Merge remote-tracking branch 'origin/topic/timw/776-using-statements'

* origin/topic/timw/776-using-statements:
  Remove 'using namespace std' from SerialTypes.h
  Remove other using statements from headers
  GH-776: Remove using statements added by PR 770

Includes small fixes in files that changed since the merge request was
made.

Also includes a few small indentation fixes.

CHANGES

@@ -1,4 +1,12 @@
 
+3.2.0-dev.382 | 2020-04-09 13:17:03 -0700
+
+  * Remove 'using namespace std' as well as other using statements from headers.
+
+    This unfortunately cuases a ton of flow-down changes because a lot of other
+    code was depending on that definition existing. This has a fairly large chance
+    to break builds of external plugins, considering how many internal ones it broke. (Tim Wojtulewicz, Corelight)
+
 3.2.0-dev.378 | 2020-04-09 08:47:44 -0700
 
   * Replace most of the uses of 0 or NULL to indicate null pointers with nullptr.

NEWS

@@ -67,6 +67,11 @@ Changed Functionality
 - Data members of many C++ classes/structs were reordered to achieve better
   packing and smaller memory footprint.
 
+- "using namespace std" was removed from the Zeek header files; Zeek now always
+  explicitly specifies std when using STL functionality in headers. This may
+  necessitate small changes in external plugins, if they relied on the using 
+  statement in Zeek headers.
+
 Removed Functionality
 ---------------------
 

VERSION

@@ -1 +1 @@
-3.2.0-dev.378
+3.2.0-dev.382

src/Anon.cc

@@ -56,7 +56,7 @@ int bi_ffs(uint32_t value)
 
 ipaddr32_t AnonymizeIPAddr::Anonymize(ipaddr32_t addr)
 	{
-	map<ipaddr32_t, ipaddr32_t>::iterator p = mapping.find(addr);
+	std::map<ipaddr32_t, ipaddr32_t>::iterator p = mapping.find(addr);
 	if ( p != mapping.end() )
 		return p->second;
 	else

src/Anon.h

@@ -13,8 +13,6 @@
 #include <vector>
 #include <map>
 
-using std::map;
-
 // TODO: Anon.h may not be the right place to put these functions ...
 
 enum ip_addr_anonymization_class_t {
@@ -51,7 +49,7 @@ public:
 	bool PreserveNet(ipaddr32_t input);
 
 protected:
-	map<ipaddr32_t, ipaddr32_t> mapping;
+	std::map<ipaddr32_t, ipaddr32_t> mapping;
 };
 
 class AnonymizeIPAddr_Seq : public AnonymizeIPAddr {

src/Attr.cc

@@ -106,7 +106,7 @@ void Attr::DescribeReST(ODesc* d, bool shorten) const
 			ODesc dd;
 			dd.SetQuotes(true);
 			expr->Describe(&dd);
-			string s = dd.Description();
+			std::string s = dd.Description();
 			add_long_expr_string(d, s, shorten);
 			}
 
@@ -114,7 +114,7 @@ void Attr::DescribeReST(ODesc* d, bool shorten) const
 			{
 			ODesc dd;
 			expr->Eval(nullptr)->Describe(&dd);
-			string s = dd.Description();
+			std::string s = dd.Description();
 
 			for ( size_t i = 0; i < s.size(); ++i )
 				if ( s[i] == '\n' )

src/Base64.cc

@@ -7,7 +7,7 @@
 #include <math.h>
 
 int Base64Converter::default_base64_table[256];
-const string Base64Converter::default_alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const std::string Base64Converter::default_alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
 void Base64Converter::Encode(int len, const unsigned char* data, int* pblen, char** pbuf)
 	{
@@ -46,7 +46,7 @@ void Base64Converter::Encode(int len, const unsigned char* data, int* pblen, cha
 	}
 
 
-int* Base64Converter::InitBase64Table(const string& alphabet)
+int* Base64Converter::InitBase64Table(const std::string& alphabet)
 	{
 	assert(alphabet.size() == 64);
 
@@ -86,7 +86,7 @@ int* Base64Converter::InitBase64Table(const string& alphabet)
 	return base64_table;
 	}
 
-Base64Converter::Base64Converter(Connection* arg_conn, const string& arg_alphabet)
+Base64Converter::Base64Converter(Connection* arg_conn, const std::string& arg_alphabet)
 	{
 	if ( arg_alphabet.size() > 0 )
 		{

src/Base64.h

@@ -2,8 +2,6 @@
 
 #include <string>
 
-using std::string;
-
 class BroString;
 class Connection;
 
@@ -15,7 +13,7 @@ public:
 	// encode_base64()), encoding-errors will go to Reporter instead of
 	// Weird. Usage errors go to Reporter in any case. Empty alphabet
 	// indicates the default base64 alphabet.
-	explicit Base64Converter(Connection* conn, const string& alphabet = "");
+	explicit Base64Converter(Connection* conn, const std::string& alphabet = "");
 	~Base64Converter();
 
 	// A note on Decode():
@@ -44,10 +42,10 @@ protected:
 	char error_msg[256];
 
 protected:
-	static const string default_alphabet;
+	static const std::string default_alphabet;
-	string alphabet;
+	std::string alphabet;
 
