - val_list vl(num_vals); + zeek::Args vl; + vl.reserve(num_vals); for ( int j = 0; j < num_vals; j++) { Val* v = ValueToVal(i, vals[j], convert_error); - vl.push_back(v); + vl.emplace_back(AdoptRef{}, v); + if ( v && ! convert_error && ! same_type(type->FieldType(j), v->Type()) ) { convert_error = true; @@ -1853,21 +1855,17 @@ bool Manager::SendEvent(ReaderFrontend* reader, const string& name, const int nu delete_value_ptr_array(vals, num_vals); if ( convert_error ) - { - for ( const auto& v : vl ) - Unref(v); - return false; - } - else - mgr.QueueEvent(handler, std::move(vl), SOURCE_LOCAL); + else if ( handler ) + mgr.Enqueue(handler, std::move(vl), SOURCE_LOCAL); return true; } void Manager::SendEvent(EventHandlerPtr ev, const int numvals, ...) const { - val_list vl(numvals); + zeek::Args vl; + vl.reserve(numvals); #ifdef DEBUG DBG_LOG(DBG_INPUT, "SendEvent with %d vals", @@ -1877,16 +1875,18 @@ void Manager::SendEvent(EventHandlerPtr ev, const int numvals, ...) const va_list lP; va_start(lP, numvals); for ( int i = 0; i < numvals; i++ ) - vl.push_back( va_arg(lP, Val*) ); + vl.emplace_back(AdoptRef{}, va_arg(lP, Val*)); va_end(lP); - mgr.QueueEvent(ev, std::move(vl), SOURCE_LOCAL); + if ( ev ) + mgr.Enqueue(ev, std::move(vl), SOURCE_LOCAL); } void Manager::SendEvent(EventHandlerPtr ev, list events) const { - val_list vl(events.size()); + zeek::Args vl; + vl.reserve(events.size()); #ifdef DEBUG DBG_LOG(DBG_INPUT, "SendEvent with %" PRIuPTR " vals (list)", @@ -1894,9 +1894,10 @@ void Manager::SendEvent(EventHandlerPtr ev, list events) const #endif for ( list::iterator i = events.begin(); i != events.end(); i++ ) - vl.push_back( *i ); + vl.emplace_back(AdoptRef{}, *i); - mgr.QueueEvent(ev, std::move(vl), SOURCE_LOCAL); + if ( ev ) + mgr.Enqueue(ev, std::move(vl), SOURCE_LOCAL); } // Convert a bro list value to a bro record value. From 6980f63a9125c919b93ee070b5976eb3a2da0e29 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Wed, 25 Mar 2020 15:20:05 -0700 Subject: [PATCH 09/16] Deprecate EventMgr::QueueEventFast() and update usages to Enqueue() --- aux/bifcl | 2 +- src/Anon.cc | 10 ++-- src/DNS_Mgr.cc | 17 +++---- src/Event.cc | 2 +- src/Event.h | 3 +- src/Reporter.cc | 18 +++---- src/RuleAction.cc | 12 ++--- src/Sessions.cc | 4 +- src/Stats.cc | 10 ++-- src/analyzer/Analyzer.cc | 24 +++++----- src/analyzer/protocol/arp/ARP.cc | 30 ++++++------ src/analyzer/protocol/pia/PIA.cc | 18 ++++--- src/broker/Manager.cc | 28 +++++------ src/file_analysis/File.cc | 11 +++-- src/file_analysis/File.h | 10 ++++ src/file_analysis/Manager.cc | 11 ++--- .../analyzer/data_event/DataEvent.cc | 18 +++---- src/file_analysis/analyzer/entropy/Entropy.cc | 10 ++-- src/file_analysis/analyzer/hash/Hash.cc | 10 ++-- src/file_analysis/analyzer/pe/pe-analyzer.pac | 47 +++++++++---------- .../analyzer/unified2/unified2-analyzer.pac | 30 +++++------- src/file_analysis/analyzer/x509/OCSP.cc | 16 +++---- src/file_analysis/analyzer/x509/X509.cc | 10 ++-- .../analyzer/x509/x509-extension.pac | 18 +++---- src/iosource/pcap/Source.cc | 2 +- src/logging/Manager.cc | 2 +- src/main.cc | 12 ++--- 27 files changed, 187 insertions(+), 198 deletions(-) diff --git a/aux/bifcl b/aux/bifcl index 75f645ac9b..3fefee1630 160000 --- a/aux/bifcl +++ b/aux/bifcl @@ -1 +1 @@ -Subproject commit 75f645ac9bdfd141f549b7e1a197459f2ad518be +Subproject commit 3fefee1630269b96ea4f39021bf387b9d0abfd80 diff --git a/src/Anon.cc b/src/Anon.cc index 691cf7f2d5..bfc8f57aa1 100644 --- a/src/Anon.cc +++ b/src/Anon.cc @@ -421,12 +421,10 @@ ipaddr32_t anonymize_ip(ipaddr32_t ip, enum ip_addr_anonymization_class_t cl) void log_anonymization_mapping(ipaddr32_t input, ipaddr32_t output) { if ( anonymization_mapping ) - { - mgr.QueueEventFast(anonymization_mapping, { - new AddrVal(input), - new AddrVal(output) - }); - } + mgr.Enqueue(anonymization_mapping, + make_intrusive(input), + make_intrusive(output) + ); } #endif diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc index d7c76d8bd6..43e0d8962a 100644 --- a/src/DNS_Mgr.cc +++ b/src/DNS_Mgr.cc @@ -704,7 +704,7 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm) if ( ! e ) return; - mgr.QueueEventFast(e, {BuildMappingVal(dm).release()}); + mgr.Enqueue(e, BuildMappingVal(dm)); } void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm, @@ -713,11 +713,11 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm, if ( ! e ) return; - mgr.QueueEventFast(e, { - BuildMappingVal(dm).release(), - l1->ConvertToSet(), - l2->ConvertToSet(), - }); + mgr.Enqueue(e, + BuildMappingVal(dm), + IntrusivePtr{AdoptRef{}, l1->ConvertToSet()}, + IntrusivePtr{AdoptRef{}, l2->ConvertToSet()} + ); } void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm) @@ -725,10 +725,7 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm) if ( ! e ) return; - mgr.QueueEventFast(e, { - BuildMappingVal(old_dm).release(), - BuildMappingVal(new_dm).release(), - }); + mgr.Enqueue(e, BuildMappingVal(old_dm), BuildMappingVal(new_dm)); } IntrusivePtr DNS_Mgr::BuildMappingVal(DNS_Mapping* dm) diff --git a/src/Event.cc b/src/Event.cc index 621b03c45b..48334b98b2 100644 --- a/src/Event.cc +++ b/src/Event.cc @@ -164,7 +164,7 @@ void EventMgr::Dispatch(Event* event, bool no_remote) void EventMgr::Drain() { if ( event_queue_flush_point ) - QueueEventFast(event_queue_flush_point, val_list{}); + Enqueue(event_queue_flush_point, zeek::Args{}); SegmentProfiler prof(segment_logger, "draining-events"); diff --git a/src/Event.h b/src/Event.h index 327b186f1d..754db32612 100644 --- a/src/Event.h +++ b/src/Event.h @@ -62,8 +62,7 @@ public: // against the case where there's no handlers (one usually also does that // because it would be a waste of effort to construct all the event // arguments when there's no handlers to consume them). - // TODO: deprecate - /* [[deprecated("Remove in v4.1. Use Enqueue() instead.")]] */ + [[deprecated("Remove in v4.1. Use Enqueue() instead.")]] void QueueEventFast(const EventHandlerPtr &h, val_list vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, TimerMgr* mgr = 0, BroObj* obj = 0); diff --git a/src/Reporter.cc b/src/Reporter.cc index ddd141ebd4..48aaa79469 100644 --- a/src/Reporter.cc +++ b/src/Reporter.cc @@ -480,26 +480,28 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out, auto vl_size = 1 + (bool)time + (bool)location + (bool)conn + (addl ? addl->length() : 0); - val_list vl(vl_size); + zeek::Args vl; + vl.reserve(vl_size); if ( time ) - vl.push_back(new Val(network_time ? network_time : current_time(), TYPE_TIME)); + vl.emplace_back(make_intrusive(network_time ? network_time : current_time(), TYPE_TIME)); - vl.push_back(new StringVal(buffer)); + vl.emplace_back(make_intrusive(buffer)); if ( location ) - vl.push_back(new StringVal(loc_str.c_str())); + vl.emplace_back(make_intrusive(loc_str.c_str())); if ( conn ) - vl.push_back(conn->BuildConnVal()); + vl.emplace_back(AdoptRef{}, conn->BuildConnVal()); if ( addl ) - std::copy(addl->begin(), addl->end(), std::back_inserter(vl)); + for ( auto v : *addl ) + vl.emplace_back(AdoptRef{}, v); if ( conn ) - conn->ConnectionEventFast(event, 0, std::move(vl)); + conn->EnqueueEvent(event, std::move(vl)); else - mgr.QueueEventFast(event, std::move(vl)); + mgr.Enqueue(event, std::move(vl)); } else { diff --git a/src/RuleAction.cc b/src/RuleAction.cc index 5419e68a4c..b5afaf0e81 100644 --- a/src/RuleAction.cc +++ b/src/RuleAction.cc @@ -21,13 +21,11 @@ void RuleActionEvent::DoAction(const Rule* parent, RuleEndpointState* state, const u_char* data, int len) { if ( signature_match ) - { - mgr.QueueEventFast(signature_match, { - rule_matcher->BuildRuleStateValue(parent, state), - new StringVal(msg), - data ? new StringVal(len, (const char*)data) : val_mgr->GetEmptyString(), - }); - } + mgr.Enqueue(signature_match, + IntrusivePtr{AdoptRef{}, rule_matcher->BuildRuleStateValue(parent, state)}, + make_intrusive(msg), + data ? make_intrusive(len, (const char*)data) : IntrusivePtr{AdoptRef{}, val_mgr->GetEmptyString()} + ); } void RuleActionEvent::PrintDebug() diff --git a/src/Sessions.cc b/src/Sessions.cc index d39fa9f8e6..d122baf633 100644 --- a/src/Sessions.cc +++ b/src/Sessions.cc @@ -123,7 +123,7 @@ void NetSessions::NextPacket(double t, const Packet* pkt) SegmentProfiler prof(segment_logger, "dispatching-packet"); if ( raw_packet ) - mgr.QueueEventFast(raw_packet, {pkt->BuildPktHdrVal()}); + mgr.Enqueue(raw_packet, IntrusivePtr{AdoptRef{}, pkt->BuildPktHdrVal()}); if ( pkt_profiler ) pkt_profiler->ProfilePkt(t, pkt->cap_len); @@ -310,7 +310,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr { dump_this_packet = 1; if ( esp_packet ) - mgr.QueueEventFast(esp_packet, {ip_hdr->BuildPktHdrVal()}); + mgr.Enqueue(esp_packet, IntrusivePtr{AdoptRef{}, ip_hdr->BuildPktHdrVal()}); // Can't do more since upper-layer payloads are going to be encrypted. return; diff --git a/src/Stats.cc b/src/Stats.cc index f584ed7a23..f3d5b39dd7 100644 --- a/src/Stats.cc +++ b/src/Stats.cc @@ -372,11 +372,11 @@ void SampleLogger::SegmentProfile(const char* /* name */, double dtime, int dmem) { if ( load_sample ) - mgr.QueueEventFast(load_sample, { - load_samples->Ref(), - new IntervalVal(dtime, Seconds), - val_mgr->GetInt(dmem) - }); + mgr.Enqueue(load_sample, + IntrusivePtr{NewRef{}, load_samples}, + make_intrusive(dtime, Seconds), + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(dmem)} + ); } void SegmentProfiler::Init() diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc index b17d7fd0e8..6a32948600 100644 --- a/src/analyzer/Analyzer.cc +++ b/src/analyzer/Analyzer.cc @@ -688,13 +688,12 @@ void Analyzer::ProtocolConfirmation(Tag arg_tag) return; EnumVal* tval = arg_tag ? arg_tag.AsEnumVal() : tag.AsEnumVal(); - Ref(tval); - mgr.QueueEventFast(protocol_confirmation, { - BuildConnVal(), - tval, - val_mgr->GetCount(id), - }); + mgr.Enqueue(protocol_confirmation, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{NewRef{}, tval}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(id)} + ); } void Analyzer::ProtocolViolation(const char* reason, const char* data, int len) @@ -716,14 +715,13 @@ void Analyzer::ProtocolViolation(const char* reason, const char* data, int len) r = new StringVal(reason); EnumVal* tval = tag.AsEnumVal(); - Ref(tval); - mgr.QueueEventFast(protocol_violation, { - BuildConnVal(), - tval, - val_mgr->GetCount(id), - r, - }); + mgr.Enqueue(protocol_violation, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{NewRef{}, tval}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(id)}, + IntrusivePtr{AdoptRef{}, r} + ); } void Analyzer::AddTimer(analyzer_timer_func timer, double t, diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc index 360a24d5bd..25a48e45a8 100644 --- a/src/analyzer/protocol/arp/ARP.cc +++ b/src/analyzer/protocol/arp/ARP.cc @@ -191,13 +191,13 @@ void ARP_Analyzer::BadARP(const struct arp_pkthdr* hdr, const char* msg) if ( ! bad_arp ) return; - mgr.QueueEventFast(bad_arp, { - ConstructAddrVal(ar_spa(hdr)), - EthAddrToStr((const u_char*) ar_sha(hdr)), - ConstructAddrVal(ar_tpa(hdr)), - EthAddrToStr((const u_char*) ar_tha(hdr)), - new StringVal(msg), - }); + mgr.Enqueue(bad_arp, + IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_spa(hdr))}, + IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_sha(hdr))}, + IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_tpa(hdr))}, + IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_tha(hdr))}, + make_intrusive(msg) + ); } void ARP_Analyzer::Corrupted(const char* msg) @@ -213,14 +213,14 @@ void ARP_Analyzer::RREvent(EventHandlerPtr e, if ( ! e ) return; - mgr.QueueEventFast(e, { - EthAddrToStr(src), - EthAddrToStr(dst), - ConstructAddrVal(spa), - EthAddrToStr((const u_char*) sha), - ConstructAddrVal(tpa), - EthAddrToStr((const u_char*) tha), - }); + mgr.Enqueue(e, + IntrusivePtr{AdoptRef{}, EthAddrToStr(src)}, + IntrusivePtr{AdoptRef{}, EthAddrToStr(dst)}, + IntrusivePtr{AdoptRef{}, ConstructAddrVal(spa)}, + IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) sha)}, + IntrusivePtr{AdoptRef{}, ConstructAddrVal(tpa)}, + IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) tha)} + ); } AddrVal* ARP_Analyzer::ConstructAddrVal(const void* addr) diff --git a/src/analyzer/protocol/pia/PIA.cc b/src/analyzer/protocol/pia/PIA.cc index 0c3a1cfbcd..f57771e708 100644 --- a/src/analyzer/protocol/pia/PIA.cc +++ b/src/analyzer/protocol/pia/PIA.cc @@ -157,12 +157,11 @@ void PIA_UDP::ActivateAnalyzer(analyzer::Tag tag, const Rule* rule) { // Queue late match event EnumVal *tval = tag ? tag.AsEnumVal() : GetAnalyzerTag().AsEnumVal(); - Ref(tval); - mgr.QueueEventFast(protocol_late_match, { - BuildConnVal(), - tval, - }); + mgr.Enqueue(protocol_late_match, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{NewRef{}, tval} + ); } pkt_buffer.state = dpd_late_match_stop ? SKIPPING : MATCHING_ONLY; @@ -306,12 +305,11 @@ void PIA_TCP::ActivateAnalyzer(analyzer::Tag tag, const Rule* rule) { // Queue late match event EnumVal *tval = tag ? tag.AsEnumVal() : GetAnalyzerTag().AsEnumVal(); - Ref(tval); - mgr.QueueEventFast(protocol_late_match, { - BuildConnVal(), - tval - }); + mgr.Enqueue(protocol_late_match, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{NewRef{}, tval} + ); } stream_buffer.state = dpd_late_match_stop ? SKIPPING : MATCHING_ONLY; diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index f99e35a445..79864ae86c 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -984,7 +984,8 @@ void Manager::ProcessEvent(const broker::topic& topic, broker::zeek::Event ev) return; } - val_list vl(args.size()); + zeek::Args vl; + vl.reserve(args.size()); for ( auto i = 0u; i < args.size(); ++i ) { @@ -993,7 +994,7 @@ void Manager::ProcessEvent(const broker::topic& topic, broker::zeek::Event ev) auto val = data_to_val(std::move(args[i]), expected_type); if ( val ) - vl.push_back(val.release()); + vl.emplace_back(std::move(val)); else { auto expected_name = type_name(expected_type->Tag()); @@ -1014,13 +1015,8 @@ void Manager::ProcessEvent(const broker::topic& topic, broker::zeek::Event ev) } } - if ( static_cast(vl.length()) == args.size() ) - mgr.QueueEventFast(handler, std::move(vl), SOURCE_BROKER); - else - { - for ( const auto& v : vl ) - Unref(v); - } + if ( vl.size() == args.size() ) + mgr.Enqueue(handler, std::move(vl), SOURCE_BROKER); } bool bro_broker::Manager::ProcessLogCreate(broker::zeek::LogCreate lc) @@ -1243,7 +1239,7 @@ void Manager::ProcessStatus(broker::status stat) return; auto ei = internal_type("Broker::EndpointInfo")->AsRecordType(); - auto endpoint_info = new RecordVal(ei); + auto endpoint_info = make_intrusive(ei); if ( ctx ) { @@ -1268,9 +1264,9 @@ void Manager::ProcessStatus(broker::status stat) } auto str = stat.message(); - auto msg = new StringVal(str ? *str : ""); + auto msg = make_intrusive(str ? *str : ""); - mgr.QueueEventFast(event, {endpoint_info, msg}); + mgr.Enqueue(event, std::move(endpoint_info), std::move(msg)); } void Manager::ProcessError(broker::error err) @@ -1347,10 +1343,10 @@ void Manager::ProcessError(broker::error err) msg = fmt("[%s] %s", caf::to_string(err.category()).c_str(), caf::to_string(err.context()).c_str()); } - mgr.QueueEventFast(Broker::error, { - BifType::Enum::Broker::ErrorCode->GetVal(ec).release(), - new StringVal(msg), - }); + mgr.Enqueue(Broker::error, + BifType::Enum::Broker::ErrorCode->GetVal(ec), + make_intrusive(msg) + ); } void Manager::ProcessStoreResponse(StoreHandleVal* s, broker::store::response response) diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index 3c88c90511..d378fcd19f 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -622,18 +622,23 @@ void File::FileEvent(EventHandlerPtr h) if ( ! FileEventAvailable(h) ) return; - FileEvent(h, {val->Ref()}); + FileEvent(h, zeek::Args{{NewRef{}, val}}); } void File::FileEvent(EventHandlerPtr h, val_list* vl) { - FileEvent(h, std::move(*vl)); + FileEvent(h, zeek::val_list_to_args(vl)); delete vl; } void File::FileEvent(EventHandlerPtr h, val_list vl) { - mgr.QueueEventFast(h, std::move(vl)); + FileEvent(h, zeek::val_list_to_args(&vl)); + } + +void File::FileEvent(EventHandlerPtr h, zeek::Args args) + { + mgr.Enqueue(h, std::move(args)); if ( h == file_new || h == file_over_new_connection || h == file_sniff || diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h index 1580d0f298..8992fca97f 100644 --- a/src/file_analysis/File.h +++ b/src/file_analysis/File.h @@ -10,6 +10,7 @@ #include "AnalyzerSet.h" #include "BroString.h" #include "BroList.h" // for val_list +#include "ZeekArgs.h" #include "WeirdState.h" using std::string; @@ -175,6 +176,7 @@ public: * @param h pointer to an event handler. * @param vl list of argument values to pass to event call. */ + // TODO: deprecate void FileEvent(EventHandlerPtr h, val_list* vl); /** @@ -182,8 +184,16 @@ public: * @param h pointer to an event handler. * @param vl list of argument values to pass to event call. */ + // TODO: deprecate void FileEvent(EventHandlerPtr h, val_list vl); + /** + * Raises an event related to the file's life-cycle. + * @param h pointer to an event handler. + * @param args list of argument values to pass to event call. + */ + void FileEvent(EventHandlerPtr h, zeek::Args args); + /** * Sets the MIME type for a file to a specific value. * diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc index a36aa54c0a..72a1a5b079 100644 --- a/src/file_analysis/Manager.cc +++ b/src/file_analysis/Manager.cc @@ -432,13 +432,12 @@ string Manager::GetFileID(const analyzer::Tag& tag, Connection* c, bool is_orig) analyzer_mgr->GetComponentName(tag).c_str()); EnumVal* tagval = tag.AsEnumVal(); - Ref(tagval); - mgr.QueueEventFast(get_file_handle, { - tagval, - c->BuildConnVal(), - val_mgr->GetBool(is_orig), - }); + mgr.Enqueue(get_file_handle, + IntrusivePtr{NewRef{}, tagval}, + IntrusivePtr{AdoptRef{}, c->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + ); mgr.Drain(); // need file handle immediately so we don't have to buffer data return current_file_id; } diff --git a/src/file_analysis/analyzer/data_event/DataEvent.cc b/src/file_analysis/analyzer/data_event/DataEvent.cc index 80e2de25e7..b8e00ff9b7 100644 --- a/src/file_analysis/analyzer/data_event/DataEvent.cc +++ b/src/file_analysis/analyzer/data_event/DataEvent.cc @@ -42,11 +42,11 @@ bool DataEvent::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset) { if ( ! chunk_event ) return true; - mgr.QueueEventFast(chunk_event, { - GetFile()->GetVal()->Ref(), - new StringVal(new BroString(data, len, 0)), - val_mgr->GetCount(offset), - }); + mgr.Enqueue(chunk_event, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + make_intrusive(new BroString(data, len, 0)), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(offset)} + ); return true; } @@ -55,10 +55,10 @@ bool DataEvent::DeliverStream(const u_char* data, uint64_t len) { if ( ! stream_event ) return true; - mgr.QueueEventFast(stream_event, { - GetFile()->GetVal()->Ref(), - new StringVal(new BroString(data, len, 0)), - }); + mgr.Enqueue(stream_event, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + make_intrusive(new BroString(data, len, 0)) + ); return true; } diff --git a/src/file_analysis/analyzer/entropy/Entropy.cc b/src/file_analysis/analyzer/entropy/Entropy.cc index 959babfb3a..ab96947d30 100644 --- a/src/file_analysis/analyzer/entropy/Entropy.cc +++ b/src/file_analysis/analyzer/entropy/Entropy.cc @@ -60,15 +60,15 @@ void Entropy::Finalize() montepi = scc = ent = mean = chisq = 0.0; entropy->Get(&ent, &chisq, &mean, &montepi, &scc); - RecordVal* ent_result = new RecordVal(entropy_test_result); + auto ent_result = make_intrusive(entropy_test_result); ent_result->Assign(0, make_intrusive(ent, TYPE_DOUBLE)); ent_result->Assign(1, make_intrusive(chisq, TYPE_DOUBLE)); ent_result->Assign(2, make_intrusive(mean, TYPE_DOUBLE)); ent_result->Assign(3, make_intrusive(montepi, TYPE_DOUBLE)); ent_result->Assign(4, make_intrusive(scc, TYPE_DOUBLE)); - mgr.QueueEventFast(file_entropy, { - GetFile()->GetVal()->Ref(), - ent_result, - }); + mgr.Enqueue(file_entropy, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + std::move(ent_result) + ); } diff --git a/src/file_analysis/analyzer/hash/Hash.cc b/src/file_analysis/analyzer/hash/Hash.cc index 03d5ba801d..a4b0a8930d 100644 --- a/src/file_analysis/analyzer/hash/Hash.cc +++ b/src/file_analysis/analyzer/hash/Hash.cc @@ -51,9 +51,9 @@ void Hash::Finalize() if ( ! file_hash ) return; - mgr.QueueEventFast(file_hash, { - GetFile()->GetVal()->Ref(), - new StringVal(kind), - hash->Get().release(), - }); + mgr.Enqueue(file_hash, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + make_intrusive(kind), + hash->Get() + ); } diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac index b5cdb27f3e..2ed3f69205 100644 --- a/src/file_analysis/analyzer/pe/pe-analyzer.pac +++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac @@ -42,7 +42,7 @@ refine flow File += { %{ if ( pe_dos_header ) { - RecordVal* dh = new RecordVal(BifType::Record::PE::DOSHeader); + auto dh = make_intrusive(BifType::Record::PE::DOSHeader); dh->Assign(0, make_intrusive(${h.signature}.length(), (const char*) ${h.signature}.data())); dh->Assign(1, val_mgr->GetCount(${h.UsedBytesInTheLastPage})); dh->Assign(2, val_mgr->GetCount(${h.FileSizeInPages})); @@ -61,10 +61,9 @@ refine flow File += { dh->Assign(15, val_mgr->GetCount(${h.OEMinfo})); dh->Assign(16, val_mgr->GetCount(${h.AddressOfNewExeHeader})); - mgr.QueueEventFast(pe_dos_header, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - dh - }); + mgr.Enqueue(pe_dos_header, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + std::move(dh)); } return true; %} @@ -72,12 +71,10 @@ refine flow File += { function proc_dos_code(code: bytestring): bool %{ if ( pe_dos_code ) - { - mgr.QueueEventFast(pe_dos_code, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - new StringVal(code.length(), (const char*) code.data()) - }); - } + mgr.Enqueue(pe_dos_code, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + make_intrusive(code.length(), (const char*) code.data()) + ); return true; %} @@ -95,7 +92,7 @@ refine flow File += { %{ if ( pe_file_header ) { - RecordVal* fh = new RecordVal(BifType::Record::PE::FileHeader); + auto fh = make_intrusive(BifType::Record::PE::FileHeader); fh->Assign(0, val_mgr->GetCount(${h.Machine})); fh->Assign(1, make_intrusive(static_cast(${h.TimeDateStamp}), TYPE_TIME)); fh->Assign(2, val_mgr->GetCount(${h.PointerToSymbolTable})); @@ -103,10 +100,9 @@ refine flow File += { fh->Assign(4, val_mgr->GetCount(${h.SizeOfOptionalHeader})); fh->Assign(5, characteristics_to_bro(${h.Characteristics}, 16)); - mgr.QueueEventFast(pe_file_header, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - fh - }); + mgr.Enqueue(pe_file_header, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + std::move(fh)); } return true; @@ -124,7 +120,7 @@ refine flow File += { if ( pe_optional_header ) { - RecordVal* oh = new RecordVal(BifType::Record::PE::OptionalHeader); + auto oh = make_intrusive(BifType::Record::PE::OptionalHeader); oh->Assign(0, val_mgr->GetCount(${h.magic})); oh->Assign(1, val_mgr->GetCount(${h.major_linker_version})); @@ -155,10 +151,9 @@ refine flow File += { oh->Assign(23, process_rvas(${h.rvas})); - mgr.QueueEventFast(pe_optional_header, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - oh - }); + mgr.Enqueue(pe_optional_header, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + std::move(oh)); } return true; %} @@ -167,7 +162,7 @@ refine flow File += { %{ if ( pe_section_header ) { - RecordVal* section_header = new RecordVal(BifType::Record::PE::SectionHeader); + auto section_header = make_intrusive(BifType::Record::PE::SectionHeader); // Strip null characters from the end of the section name. u_char* first_null = (u_char*) memchr(${h.name}.data(), 0, ${h.name}.length()); @@ -188,10 +183,10 @@ refine flow File += { section_header->Assign(8, val_mgr->GetCount(${h.non_used_num_of_line_nums})); section_header->Assign(9, characteristics_to_bro(${h.characteristics}, 32)); - mgr.QueueEventFast(pe_section_header, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - section_header - }); + mgr.Enqueue(pe_section_header, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + std::move(section_header) + ); } return true; %} diff --git a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac index d47707033e..7212b3df53 100644 --- a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac +++ b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac @@ -66,7 +66,7 @@ refine flow Flow += { %{ if ( ::unified2_event ) { - RecordVal* ids_event = new RecordVal(BifType::Record::Unified2::IDSEvent); + auto ids_event = make_intrusive(BifType::Record::Unified2::IDSEvent); ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id})); ids_event->Assign(1, val_mgr->GetCount(${ev.event_id})); ids_event->Assign(2, make_intrusive(ts_to_double(${ev.ts}), TYPE_TIME)); @@ -81,11 +81,9 @@ refine flow Flow += { ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol})); ids_event->Assign(17, val_mgr->GetCount(${ev.packet_action})); - mgr.QueueEventFast(::unified2_event, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - ids_event, - }, - SOURCE_LOCAL); + mgr.Enqueue(::unified2_event, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + std::move(ids_event)); } return true; %} @@ -94,7 +92,7 @@ refine flow Flow += { %{ if ( ::unified2_event ) { - RecordVal* ids_event = new RecordVal(BifType::Record::Unified2::IDSEvent); + auto ids_event = make_intrusive(BifType::Record::Unified2::IDSEvent); ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id})); ids_event->Assign(1, val_mgr->GetCount(${ev.event_id})); ids_event->Assign(2, make_intrusive(ts_to_double(${ev.ts}), TYPE_TIME)); @@ -113,11 +111,9 @@ refine flow Flow += { ids_event->Assign(15, val_mgr->GetCount(${ev.mpls_label})); ids_event->Assign(16, val_mgr->GetCount(${ev.vlan_id})); - mgr.QueueEventFast(::unified2_event, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - ids_event, - }, - SOURCE_LOCAL); + mgr.Enqueue(::unified2_event, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + std::move(ids_event)); } return true; @@ -127,7 +123,7 @@ refine flow Flow += { %{ if ( ::unified2_packet ) { - RecordVal* packet = new RecordVal(BifType::Record::Unified2::Packet); + auto packet = make_intrusive(BifType::Record::Unified2::Packet); packet->Assign(0, val_mgr->GetCount(${pkt.sensor_id})); packet->Assign(1, val_mgr->GetCount(${pkt.event_id})); packet->Assign(2, val_mgr->GetCount(${pkt.event_second})); @@ -135,11 +131,9 @@ refine flow Flow += { packet->Assign(4, val_mgr->GetCount(${pkt.link_type})); packet->Assign(5, bytestring_to_val(${pkt.packet_data})); - mgr.QueueEventFast(::unified2_packet, { - connection()->bro_analyzer()->GetFile()->GetVal()->Ref(), - packet, - }, - SOURCE_LOCAL); + mgr.Enqueue(::unified2_packet, + IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, + std::move(packet)); } return true; diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc index 801dd50f12..3ae0dd5c1f 100644 --- a/src/file_analysis/analyzer/x509/OCSP.cc +++ b/src/file_analysis/analyzer/x509/OCSP.cc @@ -420,10 +420,10 @@ void file_analysis::OCSP::ParseRequest(OCSP_REQUEST* req) #endif if ( ocsp_request ) - mgr.QueueEventFast(ocsp_request, { - GetFile()->GetVal()->Ref(), - val_mgr->GetCount(version), - }); + mgr.Enqueue(ocsp_request, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(version)} + ); BIO *bio = BIO_new(BIO_s_mem()); @@ -466,10 +466,10 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp) StringVal* status_val = new StringVal(strlen(status_str), status_str); if ( ocsp_response_status ) - mgr.QueueEventFast(ocsp_response_status, { - GetFile()->GetVal()->Ref(), - status_val->Ref(), - }); + mgr.Enqueue(ocsp_response_status, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + IntrusivePtr{NewRef{}, status_val} + ); //if (!resp_bytes) // { diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc index cc1173d7f2..ee19cb29fc 100644 --- a/src/file_analysis/analyzer/x509/X509.cc +++ b/src/file_analysis/analyzer/x509/X509.cc @@ -289,16 +289,16 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex) { if ( x509_ext_basic_constraints ) { - RecordVal* pBasicConstraint = new RecordVal(BifType::Record::X509::BasicConstraints); + auto pBasicConstraint = make_intrusive(BifType::Record::X509::BasicConstraints); pBasicConstraint->Assign(0, val_mgr->GetBool(constr->ca ? 1 : 0)); if ( constr->pathlen ) pBasicConstraint->Assign(1, val_mgr->GetCount((int32_t) ASN1_INTEGER_get(constr->pathlen))); - mgr.QueueEventFast(x509_ext_basic_constraints, { - GetFile()->GetVal()->Ref(), - pBasicConstraint, - }); + mgr.Enqueue(x509_ext_basic_constraints, + IntrusivePtr{NewRef{}, GetFile()->GetVal()}, + std::move(pBasicConstraint) + ); } BASIC_CONSTRAINTS_free(constr); diff --git a/src/file_analysis/analyzer/x509/x509-extension.pac b/src/file_analysis/analyzer/x509/x509-extension.pac index bbe6c9f88f..2c6f7414f9 100644 --- a/src/file_analysis/analyzer/x509/x509-extension.pac +++ b/src/file_analysis/analyzer/x509/x509-extension.pac @@ -38,15 +38,15 @@ refine connection MockConnection += { if ( ! x509_ocsp_ext_signed_certificate_timestamp ) return true; - mgr.QueueEventFast(x509_ocsp_ext_signed_certificate_timestamp, { - bro_analyzer()->GetFile()->GetVal()->Ref(), - val_mgr->GetCount(version), - new StringVal(logid.length(), reinterpret_cast(logid.begin())), - val_mgr->GetCount(timestamp), - val_mgr->GetCount(digitally_signed_algorithms->HashAlgorithm()), - val_mgr->GetCount(digitally_signed_algorithms->SignatureAlgorithm()), - new StringVal(digitally_signed_signature.length(), reinterpret_cast(digitally_signed_signature.begin())) - }); + mgr.Enqueue(x509_ocsp_ext_signed_certificate_timestamp, + IntrusivePtr{NewRef{}, bro_analyzer()->GetFile()->GetVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(version)}, + make_intrusive(logid.length(), reinterpret_cast(logid.begin())), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(timestamp)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(digitally_signed_algorithms->HashAlgorithm())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(digitally_signed_algorithms->SignatureAlgorithm())}, + make_intrusive(digitally_signed_signature.length(), reinterpret_cast(digitally_signed_signature.begin())) + ); return true; %} diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc index fc9d5618c5..6f50f17263 100644 --- a/src/iosource/pcap/Source.cc +++ b/src/iosource/pcap/Source.cc @@ -48,7 +48,7 @@ void PcapSource::Close() Closed(); if ( Pcap::file_done ) - mgr.QueueEventFast(Pcap::file_done, {new StringVal(props.path)}); + mgr.Enqueue(Pcap::file_done, make_intrusive(props.path)); } void PcapSource::OpenLive() diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc index 1a2125585b..8b5021b3f1 100644 --- a/src/logging/Manager.cc +++ b/src/logging/Manager.cc @@ -710,7 +710,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg) // Raise the log event. if ( stream->event ) - mgr.QueueEventFast(stream->event, {columns->Ref()}, SOURCE_LOCAL); + mgr.Enqueue(stream->event, columns); // Send to each of our filters. for ( list::iterator i = stream->filters.begin(); diff --git a/src/main.cc b/src/main.cc index 76be15b2d7..acb0beb6e7 100644 --- a/src/main.cc +++ b/src/main.cc @@ -269,7 +269,7 @@ void terminate_bro() EventHandlerPtr zeek_done = internal_handler("zeek_done"); if ( zeek_done ) - mgr.QueueEventFast(zeek_done, val_list{}); + mgr.Enqueue(zeek_done, zeek::Args{}); timer_mgr->Expire(); mgr.Drain(); @@ -826,7 +826,7 @@ int main(int argc, char** argv) EventHandlerPtr zeek_init = internal_handler("zeek_init"); if ( zeek_init ) //### this should be a function - mgr.QueueEventFast(zeek_init, val_list{}); + mgr.Enqueue(zeek_init, zeek::Args{}); EventRegistry::string_list dead_handlers = event_registry->UnusedHandlers(); @@ -873,10 +873,10 @@ int main(int argc, char** argv) if ( i->skipped ) continue; - mgr.QueueEventFast(zeek_script_loaded, { - new StringVal(i->name.c_str()), - val_mgr->GetCount(i->include_level), - }); + mgr.Enqueue(zeek_script_loaded, + make_intrusive(i->name.c_str()), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(i->include_level)} + ); } } From de47a50dde73b59f293e34e76431992dfa7dd2b4 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Wed, 25 Mar 2020 16:08:32 -0700 Subject: [PATCH 10/16] Deprecate Connection::ConnectionEvent methods And update usages to Connection::EnqueueEvent --- NEWS | 4 +++ src/Conn.cc | 66 +++++++++++++++++++++------------------- src/Conn.h | 22 +++++++++++--- src/Reporter.cc | 2 +- src/analyzer/Analyzer.cc | 18 +++++++++-- src/analyzer/Analyzer.h | 9 ++++++ 6 files changed, 80 insertions(+), 41 deletions(-) diff --git a/NEWS b/NEWS index ae171789fd..4fdc6e7a27 100644 --- a/NEWS +++ b/NEWS @@ -55,6 +55,10 @@ Deprecated Functionality - The ``EventMgr::QueueEvent()`` and EventMgr::QueueEventFast()`` methods are now deprecated, use ``EventMgr::Enqueue()`` instead. +- The ``Connection::ConnectionEvent()`` and + ``Connection::ConnectionEventFast()`` methods are now deprecated, use + ``Connection::EnqueueEvent()`` instead. + Zeek 3.1.0 ========== diff --git a/src/Conn.cc b/src/Conn.cc index d512f32166..a8987b30f5 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -203,7 +203,7 @@ void Connection::NextPacket(double t, int is_orig, is_successful = true; if ( ! was_successful && is_successful && connection_successful ) - ConnectionEventFast(connection_successful, nullptr, {BuildConnVal()}); + EnqueueEvent(connection_successful, nullptr, IntrusivePtr{AdoptRef{}, BuildConnVal()}); } else last_time = t; @@ -259,11 +259,11 @@ void Connection::HistoryThresholdEvent(EventHandlerPtr e, bool is_orig, // and at this stage it's not a *multiple* instance. return; - ConnectionEventFast(e, 0, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - val_mgr->GetCount(threshold) - }); + EnqueueEvent(e, nullptr, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)} + ); } void Connection::DeleteTimer(double /* t */) @@ -323,7 +323,7 @@ void Connection::EnableStatusUpdateTimer() void Connection::StatusUpdateTimer(double t) { - ConnectionEventFast(connection_status_update, 0, { BuildConnVal() }); + EnqueueEvent(connection_status_update, nullptr, IntrusivePtr{AdoptRef{}, BuildConnVal()}); ADD_TIMER(&Connection::StatusUpdateTimer, network_time + connection_status_update_interval, 0, TIMER_CONN_STATUS_UPDATE); @@ -446,15 +446,13 @@ void Connection::Match(Rule::PatternType type, const u_char* data, int len, bool void Connection::RemovalEvent() { - auto cv = BuildConnVal(); + auto cv = IntrusivePtr{AdoptRef{}, BuildConnVal()}; if ( connection_state_remove ) - ConnectionEventFast(connection_state_remove, nullptr, {cv->Ref()}); + EnqueueEvent(connection_state_remove, nullptr, cv); if ( is_successful && successful_connection_remove ) - ConnectionEventFast(successful_connection_remove, nullptr, {cv->Ref()}); - - Unref(cv); + EnqueueEvent(successful_connection_remove, nullptr, cv); } void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, const char* name) @@ -463,10 +461,9 @@ void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, const ch return; if ( name ) - ConnectionEventFast(f, analyzer, {new StringVal(name), BuildConnVal()}); + EnqueueEvent(f, analyzer, make_intrusive(name), IntrusivePtr{AdoptRef{}, BuildConnVal()}); else - ConnectionEventFast(f, analyzer, {BuildConnVal()}); - + EnqueueEvent(f, analyzer, IntrusivePtr{AdoptRef{}, BuildConnVal()}); } void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, Val* v1, Val* v2) @@ -479,25 +476,27 @@ void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, Val* v1, } if ( v2 ) - ConnectionEventFast(f, analyzer, {BuildConnVal(), v1, v2}); + EnqueueEvent(f, analyzer, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, v1}, + IntrusivePtr{AdoptRef{}, v2}); else - ConnectionEventFast(f, analyzer, {BuildConnVal(), v1}); + EnqueueEvent(f, analyzer, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, v1}); } void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_list vl) { + auto args = zeek::val_list_to_args(&vl); + if ( ! f ) - { // This may actually happen if there is no local handler // and a previously existing remote handler went away. - for ( const auto& v : vl) - Unref(v); - return; - } // "this" is passed as a cookie for the event - mgr.Enqueue(f, zeek::val_list_to_args(&vl), SOURCE_LOCAL, + mgr.Enqueue(f, std::move(args), SOURCE_LOCAL, a ? a->GetID() : 0, timer_mgr, this); } @@ -510,12 +509,15 @@ void Connection::ConnectionEventFast(EventHandlerPtr f, analyzer::Analyzer* a, v void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_list* vl) { - ConnectionEvent(f, a, std::move(*vl)); + auto args = zeek::val_list_to_args(vl); delete vl; + + if ( f ) + EnqueueEvent(f, a, std::move(args)); } -void Connection::EnqueueEvent(EventHandlerPtr f, zeek::Args args, - analyzer::Analyzer* a) +void Connection::EnqueueEvent(EventHandlerPtr f, analyzer::Analyzer* a, + zeek::Args args) { // "this" is passed as a cookie for the event mgr.Enqueue(f, std::move(args), SOURCE_LOCAL, a ? a->GetID() : 0, @@ -696,12 +698,12 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label) if ( connection_flow_label_changed && (is_orig ? saw_first_orig_packet : saw_first_resp_packet) ) { - ConnectionEventFast(connection_flow_label_changed, 0, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - val_mgr->GetCount(my_flow_label), - val_mgr->GetCount(flow_label), - }); + EnqueueEvent(connection_flow_label_changed, 0, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(my_flow_label)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flow_label)} + ); } my_flow_label = flow_label; diff --git a/src/Conn.h b/src/Conn.h index 53f8ff74a7..3511275040 100644 --- a/src/Conn.h +++ b/src/Conn.h @@ -5,6 +5,8 @@ #include #include +#include +#include #include "Dict.h" #include "Timer.h" @@ -188,7 +190,7 @@ public: // If a handler exists for 'f', an event will be generated. In any case, // reference count for each element in the 'vl' list are decremented. The // arguments used for the event are whatevever is provided in 'vl'. - // TODO: deprecate + [[deprecated("Remove in v4.1. Use EnqueueEvent() instead.")]] void ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* analyzer, val_list vl); @@ -196,7 +198,7 @@ public: // pointer instead of by value. This function takes ownership of the // memory pointed to by 'vl' and also for decrementing the reference count // of each of its elements. - // TODO: deprecate + [[deprecated("Remove in v4.1. Use EnqueueEvent() instead.")]] void ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* analyzer, val_list* vl); @@ -208,15 +210,25 @@ public: // the case where there's no handlers (one usually also does that because // it would be a waste of effort to construct all the event arguments when // there's no handlers to consume them). - // TODO: deprecate + [[deprecated("Remove in v4.1. Use EnqueueEvent() instead.")]] void ConnectionEventFast(EventHandlerPtr f, analyzer::Analyzer* analyzer, val_list vl); /** * Enqueues an event associated with this connection and given analyzer. */ - void EnqueueEvent(EventHandlerPtr f, zeek::Args args, - analyzer::Analyzer* analyzer = nullptr); + void EnqueueEvent(EventHandlerPtr f, analyzer::Analyzer* analyzer, + zeek::Args args); + + /** + * A version of EnqueueEvent() taking a variable number of arguments. + */ + template + std::enable_if_t< + std::is_convertible_v< + std::tuple_element_t<0, std::tuple>, IntrusivePtr>> + EnqueueEvent(EventHandlerPtr h, analyzer::Analyzer* analyzer, Args&&... args) + { return EnqueueEvent(h, analyzer, zeek::Args{std::forward(args)...