-	static int* InitBase64Table(const string& alphabet);
+	static int* InitBase64Table(const std::string& alphabet);
 	static int default_base64_table[256];
 	char base64_group[4];
 	int base64_group_next;

src/BroString.cc

@@ -44,7 +44,7 @@ BroString::BroString(const char* str) : BroString()
 	Set(str);
 	}
 
-BroString::BroString(const string &str) : BroString()
+BroString::BroString(const std::string &str) : BroString()
 	{
 	Set(str);
 	}
@@ -137,7 +137,7 @@ void BroString::Set(const char* str)
 	use_free_to_delete = false;
 	}
 
-void BroString::Set(const string& str)
+void BroString::Set(const std::string& str)
 	{
 	Reset();
 
@@ -234,7 +234,7 @@ char* BroString::Render(int format, int* len) const
 	return s;
 	}
 
-ostream& BroString::Render(ostream &os, int format) const
+std::ostream& BroString::Render(std::ostream &os, int format) const
 	{
 	char* tmp = Render(format);
 	os << tmp;
@@ -242,7 +242,7 @@ ostream& BroString::Render(ostream &os, int format) const
 	return os;
 	}
 
-istream& BroString::Read(istream &is, int format)
+std::istream& BroString::Read(std::istream &is, int format)
 	{
 	if ( (format & BroString::ESC_SER) )
 		{
@@ -260,7 +260,7 @@ istream& BroString::Read(istream &is, int format)
 		}
 	else
 		{
-		string str;
+		std::string str;
 		is >> str;
 		Set(str);
 		}
@@ -376,7 +376,7 @@ BroString::Vec* BroString::VecFromPolicy(VectorVal* vec)
 
 char* BroString::VecToString(const Vec* vec)
 	{
-	string result("[");
+	std::string result("[");
 
 	for ( BroString::VecCIt it = vec->begin(); it != vec->end(); ++it )
 		{
@@ -396,7 +396,7 @@ bool BroStringLenCmp::operator()(BroString * const& bst1,
 				(bst1->Len() > bst2->Len());
 	}
 
-ostream& operator<<(ostream& os, const BroString& bs)
+std::ostream& operator<<(std::ostream& os, const BroString& bs)
 	{
 	char* tmp = bs.Render(BroString::EXPANDED_STRING);
 	os << tmp;
@@ -414,7 +414,7 @@ int Bstr_eq(const BroString* s1, const BroString* s2)
 
 int Bstr_cmp(const BroString* s1, const BroString* s2)
 	{
-	int n = min(s1->Len(), s2->Len());
+	int n = std::min(s1->Len(), s2->Len());
 	int cmp = memcmp(s1->Bytes(), s2->Bytes(), n);
 
 	if ( cmp || s1->Len() == s2->Len() )

src/Brofiler.cc

@@ -13,6 +13,8 @@
 #include "Reporter.h"
 #include "util.h"
 
+using namespace std;
+
 Brofiler::Brofiler()
 	: ignoring(0), delim('\t')
 	{

src/Brofiler.h

@@ -5,11 +5,6 @@
 #include <list>
 #include <string>
 
-using std::list;
-using std::map;
-using std::pair;
-using std::string;
-
 class Stmt;
 
 /**
@@ -50,7 +45,7 @@ private:
 	/**
 	 * The current, global Brofiler instance creates this list at parse-time.
 	 */
-	list<Stmt*> stmts;
+	std::list<Stmt*> stmts;
 
 	/**
 	 * Indicates whether new statments will not be considered as part of
@@ -69,7 +64,7 @@ private:
 	 * startup time and modified at shutdown time before writing back
 	 * to a file.
 	 */
-	map<pair<string, string>, uint64_t> usage_map;
+	std::map<std::pair<std::string, std::string>, uint64_t> usage_map;
 
 	/**
 	 * A canonicalization routine for Stmt descriptions containing characters

src/CompHash.cc

@@ -906,7 +906,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			RecordType* rt = t->AsRecordType();
 			int num_fields = rt->NumFields();
 
-			vector<Val*> values;
+			std::vector<Val*> values;
 			int i;
 			for ( i = 0; i < num_fields; ++i )
 				{

src/Conn.h

@@ -369,7 +369,7 @@ protected:
 	static uint64_t total_connections;
 	static uint64_t current_connections;
 
-	string history;
+	std::string history;
 	uint32_t hist_seen;
 
 	analyzer::TransportLayerAnalyzer* root_analyzer;

src/DNS_Mgr.cc

@@ -50,6 +50,7 @@ extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
 #include "nb_dns.h"
 }
 
+using namespace std;
 
 class DNS_Mgr_Request {
 public:

src/DNS_Mgr.h

@@ -60,8 +60,8 @@ public:
 	bool Save();
 
 	const char* LookupAddrInCache(const IPAddr& addr);
-	IntrusivePtr<TableVal> LookupNameInCache(const string& name);
+	IntrusivePtr<TableVal> LookupNameInCache(const std::string& name);
-	const char* LookupTextInCache(const string& name);
+	const char* LookupTextInCache(const std::string& name);
 
 	// Support for async lookups.
 	class LookupCallback {
@@ -75,8 +75,8 @@ public:
 	};
 
 	void AsyncLookupAddr(const IPAddr& host, LookupCallback* callback);
-	void AsyncLookupName(const string& name, LookupCallback* callback);
+	void AsyncLookupName(const std::string& name, LookupCallback* callback);
-	void AsyncLookupNameText(const string& name, LookupCallback* callback);
+	void AsyncLookupNameText(const std::string& name, LookupCallback* callback);
 
 	struct Stats {
 		unsigned long requests;	// These count only async requests.
@@ -108,9 +108,9 @@ protected:
 	IntrusivePtr<ListVal> AddrListDelta(ListVal* al1, ListVal* al2);
 	void DumpAddrList(FILE* f, ListVal* al);
 
-	typedef map<string, pair<DNS_Mapping*, DNS_Mapping*> > HostMap;
+	typedef std::map<std::string, std::pair<DNS_Mapping*, DNS_Mapping*> > HostMap;
-	typedef map<IPAddr, DNS_Mapping*> AddrMap;
+	typedef std::map<IPAddr, DNS_Mapping*> AddrMap;
-	typedef map<string, DNS_Mapping*> TextMap;
+	typedef std::map<std::string, DNS_Mapping*> TextMap;
 	void LoadCache(FILE* f);
 	void Save(FILE* f, const AddrMap& m);
 	void Save(FILE* f, const HostMap& m);
@@ -159,12 +159,12 @@ protected:
 
 	RecordType* dm_rec;
 
-	typedef list<LookupCallback*> CallbackList;
+	typedef std::list<LookupCallback*> CallbackList;
 
 	struct AsyncRequest {
 		double time;
 		IPAddr host;
-		string name;
+		std::string name;
 		CallbackList callbacks;
 		bool is_txt;
 		bool processed;
@@ -211,16 +211,16 @@ protected:
 
 	};
 
-	typedef map<IPAddr, AsyncRequest*> AsyncRequestAddrMap;
+	typedef std::map<IPAddr, AsyncRequest*> AsyncRequestAddrMap;
 	AsyncRequestAddrMap asyncs_addrs;
 
-	typedef map<string, AsyncRequest*> AsyncRequestNameMap;
+	typedef std::map<std::string, AsyncRequest*> AsyncRequestNameMap;
 	AsyncRequestNameMap asyncs_names;
 
-	typedef map<string, AsyncRequest*> AsyncRequestTextMap;
+	typedef std::map<std::string, AsyncRequest*> AsyncRequestTextMap;
 	AsyncRequestTextMap asyncs_texts;
 
-	typedef list<AsyncRequest*> QueuedList;
+	typedef std::list<AsyncRequest*> QueuedList;
 	QueuedList asyncs_queued;
 
 	struct AsyncRequestCompare {
@@ -230,7 +230,7 @@ protected:
 			}
 	};
 
-	typedef priority_queue<AsyncRequest*, std::vector<AsyncRequest*>, AsyncRequestCompare> TimeoutQueue;
+	typedef std::priority_queue<AsyncRequest*, std::vector<AsyncRequest*>, AsyncRequestCompare> TimeoutQueue;
 	TimeoutQueue asyncs_timeouts;
 
 	int asyncs_pending;

src/DbgBreakpoint.cc

@@ -90,7 +90,7 @@ void DbgBreakpoint::AddToGlobalMap()
 
 void DbgBreakpoint::RemoveFromGlobalMap()
 	{
-	pair<BPMapType::iterator, BPMapType::iterator> p;
+	std::pair<BPMapType::iterator, BPMapType::iterator> p;
 	p = g_debugger_state.breakpoint_map.equal_range(at_stmt);
 
 	for ( BPMapType::iterator i = p.first; i != p.second; )
@@ -120,7 +120,7 @@ void DbgBreakpoint::RemoveFromStmt()
 	}
 
 
-bool DbgBreakpoint::SetLocation(ParseLocationRec plr, string_view loc_str)
+bool DbgBreakpoint::SetLocation(ParseLocationRec plr, std::string_view loc_str)
 	{
 	if ( plr.type == plrUnknown )
 		{
@@ -224,7 +224,7 @@ bool DbgBreakpoint::Reset()
 	return false;
 	}
 
-bool DbgBreakpoint::SetCondition(const string& new_condition)
+bool DbgBreakpoint::SetCondition(const std::string& new_condition)
 	{
 	condition = new_condition;
 	return true;

src/DbgBreakpoint.h

@@ -4,8 +4,6 @@
 
 #include <string>
 
-using std::string;
-
 struct ParseLocationRec;
 class Stmt;
 
@@ -40,8 +38,8 @@ public:
 	BreakCode ShouldBreak(Stmt* s);
 	BreakCode ShouldBreak(double t);
 
-	const string& GetCondition() const	{ return condition; }
+	const std::string& GetCondition() const	{ return condition; }
-	bool SetCondition(const string& new_condition);
+	bool SetCondition(const std::string& new_condition);
 
 	int GetRepeatCount() const	{ return repeat_count; }
 	bool SetRepeatCount(int count); // implements function of ignore command in gdb
@@ -66,7 +64,7 @@ protected:
 	int32_t BPID;
 
 	char description[512];
-	string function_name;	// location
+	std::string function_name;	// location
 	const char* source_filename;
 	int32_t source_line;
 	bool enabled;	// ### comment this and next
@@ -79,5 +77,5 @@ protected:
 	int32_t repeat_count;	// if positive, break after this many hits
 	int32_t hit_count;	// how many times it's been hit (w/o breaking)
 
-	string condition;	// condition to evaluate; nil for none
+	std::string condition;	// condition to evaluate; nil for none
 };

src/DebugCmds.cc

@@ -25,6 +25,8 @@
 #include "Val.h"
 #include "util.h"
 