}); } void Weird(const char* name, const char* addl = ""); bool DidWeird() const { return weird != 0; } diff --git a/src/Reporter.cc b/src/Reporter.cc index 48aaa79469..14434146cc 100644 --- a/src/Reporter.cc +++ b/src/Reporter.cc @@ -499,7 +499,7 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out, vl.emplace_back(AdoptRef{}, v); if ( conn ) - conn->EnqueueEvent(event, std::move(vl)); + conn->EnqueueEvent(event, nullptr, std::move(vl)); else mgr.Enqueue(event, std::move(vl)); } diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc index 6a32948600..41a98273e2 100644 --- a/src/analyzer/Analyzer.cc +++ b/src/analyzer/Analyzer.cc @@ -803,17 +803,29 @@ void Analyzer::Event(EventHandlerPtr f, Val* v1, Val* v2) void Analyzer::ConnectionEvent(EventHandlerPtr f, val_list* vl) { - conn->ConnectionEvent(f, this, vl); + auto args = zeek::val_list_to_args(vl); + + if ( f ) + conn->EnqueueEvent(f, this, std::move(args)); } void Analyzer::ConnectionEvent(EventHandlerPtr f, val_list vl) { - conn->ConnectionEvent(f, this, std::move(vl)); + auto args = zeek::val_list_to_args(&vl); + + if ( f ) + conn->EnqueueEvent(f, this, std::move(args)); } void Analyzer::ConnectionEventFast(EventHandlerPtr f, val_list vl) { - conn->ConnectionEventFast(f, this, std::move(vl)); + auto args = zeek::val_list_to_args(&vl); + conn->EnqueueEvent(f, this, std::move(args)); + } + +void Analyzer::EnqueueConnEvent(EventHandlerPtr f, zeek::Args args) + { + conn->EnqueueEvent(f, this, std::move(args)); } void Analyzer::Weird(const char* name, const char* addl) diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h index 1a94ad3cf2..96e51a2b25 100644 --- a/src/analyzer/Analyzer.h +++ b/src/analyzer/Analyzer.h @@ -567,20 +567,29 @@ public: * Convenience function that forwards directly to * Connection::ConnectionEvent(). */ + // TODO: deprecate void ConnectionEvent(EventHandlerPtr f, val_list* vl); /** * Convenience function that forwards directly to * Connection::ConnectionEvent(). */ + // TODO: deprecate void ConnectionEvent(EventHandlerPtr f, val_list vl); /** * Convenience function that forwards directly to * Connection::ConnectionEventFast(). */ + // TODO: deprecate void ConnectionEventFast(EventHandlerPtr f, val_list vl); + /** + * Convenience function that forwards directly to + * Connection::EnqueueEvent(). + */ + void EnqueueConnEvent(EventHandlerPtr f, zeek::Args args); + /** * Convenience function that forwards directly to the corresponding * Connection::Weird(). From e394ea38bc609484c90186104b7b25f6f5a77cec Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Wed, 25 Mar 2020 16:20:22 -0700 Subject: [PATCH 11/16] Deprecate file_analysis::File::FileEvent methods using val_list args And update usages to the overload that takes a zeek::Args instead. --- NEWS | 4 +++ src/file_analysis/File.cc | 27 +++++++++---------- src/file_analysis/File.h | 4 +-- src/file_analysis/analyzer/extract/Extract.cc | 8 +++--- 4 files changed, 23 insertions(+), 20 deletions(-) diff --git a/NEWS b/NEWS index 4fdc6e7a27..781b1534f7 100644 --- a/NEWS +++ b/NEWS @@ -59,6 +59,10 @@ Deprecated Functionality ``Connection::ConnectionEventFast()`` methods are now deprecated, use ``Connection::EnqueueEvent()`` instead. +- The ``file_analysis::File::FileEvent()`` methods taking ``val_list`` + arguments are now deprecated, use the overload that takes a ``zeek::Args`` + instead. + Zeek 3.1.0 ========== diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index d378fcd19f..5d7711d16c 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -155,9 +155,9 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig) if ( conn && FileEventAvailable(file_over_new_connection) ) { FileEvent(file_over_new_connection, { - val->Ref(), - conn->BuildConnVal(), - val_mgr->GetBool(is_orig), + IntrusivePtr{NewRef{}, val}, + IntrusivePtr{AdoptRef{}, conn->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, }); } } @@ -299,11 +299,11 @@ bool File::SetMime(const string& mime_type) if ( ! FileEventAvailable(file_sniff) ) return false; - RecordVal* meta = new RecordVal(fa_metadata_type); + auto meta = make_intrusive(fa_metadata_type); meta->Assign(meta_mime_type_idx, make_intrusive(mime_type)); meta->Assign(meta_inferred_idx, val_mgr->GetBool(0)); - FileEvent(file_sniff, {val->Ref(), meta}); + FileEvent(file_sniff, {IntrusivePtr{NewRef{}, val}, std::move(meta)}); return true; } @@ -332,7 +332,7 @@ void File::InferMetadata() len = min(len, LookupFieldDefaultCount(bof_buffer_size_idx)); file_mgr->DetectMIME(data, len, &matches); - RecordVal* meta = new RecordVal(fa_metadata_type); + auto meta = make_intrusive(fa_metadata_type); if ( ! matches.empty() ) { @@ -342,8 +342,7 @@ void File::InferMetadata() file_analysis::GenMIMEMatchesVal(matches)); } - FileEvent(file_sniff, {val->Ref(), meta}); - return; + FileEvent(file_sniff, {IntrusivePtr{NewRef{}, val}, std::move(meta)}); } bool File::BufferBOF(const u_char* data, uint64_t len) @@ -455,9 +454,9 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset) if ( FileEventAvailable(file_reassembly_overflow) ) { FileEvent(file_reassembly_overflow, { - val->Ref(), - val_mgr->GetCount(current_offset), - val_mgr->GetCount(gap_bytes), + IntrusivePtr{NewRef{}, val}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(current_offset)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(gap_bytes)} }); } } @@ -600,9 +599,9 @@ void File::Gap(uint64_t offset, uint64_t len) if ( FileEventAvailable(file_gap) ) { FileEvent(file_gap, { - val->Ref(), - val_mgr->GetCount(offset), - val_mgr->GetCount(len), + IntrusivePtr{NewRef{}, val}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(offset)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} }); } diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h index 8992fca97f..3b0f06e6f4 100644 --- a/src/file_analysis/File.h +++ b/src/file_analysis/File.h @@ -176,7 +176,7 @@ public: * @param h pointer to an event handler. * @param vl list of argument values to pass to event call. */ - // TODO: deprecate + [[deprecated("Remove in v4.1. Use zeek::Args overload instead.")]] void FileEvent(EventHandlerPtr h, val_list* vl); /** @@ -184,7 +184,7 @@ public: * @param h pointer to an event handler. * @param vl list of argument values to pass to event call. */ - // TODO: deprecate + [[deprecated("Remove in v4.1. Use zeek::Args overload instead.")]] void FileEvent(EventHandlerPtr h, val_list vl); /** diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc index 69ab2f16c7..2a4a5a54f7 100644 --- a/src/file_analysis/analyzer/extract/Extract.cc +++ b/src/file_analysis/analyzer/extract/Extract.cc @@ -92,10 +92,10 @@ bool Extract::DeliverStream(const u_char* data, uint64_t len) { File* f = GetFile(); f->FileEvent(file_extraction_limit, { - f->GetVal()->Ref(), - Args()->Ref(), - val_mgr->GetCount(limit), - val_mgr->GetCount(len), + IntrusivePtr{NewRef{}, f->GetVal()}, + IntrusivePtr{NewRef{}, Args()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(limit)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} }); // Limit may have been modified by a BIF, re-check it. From 5e496e43b78e3d71aa9a1d7d5ae47d15568091e4 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Wed, 25 Mar 2020 18:36:58 -0700 Subject: [PATCH 12/16] Deprecate Analyzer::ConnectionEvent() And update usages to Analyzer::EnqueueConnEvent() --- NEWS | 4 + src/analyzer/Analyzer.h | 18 +- .../protocol/bittorrent/BitTorrent.cc | 12 +- .../protocol/bittorrent/BitTorrentTracker.cc | 46 +- src/analyzer/protocol/conn-size/ConnSize.cc | 20 +- src/analyzer/protocol/dns/DNS.cc | 277 +++++----- src/analyzer/protocol/file/File.cc | 12 +- src/analyzer/protocol/finger/Finger.cc | 22 +- src/analyzer/protocol/ftp/FTP.cc | 22 +- src/analyzer/protocol/gnutella/Gnutella.cc | 62 +-- src/analyzer/protocol/http/HTTP.cc | 146 +++-- src/analyzer/protocol/icmp/ICMP.cc | 146 +++-- src/analyzer/protocol/ident/Ident.cc | 36 +- src/analyzer/protocol/irc/IRC.cc | 508 +++++++++--------- src/analyzer/protocol/login/Login.cc | 79 ++- src/analyzer/protocol/login/NVT.cc | 10 +- src/analyzer/protocol/login/RSH.cc | 28 +- src/analyzer/protocol/login/Rlogin.cc | 10 +- src/analyzer/protocol/mime/MIME.cc | 76 ++- src/analyzer/protocol/ncp/NCP.cc | 33 +- src/analyzer/protocol/netbios/NetbiosSSN.cc | 34 +- src/analyzer/protocol/pop3/POP3.cc | 16 +- src/analyzer/protocol/rpc/MOUNT.cc | 23 +- src/analyzer/protocol/rpc/MOUNT.h | 4 +- src/analyzer/protocol/rpc/NFS.cc | 23 +- src/analyzer/protocol/rpc/NFS.h | 2 +- src/analyzer/protocol/rpc/Portmap.cc | 23 +- src/analyzer/protocol/rpc/RPC.cc | 54 +- src/analyzer/protocol/smtp/SMTP.cc | 57 +- .../protocol/stepping-stone/SteppingStone.cc | 16 +- src/analyzer/protocol/tcp/TCP.cc | 90 ++-- src/analyzer/protocol/tcp/TCP_Endpoint.cc | 12 +- src/analyzer/protocol/tcp/TCP_Reassembler.cc | 64 +-- src/analyzer/protocol/udp/UDP.cc | 12 +- 34 files changed, 954 insertions(+), 1043 deletions(-) diff --git a/NEWS b/NEWS index 781b1534f7..3843fc92e3 100644 --- a/NEWS +++ b/NEWS @@ -63,6 +63,10 @@ Deprecated Functionality arguments are now deprecated, use the overload that takes a ``zeek::Args`` instead. +- The ``analyzer::Analyzer::ConnectionEvent()`` and + ``analyzer::Analyzer::ConectionEventFast()`` methods are deprecated, use + ``analyzer::Analyzer::EnqueueConnEvent()`` instead. + Zeek 3.1.0 ========== diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h index 96e51a2b25..e53caad475 100644 --- a/src/analyzer/Analyzer.h +++ b/src/analyzer/Analyzer.h @@ -10,6 +10,8 @@ #include #include +#include +#include #include // for u_char @@ -567,21 +569,21 @@ public: * Convenience function that forwards directly to * Connection::ConnectionEvent(). */ - // TODO: deprecate + [[deprecated("Remove in v4.1. Use EnqueueConnEvent() instead.")]] void ConnectionEvent(EventHandlerPtr f, val_list* vl); /** * Convenience function that forwards directly to * Connection::ConnectionEvent(). */ - // TODO: deprecate + [[deprecated("Remove in v4.1. Use EnqueueConnEvent() instead.")]] void ConnectionEvent(EventHandlerPtr f, val_list vl); /** * Convenience function that forwards directly to * Connection::ConnectionEventFast(). */ - // TODO: deprecate + [[deprecated("Remove in v4.1. Use EnqueueConnEvent() instead.")]] void ConnectionEventFast(EventHandlerPtr f, val_list vl); /** @@ -590,6 +592,16 @@ public: */ void EnqueueConnEvent(EventHandlerPtr f, zeek::Args args); + /** + * A version of EnqueueConnEvent() taking a variable number of arguments. + */ + template + std::enable_if_t< + std::is_convertible_v< + std::tuple_element_t<0, std::tuple>, IntrusivePtr>> + EnqueueConnEvent(EventHandlerPtr h, Args&&... args) + { return EnqueueConnEvent(h, zeek::Args{std::forward(args)...}); } + /** * Convenience function that forwards directly to the corresponding * Connection::Weird(). diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.cc b/src/analyzer/protocol/bittorrent/BitTorrent.cc index 57ef52550a..5a85b01660 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrent.cc +++ b/src/analyzer/protocol/bittorrent/BitTorrent.cc @@ -119,11 +119,9 @@ void BitTorrent_Analyzer::EndpointEOF(bool is_orig) void BitTorrent_Analyzer::DeliverWeird(const char* msg, bool orig) { if ( bittorrent_peer_weird ) - { - ConnectionEventFast(bittorrent_peer_weird, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(msg), - }); - } + EnqueueConnEvent(bittorrent_peer_weird, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(msg) + ); } diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc index 301f37eb6c..7b0d8aedbb 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc +++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc @@ -246,13 +246,11 @@ void BitTorrentTracker_Analyzer::InitBencParser(void) void BitTorrentTracker_Analyzer::DeliverWeird(const char* msg, bool orig) { if ( bt_tracker_weird ) - { - ConnectionEventFast(bt_tracker_weird, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(msg), - }); - } + EnqueueConnEvent(bt_tracker_weird, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(msg) + ); } bool BitTorrentTracker_Analyzer::ParseRequest(char* line) @@ -349,11 +347,11 @@ void BitTorrentTracker_Analyzer::EmitRequest(void) ProtocolConfirmation(); if ( bt_tracker_request ) - ConnectionEventFast(bt_tracker_request, { - BuildConnVal(), - req_val_uri, - req_val_headers, - }); + EnqueueConnEvent(bt_tracker_request, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, req_val_uri}, + IntrusivePtr{AdoptRef{}, req_val_headers} + ); req_val_uri = 0; req_val_headers = 0; @@ -403,11 +401,11 @@ bool BitTorrentTracker_Analyzer::ParseResponse(char* line) if ( res_status != 200 ) { if ( bt_tracker_response_not_ok ) - ConnectionEventFast(bt_tracker_response_not_ok, { - BuildConnVal(), - val_mgr->GetCount(res_status), - res_val_headers, - }); + EnqueueConnEvent(bt_tracker_response_not_ok, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(res_status)}, + IntrusivePtr{AdoptRef{}, res_val_headers} + ); res_val_headers = 0; res_buf_pos = res_buf + res_buf_len; res_state = BTT_RES_DONE; @@ -790,13 +788,13 @@ void BitTorrentTracker_Analyzer::EmitResponse(void) ProtocolConfirmation(); if ( bt_tracker_response ) - ConnectionEventFast(bt_tracker_response, { - BuildConnVal(), - val_mgr->GetCount(res_status), - res_val_headers, - res_val_peers, - res_val_benc, - }); + EnqueueConnEvent(bt_tracker_response, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(res_status)}, + IntrusivePtr{AdoptRef{}, res_val_headers}, + IntrusivePtr{AdoptRef{}, res_val_peers}, + IntrusivePtr{AdoptRef{}, res_val_benc} + ); res_val_headers = 0; res_val_peers = 0; diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc index 58e8ccb857..cec1beed2c 100644 --- a/src/analyzer/protocol/conn-size/ConnSize.cc +++ b/src/analyzer/protocol/conn-size/ConnSize.cc @@ -50,11 +50,11 @@ void ConnSize_Analyzer::ThresholdEvent(EventHandlerPtr f, uint64_t threshold, bo if ( ! f ) return; - ConnectionEventFast(f, { - BuildConnVal(), - val_mgr->GetCount(threshold), - val_mgr->GetBool(is_orig), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + ); } void ConnSize_Analyzer::CheckThresholds(bool is_orig) @@ -92,11 +92,11 @@ void ConnSize_Analyzer::CheckThresholds(bool is_orig) { if ( duration_thresh > ( network_time - start_time ) && conn_duration_threshold_crossed ) { - ConnectionEventFast(conn_duration_threshold_crossed, { - BuildConnVal(), - new Val(duration_thresh, TYPE_INTERVAL), - val_mgr->GetBool(is_orig), - }); + EnqueueConnEvent(conn_duration_threshold_crossed, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(duration_thresh, TYPE_INTERVAL), + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + ); duration_thresh = 0; } } diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc index ac82a042ab..56276a7d55 100644 --- a/src/analyzer/protocol/dns/DNS.cc +++ b/src/analyzer/protocol/dns/DNS.cc @@ -48,14 +48,12 @@ int DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query) first_message = false; if ( dns_message ) - { - analyzer->ConnectionEventFast(dns_message, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_query), - msg.BuildHdrVal(), - val_mgr->GetCount(len), - }); - } + analyzer->EnqueueConnEvent(dns_message, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_query)}, + IntrusivePtr{AdoptRef{}, msg.BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} + ); // There is a great deal of non-DNS traffic that runs on port 53. // This should weed out most of it. @@ -136,10 +134,10 @@ int DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query) int DNS_Interpreter::EndMessage(DNS_MsgInfo* msg) { if ( dns_end ) - analyzer->ConnectionEventFast(dns_end, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - }); + analyzer->EnqueueConnEvent(dns_end, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()} + ); return 1; } @@ -341,13 +339,11 @@ int DNS_Interpreter::ParseAnswer(DNS_MsgInfo* msg, default: if ( dns_unknown_reply && ! msg->skip_event ) - { - analyzer->ConnectionEventFast(dns_unknown_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - }); - } + analyzer->EnqueueConnEvent(dns_unknown_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()} + ); analyzer->Weird("DNS_RR_unknown_type", fmt("%d", msg->atype)); data += rdlength; @@ -556,14 +552,12 @@ int DNS_Interpreter::ParseRR_Name(DNS_MsgInfo* msg, } if ( reply_event && ! msg->skip_event ) - { - analyzer->ConnectionEventFast(reply_event, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - new StringVal(new BroString(name, name_end - name, 1)), - }); - } + analyzer->EnqueueConnEvent(reply_event, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + make_intrusive(new BroString(name, name_end - name, 1)) + ); return 1; } @@ -602,7 +596,7 @@ int DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg, if ( dns_SOA_reply && ! msg->skip_event ) { - RecordVal* r = new RecordVal(dns_soa); + auto r = make_intrusive(dns_soa); r->Assign(0, make_intrusive(new BroString(mname, mname_end - mname, 1))); r->Assign(1, make_intrusive(new BroString(rname, rname_end - rname, 1))); r->Assign(2, val_mgr->GetCount(serial)); @@ -611,12 +605,12 @@ int DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg, r->Assign(5, make_intrusive(double(expire), Seconds)); r->Assign(6, make_intrusive(double(minimum), Seconds)); - analyzer->ConnectionEventFast(dns_SOA_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - r - }); + analyzer->EnqueueConnEvent(dns_SOA_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + std::move(r) + ); } return 1; @@ -641,15 +635,13 @@ int DNS_Interpreter::ParseRR_MX(DNS_MsgInfo* msg, analyzer->Weird("DNS_RR_length_mismatch"); if ( dns_MX_reply && ! msg->skip_event ) - { - analyzer->ConnectionEventFast(dns_MX_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - new StringVal(new BroString(name, name_end - name, 1)), - val_mgr->GetCount(preference), - }); - } + analyzer->EnqueueConnEvent(dns_MX_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + make_intrusive(new BroString(name, name_end - name, 1)), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(preference)} + ); return 1; } @@ -684,17 +676,15 @@ int DNS_Interpreter::ParseRR_SRV(DNS_MsgInfo* msg, analyzer->Weird("DNS_RR_length_mismatch"); if ( dns_SRV_reply && ! msg->skip_event ) - { - analyzer->ConnectionEventFast(dns_SRV_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - new StringVal(new BroString(name, name_end - name, 1)), - val_mgr->GetCount(priority), - val_mgr->GetCount(weight), - val_mgr->GetCount(port), - }); - } + analyzer->EnqueueConnEvent(dns_SRV_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + make_intrusive(new BroString(name, name_end - name, 1)), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(priority)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(weight)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(port)} + ); return 1; } @@ -707,13 +697,11 @@ int DNS_Interpreter::ParseRR_EDNS(DNS_MsgInfo* msg, // out to the policy side of the house if rdlength > 0. if ( dns_EDNS_addl && ! msg->skip_event ) - { - analyzer->ConnectionEventFast(dns_EDNS_addl, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildEDNS_Val(), - }); - } + analyzer->EnqueueConnEvent(dns_EDNS_addl, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildEDNS_Val()} + ); // Currently EDNS supports the movement of type:data pairs // in the RR_DATA section. Here's where we should put together @@ -786,11 +774,11 @@ int DNS_Interpreter::ParseRR_TSIG(DNS_MsgInfo* msg, tsig.orig_id = orig_id; tsig.rr_error = rr_error; - analyzer->ConnectionEventFast(dns_TSIG_addl, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildTSIG_Val(&tsig), - }); + analyzer->EnqueueConnEvent(dns_TSIG_addl, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildTSIG_Val(&tsig)} + ); } return 1; @@ -887,12 +875,12 @@ int DNS_Interpreter::ParseRR_RRSIG(DNS_MsgInfo* msg, rrsig.signer_name = new BroString(name, name_end - name, 1); rrsig.signature = sign; - analyzer->ConnectionEventFast(dns_RRSIG, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - msg->BuildRRSIG_Val(&rrsig), - }); + analyzer->EnqueueConnEvent(dns_RRSIG, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildRRSIG_Val(&rrsig)} + ); } return 1; @@ -982,12 +970,12 @@ int DNS_Interpreter::ParseRR_DNSKEY(DNS_MsgInfo* msg, dnskey.dprotocol = dprotocol; dnskey.public_key = key; - analyzer->ConnectionEventFast(dns_DNSKEY, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - msg->BuildDNSKEY_Val(&dnskey), - }); + analyzer->EnqueueConnEvent(dns_DNSKEY, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildDNSKEY_Val(&dnskey)} + ); } return 1; @@ -1014,7 +1002,7 @@ int DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg, int typebitmaps_len = rdlength - (data - data_start); - VectorVal* char_strings = new VectorVal(string_vec); + auto char_strings = make_intrusive(string_vec); while ( typebitmaps_len > 0 && len > 0 ) { @@ -1034,15 +1022,13 @@ int DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg, } if ( dns_NSEC ) - analyzer->ConnectionEventFast(dns_NSEC, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - new StringVal(new BroString(name, name_end - name, 1)), - char_strings, - }); - else - Unref(char_strings); + analyzer->EnqueueConnEvent(dns_NSEC, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + make_intrusive(new BroString(name, name_end - name, 1)), + std::move(char_strings) + ); return 1; } @@ -1122,12 +1108,12 @@ int DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg, nsec3.nsec_hash = hash_val; nsec3.bitmaps = char_strings; - analyzer->ConnectionEventFast(dns_NSEC3, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - msg->BuildNSEC3_Val(&nsec3), - }); + analyzer->EnqueueConnEvent(dns_NSEC3, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildNSEC3_Val(&nsec3)} + ); } else Unref(char_strings); @@ -1182,12 +1168,12 @@ int DNS_Interpreter::ParseRR_DS(DNS_MsgInfo* msg, ds.digest_type = ds_dtype; ds.digest_val = ds_digest; - analyzer->ConnectionEventFast(dns_DS, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - msg->BuildDS_Val(&ds), - }); + analyzer->EnqueueConnEvent(dns_DS, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildDS_Val(&ds)} + ); } return 1; @@ -1205,14 +1191,12 @@ int DNS_Interpreter::ParseRR_A(DNS_MsgInfo* msg, uint32_t addr = ExtractLong(data, len); if ( dns_A_reply && ! msg->skip_event ) - { - analyzer->ConnectionEventFast(dns_A_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - new AddrVal(htonl(addr)), - }); - } + analyzer->EnqueueConnEvent(dns_A_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + make_intrusive(htonl(addr)) + ); return 1; } @@ -1241,15 +1225,14 @@ int DNS_Interpreter::ParseRR_AAAA(DNS_MsgInfo* msg, event = dns_AAAA_reply; else event = dns_A6_reply; + if ( event && ! msg->skip_event ) - { - analyzer->ConnectionEventFast(event, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - new AddrVal(addr), - }); - } + analyzer->EnqueueConnEvent(event, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + make_intrusive(addr) + ); return 1; } @@ -1311,21 +1294,19 @@ int DNS_Interpreter::ParseRR_TXT(DNS_MsgInfo* msg, return 1; } - VectorVal* char_strings = new VectorVal(string_vec); + auto char_strings = make_intrusive(string_vec); StringVal* char_string; while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) ) char_strings->Assign(char_strings->Size(), char_string); if ( dns_TXT_reply ) - analyzer->ConnectionEventFast(dns_TXT_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - char_strings, - }); - else - Unref(char_strings); + analyzer->EnqueueConnEvent(dns_TXT_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + std::move(char_strings) + ); return rdlength == 0; } @@ -1341,21 +1322,19 @@ int DNS_Interpreter::ParseRR_SPF(DNS_MsgInfo* msg, return 1; } - VectorVal* char_strings = new VectorVal(string_vec); + auto char_strings = make_intrusive(string_vec); StringVal* char_string; while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) ) char_strings->Assign(char_strings->Size(), char_string); if ( dns_SPF_reply ) - analyzer->ConnectionEventFast(dns_SPF_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - char_strings, - }); - else - Unref(char_strings); + analyzer->EnqueueConnEvent(dns_SPF_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + std::move(char_strings) + ); return rdlength == 0; } @@ -1391,14 +1370,14 @@ int DNS_Interpreter::ParseRR_CAA(DNS_MsgInfo* msg, rdlength -= value->Len(); if ( dns_CAA_reply ) - analyzer->ConnectionEventFast(dns_CAA_reply, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - msg->BuildAnswerVal(), - val_mgr->GetCount(flags), - new StringVal(tag), - new StringVal(value), - }); + analyzer->EnqueueConnEvent(dns_CAA_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flags)}, + make_intrusive(tag), + make_intrusive(value) + ); else { delete tag; @@ -1419,13 +1398,13 @@ void DNS_Interpreter::SendReplyOrRejectEvent(DNS_MsgInfo* msg, assert(event); - analyzer->ConnectionEventFast(event, { - analyzer->BuildConnVal(), - msg->BuildHdrVal(), - new StringVal(question_name), - val_mgr->GetCount(qtype), - val_mgr->GetCount(qclass), - }); + analyzer->EnqueueConnEvent(event, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, + make_intrusive(question_name), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(qtype)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(qclass)} + ); } diff --git a/src/analyzer/protocol/file/File.cc b/src/analyzer/protocol/file/File.cc index 0d32f08ff0..7dca15c119 100644 --- a/src/analyzer/protocol/file/File.cc +++ b/src/analyzer/protocol/file/File.cc @@ -79,10 +79,10 @@ void File_Analyzer::Identify() : *(matches.begin()->second.begin()); if ( file_transferred ) - ConnectionEventFast(file_transferred, { - BuildConnVal(), - new StringVal(buffer_len, buffer), - new StringVal(""), - new StringVal(match), - }); + EnqueueConnEvent(file_transferred, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(buffer_len, buffer), + make_intrusive(""), + make_intrusive(match) + ); } diff --git a/src/analyzer/protocol/finger/Finger.cc b/src/analyzer/protocol/finger/Finger.cc index 127ab048e1..cbb1e94ce0 100644 --- a/src/analyzer/protocol/finger/Finger.cc +++ b/src/analyzer/protocol/finger/Finger.cc @@ -67,14 +67,12 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig host = at + 1; if ( finger_request ) - { - ConnectionEventFast(finger_request, { - BuildConnVal(), - val_mgr->GetBool(long_cnt), - new StringVal(at - line, line), - new StringVal(end_of_line - host, host), - }); - } + EnqueueConnEvent(finger_request, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(long_cnt)}, + make_intrusive(at - line, line), + make_intrusive(end_of_line - host, host) + ); Conn()->Match(Rule::FINGER, (const u_char *) line, end_of_line - line, true, true, 1, true); @@ -87,9 +85,9 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig if ( ! finger_reply ) return; - ConnectionEventFast(finger_reply, { - BuildConnVal(), - new StringVal(end_of_line - line, line), - }); + EnqueueConnEvent(finger_reply, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(end_of_line - line, line) + ); } } diff --git a/src/analyzer/protocol/ftp/FTP.cc b/src/analyzer/protocol/ftp/FTP.cc index 820a193958..a9b658e06b 100644 --- a/src/analyzer/protocol/ftp/FTP.cc +++ b/src/analyzer/protocol/ftp/FTP.cc @@ -75,7 +75,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig) // Could emit "ftp empty request/reply" weird, but maybe not worth it. return; - val_list vl; + zeek::Args vl; EventHandlerPtr f; if ( orig ) @@ -96,10 +96,10 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig) else cmd_str = (new StringVal(cmd_len, cmd))->ToUpper(); - vl = val_list{ - BuildConnVal(), - cmd_str, - new StringVal(end_of_line - line, line), + vl = { + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, cmd_str}, + make_intrusive(end_of_line - line, line), }; f = ftp_request; @@ -175,17 +175,17 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig) } } - vl = val_list{ - BuildConnVal(), - val_mgr->GetCount(reply_code), - new StringVal(end_of_line - line, line), - val_mgr->GetBool(cont_resp), + vl = { + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, + make_intrusive(end_of_line - line, line), + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(cont_resp)} }; f = ftp_reply; } - ConnectionEvent(f, std::move(vl)); + EnqueueConnEvent(f, std::move(vl)); ForwardStream(length, data, orig); } diff --git a/src/analyzer/protocol/gnutella/Gnutella.cc b/src/analyzer/protocol/gnutella/Gnutella.cc index 7cc6285c8c..abb1bb892e 100644 --- a/src/analyzer/protocol/gnutella/Gnutella.cc +++ b/src/analyzer/protocol/gnutella/Gnutella.cc @@ -59,9 +59,9 @@ void Gnutella_Analyzer::Done() if ( ! sent_establish && (gnutella_establish || gnutella_not_establish) ) { if ( Established() && gnutella_establish ) - ConnectionEventFast(gnutella_establish, {BuildConnVal()}); + EnqueueConnEvent(gnutella_establish, IntrusivePtr{AdoptRef{}, BuildConnVal()}); else if ( ! Established () && gnutella_not_establish ) - ConnectionEventFast(gnutella_not_establish, {BuildConnVal()}); + EnqueueConnEvent(gnutella_not_establish, IntrusivePtr{AdoptRef{}, BuildConnVal()}); } if ( gnutella_partial_binary_msg ) @@ -71,14 +71,12 @@ void Gnutella_Analyzer::Done() for ( int i = 0; i < 2; ++i, p = resp_msg_state ) { if ( ! p->msg_sent && p->msg_pos ) - { - ConnectionEventFast(gnutella_partial_binary_msg, { - BuildConnVal(), - new StringVal(p->msg), - val_mgr->GetBool((i == 0)), - val_mgr->GetCount(p->msg_pos), - }); - } + EnqueueConnEvent(gnutella_partial_binary_msg, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(p->msg), + IntrusivePtr{AdoptRef{}, val_mgr->GetBool((i == 0))}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_pos)} + ); else if ( ! p->msg_sent && p->payload_left ) SendEvents(p, (i == 0)); @@ -120,9 +118,7 @@ int Gnutella_Analyzer::IsHTTP(string header) return 0; if ( gnutella_http_notify ) - { - ConnectionEventFast(gnutella_http_notify, {BuildConnVal()}); - } + EnqueueConnEvent(gnutella_http_notify, IntrusivePtr{AdoptRef{}, BuildConnVal()}); analyzer::Analyzer* a = analyzer_mgr->InstantiateAnalyzer("HTTP", Conn()); @@ -180,13 +176,11 @@ void Gnutella_Analyzer::DeliverLines(int len, const u_char* data, bool orig) else { if ( gnutella_text_msg ) - { - ConnectionEventFast(gnutella_text_msg, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(ms->headers.data()), - }); - } + EnqueueConnEvent(gnutella_text_msg, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(ms->headers.data()) + ); ms->headers = ""; state |= new_state; @@ -195,7 +189,7 @@ void Gnutella_Analyzer::DeliverLines(int len, const u_char* data, bool orig) { sent_establish = 1; - ConnectionEventFast(gnutella_establish, {BuildConnVal()}); + EnqueueConnEvent(gnutella_establish, IntrusivePtr{AdoptRef{}, BuildConnVal()}); } } } @@ -220,20 +214,18 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig) return; if ( gnutella_binary_msg ) - { - ConnectionEventFast(gnutella_binary_msg, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - val_mgr->GetCount(p->msg_type), - val_mgr->GetCount(p->msg_ttl), - val_mgr->GetCount(p->msg_hops), - val_mgr->GetCount(p->msg_len), - new StringVal(p->payload), - val_mgr->GetCount(p->payload_len), - val_mgr->GetBool((p->payload_len < min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))), - val_mgr->GetBool((p->payload_left == 0)), - }); - } + EnqueueConnEvent(gnutella_binary_msg, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_type)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_ttl)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_hops)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_len)}, + make_intrusive(p->payload), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->payload_len)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_len < min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD)))}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_left == 0))} + ); } diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index 7c7190d936..afae705756 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -649,13 +649,11 @@ void HTTP_Message::Done(const int interrupted, const char* detail) } if ( http_message_done ) - { - GetAnalyzer()->ConnectionEventFast(http_message_done, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_orig), - BuildMessageStat(interrupted, detail), - }); - } + GetAnalyzer()->EnqueueConnEvent(http_message_done, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, BuildMessageStat(interrupted, detail)} + ); MyHTTP_Analyzer()->HTTP_MessageDone(is_orig, this); } @@ -682,12 +680,10 @@ void HTTP_Message::BeginEntity(mime::MIME_Entity* entity) current_entity = (HTTP_Entity*) entity; if ( http_begin_entity ) - { - analyzer->ConnectionEventFast(http_begin_entity, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_orig), - }); - } + analyzer->EnqueueConnEvent(http_begin_entity, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + ); } void HTTP_Message::EndEntity(mime::MIME_Entity* entity) @@ -699,12 +695,10 @@ void HTTP_Message::EndEntity(mime::MIME_Entity* entity) header_length += ((HTTP_Entity*) entity)->HeaderLength(); if ( http_end_entity ) - { - analyzer->ConnectionEventFast(http_end_entity, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_orig), - }); - } + analyzer->EnqueueConnEvent(http_end_entity, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + ); current_entity = (HTTP_Entity*) entity->Parent(); @@ -740,27 +734,23 @@ void HTTP_Message::SubmitHeader(mime::MIME_Header* h) void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist) { if ( http_all_headers ) - { - analyzer->ConnectionEventFast(http_all_headers, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_orig), - BuildHeaderTable(hlist), - }); - } + analyzer->EnqueueConnEvent(http_all_headers, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, BuildHeaderTable(hlist)} + ); if ( http_content_type ) { StringVal* ty = current_entity->ContentType(); StringVal* subty = current_entity->ContentSubType(); - ty->Ref(); - subty->Ref(); - analyzer->ConnectionEventFast(http_content_type, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_orig), - ty, - subty, - }); + analyzer->EnqueueConnEvent(http_content_type, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{NewRef{}, ty}, + IntrusivePtr{NewRef{}, subty} + ); } } @@ -1182,14 +1172,14 @@ void HTTP_Analyzer::GenStats() { if ( http_stats ) { - RecordVal* r = new RecordVal(http_stats_rec); + auto r = make_intrusive(http_stats_rec); r->Assign(0, val_mgr->GetCount(num_requests)); r->Assign(1, val_mgr->GetCount(num_replies)); r->Assign(2, make_intrusive(request_version.ToDouble(), TYPE_DOUBLE)); r->Assign(3, make_intrusive(reply_version.ToDouble(), TYPE_DOUBLE)); // DEBUG_MSG("%.6f http_stats\n", network_time); - ConnectionEventFast(http_stats, {BuildConnVal(), r}); + EnqueueConnEvent(http_stats, IntrusivePtr{AdoptRef{}, BuildConnVal()}, std::move(r)); } } @@ -1387,16 +1377,14 @@ void HTTP_Analyzer::HTTP_Event(const char* category, const char* detail) void HTTP_Analyzer::HTTP_Event(const char* category, StringVal* detail) { if ( http_event ) - { // DEBUG_MSG("%.6f http_event\n", network_time); - ConnectionEventFast(http_event, { - BuildConnVal(), - new StringVal(category), - detail, - }); - } + EnqueueConnEvent(http_event, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(category), + IntrusivePtr{AdoptRef{}, detail} + ); else - delete detail; + Unref(detail); } StringVal* HTTP_Analyzer::TruncateURI(StringVal* uri) @@ -1428,33 +1416,27 @@ void HTTP_Analyzer::HTTP_Request() connect_request = true; if ( http_request ) - { - Ref(request_method); - // DEBUG_MSG("%.6f http_request\n", network_time); - ConnectionEventFast(http_request, { - BuildConnVal(), - request_method, - TruncateURI(request_URI->AsStringVal()), - TruncateURI(unescaped_URI->AsStringVal()), - new StringVal(fmt("%.1f", request_version.ToDouble())), - }); - } + EnqueueConnEvent(http_request, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{NewRef{}, request_method}, + IntrusivePtr{AdoptRef{}, TruncateURI(request_URI->AsStringVal())}, + IntrusivePtr{AdoptRef{}, TruncateURI(unescaped_URI->AsStringVal())}, + make_intrusive(fmt("%.1f", request_version.ToDouble())) + ); } void HTTP_Analyzer::HTTP_Reply() { if ( http_reply ) - { - ConnectionEventFast(http_reply, { - BuildConnVal(), - new StringVal(fmt("%.1f", reply_version.ToDouble())), - val_mgr->GetCount(reply_code), + EnqueueConnEvent(http_reply, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(fmt("%.1f", reply_version.ToDouble())), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, reply_reason_phrase ? - reply_reason_phrase->Ref() : - new StringVal(""), - }); - } + IntrusivePtr{NewRef{}, reply_reason_phrase} : + make_intrusive("") + ); else { Unref(reply_reason_phrase); @@ -1524,12 +1506,10 @@ void HTTP_Analyzer::ReplyMade(const int interrupted, const char* msg) RemoveSupportAnalyzer(content_line_resp); if ( http_connection_upgrade ) - { - ConnectionEventFast(http_connection_upgrade, { - BuildConnVal(), - new StringVal(upgrade_protocol), - }); - } + EnqueueConnEvent(http_connection_upgrade, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(upgrade_protocol) + ); } reply_code = 0; @@ -1690,26 +1670,24 @@ void HTTP_Analyzer::HTTP_Header(int is_orig, mime::MIME_Header* h) if ( DEBUG_http ) DEBUG_MSG("%.6f http_header\n", network_time); - ConnectionEventFast(http_header, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - mime::new_string_val(h->get_name())->ToUpper(), - mime::new_string_val(h->get_value()), - }); + EnqueueConnEvent(http_header, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())->ToUpper()}, + IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_value())} + ); } } void HTTP_Analyzer::HTTP_EntityData(int is_orig, BroString* entity_data) { if ( http_entity_data ) - { - ConnectionEventFast(http_entity_data, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - val_mgr->GetCount(entity_data->Len()), - new StringVal(entity_data), - }); - } + EnqueueConnEvent(http_entity_data, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(entity_data->Len())}, + make_intrusive(entity_data) + ); else delete entity_data; } diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc index 9595d6a795..1a3cb6ad34 100644 --- a/src/analyzer/protocol/icmp/ICMP.cc +++ b/src/analyzer/protocol/icmp/ICMP.cc @@ -202,22 +202,20 @@ void ICMP_Analyzer::ICMP_Sent(const struct icmp* icmpp, int len, int caplen, const IP_Hdr* ip_hdr) { if ( icmp_sent ) - { - ConnectionEventFast(icmp_sent, { - BuildConnVal(), - BuildICMPVal(icmpp, len, icmpv6, ip_hdr), - }); - } + EnqueueConnEvent(icmp_sent, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, icmpv6, ip_hdr)} + ); if ( icmp_sent_payload ) { BroString* payload = new BroString(data, min(len, caplen), 0); - ConnectionEventFast(icmp_sent_payload, { - BuildConnVal(), - BuildICMPVal(icmpp, len, icmpv6, ip_hdr), - new StringVal(payload), - }); + EnqueueConnEvent(icmp_sent_payload, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, icmpv6, ip_hdr)}, + make_intrusive(payload) + ); } } @@ -516,13 +514,13 @@ void ICMP_Analyzer::Echo(double t, const struct icmp* icmpp, int len, BroString* payload = new BroString(data, caplen, 0); - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr), - val_mgr->GetCount(iid), - val_mgr->GetCount(iseq), - new StringVal(payload), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(iid)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(iseq)}, + make_intrusive(payload) + ); } @@ -544,21 +542,21 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len, int opt_offset = sizeof(reachable) + sizeof(retrans); - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, 1, ip_hdr), - val_mgr->GetCount(icmpp->icmp_num_addrs), // Cur Hop Limit - val_mgr->GetBool(icmpp->icmp_wpa & 0x80), // Managed - val_mgr->GetBool(icmpp->icmp_wpa & 0x40), // Other - val_mgr->GetBool(icmpp->icmp_wpa & 0x20), // Home Agent - val_mgr->GetCount((icmpp->icmp_wpa & 0x18)>>3), // Pref - val_mgr->GetBool(icmpp->icmp_wpa & 0x04), // Proxy - val_mgr->GetCount(icmpp->icmp_wpa & 0x02), // Reserved - new IntervalVal((double)ntohs(icmpp->icmp_lifetime), Seconds), - new IntervalVal((double)ntohl(reachable), Milliseconds), - new IntervalVal((double)ntohl(retrans), Milliseconds), - BuildNDOptionsVal(caplen - opt_offset, data + opt_offset), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_num_addrs)}, // Cur Hop Limit + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x80)}, // Managed + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x40)}, // Other + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x20)}, // Home Agent + IntrusivePtr{AdoptRef{}, val_mgr->GetCount((icmpp->icmp_wpa & 0x18)>>3)}, // Pref + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x04)}, // Proxy + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_wpa & 0x02)}, // Reserved + make_intrusive((double)ntohs(icmpp->icmp_lifetime), Seconds), + make_intrusive((double)ntohl(reachable), Milliseconds), + make_intrusive((double)ntohl(retrans), Milliseconds), + IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)} + ); } @@ -577,15 +575,15 @@ void ICMP_Analyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len, int opt_offset = sizeof(in6_addr); - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, 1, ip_hdr), - val_mgr->GetBool(icmpp->icmp_num_addrs & 0x80), // Router - val_mgr->GetBool(icmpp->icmp_num_addrs & 0x40), // Solicited - val_mgr->GetBool(icmpp->icmp_num_addrs & 0x20), // Override - new AddrVal(tgtaddr), - BuildNDOptionsVal(caplen - opt_offset, data + opt_offset), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x80)}, // Router + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x40)}, // Solicited + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x20)}, // Override + make_intrusive(tgtaddr), + IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)} + ); } @@ -604,12 +602,12 @@ void ICMP_Analyzer::NeighborSolicit(double t, const struct icmp* icmpp, int len, int opt_offset = sizeof(in6_addr); - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, 1, ip_hdr), - new AddrVal(tgtaddr), - BuildNDOptionsVal(caplen - opt_offset, data + opt_offset), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, + make_intrusive(tgtaddr), + IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)} + ); } @@ -631,13 +629,13 @@ void ICMP_Analyzer::Redirect(double t, const struct icmp* icmpp, int len, int opt_offset = 2 * sizeof(in6_addr); - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, 1, ip_hdr), - new AddrVal(tgtaddr), - new AddrVal(dstaddr), - BuildNDOptionsVal(caplen - opt_offset, data + opt_offset), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, + make_intrusive(tgtaddr), + make_intrusive(dstaddr), + IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)} + ); } @@ -649,11 +647,11 @@ void ICMP_Analyzer::RouterSolicit(double t, const struct icmp* icmpp, int len, if ( ! f ) return; - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, 1, ip_hdr), - BuildNDOptionsVal(caplen, data), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, + IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen, data)} + ); } @@ -674,14 +672,12 @@ void ICMP_Analyzer::Context4(double t, const struct icmp* icmpp, } if ( f ) - { - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, 0, ip_hdr), - val_mgr->GetCount(icmpp->icmp_code), - ExtractICMP4Context(caplen, data), - }); - } + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 0, ip_hdr)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_code)}, + IntrusivePtr{AdoptRef{}, ExtractICMP4Context(caplen, data)} + ); } @@ -714,14 +710,12 @@ void ICMP_Analyzer::Context6(double t, const struct icmp* icmpp, } if ( f ) - { - ConnectionEventFast(f, { - BuildConnVal(), - BuildICMPVal(icmpp, len, 1, ip_hdr), - val_mgr->GetCount(icmpp->icmp_code), - ExtractICMP6Context(caplen, data), - }); - } + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_code)}, + IntrusivePtr{AdoptRef{}, ExtractICMP6Context(caplen, data)} + ); } VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) diff --git a/src/analyzer/protocol/ident/Ident.cc b/src/analyzer/protocol/ident/Ident.cc index 2ccb66dbb9..eb9a7d71df 100644 --- a/src/analyzer/protocol/ident/Ident.cc +++ b/src/analyzer/protocol/ident/Ident.cc @@ -84,11 +84,11 @@ void Ident_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig) Weird("ident_request_addendum", s.CheckString()); } - ConnectionEventFast(ident_request, { - BuildConnVal(), - val_mgr->GetPort(local_port, TRANSPORT_TCP), - val_mgr->GetPort(remote_port, TRANSPORT_TCP), - }); + EnqueueConnEvent(ident_request, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetPort(local_port, TRANSPORT_TCP)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetPort(remote_port, TRANSPORT_TCP)} + ); did_deliver = true; } @@ -145,12 +145,12 @@ void Ident_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig) if ( is_error ) { if ( ident_error ) - ConnectionEventFast(ident_error, { - BuildConnVal(), - val_mgr->GetPort(local_port, TRANSPORT_TCP), - val_mgr->GetPort(remote_port, TRANSPORT_TCP), - new StringVal(end_of_line - line, line), - }); + EnqueueConnEvent(ident_error, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetPort(local_port, TRANSPORT_TCP)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetPort(remote_port, TRANSPORT_TCP)}, + make_intrusive(end_of_line - line, line) + ); } else @@ -178,13 +178,13 @@ void Ident_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig) line = skip_whitespace(colon + 1, end_of_line); - ConnectionEventFast(ident_reply, { - BuildConnVal(), - val_mgr->GetPort(local_port, TRANSPORT_TCP), - val_mgr->GetPort(remote_port, TRANSPORT_TCP), - new StringVal(end_of_line - line, line), - new StringVal(sys_type_s), - }); + EnqueueConnEvent(ident_reply, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetPort(local_port, TRANSPORT_TCP)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetPort(remote_port, TRANSPORT_TCP)}, + make_intrusive(end_of_line - line, line), + make_intrusive(sys_type_s) + ); } } } diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc index d380b7742c..ff9bb4cb4c 100644 --- a/src/analyzer/protocol/irc/IRC.cc +++ b/src/analyzer/protocol/irc/IRC.cc @@ -233,13 +233,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) // else ### } - ConnectionEventFast(irc_network_info, { - BuildConnVal(), - val_mgr->GetBool(orig), - val_mgr->GetInt(users), - val_mgr->GetInt(services), - val_mgr->GetInt(servers), - }); + EnqueueConnEvent(irc_network_info, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)} + ); } break; @@ -270,24 +270,23 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts.size() > 0 && parts[0][0] == ':' ) parts[0] = parts[0].substr(1); - TableVal* set = new TableVal({NewRef{}, string_set}); + auto set = make_intrusive(IntrusivePtr{NewRef{}, string_set}); for ( unsigned int i = 0; i < parts.size(); ++i ) { if ( parts[i][0] == '@' ) parts[i] = parts[i].substr(1); - Val* idx = new StringVal(parts[i].c_str()); - set->Assign(idx, 0); - Unref(idx); + auto idx = make_intrusive(parts[i].c_str()); + set->Assign(idx.get(), 0); } - ConnectionEventFast(irc_names_info, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(type.c_str()), - new StringVal(channel.c_str()), - set, - }); + EnqueueConnEvent(irc_names_info, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(type.c_str()), + make_intrusive(channel.c_str()), + std::move(set) + ); } break; @@ -315,13 +314,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) // else ### } - ConnectionEventFast(irc_server_info, { - BuildConnVal(), - val_mgr->GetBool(orig), - val_mgr->GetInt(users), - val_mgr->GetInt(services), - val_mgr->GetInt(servers), - }); + EnqueueConnEvent(irc_server_info, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)} + ); } break; @@ -337,11 +336,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts[i] == ":channels" ) channels = atoi(parts[i - 1].c_str()); - ConnectionEventFast(irc_channel_info, { - BuildConnVal(), - val_mgr->GetBool(orig), - val_mgr->GetInt(channels), - }); + EnqueueConnEvent(irc_channel_info, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(channels)} + ); } break; @@ -369,12 +368,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) break; } - ConnectionEventFast(irc_global_users, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(eop - prefix, prefix), - new StringVal(++msg), - }); + EnqueueConnEvent(irc_global_users, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(eop - prefix, prefix), + make_intrusive(++msg) + ); break; } @@ -394,12 +393,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) return; } - val_list vl(6); - vl.push_back(BuildConnVal()); - vl.push_back(val_mgr->GetBool(orig)); - vl.push_back(new StringVal(parts[0].c_str())); - vl.push_back(new StringVal(parts[1].c_str())); - vl.push_back(new StringVal(parts[2].c_str())); + zeek::Args vl; + vl.reserve(6); + vl.emplace_back(AdoptRef{}, BuildConnVal()); + vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig)); + vl.emplace_back(make_intrusive(parts[0].c_str())); + vl.emplace_back(make_intrusive(parts[1].c_str())); + vl.emplace_back(make_intrusive(parts[2].c_str())); parts.erase(parts.begin(), parts.begin() + 4); @@ -410,9 +410,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( real_name[0] == ':' ) real_name = real_name.substr(1); - vl.push_back(new StringVal(real_name.c_str())); + vl.emplace_back(make_intrusive(real_name.c_str())); - ConnectionEventFast(irc_whois_user_line, std::move(vl)); + EnqueueConnEvent(irc_whois_user_line, std::move(vl)); } break; @@ -433,11 +433,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) return; } - ConnectionEventFast(irc_whois_operator_line, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(parts[0].c_str()), - }); + EnqueueConnEvent(irc_whois_operator_line, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(parts[0].c_str()) + ); } break; @@ -463,21 +463,20 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts.size() > 0 && parts[0][0] == ':' ) parts[0] = parts[0].substr(1); - TableVal* set = new TableVal({NewRef{}, string_set}); + auto set = make_intrusive(IntrusivePtr{NewRef{}, string_set}); for ( unsigned int i = 0; i < parts.size(); ++i ) { - Val* idx = new StringVal(parts[i].c_str()); - set->Assign(idx, 0); - Unref(idx); + auto idx = make_intrusive(parts[i].c_str()); + set->Assign(idx.get(), 0); } - ConnectionEventFast(irc_whois_channel_line, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(nick.c_str()), - set, - }); + EnqueueConnEvent(irc_whois_channel_line, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(nick.c_str()), + std::move(set) + ); } break; @@ -503,12 +502,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( *t == ':' ) ++t; - ConnectionEventFast(irc_channel_topic, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(parts[1].c_str()), - new StringVal(t), - }); + EnqueueConnEvent(irc_channel_topic, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(parts[1].c_str()), + make_intrusive(t) + ); } else { @@ -537,19 +536,19 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts[7][0] == ':' ) parts[7] = parts[7].substr(1); - ConnectionEventFast(irc_who_line, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(parts[0].c_str()), - new StringVal(parts[1].c_str()), - new StringVal(parts[2].c_str()), - new StringVal(parts[3].c_str()), - new StringVal(parts[4].c_str()), - new StringVal(parts[5].c_str()), - new StringVal(parts[6].c_str()), - val_mgr->GetInt(atoi(parts[7].c_str())), - new StringVal(parts[8].c_str()), - }); + EnqueueConnEvent(irc_who_line, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(parts[0].c_str()), + make_intrusive(parts[1].c_str()), + make_intrusive(parts[2].c_str()), + make_intrusive(parts[3].c_str()), + make_intrusive(parts[4].c_str()), + make_intrusive(parts[5].c_str()), + make_intrusive(parts[6].c_str()), + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(atoi(parts[7].c_str()))}, + make_intrusive(parts[8].c_str()) + ); } break; @@ -559,25 +558,21 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) case 433: case 436: if ( irc_invalid_nick ) - { - ConnectionEventFast(irc_invalid_nick, { - BuildConnVal(), - val_mgr->GetBool(orig), - }); - } + EnqueueConnEvent(irc_invalid_nick, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)} + ); break; // Operator responses. case 381: // User is operator case 491: // user is not operator if ( irc_oper_response ) - { - ConnectionEventFast(irc_oper_response, { - BuildConnVal(), - val_mgr->GetBool(orig), - val_mgr->GetBool(code == 381), - }); - } + EnqueueConnEvent(irc_oper_response, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(code == 381)} + ); break; case 670: @@ -588,13 +583,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) // All other server replies. default: if ( irc_reply ) - ConnectionEventFast(irc_reply, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - val_mgr->GetCount(code), - new StringVal(params.c_str()), - }); + EnqueueConnEvent(irc_reply, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(code)}, + make_intrusive(params.c_str()) + ); break; } return; @@ -659,31 +654,31 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_dcc_message ) - ConnectionEventFast(irc_dcc_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(target.c_str()), - new StringVal(parts[1].c_str()), - new StringVal(parts[2].c_str()), - new AddrVal(htonl(raw_ip)), - val_mgr->GetCount(atoi(parts[4].c_str())), - parts.size() >= 6 ? + EnqueueConnEvent(irc_dcc_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(target.c_str()), + make_intrusive(parts[1].c_str()), + make_intrusive(parts[2].c_str()), + make_intrusive(htonl(raw_ip)), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(atoi(parts[4].c_str()))}, + IntrusivePtr{AdoptRef{}, parts.size() >= 6 ? val_mgr->GetCount(atoi(parts[5].c_str())) : - val_mgr->GetCount(0), - }); + val_mgr->GetCount(0)} + ); } else { if ( irc_privmsg_message ) - ConnectionEventFast(irc_privmsg_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(target.c_str()), - new StringVal(message.c_str()), - }); + EnqueueConnEvent(irc_privmsg_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(target.c_str()), + make_intrusive(message.c_str()) + ); } } @@ -702,13 +697,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( message[0] == ':' ) message = message.substr(1); - ConnectionEventFast(irc_notice_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(target.c_str()), - new StringVal(message.c_str()), - }); + EnqueueConnEvent(irc_notice_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(target.c_str()), + make_intrusive(message.c_str()) + ); } else if ( irc_squery_message && command == "SQUERY" ) @@ -726,34 +721,35 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( message[0] == ':' ) message = message.substr(1); - ConnectionEventFast(irc_squery_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(target.c_str()), - new StringVal(message.c_str()), - }); + EnqueueConnEvent(irc_squery_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(target.c_str()), + make_intrusive(message.c_str()) + ); } else if ( irc_user_message && command == "USER" ) { // extract username and real name vector parts = SplitWords(params, ' '); - val_list vl(6); - vl.push_back(BuildConnVal()); - vl.push_back(val_mgr->GetBool(orig)); + zeek::Args vl; + vl.reserve(6); + vl.emplace_back(AdoptRef{}, BuildConnVal()); + vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig)); if ( parts.size() > 0 ) - vl.push_back(new StringVal(parts[0].c_str())); - else vl.push_back(val_mgr->GetEmptyString()); + vl.emplace_back(make_intrusive(parts[0].c_str())); + else vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); if ( parts.size() > 1 ) - vl.push_back(new StringVal(parts[1].c_str())); - else vl.push_back(val_mgr->GetEmptyString()); + vl.emplace_back(make_intrusive(parts[1].c_str())); + else vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); if ( parts.size() > 2 ) - vl.push_back(new StringVal(parts[2].c_str())); - else vl.push_back(val_mgr->GetEmptyString()); + vl.emplace_back(make_intrusive(parts[2].c_str())); + else vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); string realname; for ( unsigned int i = 3; i < parts.size(); i++ ) @@ -764,9 +760,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) } const char* name = realname.c_str(); - vl.push_back(new StringVal(*name == ':' ? name + 1 : name)); + vl.emplace_back(make_intrusive(*name == ':' ? name + 1 : name)); - ConnectionEventFast(irc_user_message, std::move(vl)); + EnqueueConnEvent(irc_user_message, std::move(vl)); } else if ( irc_oper_message && command == "OPER" ) @@ -774,14 +770,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) // extract username and password vector parts = SplitWords(params, ' '); if ( parts.size() == 2 ) - { - ConnectionEventFast(irc_oper_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(parts[0].c_str()), - new StringVal(parts[1].c_str()), - }); - } + EnqueueConnEvent(irc_oper_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(parts[0].c_str()), + make_intrusive(parts[1].c_str()) + ); else Weird("irc_invalid_oper_message_format"); @@ -797,12 +791,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) return; } - val_list vl(6); - vl.push_back(BuildConnVal()); - vl.push_back(val_mgr->GetBool(orig)); - vl.push_back(new StringVal(prefix.c_str())); - vl.push_back(new StringVal(parts[0].c_str())); - vl.push_back(new StringVal(parts[1].c_str())); + zeek::Args vl; + vl.reserve(6); + vl.emplace_back(AdoptRef{}, BuildConnVal()); + vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig)); + vl.emplace_back(make_intrusive(prefix.c_str())); + vl.emplace_back(make_intrusive(parts[0].c_str())); + vl.emplace_back(make_intrusive(parts[1].c_str())); + if ( parts.size() > 2 ) { string comment = parts[2]; @@ -812,12 +808,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( comment[0] == ':' ) comment = comment.substr(1); - vl.push_back(new StringVal(comment.c_str())); + vl.emplace_back(make_intrusive(comment.c_str())); } else - vl.push_back(val_mgr->GetEmptyString()); + vl.emplace_back(AdoptRef{}, val_mgr->GetEmptyString()); - ConnectionEventFast(irc_kick_message, std::move(vl)); + EnqueueConnEvent(irc_kick_message, std::move(vl)); } else if ( irc_join_message && command == "JOIN" ) @@ -841,7 +837,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) nickname = prefix.substr(0, pos); } - TableVal* list = new TableVal({NewRef{}, irc_join_list}); + auto list = make_intrusive(IntrusivePtr{NewRef{}, irc_join_list}); vector channels = SplitWords(parts[0], ','); vector passwords; @@ -865,11 +861,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) Unref(info); } - ConnectionEventFast(irc_join_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - list, - }); + EnqueueConnEvent(irc_join_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + std::move(list) + ); } else if ( irc_join_message && command == "NJOIN" ) @@ -886,13 +882,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) parts[1] = parts[1].substr(1); vector users = SplitWords(parts[1], ','); - TableVal* list = new TableVal({NewRef{}, irc_join_list}); + auto list = make_intrusive(IntrusivePtr{NewRef{}, irc_join_list}); string empty_string = ""; for ( unsigned int i = 0; i < users.size(); ++i ) { - RecordVal* info = new RecordVal(irc_join_info); + auto info = make_intrusive(irc_join_info); string nick = users[i]; string mode = "none"; @@ -922,15 +918,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) info->Assign(2, make_intrusive(empty_string.c_str())); // User mode: info->Assign(3, make_intrusive(mode.c_str())); - list->Assign(info, 0); - Unref(info); + list->Assign(info.get(), 0); } - ConnectionEventFast(irc_join_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - list, - }); + EnqueueConnEvent(irc_join_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + std::move(list) + ); } else if ( irc_part_message && command == "PART" ) @@ -957,22 +952,21 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) nick = nick.substr(0, pos); vector channelList = SplitWords(channels, ','); - TableVal* set = new TableVal({NewRef{}, string_set}); + auto set = make_intrusive(IntrusivePtr{NewRef{}, string_set}); for ( unsigned int i = 0; i < channelList.size(); ++i ) { - Val* idx = new StringVal(channelList[i].c_str()); - set->Assign(idx, 0); - Unref(idx); + auto idx = make_intrusive(channelList[i].c_str()); + set->Assign(idx.get(), 0); } - ConnectionEventFast(irc_part_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(nick.c_str()), - set, - new StringVal(message.c_str()), - }); + EnqueueConnEvent(irc_part_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(nick.c_str()), + std::move(set), + make_intrusive(message.c_str()) + ); } else if ( irc_quit_message && command == "QUIT" ) @@ -989,12 +983,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) nickname = prefix.substr(0, pos); } - ConnectionEventFast(irc_quit_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(nickname.c_str()), - new StringVal(message.c_str()), - }); + EnqueueConnEvent(irc_quit_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(nickname.c_str()), + make_intrusive(message.c_str()) + ); } else if ( irc_nick_message && command == "NICK" ) @@ -1003,12 +997,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( nick[0] == ':' ) nick = nick.substr(1); - ConnectionEventFast(irc_nick_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(nick.c_str()) - }); + EnqueueConnEvent(irc_nick_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(nick.c_str()) + ); } else if ( irc_who_message && command == "WHO" ) @@ -1028,14 +1022,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts.size() > 0 && parts[0].size() > 0 && parts[0][0] == ':' ) parts[0] = parts[0].substr(1); - ConnectionEventFast(irc_who_message, { - BuildConnVal(), - val_mgr->GetBool(orig), + EnqueueConnEvent(irc_who_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, parts.size() > 0 ? - new StringVal(parts[0].c_str()) : - val_mgr->GetEmptyString(), - val_mgr->GetBool(oper), - }); + make_intrusive(parts[0].c_str()) : + IntrusivePtr{AdoptRef{}, val_mgr->GetEmptyString()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(oper)} + ); } else if ( irc_whois_message && command == "WHOIS" ) @@ -1058,12 +1052,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) else users = parts[0]; - ConnectionEventFast(irc_whois_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(server.c_str()), - new StringVal(users.c_str()), - }); + EnqueueConnEvent(irc_whois_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(server.c_str()), + make_intrusive(users.c_str()) + ); } else if ( irc_error_message && command == "ERROR" ) @@ -1071,12 +1065,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( params[0] == ':' ) params = params.substr(1); - ConnectionEventFast(irc_error_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(params.c_str()), - }); + EnqueueConnEvent(irc_error_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(params.c_str()) + ); } else if ( irc_invite_message && command == "INVITE" ) @@ -1087,13 +1081,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts[1].size() > 0 && parts[1][0] == ':' ) parts[1] = parts[1].substr(1); - ConnectionEventFast(irc_invite_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(parts[0].c_str()), - new StringVal(parts[1].c_str()), - }); + EnqueueConnEvent(irc_invite_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(parts[0].c_str()), + make_intrusive(parts[1].c_str()) + ); } else Weird("irc_invalid_invite_message_format"); @@ -1102,14 +1096,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) else if ( irc_mode_message && command == "MODE" ) { if ( params.size() > 0 ) - { - ConnectionEventFast(irc_mode_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(params.c_str()), - }); - } + EnqueueConnEvent(irc_mode_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(params.c_str()) + ); else Weird("irc_invalid_mode_message_format"); @@ -1117,11 +1109,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) else if ( irc_password_message && command == "PASS" ) { - ConnectionEventFast(irc_password_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(params.c_str()), - }); + EnqueueConnEvent(irc_password_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(params.c_str()) + ); } else if ( irc_squit_message && command == "SQUIT" ) @@ -1139,13 +1131,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) message = message.substr(1); } - ConnectionEventFast(irc_squit_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(server.c_str()), - new StringVal(message.c_str()), - }); + EnqueueConnEvent(irc_squit_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(server.c_str()), + make_intrusive(message.c_str()) + ); } @@ -1153,13 +1145,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) { if ( irc_request ) { - ConnectionEventFast(irc_request, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(command.c_str()), - new StringVal(params.c_str()), - }); + EnqueueConnEvent(irc_request, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(command.c_str()), + make_intrusive(params.c_str()) + ); } } @@ -1167,13 +1159,13 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) { if ( irc_message ) { - ConnectionEventFast(irc_message, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(prefix.c_str()), - new StringVal(command.c_str()), - new StringVal(params.c_str()), - }); + EnqueueConnEvent(irc_message, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(prefix.c_str()), + make_intrusive(command.c_str()), + make_intrusive(params.c_str()) + ); } } @@ -1203,7 +1195,7 @@ void IRC_Analyzer::StartTLS() AddChildAnalyzer(ssl); if ( irc_starttls ) - ConnectionEventFast(irc_starttls, {BuildConnVal()}); + EnqueueConnEvent(irc_starttls, IntrusivePtr{AdoptRef{}, BuildConnVal()}); } vector IRC_Analyzer::SplitWords(const string& input, char split) diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc index 7db2a81155..2b34fa5f48 100644 --- a/src/analyzer/protocol/login/Login.cc +++ b/src/analyzer/protocol/login/Login.cc @@ -290,9 +290,7 @@ void Login_Analyzer::AuthenticationDialog(bool orig, char* line) else if ( IsSkipAuthentication(line) ) { if ( authentication_skipped ) - { - ConnectionEventFast(authentication_skipped, {BuildConnVal()}); - } + EnqueueConnEvent(authentication_skipped, IntrusivePtr{AdoptRef{}, BuildConnVal()}); state = LOGIN_STATE_SKIP; SetSkip(1); @@ -333,28 +331,22 @@ void Login_Analyzer::SetEnv(bool orig, char* name, char* val) } else if ( login_terminal && streq(name, "TERM") ) - { - ConnectionEventFast(login_terminal, { - BuildConnVal(), - new StringVal(val), - }); - } + EnqueueConnEvent(login_terminal, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(val) + ); else if ( login_display && streq(name, "DISPLAY") ) - { - ConnectionEventFast(login_display, { - BuildConnVal(), - new StringVal(val), - }); - } + EnqueueConnEvent(login_display, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(val) + ); else if ( login_prompt && streq(name, "TTYPROMPT") ) - { - ConnectionEventFast(login_prompt, { - BuildConnVal(), - new StringVal(val), - }); - } + EnqueueConnEvent(login_prompt, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(val) + ); } delete [] name; @@ -427,13 +419,14 @@ void Login_Analyzer::LoginEvent(EventHandlerPtr f, const char* line, Val* password = HaveTypeahead() ? PopUserTextVal() : new StringVal(""); - ConnectionEventFast(f, { - BuildConnVal(), - username->Ref(), - client_name ? client_name->Ref() : val_mgr->GetEmptyString(), - password, - new StringVal(line), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{NewRef{}, username}, + client_name ? IntrusivePtr{NewRef{}, client_name} + : IntrusivePtr{AdoptRef{}, val_mgr->GetEmptyString()}, + IntrusivePtr{AdoptRef{}, password}, + make_intrusive(line) + ); } const char* Login_Analyzer::GetUsername(const char* line) const @@ -449,10 +442,10 @@ void Login_Analyzer::LineEvent(EventHandlerPtr f, const char* line) if ( ! f ) return; - ConnectionEventFast(f, { - BuildConnVal(), - new StringVal(line), - }); + EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(line) + ); } @@ -461,13 +454,11 @@ void Login_Analyzer::Confused(const char* msg, const char* line) state = LOGIN_STATE_CONFUSED; // to suppress further messages if ( login_confused ) - { - ConnectionEventFast(login_confused, { - BuildConnVal(), - new StringVal(msg), - new StringVal(line), - }); - } + EnqueueConnEvent(login_confused, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(msg), + make_intrusive(line) + ); if ( login_confused_text ) { @@ -487,12 +478,10 @@ void Login_Analyzer::Confused(const char* msg, const char* line) void Login_Analyzer::ConfusionText(const char* line) { if ( login_confused_text ) - { - ConnectionEventFast(login_confused_text, { - BuildConnVal(), - new StringVal(line), - }); - } + EnqueueConnEvent(login_confused_text, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(line) + ); } int Login_Analyzer::IsPloy(const char* line) diff --git a/src/analyzer/protocol/login/NVT.cc b/src/analyzer/protocol/login/NVT.cc index 47dfca94fe..09d866fe3b 100644 --- a/src/analyzer/protocol/login/NVT.cc +++ b/src/analyzer/protocol/login/NVT.cc @@ -462,12 +462,10 @@ const char* NVT_Analyzer::PeerAuthName() const void NVT_Analyzer::SetTerminal(const u_char* terminal, int len) { if ( login_terminal ) - { - ConnectionEventFast(login_terminal, { - BuildConnVal(), - new StringVal(new BroString(terminal, len, 0)), - }); - } + EnqueueConnEvent(login_terminal, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(new BroString(terminal, len, 0)) + ); } void NVT_Analyzer::SetEncrypting(int mode) diff --git a/src/analyzer/protocol/login/RSH.cc b/src/analyzer/protocol/login/RSH.cc index ef9fb3fa18..4b5b81d3c7 100644 --- a/src/analyzer/protocol/login/RSH.cc +++ b/src/analyzer/protocol/login/RSH.cc @@ -168,27 +168,37 @@ void Rsh_Analyzer::DeliverStream(int len, const u_char* data, bool orig) return; } - val_list vl(4 + orig); + zeek::Args vl; + vl.reserve(4 + orig); const char* line = (const char*) data; line = skip_whitespace(line); - vl.push_back(BuildConnVal()); - vl.push_back(client_name ? client_name->Ref() : new StringVal("")); - vl.push_back(username ? username->Ref() : new StringVal("")); - vl.push_back(new StringVal(line)); + vl.emplace_back(AdoptRef{}, BuildConnVal()); + + if ( client_name ) + vl.emplace_back(NewRef{}, client_name); + else + vl.emplace_back(make_intrusive("")); + + if ( username ) + vl.emplace_back(NewRef{}, username); + else + vl.emplace_back(make_intrusive("")); + + vl.emplace_back(make_intrusive(line)); if ( orig ) { if ( contents_orig->RshSaveState() == RSH_SERVER_USER_NAME ) // First input - vl.push_back(val_mgr->GetTrue()); + vl.emplace_back(AdoptRef{}, val_mgr->GetTrue()); else - vl.push_back(val_mgr->GetFalse()); + vl.emplace_back(AdoptRef{}, val_mgr->GetFalse()); - ConnectionEventFast(rsh_request, std::move(vl)); + EnqueueConnEvent(rsh_request, std::move(vl)); } else - ConnectionEventFast(rsh_reply, std::move(vl)); + EnqueueConnEvent(rsh_reply, std::move(vl)); } void Rsh_Analyzer::ClientUserName(const char* s) diff --git a/src/analyzer/protocol/login/Rlogin.cc b/src/analyzer/protocol/login/Rlogin.cc index bed3c0317d..e041d757c9 100644 --- a/src/analyzer/protocol/login/Rlogin.cc +++ b/src/analyzer/protocol/login/Rlogin.cc @@ -244,10 +244,8 @@ void Rlogin_Analyzer::ServerUserName(const char* s) void Rlogin_Analyzer::TerminalType(const char* s) { if ( login_terminal ) - { - ConnectionEventFast(login_terminal, { - BuildConnVal(), - new StringVal(s), - }); - } + EnqueueConnEvent(login_terminal, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + make_intrusive(s) + ); } diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc index e597ae6275..0a4a901d90 100644 --- a/src/analyzer/protocol/mime/MIME.cc +++ b/src/analyzer/protocol/mime/MIME.cc @@ -1365,11 +1365,11 @@ void MIME_Mail::Done() hash_final(md5_hash, digest); md5_hash = nullptr; - analyzer->ConnectionEventFast(mime_content_hash, { - analyzer->BuildConnVal(), - val_mgr->GetCount(content_hash_length), - new StringVal(new BroString(1, digest, 16)), - }); + analyzer->EnqueueConnEvent(mime_content_hash, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(content_hash_length)}, + make_intrusive(new BroString(1, digest, 16)) + ); } MIME_Message::Done(); @@ -1393,7 +1393,7 @@ void MIME_Mail::BeginEntity(MIME_Entity* /* entity */) cur_entity_id.clear(); if ( mime_begin_entity ) - analyzer->ConnectionEventFast(mime_begin_entity, {analyzer->BuildConnVal()}); + analyzer->EnqueueConnEvent(mime_begin_entity, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}); buffer_start = data_start = 0; ASSERT(entity_content.size() == 0); @@ -1405,11 +1405,11 @@ void MIME_Mail::EndEntity(MIME_Entity* /* entity */) { BroString* s = concatenate(entity_content); - analyzer->ConnectionEventFast(mime_entity_data, { - analyzer->BuildConnVal(), - val_mgr->GetCount(s->Len()), - new StringVal(s), - }); + analyzer->EnqueueConnEvent(mime_entity_data, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(s->Len())}, + make_intrusive(s) + ); if ( ! mime_all_data ) delete_strings(entity_content); @@ -1418,7 +1418,7 @@ void MIME_Mail::EndEntity(MIME_Entity* /* entity */) } if ( mime_end_entity ) - analyzer->ConnectionEventFast(mime_end_entity, {analyzer->BuildConnVal()}); + analyzer->EnqueueConnEvent(mime_end_entity, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}); file_mgr->EndOfFile(analyzer->GetAnalyzerTag(), analyzer->Conn()); cur_entity_id.clear(); @@ -1427,23 +1427,19 @@ void MIME_Mail::EndEntity(MIME_Entity* /* entity */) void MIME_Mail::SubmitHeader(MIME_Header* h) { if ( mime_one_header ) - { - analyzer->ConnectionEventFast(mime_one_header, { - analyzer->BuildConnVal(), - BuildHeaderVal(h), - }); - } + analyzer->EnqueueConnEvent(mime_one_header, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildHeaderVal(h)} + ); } void MIME_Mail::SubmitAllHeaders(MIME_HeaderList& hlist) { if ( mime_all_headers ) - { - analyzer->ConnectionEventFast(mime_all_headers, { - analyzer->BuildConnVal(), - BuildHeaderTable(hlist), - }); - } + analyzer->EnqueueConnEvent(mime_all_headers, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, BuildHeaderTable(hlist)} + ); } void MIME_Mail::SubmitData(int len, const char* buf) @@ -1476,11 +1472,11 @@ void MIME_Mail::SubmitData(int len, const char* buf) const char* data = (char*) data_buffer->Bytes() + data_start; int data_len = (buf + len) - data; - analyzer->ConnectionEventFast(mime_segment_data, { - analyzer->BuildConnVal(), - val_mgr->GetCount(data_len), - new StringVal(data_len, data), - }); + analyzer->EnqueueConnEvent(mime_segment_data, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(data_len)}, + make_intrusive(data_len, data) + ); } cur_entity_id = file_mgr->DataIn(reinterpret_cast(buf), len, @@ -1523,11 +1519,11 @@ void MIME_Mail::SubmitAllData() BroString* s = concatenate(all_content); delete_strings(all_content); - analyzer->ConnectionEventFast(mime_all_data, { - analyzer->BuildConnVal(), - val_mgr->GetCount(s->Len()), - new StringVal(s), - }); + analyzer->EnqueueConnEvent(mime_all_data, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(s->Len())}, + make_intrusive(s) + ); } } @@ -1551,11 +1547,9 @@ void MIME_Mail::SubmitEvent(int event_type, const char* detail) } if ( mime_event ) - { - analyzer->ConnectionEventFast(mime_event, { - analyzer->BuildConnVal(), - new StringVal(category), - new StringVal(detail), - }); - } + analyzer->EnqueueConnEvent(mime_event, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + make_intrusive(category), + make_intrusive(detail) + ); } diff --git a/src/analyzer/protocol/ncp/NCP.cc b/src/analyzer/protocol/ncp/NCP.cc index 45f333c872..c987c78c7a 100644 --- a/src/analyzer/protocol/ncp/NCP.cc +++ b/src/analyzer/protocol/ncp/NCP.cc @@ -62,26 +62,21 @@ void NCP_Session::DeliverFrame(const binpac::NCP::ncp_frame* frame) if ( f ) { if ( frame->is_orig() ) - { - analyzer->ConnectionEventFast(f, { - analyzer->BuildConnVal(), - val_mgr->GetCount(frame->frame_type()), - val_mgr->GetCount(frame->body_length()), - val_mgr->GetCount(req_func), - }); - } + analyzer->EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->frame_type())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->body_length())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(req_func)} + ); else - { - analyzer->ConnectionEventFast(f, { - analyzer->BuildConnVal(), - val_mgr->GetCount(frame->frame_type()), - val_mgr->GetCount(frame->body_length()), - val_mgr->GetCount(req_frame_type), - val_mgr->GetCount(req_func), - val_mgr->GetCount(frame->reply()->completion_code()), - }); - } - + analyzer->EnqueueConnEvent(f, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->frame_type())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->body_length())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(req_frame_type)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(req_func)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->reply()->completion_code())} + ); } } diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc index 8fbedf58b6..86f10e9698 100644 --- a/src/analyzer/protocol/netbios/NetbiosSSN.cc +++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc @@ -59,14 +59,12 @@ int NetbiosSSN_Interpreter::ParseMessage(unsigned int type, unsigned int flags, const u_char* data, int len, int is_query) { if ( netbios_session_message ) - { - analyzer->ConnectionEventFast(netbios_session_message, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_query), - val_mgr->GetCount(type), - val_mgr->GetCount(len), - }); - } + analyzer->EnqueueConnEvent(netbios_session_message, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_query)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(type)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} + ); switch ( type ) { case NETBIOS_SSN_MSG: @@ -331,18 +329,16 @@ void NetbiosSSN_Interpreter::Event(EventHandlerPtr event, const u_char* data, return; if ( is_orig >= 0 ) - { - analyzer->ConnectionEventFast(event, { - analyzer->BuildConnVal(), - val_mgr->GetBool(is_orig), - new StringVal(new BroString(data, len, 0)), - }); - } + analyzer->EnqueueConnEvent(event, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + make_intrusive(new