+using namespace std;
+
 //
 // Helper routines
 //

src/DebugLogger.cc

@@ -165,7 +165,7 @@ void DebugLogger::Log(DebugStream stream, const char* fmt, ...)
 
 void DebugLogger::Log(const plugin::Plugin& plugin, const char* fmt, ...)
 	{
-	string tok = string("plugin-") + plugin.Name();
+	std::string tok = std::string("plugin-") + plugin.Name();
 	tok = strreplace(tok, "::", "-");
 
 	if ( enabled_streams.find(tok) == enabled_streams.end() )

src/Desc.cc

@@ -251,7 +251,7 @@ size_t ODesc::StartsWithEscapeSequence(const char* start, const char* end)
 
 	for ( it = escape_sequences.begin(); it != escape_sequences.end(); ++it )
 		{
-		const string& esc_str = *it;
+		const std::string& esc_str = *it;
 		size_t esc_len = esc_str.length();
 
 		if ( start + esc_len > end )
@@ -264,9 +264,9 @@ size_t ODesc::StartsWithEscapeSequence(const char* start, const char* end)
 	return 0;
 	}
 
-pair<const char*, size_t> ODesc::FirstEscapeLoc(const char* bytes, size_t n)
+std::pair<const char*, size_t> ODesc::FirstEscapeLoc(const char* bytes, size_t n)
 	{
-	typedef pair<const char*, size_t> escape_pos;
+	typedef std::pair<const char*, size_t> escape_pos;
 
 	if ( IsBinary() )
 		return escape_pos(0, 0);
@@ -327,7 +327,7 @@ void ODesc::AddBytes(const void* bytes, unsigned int n)
 
 	while ( s < e )
 		{
-		pair<const char*, size_t> p = FirstEscapeLoc(s, e - s);
+		std::pair<const char*, size_t> p = FirstEscapeLoc(s, e - s);
 
 		if ( p.first )
 			{

src/Discard.cc

@@ -161,7 +161,7 @@ Val* Discarder::BuildData(const u_char* data, int hdrlen, int len, int caplen)
 	caplen -= hdrlen;
 	data += hdrlen;
 
-	len = max(min(min(len, caplen), discarder_maxlen), 0);
+	len = std::max(std::min(std::min(len, caplen), discarder_maxlen), 0);
 
 	return new StringVal(new BroString(data, len, true));
 	}

src/EventHandler.cc

@@ -83,7 +83,7 @@ void EventHandler::Call(const zeek::Args& vl, bool no_remote)
 				auto opt_data = bro_broker::val_to_data(vl[i].get());
 
 				if ( opt_data )
-					xs.emplace_back(move(*opt_data));
+					xs.emplace_back(std::move(*opt_data));
 				else
 					{
 					valid_args = false;

src/EventRegistry.cc

@@ -8,10 +8,10 @@ EventRegistry::~EventRegistry() noexcept = default;
 
 void EventRegistry::Register(EventHandlerPtr handler)
 	{
-	handlers[string(handler->Name())] = std::unique_ptr<EventHandler>(handler.Ptr());
+	handlers[std::string(handler->Name())] = std::unique_ptr<EventHandler>(handler.Ptr());
 	}
 
-EventHandler* EventRegistry::Lookup(const string& name)
+EventHandler* EventRegistry::Lookup(const std::string& name)
 	{
 	auto it = handlers.find(name);
 	if ( it != handlers.end() )
@@ -86,7 +86,7 @@ void EventRegistry::PrintDebug()
 		}
 	}
 
-void EventRegistry::SetErrorHandler(const string& name)
+void EventRegistry::SetErrorHandler(const std::string& name)
 	{
 	EventHandler* eh = Lookup(name);
 

src/EventRegistry.h

@@ -7,9 +7,6 @@
 #include <string>
 #include <vector>
 
-using std::string;
-using std::vector;
-
 class EventHandler;
 class EventHandlerPtr;
 class RE_Matcher;
@@ -23,17 +20,17 @@ public:
 	void Register(EventHandlerPtr handler);
 
 	// Return nil if unknown.
-	EventHandler* Lookup(const string& name);
+	EventHandler* Lookup(const std::string& name);
 
 	// Returns a list of all local handlers that match the given pattern.
 	// Passes ownership of list.
-	typedef vector<string> string_list;
+	using string_list = std::vector<std::string>;
 	string_list Match(RE_Matcher* pattern);
 
 	// Marks a handler as handling errors. Error handler will not be called
 	// recursively to avoid infinite loops in case they trigger an error
 	// themselves.
-	void SetErrorHandler(const string& name);
+	void SetErrorHandler(const std::string& name);
 
 	string_list UnusedHandlers();
 	string_list UsedHandlers();

src/Expr.cc

@@ -709,7 +709,7 @@ IntrusivePtr<Val> BinaryExpr::StringFold(Val* v1, Val* v2) const
 	case EXPR_ADD:
 	case EXPR_ADD_TO:
 		{
-		vector<const BroString*> strings;
+		std::vector<const BroString*> strings;
 		strings.push_back(s1);
 		strings.push_back(s2);
 
@@ -3602,7 +3602,7 @@ RecordCoerceExpr::RecordCoerceExpr(IntrusivePtr<Expr> arg_op,
 				if ( ! is_arithmetic_promotable(sup_t_i, sub_t_i) &&
 				     ! is_record_promotable(sup_t_i, sub_t_i) )
 					{
-					string error_msg = fmt(
+					std::string error_msg = fmt(
 						"type clash for field \"%s\"", sub_r->FieldName(i));
 					Error(error_msg.c_str(), sub_t_i);
 					SetError();
@@ -3622,7 +3622,7 @@ RecordCoerceExpr::RecordCoerceExpr(IntrusivePtr<Expr> arg_op,
 				{
 				if ( ! t_r->FieldDecl(i)->FindAttr(ATTR_OPTIONAL) )
 					{
-					string error_msg = fmt(
+					std::string error_msg = fmt(
 						"non-optional field \"%s\" missing", t_r->FieldName(i));
 					Error(error_msg.c_str());
 					SetError();
@@ -4832,7 +4832,7 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 				}
 			else
 				{
-				string s = "No such field '";
+				std::string s = "No such field '";
 				s += field_name;
 				s += "'";
 				init_list->SetError(s.c_str());

src/Expr.h

@@ -2,6 +2,12 @@
 
 #pragma once
 
+#include <memory>
+#include <string>
+#include <vector>
+#include <utility>
+#include <optional>
+
 #include "BroList.h"
 #include "IntrusivePtr.h"
 #include "Timer.h"
@@ -11,14 +17,6 @@
 #include "Val.h"
 #include "ZeekArgs.h"
 
-#include <memory>
-#include <string>
-#include <vector>
-#include <utility>
-#include <optional>
-
-using std::string;
-
 enum BroExprTag : int {
 	EXPR_ANY = -1,
 	EXPR_NAME, EXPR_CONST,
@@ -683,7 +681,7 @@ public:
 protected:
 	void ExprDescribe(ODesc* d) const override;
 
-	string field_name;
+	std::string field_name;
 };
 
 class ArithCoerceExpr final : public UnaryExpr {
@@ -843,7 +841,7 @@ public:
 protected:
 	void ExprDescribe(ODesc* d) const override;
 
-	string name;
+	std::string name;
 	EventHandlerPtr handler;
 	IntrusivePtr<ListExpr> args;
 };

src/Frame.cc

@@ -12,7 +12,7 @@
 #include "Val.h"
 #include "ID.h"
 
-vector<Frame*> g_frame_stack;
+std::vector<Frame*> g_frame_stack;
 
 Frame::Frame(int arg_size, const BroFunc* func, const zeek::Args* fn_args)
 	{
@@ -61,7 +61,7 @@ void Frame::AddFunctionWithClosureRef(BroFunc* func)
 	::Ref(func);
 
 	if ( ! functions_with_closure_frame_reference )
-		functions_with_closure_frame_reference = make_unique<std::vector<BroFunc*>>();
+		functions_with_closure_frame_reference = std::make_unique<std::vector<BroFunc*>>();
 
 	functions_with_closure_frame_reference->emplace_back(func);
 	}
@@ -183,7 +183,7 @@ Frame* Frame::Clone() const
 	Frame* other = new Frame(size, function, func_args);
 
 	if ( offset_map )
-		other->offset_map = make_unique<OffsetMap>(*offset_map);
+		other->offset_map = std::make_unique<OffsetMap>(*offset_map);
 
 	other->CaptureClosure(closure, outer_ids);
 
@@ -278,7 +278,7 @@ Frame* Frame::SelectiveClone(const id_list& selection, BroFunc* func) const
 	if ( offset_map )
 		{
 		if ( ! other->offset_map )
-			other->offset_map = make_unique<OffsetMap>(*offset_map);
+			other->offset_map = std::make_unique<OffsetMap>(*offset_map);
 		else
 			*(other->offset_map) = *offset_map;
 		}
@@ -462,7 +462,7 @@ std::pair<bool, IntrusivePtr<Frame>> Frame::Unserialize(const broker::vector& da
 
 	// We'll associate this frame with a function later.
 	auto rf = make_intrusive<Frame>(frame_size, nullptr, nullptr);
-	rf->offset_map = make_unique<OffsetMap>(std::move(offset_map));
+	rf->offset_map = std::make_unique<OffsetMap>(std::move(offset_map));
 
 	// Frame takes ownership of unref'ing elements in outer_ids
 	rf->outer_ids = std::move(outer_ids);
@@ -499,7 +499,7 @@ std::pair<bool, IntrusivePtr<Frame>> Frame::Unserialize(const broker::vector& da
 void Frame::AddKnownOffsets(const id_list& ids)
 	{
 	if ( ! offset_map )
-		offset_map = make_unique<OffsetMap>();
+		offset_map = std::make_unique<OffsetMap>();
 
 	std::transform(ids.begin(), ids.end(), std::inserter(*offset_map, offset_map->end()),
 		       [] (const ID* id) -> std::pair<std::string, int>

src/Func.cc

@@ -56,10 +56,10 @@
 
 extern	RETSIGTYPE sig_handler(int signo);
 
-vector<CallInfo> call_stack;
+std::vector<CallInfo> call_stack;
 bool did_builtin_init = false;
 