BroString(data, len, 0)) + ); else - analyzer->ConnectionEventFast(event, { - analyzer->BuildConnVal(), - new StringVal(new BroString(data, len, 0)), - }); + analyzer->EnqueueConnEvent(event, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + make_intrusive(new BroString(data, len, 0)) + ); } diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc index 7da678f855..2e4af7afcf 100644 --- a/src/analyzer/protocol/pop3/POP3.cc +++ b/src/analyzer/protocol/pop3/POP3.cc @@ -830,7 +830,7 @@ void POP3_Analyzer::StartTLS() AddChildAnalyzer(ssl); if ( pop3_starttls ) - ConnectionEventFast(pop3_starttls, {BuildConnVal()}); + EnqueueConnEvent(pop3_starttls, IntrusivePtr{AdoptRef{}, BuildConnVal()}); } void POP3_Analyzer::AuthSuccessfull() @@ -920,14 +920,16 @@ void POP3_Analyzer::POP3Event(EventHandlerPtr event, bool is_orig, if ( ! event ) return; - val_list vl(2 + (bool)arg1 + (bool)arg2); + zeek::Args vl; + vl.reserve(2 + (bool)arg1 + (bool)arg2); + + vl.emplace_back(AdoptRef{}, BuildConnVal()); + vl.emplace_back(AdoptRef{}, val_mgr->GetBool(is_orig)); - vl.push_back(BuildConnVal()); - vl.push_back(val_mgr->GetBool(is_orig)); if ( arg1 ) - vl.push_back(new StringVal(arg1)); + vl.emplace_back(make_intrusive(arg1)); if ( arg2 ) - vl.push_back(new StringVal(arg2)); + vl.emplace_back(make_intrusive(arg2)); - ConnectionEventFast(event, std::move(vl)); + EnqueueConnEvent(event, std::move(vl)); } diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc index 7265001fe3..c4bfd373bc 100644 --- a/src/analyzer/protocol/rpc/MOUNT.cc +++ b/src/analyzer/protocol/rpc/MOUNT.cc @@ -96,7 +96,7 @@ int MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status { auto vl = event_common_vl(c, rpc_status, mount_status, start_time, last_time, reply_len, 0); - analyzer->ConnectionEventFast(mount_reply_status, std::move(vl)); + analyzer->EnqueueConnEvent(mount_reply_status, std::move(vl)); } if ( ! rpc_success ) @@ -169,19 +169,19 @@ int MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status start_time, last_time, reply_len, (bool)request + (bool)reply); if ( request ) - vl.push_back(request); + vl.emplace_back(AdoptRef{}, request); if ( reply ) - vl.push_back(reply); + vl.emplace_back(AdoptRef{}, reply); - analyzer->ConnectionEventFast(event, std::move(vl)); + analyzer->EnqueueConnEvent(event, std::move(vl)); } else Unref(reply); return 1; } -val_list MOUNT_Interp::event_common_vl(RPC_CallInfo *c, +zeek::Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status, BifEnum::MOUNT3::status_t mount_status, double rep_start_time, @@ -189,16 +189,17 @@ val_list MOUNT_Interp::event_common_vl(RPC_CallInfo *c, { // Returns a new val_list that already has a conn_val, and mount3_info. // These are the first parameters for each mount_* event ... - val_list vl(2 + extra_elements); - vl.push_back(analyzer->BuildConnVal()); - VectorVal* auxgids = new VectorVal(internal_type("index_vec")->AsVectorType()); + zeek::Args vl; + vl.reserve(2 + extra_elements); + vl.emplace_back(AdoptRef{}, analyzer->BuildConnVal()); + auto auxgids = make_intrusive(internal_type("index_vec")->AsVectorType()); for (size_t i = 0; i < c->AuxGIDs().size(); ++i) { auxgids->Assign(i, val_mgr->GetCount(c->AuxGIDs()[i])); } - RecordVal* info = new RecordVal(BifType::Record::MOUNT3::info_t); + auto info = make_intrusive(BifType::Record::MOUNT3::info_t); info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status)); info->Assign(1, BifType::Enum::MOUNT3::status_t->GetVal(mount_status)); info->Assign(2, make_intrusive(c->StartTime(), TYPE_TIME)); @@ -211,9 +212,9 @@ val_list MOUNT_Interp::event_common_vl(RPC_CallInfo *c, info->Assign(9, val_mgr->GetCount(c->Gid())); info->Assign(10, val_mgr->GetCount(c->Stamp())); info->Assign(11, make_intrusive(c->MachineName())); - info->Assign(12, auxgids); + info->Assign(12, std::move(auxgids)); - vl.push_back(info); + vl.emplace_back(std::move(info)); return vl; } diff --git a/src/analyzer/protocol/rpc/MOUNT.h b/src/analyzer/protocol/rpc/MOUNT.h index 182922dfd4..2d78aaaf31 100644 --- a/src/analyzer/protocol/rpc/MOUNT.h +++ b/src/analyzer/protocol/rpc/MOUNT.h @@ -16,10 +16,10 @@ protected: const u_char*& buf, int& n, double start_time, double last_time, int reply_len) override; - // Returns a new val_list that already has a conn_val, rpc_status and + // Returns a new arg list that already has a conn_val, rpc_status and // mount_status. These are the first parameters for each mount_* event // ... - val_list event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status, + zeek::Args event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status, BifEnum::MOUNT3::status_t mount_status, double rep_start_time, double rep_last_time, int reply_len, int extra_elements); diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc index 96b7c59c78..a832b0f96d 100644 --- a/src/analyzer/protocol/rpc/NFS.cc +++ b/src/analyzer/protocol/rpc/NFS.cc @@ -150,7 +150,7 @@ int NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status, { auto vl = event_common_vl(c, rpc_status, nfs_status, start_time, last_time, reply_len, 0); - analyzer->ConnectionEventFast(nfs_reply_status, std::move(vl)); + analyzer->EnqueueConnEvent(nfs_reply_status, std::move(vl)); } if ( ! rpc_success ) @@ -281,12 +281,12 @@ int NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status, start_time, last_time, reply_len, (bool)request + (bool)reply); if ( request ) - vl.push_back(request); + vl.emplace_back(AdoptRef{}, request); if ( reply ) - vl.push_back(reply); + vl.emplace_back(AdoptRef{}, reply); - analyzer->ConnectionEventFast(event, std::move(vl)); + analyzer->EnqueueConnEvent(event, std::move(vl)); } else Unref(reply); @@ -318,21 +318,22 @@ StringVal* NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offse return 0; } -val_list NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status, +zeek::Args NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status, BifEnum::NFS3::status_t nfs_status, double rep_start_time, double rep_last_time, int reply_len, int extra_elements) { // Returns a new val_list that already has a conn_val, and nfs3_info. // These are the first parameters for each nfs_* event ... - val_list vl(2 + extra_elements); - vl.push_back(analyzer->BuildConnVal()); - VectorVal* auxgids = new VectorVal(internal_type("index_vec")->AsVectorType()); + zeek::Args vl; + vl.reserve(2 + extra_elements); + vl.emplace_back(IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}); + auto auxgids = make_intrusive(internal_type("index_vec")->AsVectorType()); for ( size_t i = 0; i < c->AuxGIDs().size(); ++i ) auxgids->Assign(i, val_mgr->GetCount(c->AuxGIDs()[i])); - RecordVal *info = new RecordVal(BifType::Record::NFS3::info_t); + auto info = make_intrusive(BifType::Record::NFS3::info_t); info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status)); info->Assign(1, BifType::Enum::NFS3::status_t->GetVal(nfs_status)); info->Assign(2, make_intrusive(c->StartTime(), TYPE_TIME)); @@ -345,9 +346,9 @@ val_list NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_st info->Assign(9, val_mgr->GetCount(c->Gid())); info->Assign(10, val_mgr->GetCount(c->Stamp())); info->Assign(11, make_intrusive(c->MachineName())); - info->Assign(12, auxgids); + info->Assign(12, std::move(auxgids)); - vl.push_back(info); + vl.emplace_back(std::move(info)); return vl; } diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h index 8c4e259bd0..272c0612ab 100644 --- a/src/analyzer/protocol/rpc/NFS.h +++ b/src/analyzer/protocol/rpc/NFS.h @@ -20,7 +20,7 @@ protected: // Returns a new val_list that already has a conn_val, rpc_status and // nfs_status. These are the first parameters for each nfs_* event // ... - val_list event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status, + zeek::Args event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_status, BifEnum::NFS3::status_t nfs_status, double rep_start_time, double rep_last_time, int reply_len, int extra_elements); diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc index 2b3445ec20..1b2a01875f 100644 --- a/src/analyzer/protocol/rpc/Portmap.cc +++ b/src/analyzer/protocol/rpc/Portmap.cc @@ -261,10 +261,10 @@ uint32_t PortmapperInterp::CheckPort(uint32_t port) { if ( pm_bad_port ) { - analyzer->ConnectionEventFast(pm_bad_port, { - analyzer->BuildConnVal(), - val_mgr->GetCount(port), - }); + analyzer->EnqueueConnEvent(pm_bad_port, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(port)} + ); } port = 0; @@ -282,25 +282,26 @@ void PortmapperInterp::Event(EventHandlerPtr f, Val* request, BifEnum::rpc_statu return; } - val_list vl; + zeek::Args vl; - vl.push_back(analyzer->BuildConnVal()); + vl.emplace_back(AdoptRef{}, analyzer->BuildConnVal()); if ( status == BifEnum::RPC_SUCCESS ) { if ( request ) - vl.push_back(request); + vl.emplace_back(AdoptRef{}, request); if ( reply ) - vl.push_back(reply); + vl.emplace_back(AdoptRef{}, reply); } else { - vl.push_back(BifType::Enum::rpc_status->GetVal(status).release()); + vl.emplace_back(BifType::Enum::rpc_status->GetVal(status)); + if ( request ) - vl.push_back(request); + vl.emplace_back(AdoptRef{}, request); } - analyzer->ConnectionEventFast(f, std::move(vl)); + analyzer->EnqueueConnEvent(f, std::move(vl)); } Portmapper_Analyzer::Portmapper_Analyzer(Connection* conn) diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc index b76cd7d643..7cb0015a92 100644 --- a/src/analyzer/protocol/rpc/RPC.cc +++ b/src/analyzer/protocol/rpc/RPC.cc @@ -338,46 +338,40 @@ void RPC_Interpreter::Timeout() void RPC_Interpreter::Event_RPC_Dialogue(RPC_CallInfo* c, BifEnum::rpc_status status, int reply_len) { if ( rpc_dialogue ) - { - analyzer->ConnectionEventFast(rpc_dialogue, { - analyzer->BuildConnVal(), - val_mgr->GetCount(c->Program()), - val_mgr->GetCount(c->Version()), - val_mgr->GetCount(c->Proc()), - BifType::Enum::rpc_status->GetVal(status).release(), - new Val(c->StartTime(), TYPE_TIME), - val_mgr->GetCount(c->CallLen()), - val_mgr->GetCount(reply_len), - }); - } + analyzer->EnqueueConnEvent(rpc_dialogue, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Program())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Version())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Proc())}, + BifType::Enum::rpc_status->GetVal(status), + make_intrusive(c->StartTime(), TYPE_TIME), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->CallLen())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_len)} + ); } void RPC_Interpreter::Event_RPC_Call(RPC_CallInfo* c) { if ( rpc_call ) - { - analyzer->ConnectionEventFast(rpc_call, { - analyzer->BuildConnVal(), - val_mgr->GetCount(c->XID()), - val_mgr->GetCount(c->Program()), - val_mgr->GetCount(c->Version()), - val_mgr->GetCount(c->Proc()), - val_mgr->GetCount(c->CallLen()), - }); - } + analyzer->EnqueueConnEvent(rpc_call, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->XID())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Program())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Version())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Proc())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->CallLen())} + ); } void RPC_Interpreter::Event_RPC_Reply(uint32_t xid, BifEnum::rpc_status status, int reply_len) { if ( rpc_reply ) - { - analyzer->ConnectionEventFast(rpc_reply, { - analyzer->BuildConnVal(), - val_mgr->GetCount(xid), - BifType::Enum::rpc_status->GetVal(status).release(), - val_mgr->GetCount(reply_len), - }); - } + analyzer->EnqueueConnEvent(rpc_reply, + IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(xid)}, + BifType::Enum::rpc_status->GetVal(status), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_len)} + ); } void RPC_Interpreter::Weird(const char* msg, const char* addl) diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc index 2cd8148357..1aa3d8ee70 100644 --- a/src/analyzer/protocol/smtp/SMTP.cc +++ b/src/analyzer/protocol/smtp/SMTP.cc @@ -219,11 +219,11 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig) if ( smtp_data && ! skip_data ) { - ConnectionEventFast(smtp_data, { - BuildConnVal(), - val_mgr->GetBool(orig), - new StringVal(data_len, line), - }); + EnqueueConnEvent(smtp_data, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + make_intrusive(data_len, line) + ); } } @@ -349,14 +349,14 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig) break; } - ConnectionEventFast(smtp_reply, { - BuildConnVal(), - val_mgr->GetBool(orig), - val_mgr->GetCount(reply_code), - new StringVal(cmd), - new StringVal(end_of_line - line, line), - val_mgr->GetBool((pending_reply > 0)), - }); + EnqueueConnEvent(smtp_reply, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, + make_intrusive(cmd), + make_intrusive(end_of_line - line, line), + IntrusivePtr{AdoptRef{}, val_mgr->GetBool((pending_reply > 0))} + ); } } @@ -410,7 +410,7 @@ void SMTP_Analyzer::StartTLS() AddChildAnalyzer(ssl); if ( smtp_starttls ) - ConnectionEventFast(smtp_starttls, {BuildConnVal()}); + EnqueueConnEvent(smtp_starttls, IntrusivePtr{AdoptRef{}, BuildConnVal()}); } @@ -854,12 +854,17 @@ void SMTP_Analyzer::RequestEvent(int cmd_len, const char* cmd, ProtocolConfirmation(); if ( smtp_request ) - ConnectionEventFast(smtp_request, { - BuildConnVal(), - val_mgr->GetBool(orig_is_sender), - (new StringVal(cmd_len, cmd))->ToUpper(), - new StringVal(arg_len, arg), - }); + { + auto cmd_arg = make_intrusive(cmd_len, cmd); + cmd_arg->ToUpper(); + + EnqueueConnEvent(smtp_request, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig_is_sender)}, + std::move(cmd_arg), + make_intrusive(arg_len, arg) + ); + } } void SMTP_Analyzer::Unexpected(const int is_sender, const char* msg, @@ -874,12 +879,12 @@ void SMTP_Analyzer::Unexpected(const int is_sender, const char* msg, if ( ! orig_is_sender ) is_orig = ! is_orig; - ConnectionEventFast(smtp_unexpected, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - new StringVal(msg), - new StringVal(detail_len, detail), - }); + EnqueueConnEvent(smtp_unexpected, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + make_intrusive(msg), + make_intrusive(detail_len, detail) + ); } } diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.cc b/src/analyzer/protocol/stepping-stone/SteppingStone.cc index 1d37e83815..79133ffdca 100644 --- a/src/analyzer/protocol/stepping-stone/SteppingStone.cc +++ b/src/analyzer/protocol/stepping-stone/SteppingStone.cc @@ -135,10 +135,10 @@ void SteppingStoneEndpoint::Event(EventHandlerPtr f, int id1, int id2) return; if ( id2 >= 0 ) - endp->TCP()->ConnectionEventFast(f, {val_mgr->GetInt(id1), val_mgr->GetInt(id2)}); + endp->TCP()->EnqueueConnEvent(f, IntrusivePtr{AdoptRef{}, val_mgr->GetInt(id1)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(id2)}); else - endp->TCP()->ConnectionEventFast(f, {val_mgr->GetInt(id1)}); - + endp->TCP()->EnqueueConnEvent(f, IntrusivePtr{AdoptRef{}, val_mgr->GetInt(id1)}); } void SteppingStoneEndpoint::CreateEndpEvent(int is_orig) @@ -146,11 +146,11 @@ void SteppingStoneEndpoint::CreateEndpEvent(int is_orig) if ( ! stp_create_endp ) return; - endp->TCP()->ConnectionEventFast(stp_create_endp, { - endp->TCP()->BuildConnVal(), - val_mgr->GetInt(stp_id), - val_mgr->GetBool(is_orig), - }); + endp->TCP()->EnqueueConnEvent(stp_create_endp, + IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetInt(stp_id)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + ); } SteppingStone_Analyzer::SteppingStone_Analyzer(Connection* c) diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc index 5851b2113a..77d22d6c1b 100644 --- a/src/analyzer/protocol/tcp/TCP.cc +++ b/src/analyzer/protocol/tcp/TCP.cc @@ -785,17 +785,17 @@ void TCP_Analyzer::GeneratePacketEvent( const u_char* data, int len, int caplen, int is_orig, TCP_Flags flags) { - ConnectionEventFast(tcp_packet, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - new StringVal(flags.AsString()), - val_mgr->GetCount(rel_seq), - val_mgr->GetCount(flags.ACK() ? rel_ack : 0), - val_mgr->GetCount(len), + EnqueueConnEvent(tcp_packet, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + make_intrusive(flags.AsString()), + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(rel_seq)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flags.ACK() ? rel_ack : 0)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}, // We need the min() here because Ethernet padding can lead to // caplen > len. - new StringVal(min(caplen, len), (const char*) data), - }); + make_intrusive(min(caplen, len), (const char*) data) + ); } int TCP_Analyzer::DeliverData(double t, const u_char* data, int len, int caplen, @@ -1101,12 +1101,10 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, base_seq, ack_seq); if ( connection_SYN_packet ) - { - ConnectionEventFast(connection_SYN_packet, { - BuildConnVal(), - SYN_vals->Ref(), - }); - } + EnqueueConnEvent(connection_SYN_packet, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{NewRef{}, SYN_vals} + ); Unref(SYN_vals); } @@ -1347,17 +1345,17 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) { auto kind = o[0]; auto length = kind < 2 ? 