-vector<Func*> Func::unique_ids;
+std::vector<Func*> Func::unique_ids;
 static const std::pair<bool, Val*> empty_hook_result(false, NULL);
 
 std::string render_call_stack()

src/Func.h

@@ -2,13 +2,6 @@
 
 #pragma once
 
-#include "BroList.h"
-#include "Obj.h"
-#include "IntrusivePtr.h"
-#include "Type.h" /* for function_flavor */
-#include "TraverseTypes.h"
-#include "ZeekArgs.h"
-
 #include <utility>
 #include <memory>
 #include <string>
@@ -19,8 +12,12 @@
 #include <broker/data.hh>
 #include <broker/expected.hh>
 
-using std::string;
+#include "BroList.h"
-using std::vector;
+#include "Obj.h"
+#include "IntrusivePtr.h"
+#include "Type.h" /* for function_flavor */
+#include "TraverseTypes.h"
+#include "ZeekArgs.h"
 
 class Val;
 class ListExpr;
@@ -49,7 +46,7 @@ public:
 			{ return priority > other.priority; } // reverse sort
 	};
 
-	const vector<Body>& GetBodies() const	{ return bodies; }
+	const std::vector<Body>& GetBodies() const	{ return bodies; }
 	bool HasBodies() const	{ return bodies.size(); }
 
 	[[deprecated("Remove in v4.1. Use zeek::Args overload instead.")]]
@@ -108,13 +105,13 @@ protected:
 	// Helper function for handling result of plugin hook.
 	std::pair<bool, Val*> HandlePluginResult(std::pair<bool, Val*> plugin_result, function_flavor flavor) const;
 
-	vector<Body> bodies;
+	std::vector<Body> bodies;
 	IntrusivePtr<Scope> scope;
 	Kind kind;
 	uint32_t unique_id;
 	IntrusivePtr<BroType> type;
-	string name;
+	std::string name;
-	static vector<Func*> unique_ids;
+	static std::vector<Func*> unique_ids;
 };
 
 
@@ -244,7 +241,7 @@ struct function_ingredients {
 	IntrusivePtr<Scope> scope;
 };
 
-extern vector<CallInfo> call_stack;
+extern std::vector<CallInfo> call_stack;
 
 extern std::string render_call_stack();
 

src/ID.cc

@@ -45,7 +45,7 @@ ID::~ID()
 		Unref(val);
 	}
 
-string ID::ModuleName() const
+std::string ID::ModuleName() const
 	{
 	return extract_module_name(name);
 	}
@@ -214,9 +214,9 @@ void ID::MakeDeprecated(IntrusivePtr<Expr> deprecation)
 	AddAttrs(make_intrusive<Attributes>(attr, IntrusivePtr{NewRef{}, Type()}, false, IsGlobal()));
 	}
 
-string ID::GetDeprecationWarning() const
+std::string ID::GetDeprecationWarning() const
 	{
-	string result;
+	std::string result;
 	Attr* depr_attr = FindAttr(ATTR_DEPRECATED);
 	if ( depr_attr )
 		{
@@ -541,12 +541,12 @@ void ID::AddOptionHandler(IntrusivePtr<Func> callback, int priority)
 	option_handlers.emplace(priority, std::move(callback));
 	}
 
-vector<Func*> ID::GetOptionHandlers() const
+std::vector<Func*> ID::GetOptionHandlers() const
 	{
 	// multimap is sorted
 	// It might be worth caching this if we expect it to be called
 	// a lot...
-	vector<Func*> v;
+	std::vector<Func*> v;
 	for ( auto& element : option_handlers )
 		v.push_back(element.second.get());
 	return v;

src/IP.h

@@ -4,8 +4,6 @@
 
 #include "zeek-config.h"
 
-#include <vector>
-
 #include <sys/types.h> // for u_char
 #include <netinet/in.h>
 #include <netinet/ip.h>
@@ -14,7 +12,7 @@
 #include <netinet/ip6.h>
 #endif
 
-using std::vector;
+#include <vector>
 
 class IPAddr;
 class RecordVal;
@@ -263,7 +261,7 @@ protected:
 	void ProcessDstOpts(const struct ip6_dest* d, uint16_t len);
 #endif
 
-	vector<IPv6_Hdr*> chain;
+	std::vector<IPv6_Hdr*> chain;
 
 	/**
 	 * The summation of all header lengths in the chain in bytes.

src/IPAddr.cc

@@ -153,7 +153,7 @@ void IPAddr::Init(const char* s)
 		}
 	}
 
-string IPAddr::AsString() const
+std::string IPAddr::AsString() const
 	{
 	if ( GetFamily() == IPv4 )
 		{
@@ -175,7 +175,7 @@ string IPAddr::AsString() const
 		}
 	}
 
-string IPAddr::AsHexString() const
+std::string IPAddr::AsHexString() const
 	{
 	char buf[33];
 
@@ -195,7 +195,7 @@ string IPAddr::AsHexString() const
 	return buf;
 	}
 
-string IPAddr::PtrName() const
+std::string IPAddr::PtrName() const
 	{
 	if ( GetFamily() == IPv4 )
 		{
@@ -212,7 +212,7 @@ string IPAddr::PtrName() const
 	else
 		{
 		static const char hex_digit[] = "0123456789abcdef";
-		string ptr_name("ip6.arpa");
+		std::string ptr_name("ip6.arpa");
 		uint32_t* p = (uint32_t*) in6.s6_addr;
 
 		for ( unsigned int i = 0; i < 4; ++i )
@@ -290,7 +290,7 @@ IPPrefix::IPPrefix(const IPAddr& addr, uint8_t length, bool len_is_v6_relative)
 	prefix.Mask(this->length);
 	}
 
-string IPPrefix::AsString() const
+std::string IPPrefix::AsString() const
 	{
 	char l[16];
 
@@ -317,10 +317,10 @@ HashKey* IPPrefix::GetHashKey() const
 
 bool IPPrefix::ConvertString(const char* text, IPPrefix* result)
 	{
-	string s(text);
+	std::string s(text);
 	size_t slash_loc = s.find('/');
 
-	if ( slash_loc == string::npos )
+	if ( slash_loc == std::string::npos )
 		return false;
 
 	auto ip_str = s.substr(0, slash_loc);

src/IPAddr.h

@@ -2,14 +2,13 @@
 
 #pragma once
 
-#include "threading/SerialTypes.h"
-
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <string.h>
 #include <string>
 
-using std::string;
+#include "threading/SerialTypes.h"
+
 struct ConnID;
 class BroString;
 class HashKey;
@@ -317,7 +316,7 @@ public:
 		if ( GetFamily() == IPv4 )
 			return AsString();
 
-		return string("[") + AsString() + "]";
+		return std::string("[") + AsString() + "]";
 		}
 
 	/**

src/Net.cc

@@ -65,7 +65,7 @@ iosource::PktSrc* current_pktsrc = nullptr;
 iosource::IOSource* current_iosrc = nullptr;
 
 std::list<ScannedFile> files_scanned;
-std::vector<string> sig_files;
+std::vector<std::string> sig_files;
 
 RETSIGTYPE watchdog(int /* signo */)
 	{

src/Net.h

@@ -2,15 +2,13 @@
 
 #pragma once
 
+#include <sys/stat.h> // for ino_t
+
 #include <list>
 #include <vector>
 #include <string>
 #include <optional>
 
-#include <sys/stat.h> // for ino_t
-
-using std::string;
-
 namespace iosource {
 	class IOSource;
 	class PktSrc;
@@ -95,10 +93,10 @@ struct ScannedFile {
 	int include_level;
 	bool skipped;		// This ScannedFile was @unload'd.
 	bool prefixes_checked;	// If loading prefixes for this file has been tried.
-	string name;
+	std::string name;
 
 	ScannedFile(dev_t arg_dev, ino_t arg_inode, int arg_include_level,
-	            const string& arg_name, bool arg_skipped = false,
+	            const std::string& arg_name, bool arg_skipped = false,
 	            bool arg_prefixes_checked = false)
 		: dev(arg_dev), inode(arg_inode),
 		  include_level(arg_include_level),
@@ -109,4 +107,4 @@ struct ScannedFile {
 };
 
 extern std::list<ScannedFile> files_scanned;
-extern std::vector<string> sig_files;
+extern std::vector<std::string> sig_files;

src/OpaqueVal.cc

@@ -777,7 +777,7 @@ bool BloomFilterVal::Empty() const
 	return bloom_filter->Empty();
 	}
 
-string BloomFilterVal::InternalState() const
+std::string BloomFilterVal::InternalState() const
 	{
 	return bloom_filter->InternalState();
 	}

src/OpaqueVal.h

@@ -306,7 +306,7 @@ public:
 	size_t Count(const Val* val) const;
 	void Clear();
 	bool Empty() const;
-	string InternalState() const;
+	std::string InternalState() const;
 
 	static IntrusivePtr<BloomFilterVal> Merge(const BloomFilterVal* x,
 	                                          const BloomFilterVal* y);

src/PrefixTable.cc

@@ -63,9 +63,9 @@ void* PrefixTable::Insert(const Val* value, void* data)
 	}
 	}
 
-list<tuple<IPPrefix,void*>> PrefixTable::FindAll(const IPAddr& addr, int width) const
+std::list<std::tuple<IPPrefix,void*>> PrefixTable::FindAll(const IPAddr& addr, int width) const
 	{
-	std::list<tuple<IPPrefix,void*>> out;
+	std::list<std::tuple<IPPrefix,void*>> out;
 	prefix_t* prefix = MakePrefix(addr, width);
 
 	int elems = 0;
@@ -81,7 +81,7 @@ list<tuple<IPPrefix,void*>> PrefixTable::FindAll(const IPAddr& addr, int width)
 	return out;
 	}
 
-list<tuple<IPPrefix,void*>> PrefixTable::FindAll(const SubNetVal* value) const
+std::list<std::tuple<IPPrefix,void*>> PrefixTable::FindAll(const SubNetVal* value) const
 	{
 	return FindAll(value->AsSubNet().Prefix(), value->AsSubNet().LengthIPv6());
 	}

src/PrefixTable.h

@@ -1,15 +1,12 @@
 #pragma once
 
-#include "IPAddr.h"
-
 extern "C" {
 	#include "patricia.h"
 }
 
 #include <list>
 
-using std::list;
+#include "IPAddr.h"
-using std::tuple;
 
 class Val;
 class SubNetVal;
@@ -42,8 +39,8 @@ public:
 	void* Lookup(const Val* value, bool exact = false) const;
 
 	// Returns list of all found matches or empty list otherwise.
-	list<tuple<IPPrefix,void*>> FindAll(const IPAddr& addr, int width) const;
+	std::list<std::tuple<IPPrefix,void*>> FindAll(const IPAddr& addr, int width) const;
-	list<tuple<IPPrefix,void*>> FindAll(const SubNetVal* value) const;
+	std::list<std::tuple<IPPrefix,void*>> FindAll(const SubNetVal* value) const;
 