1 : o[1]; - ConnectionEventFast(tcp_option, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - val_mgr->GetCount(kind), - val_mgr->GetCount(length), - }); + EnqueueConnEvent(tcp_option, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(kind)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(length)} + ); } if ( tcp_options ) { - auto option_list = new VectorVal(BifType::Vector::TCP::OptionList); + auto option_list = make_intrusive(BifType::Vector::TCP::OptionList); auto add_option_data = [](RecordVal* rv, const u_char* odata, int olen) { @@ -1460,11 +1458,11 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) } } - ConnectionEventFast(tcp_options, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - option_list, - }); + EnqueueConnEvent(tcp_options, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + std::move(option_list) + ); } if ( options < opt_end ) @@ -1782,12 +1780,10 @@ int TCP_Analyzer::DataPending(TCP_Endpoint* closing_endp) void TCP_Analyzer::EndpointEOF(TCP_Reassembler* endp) { if ( connection_EOF ) - { - ConnectionEventFast(connection_EOF, { - BuildConnVal(), - val_mgr->GetBool(endp->IsOrig()), - }); - } + EnqueueConnEvent(connection_EOF, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(endp->IsOrig())} + ); const analyzer_list& children(GetChildren()); LOOP_OVER_CONST_CHILDREN(i) @@ -2064,16 +2060,14 @@ int TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int caple network_time, seq, len, max_top_seq, data_in_flight); if ( tcp_rexmit ) - { - endp->TCP()->ConnectionEventFast(tcp_rexmit, { - endp->TCP()->BuildConnVal(), - val_mgr->GetBool(endp->IsOrig()), - val_mgr->GetCount(seq), - val_mgr->GetCount(len), - val_mgr->GetCount(data_in_flight), - val_mgr->GetCount(endp->peer->window), - }); - } + endp->TCP()->EnqueueConnEvent(tcp_rexmit, + IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(endp->IsOrig())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(data_in_flight)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(endp->peer->window)} + ); } else max_top_seq = top_seq; @@ -2121,11 +2115,11 @@ void TCPStats_Analyzer::Done() TCP_ApplicationAnalyzer::Done(); if ( conn_stats ) - ConnectionEventFast(conn_stats, { - BuildConnVal(), - orig_stats->BuildStats(), - resp_stats->BuildStats(), - }); + EnqueueConnEvent(conn_stats, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, orig_stats->BuildStats()}, + IntrusivePtr{AdoptRef{}, resp_stats->BuildStats()} + ); } void TCPStats_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, uint64_t seq, const IP_Hdr* ip, int caplen) diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc index fb3be41996..b05265a1ef 100644 --- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc +++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc @@ -237,13 +237,11 @@ int TCP_Endpoint::DataSent(double t, uint64_t seq, int len, int caplen, reporter->Error("TCP contents write failed: %s", buf); if ( contents_file_write_failure ) - { - tcp_analyzer->ConnectionEventFast(contents_file_write_failure, { - Conn()->BuildConnVal(), - val_mgr->GetBool(IsOrig()), - new StringVal(buf), - }); - } + tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, + IntrusivePtr{AdoptRef{}, Conn()->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + make_intrusive(buf) + ); } } diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc index 23b400e585..61166f82fb 100644 --- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc +++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc @@ -151,14 +151,12 @@ void TCP_Reassembler::Gap(uint64_t seq, uint64_t len) endp->Gap(seq, len); if ( report_gap(endp, endp->peer) ) - { - dst_analyzer->ConnectionEventFast(content_gap, { - dst_analyzer->BuildConnVal(), - val_mgr->GetBool(IsOrig()), - val_mgr->GetCount(seq), - val_mgr->GetCount(len), - }); - } + dst_analyzer->EnqueueConnEvent(content_gap, + IntrusivePtr{AdoptRef{}, dst_analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} + ); if ( type == Direct ) dst_analyzer->NextUndelivered(seq, len, IsOrig()); @@ -363,13 +361,11 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, BroFile* f) reporter->Error("TCP_Reassembler contents write failed"); if ( contents_file_write_failure ) - { - tcp_analyzer->ConnectionEventFast(contents_file_write_failure, { - Endpoint()->Conn()->BuildConnVal(), - val_mgr->GetBool(IsOrig()), - new StringVal("TCP reassembler content write failure"), - }); - } + tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, + IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + make_intrusive("TCP reassembler content write failure") + ); } void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile* f) @@ -380,13 +376,11 @@ void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile* reporter->Error("TCP_Reassembler contents gap write failed"); if ( contents_file_write_failure ) - { - tcp_analyzer->ConnectionEventFast(contents_file_write_failure, { - Endpoint()->Conn()->BuildConnVal(), - val_mgr->GetBool(IsOrig()), - new StringVal("TCP reassembler gap write failure"), - }); - } + tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, + IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + make_intrusive("TCP reassembler gap write failure") + ); } void TCP_Reassembler::BlockInserted(DataBlockMap::const_iterator it) @@ -462,12 +456,12 @@ void TCP_Reassembler::Overlap(const u_char* b1, const u_char* b2, uint64_t n) BroString* b1_s = new BroString((const u_char*) b1, n, 0); BroString* b2_s = new BroString((const u_char*) b2, n, 0); - tcp_analyzer->ConnectionEventFast(rexmit_inconsistency, { - tcp_analyzer->BuildConnVal(), - new StringVal(b1_s), - new StringVal(b2_s), - new StringVal(flags.AsString()), - }); + tcp_analyzer->EnqueueConnEvent(rexmit_inconsistency, + IntrusivePtr{AdoptRef{}, tcp_analyzer->BuildConnVal()}, + make_intrusive(b1_s), + make_intrusive(b2_s), + make_intrusive(flags.AsString()) + ); } } @@ -618,14 +612,12 @@ void TCP_Reassembler::DeliverBlock(uint64_t seq, int len, const u_char* data) } if ( deliver_tcp_contents ) - { - tcp_analyzer->ConnectionEventFast(tcp_contents, { - tcp_analyzer->BuildConnVal(), - val_mgr->GetBool(IsOrig()), - val_mgr->GetCount(seq), - new StringVal(len, (const char*) data), - }); - } + tcp_analyzer->EnqueueConnEvent(tcp_contents, + IntrusivePtr{AdoptRef{}, tcp_analyzer->BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, + make_intrusive(len, (const char*) data) + ); // Q. Can we say this because it is already checked in DataSent()? // ASSERT(!Conn()->Skipping() && !SkipDeliveries()); diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc index 810f493486..04bbe31259 100644 --- a/src/analyzer/protocol/udp/UDP.cc +++ b/src/analyzer/protocol/udp/UDP.cc @@ -153,13 +153,11 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, } if ( do_udp_contents ) - { - ConnectionEventFast(udp_contents, { - BuildConnVal(), - val_mgr->GetBool(is_orig), - new StringVal(len, (const char*) data), - }); - } + EnqueueConnEvent(udp_contents, + IntrusivePtr{AdoptRef{}, BuildConnVal()}, + IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + make_intrusive(len, (const char*) data) + ); Unref(port_val); } From 54bc3bd5c66c70b74f73a17f53b1c2d740da18d5 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Wed, 25 Mar 2020 19:05:17 -0700 Subject: [PATCH 13/16] Remove TimerMgr arg from event queuing/scheduling methods It's not useful for anything since there's only ever a single TimerMgr. --- aux/bifcl | 2 +- src/Conn.cc | 8 +++----- src/Event.cc | 17 ++++++----------- src/Event.h | 10 ++-------- src/Expr.cc | 15 ++++----------- src/Expr.h | 4 +--- 6 files changed, 17 insertions(+), 39 deletions(-) diff --git a/aux/bifcl b/aux/bifcl index 3fefee1630..92377e064d 160000 --- a/aux/bifcl +++ b/aux/bifcl @@ -1 +1 @@ -Subproject commit 3fefee1630269b96ea4f39021bf387b9d0abfd80 +Subproject commit 92377e064d925389b1732d105a674f2f761615e6 diff --git a/src/Conn.cc b/src/Conn.cc index a8987b30f5..64d32a7f5c 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -496,15 +496,14 @@ void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_l return; // "this" is passed as a cookie for the event - mgr.Enqueue(f, std::move(args), SOURCE_LOCAL, - a ? a->GetID() : 0, timer_mgr, this); + mgr.Enqueue(f, std::move(args), SOURCE_LOCAL, a ? a->GetID() : 0, this); } void Connection::ConnectionEventFast(EventHandlerPtr f, analyzer::Analyzer* a, val_list vl) { // "this" is passed as a cookie for the event mgr.Enqueue(f, zeek::val_list_to_args(&vl), SOURCE_LOCAL, - a ? a->GetID() : 0, timer_mgr, this); + a ? a->GetID() : 0, this); } void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_list* vl) @@ -520,8 +519,7 @@ void Connection::EnqueueEvent(EventHandlerPtr f, analyzer::Analyzer* a, zeek::Args args) { // "this" is passed as a cookie for the event - mgr.Enqueue(f, std::move(args), SOURCE_LOCAL, a ? a->GetID() : 0, - timer_mgr, this); + mgr.Enqueue(f, std::move(args), SOURCE_LOCAL, a ? a->GetID() : 0, this); } void Connection::Weird(const char* name, const char* addl) diff --git a/src/Event.cc b/src/Event.cc index 48334b98b2..6ad75d0325 100644 --- a/src/Event.cc +++ b/src/Event.cc @@ -19,13 +19,11 @@ uint64_t num_events_queued = 0; uint64_t num_events_dispatched = 0; Event::Event(EventHandlerPtr arg_handler, zeek::Args arg_args, - SourceID arg_src, analyzer::ID arg_aid, TimerMgr* arg_mgr, - BroObj* arg_obj) + SourceID arg_src, analyzer::ID arg_aid, BroObj* arg_obj) : handler(arg_handler), args(std::move(arg_args)), src(arg_src), aid(arg_aid), - mgr(arg_mgr ? arg_mgr : timer_mgr), obj(arg_obj), next_event(nullptr) { @@ -80,7 +78,6 @@ EventMgr::EventMgr() { head = tail = 0; current_src = SOURCE_LOCAL; - current_mgr = timer_mgr; current_aid = 0; src_val = 0; draining = 0; @@ -102,7 +99,7 @@ void EventMgr::QueueEventFast(const EventHandlerPtr &h, val_list vl, SourceID src, analyzer::ID aid, TimerMgr* mgr, BroObj* obj) { - QueueEvent(new Event(h, zeek::val_list_to_args(&vl), src, aid, mgr, obj)); + QueueEvent(new Event(h, zeek::val_list_to_args(&vl), src, aid, obj)); } void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list vl, @@ -112,7 +109,7 @@ void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list vl, auto args = zeek::val_list_to_args(&vl); if ( h ) - Enqueue(h, std::move(args), src, aid, mgr, obj); + Enqueue(h, std::move(args), src, aid, obj); } void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list* vl, @@ -123,14 +120,13 @@ void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list* vl, delete vl; if ( h ) - Enqueue(h, std::move(args), src, aid, mgr, obj); + Enqueue(h, std::move(args), src, aid, obj); } void EventMgr::Enqueue(const EventHandlerPtr& h, zeek::Args vl, - SourceID src, analyzer::ID aid, - TimerMgr* mgr, BroObj* obj) + SourceID src, analyzer::ID aid, BroObj* obj) { - QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj)); + QueueEvent(new Event(h, std::move(vl), src, aid, obj)); } void EventMgr::QueueEvent(Event* event) @@ -190,7 +186,6 @@ void EventMgr::Drain() Event* next = current->NextEvent(); current_src = current->Source(); - current_mgr = current->Mgr(); current_aid = current->Analyzer(); current->Dispatch(); Unref(current); diff --git a/src/Event.h b/src/Event.h index 754db32612..85496e3eb4 100644 --- a/src/Event.h +++ b/src/Event.h @@ -17,14 +17,13 @@ class Event : public BroObj { public: Event(EventHandlerPtr handler, zeek::Args args, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = nullptr, BroObj* obj = nullptr); + BroObj* obj = nullptr); void SetNext(Event* n) { next_event = n; } Event* NextEvent() const { return next_event; } SourceID Source() const { return src; } analyzer::ID Analyzer() const { return aid; } - TimerMgr* Mgr() const { return mgr; } EventHandlerPtr Handler() const { return handler; } const zeek::Args& Args() const { return args; } @@ -41,7 +40,6 @@ protected: zeek::Args args; SourceID src; analyzer::ID aid; - TimerMgr* mgr; BroObj* obj; Event* next_event; }; @@ -101,7 +99,7 @@ public: */ void Enqueue(const EventHandlerPtr& h, zeek::Args vl, SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0, - TimerMgr* mgr = nullptr, BroObj* obj = nullptr); + BroObj* obj = nullptr); /** * A version of Enqueue() taking a variable number of arguments. @@ -127,9 +125,6 @@ public: // non-analyzer event. analyzer::ID CurrentAnalyzer() const { return current_aid; } - // Returns the timer mgr associated with the last raised event. - TimerMgr* CurrentTimerMgr() const { return current_mgr; } - int Size() const { return num_events_queued - num_events_dispatched; } @@ -147,7 +142,6 @@ protected: Event* tail; SourceID current_src; analyzer::ID current_aid; - TimerMgr* current_mgr; RecordVal* src_val; bool draining; bro::Flare queue_flare; diff --git a/src/Expr.cc b/src/Expr.cc index 693ff316c2..56fae6d1fb 100644 --- a/src/Expr.cc +++ b/src/Expr.cc @@ -3885,9 +3885,9 @@ IntrusivePtr FlattenExpr::Fold(Val* v) const } ScheduleTimer::ScheduleTimer(EventHandlerPtr arg_event, zeek::Args arg_args, - double t, TimerMgr* arg_tmgr) + double t) : Timer(t, TIMER_SCHEDULE), - event(arg_event), args(std::move(arg_args)), tmgr(arg_tmgr) + event(arg_event), args(std::move(arg_args)) { } @@ -3898,7 +3898,7 @@ ScheduleTimer::~ScheduleTimer() void ScheduleTimer::Dispatch(double /* t */, int /* is_expire */) { if ( event ) - mgr.Enqueue(event, std::move(args), SOURCE_LOCAL, 0, tmgr); + mgr.Enqueue(event, std::move(args)); } ScheduleExpr::ScheduleExpr(IntrusivePtr arg_when, @@ -3940,14 +3940,7 @@ IntrusivePtr ScheduleExpr::Eval(Frame* f) const auto args = eval_list(f, event->Args()); if ( args ) - { - TimerMgr* tmgr = mgr.CurrentTimerMgr(); - - if ( ! tmgr ) - tmgr = timer_mgr; - - tmgr->Add(new ScheduleTimer(event->Handler(), std::move(*args), dt, tmgr)); - } + timer_mgr->Add(new ScheduleTimer(event->Handler(), std::move(*args), dt)); return nullptr; } diff --git a/src/Expr.h b/src/Expr.h index 48f02cd90e..d793389eba 100644 --- a/src/Expr.h +++ b/src/Expr.h @@ -740,8 +740,7 @@ protected: class ScheduleTimer : public Timer { public: - ScheduleTimer(EventHandlerPtr event, zeek::Args args, - double t, TimerMgr* tmgr); + ScheduleTimer(EventHandlerPtr event, zeek::Args args, double t); ~ScheduleTimer() override; void Dispatch(double t, int is_expire) override; @@ -749,7 +748,6 @@ public: protected: EventHandlerPtr event; zeek::Args args; - TimerMgr* tmgr; }; class ScheduleExpr : public Expr { From 599dda9ae9519af23ae0593154b57ab410434141 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Wed, 25 Mar 2020 19:37:06 -0700 Subject: [PATCH 14/16] Fix missing IntrusivePtr.h include and ambiguous ODesc::Add call --- src/Conn.h | 1 + src/Event.h | 1 + src/Val.cc | 2 +- src/analyzer/Analyzer.h | 1 + 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/Conn.h b/src/Conn.h index 3511275040..547f5c0bfd 100644 --- a/src/Conn.h +++ b/src/Conn.h @@ -15,6 +15,7 @@ #include "UID.h" #include "WeirdState.h" #include "ZeekArgs.h" +#include "IntrusivePtr.h" #include "iosource/Packet.h" #include "analyzer/Tag.h" diff --git a/src/Event.h b/src/Event.h index 85496e3eb4..0f97ed5538 100644 --- a/src/Event.h +++ b/src/Event.h @@ -7,6 +7,7 @@ #include "iosource/IOSource.h" #include "Flare.h" #include "ZeekArgs.h" +#include "IntrusivePtr.h" #include #include diff --git a/src/Val.cc b/src/Val.cc index 4b5e7db313..45bf78cb90 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -3304,7 +3304,7 @@ void describe_vals(const std::vector>& vals, { if ( ! d->IsReadable() ) { - d->Add(vals.size()); + d->Add(static_cast(vals.size())); d->SP(); } diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h index e53caad475..e50c8e4e91 100644 --- a/src/analyzer/Analyzer.h +++ b/src/analyzer/Analyzer.h @@ -7,6 +7,7 @@ #include "../Obj.h" #include "../EventHandler.h" #include "../Timer.h" +#include "../IntrusivePtr.h" #include #include From e7e5cf0f897679e4a858e69e9338dd765caf2a41 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Thu, 26 Mar 2020 11:29:29 -0700 Subject: [PATCH 15/16] Use const-ref parameter for zeek::val_list_to_args() It ended up being used a bit more than initially expected and this is closer to the style we're generally aiming for. --- src/Conn.cc | 6 +++--- src/Event.cc | 6 +++--- src/Func.cc | 2 +- src/ZeekArgs.cc | 6 +++--- src/ZeekArgs.h | 5 ++--- src/analyzer/Analyzer.cc | 6 +++--- src/file_analysis/File.cc | 4 ++-- 7 files changed, 17 insertions(+), 18 deletions(-) diff --git a/src/Conn.cc b/src/Conn.cc index 64d32a7f5c..b7c80118be 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -488,7 +488,7 @@ void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, Val* v1, void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_list vl) { - auto args = zeek::val_list_to_args(&vl); + auto args = zeek::val_list_to_args(vl); if ( ! f ) // This may actually happen if there is no local handler @@ -502,13 +502,13 @@ void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_l void Connection::ConnectionEventFast(EventHandlerPtr f, analyzer::Analyzer* a, val_list vl) { // "this" is passed as a cookie for the event - mgr.Enqueue(f, zeek::val_list_to_args(&vl), SOURCE_LOCAL, + mgr.Enqueue(f, zeek::val_list_to_args(vl), SOURCE_LOCAL, a ? a->GetID() : 0, this); } void Connection::ConnectionEvent(EventHandlerPtr f, analyzer::Analyzer* a, val_list* vl) { - auto args = zeek::val_list_to_args(vl); + auto args = zeek::val_list_to_args(*vl); delete vl; if ( f ) diff --git a/src/Event.cc b/src/Event.cc index 6ad75d0325..96f35f6a91 100644 --- a/src/Event.cc +++ b/src/Event.cc @@ -99,14 +99,14 @@ void EventMgr::QueueEventFast(const EventHandlerPtr &h, val_list vl, SourceID src, analyzer::ID aid, TimerMgr* mgr, BroObj* obj) { - QueueEvent(new Event(h, zeek::val_list_to_args(&vl), src, aid, obj)); + QueueEvent(new Event(h, zeek::val_list_to_args(vl), src, aid, obj)); } void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list vl, SourceID src, analyzer::ID aid, TimerMgr* mgr, BroObj* obj) { - auto args = zeek::val_list_to_args(&vl); + auto args = zeek::val_list_to_args(vl); if ( h ) Enqueue(h, std::move(args), src, aid, obj); @@ -116,7 +116,7 @@ void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list* vl, SourceID src, analyzer::ID aid, TimerMgr* mgr, BroObj* obj) { - auto args = zeek::val_list_to_args(vl); + auto args = zeek::val_list_to_args(*vl); delete vl; if ( h ) diff --git a/src/Func.cc b/src/Func.cc index 0f4b9ca376..58a39922a3 100644 --- a/src/Func.cc +++ b/src/Func.cc @@ -296,7 +296,7 @@ int BroFunc::IsPure() const IntrusivePtr Func::Call(val_list* args, Frame* parent) const { - return Call(zeek::val_list_to_args(args), parent); + return Call(zeek::val_list_to_args(*args), parent); } IntrusivePtr BroFunc::Call(const zeek::Args& args, Frame* parent) const diff --git a/src/ZeekArgs.cc b/src/ZeekArgs.cc index 810da7f1dc..e9c4b36412 100644 --- a/src/ZeekArgs.cc +++ b/src/ZeekArgs.cc @@ -2,12 +2,12 @@ #include "IntrusivePtr.h" #include "Val.h" -zeek::Args zeek::val_list_to_args(const val_list* vl) +zeek::Args zeek::val_list_to_args(const val_list& vl) { zeek::Args rval; - rval.reserve(vl->length()); + rval.reserve(vl.length()); - for ( auto& v : *vl ) + for ( auto& v : vl ) rval.emplace_back(AdoptRef{}, v); return rval; diff --git a/src/ZeekArgs.h b/src/ZeekArgs.h index a18d186863..fbde15965c 100644 --- a/src/ZeekArgs.h +++ b/src/ZeekArgs.h @@ -17,11 +17,10 @@ using Args = std::vector>; * Converts a legacy-style argument list for use in modern Zeek function * calling or event queueing APIs. * @param vl the argument list to convert, the returned value takes ownership - * of a reference to each element in the list, but not ownership of the list - * itself. + * of a reference to each element in the list * @return the converted argument list * */ -Args val_list_to_args(const val_list* vl); +Args val_list_to_args(const val_list& vl); } // namespace zeek diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc index 41a98273e2..e651b58239 100644 --- a/src/analyzer/Analyzer.cc +++ b/src/analyzer/Analyzer.cc @@ -803,7 +803,7 @@ void Analyzer::Event(EventHandlerPtr f, Val* v1, Val* v2) void Analyzer::ConnectionEvent(EventHandlerPtr f, val_list* vl) { - auto args = zeek::val_list_to_args(vl); + auto args = zeek::val_list_to_args(*vl); if ( f ) conn->EnqueueEvent(f, this, std::move(args)); @@ -811,7 +811,7 @@ void Analyzer::ConnectionEvent(EventHandlerPtr f, val_list* vl) void Analyzer::ConnectionEvent(EventHandlerPtr f, val_list vl) { - auto args = zeek::val_list_to_args(&vl); + auto args = zeek::val_list_to_args(vl); if ( f ) conn->EnqueueEvent(f, this, std::move(args)); @@ -819,7 +819,7 @@ void Analyzer::ConnectionEvent(EventHandlerPtr f, val_list vl) void Analyzer::ConnectionEventFast(EventHandlerPtr f, val_list vl) { - auto args = zeek::val_list_to_args(&vl); + auto args = zeek::val_list_to_args(vl); conn->EnqueueEvent(f, this, std::move(args)); } diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index 5d7711d16c..9ea5d3370b 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -626,13 +626,13 @@ void File::FileEvent(EventHandlerPtr h) void File::FileEvent(EventHandlerPtr h, val_list* vl) { - FileEvent(h, zeek::val_list_to_args(vl)); + FileEvent(h, zeek::val_list_to_args(*vl)); delete vl; } void File::FileEvent(EventHandlerPtr h, val_list vl) { - FileEvent(h, zeek::val_list_to_args(&vl)); + FileEvent(h, zeek::val_list_to_args(vl)); } void File::FileEvent(EventHandlerPtr h, zeek::Args args) From 29a72225631b3a5b4cab5f6ee4e9334f4b8b8b93 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Thu, 26 Mar 2020 15:21:51 -0700 Subject: [PATCH 16/16] Func::DescribeDebug: move a NumFields() call out of loop --- src/Func.cc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/Func.cc b/src/Func.cc index 58a39922a3..79216fea17 100644 --- a/src/Func.cc +++ b/src/Func.cc @@ -144,19 +144,20 @@ void Func::DescribeDebug(ODesc* d, const zeek::Args* args) const { d->Add(Name()); - RecordType* func_args = FType()->Args(); - if ( args ) { d->Add("("); + RecordType* func_args = FType()->Args(); + auto num_fields = static_cast(func_args->NumFields()); for ( auto i = 0u; i < args->size(); ++i ) { // Handle varargs case (more args than formals). - if ( i >= static_cast(func_args->NumFields()) ) + if ( i >= num_fields ) { d->Add("vararg"); - d->Add(i - func_args->NumFields()); + int va_num = i - num_fields; + d->Add(va_num); } else d->Add(func_args->FieldName(i));