 	// Returns pointer to data or nil if not found.
 	void* Remove(const IPAddr& addr, int width);

src/RE.cc

@@ -195,13 +195,13 @@ bool Specific_RE_Matcher::CompileSet(const string_list& set, const int_list& idx
 	return true;
 	}
 
-string Specific_RE_Matcher::LookupDef(const string& def)
+std::string Specific_RE_Matcher::LookupDef(const std::string& def)
 	{
 	const auto& iter = defs.find(def);
 	if ( iter != defs.end() )
 		return iter->second;
 
-	return string();
+	return std::string();
 	}
 
 bool Specific_RE_Matcher::MatchAll(const char* s)

src/Reporter.cc

@@ -78,7 +78,7 @@ void Reporter::InitOptions()
 	while ( (v = wl_table->NextEntry(k, c)) )
 		{
 		auto index = wl_val->RecoverIndex(k);
-		string key = index->Index(0)->AsString()->CheckString();
+		std::string key = index->Index(0)->AsString()->CheckString();
 		weird_sampling_whitelist.emplace(move(key));
 		delete k;
 		}
@@ -384,11 +384,11 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
 	char* buffer  = tmp;
 	char* alloced = nullptr;
 
-	string loc_str;
+	std::string loc_str;
 
 	if ( location )
 		{
-		string loc_file = "";
+		std::string loc_file = "";
 		int loc_line = 0;
 
 		if ( locations.size() )
@@ -427,7 +427,7 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
 			loc_str = filename;
 			char tmp[32];
 			snprintf(tmp, 32, "%d", line_number);
-			loc_str += string(", line ") + string(tmp);
+			loc_str += std::string(", line ") + std::string(tmp);
 			}
 		}
 
@@ -514,21 +514,21 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
 
 	if ( out )
 		{
-		string s = "";
+		std::string s = "";
 
 		if ( bro_start_network_time != 0.0 )
 			{
 			char tmp[32];
 			snprintf(tmp, 32, "%.6f", network_time);
-			s += string(tmp) + " ";
+			s += std::string(tmp) + " ";
 			}
 
 		if ( prefix && *prefix )
 			{
 			if ( loc_str != "" )
-				s += string(prefix) + " in " + loc_str + ": ";
+				s += std::string(prefix) + " in " + loc_str + ": ";
 			else
-				s += string(prefix) + ": ";
+				s += std::string(prefix) + ": ";
 			}
 
 		else

src/RuleAction.h

@@ -6,8 +6,6 @@
 
 #include <sys/types.h> // for u_char
 
-using std::string;
-
 class Rule;
 class RuleEndpointState;
 
@@ -50,7 +48,7 @@ public:
 
 	void PrintDebug() override;
 
-	string GetMIME() const
+	std::string GetMIME() const
 		{ return mime; }
 
 	int GetStrength() const

src/RuleMatcher.cc

@@ -21,6 +21,8 @@
 #include "Reporter.h"
 #include "module_util.h"
 
+using namespace std;
+
 // FIXME: Things that are not fully implemented/working yet:
 //
 //		  - "ip-options" always evaluates to false

src/RuleMatcher.h

@@ -1,8 +1,7 @@
 #pragma once
 
-#include "Rule.h"
+#include <sys/types.h> // for u_char
-#include "RE.h"
+#include <limits.h>
-#include "CCL.h"
 
 #include <vector>
 #include <map>
@@ -10,8 +9,9 @@
 #include <set>
 #include <string>
 
-#include <sys/types.h> // for u_char
+#include "Rule.h"
-#include <limits.h>
+#include "RE.h"
+#include "CCL.h"
 
 //#define MATCHER_PRINT_STATS
 
@@ -27,11 +27,6 @@ extern FILE* rules_in;
 extern int rules_line_number;
 extern const char* current_rule_file;
 
-using std::vector;
-using std::map;
-using std::set;
-using std::string;
-
 class Val;
 class BroFile;
 class IntSet;
@@ -67,7 +62,7 @@ typedef PList<BroString> bstr_list;
 
 // Get values from Bro's script-level variables.
 extern void id_to_maskedvallist(const char* id, maskedvalue_list* append_to,
-                                vector<IPPrefix>* prefix_vector = nullptr);
+                                std::vector<IPPrefix>* prefix_vector = nullptr);
 extern char* id_to_str(const char* id);
 extern uint32_t id_to_uint(const char* id);
 
@@ -79,7 +74,7 @@ public:
 
 	RuleHdrTest(Prot arg_prot, uint32_t arg_offset, uint32_t arg_size,
 			Comp arg_comp, maskedvalue_list* arg_vals);
-	RuleHdrTest(Prot arg_prot, Comp arg_comp, vector<IPPrefix> arg_v);
+	RuleHdrTest(Prot arg_prot, Comp arg_comp, std::vector<IPPrefix> arg_v);
 	~RuleHdrTest();
 
 	void PrintDebug();
@@ -96,7 +91,7 @@ private:
 	Prot prot;
 	Comp comp;
 	maskedvalue_list* vals;
-	vector<IPPrefix> prefix_vals; // for use with IPSrc/IPDst comparisons
+	std::vector<IPPrefix> prefix_vals; // for use with IPSrc/IPDst comparisons
 	uint32_t offset;
 	uint32_t size;
 
@@ -240,7 +235,7 @@ public:
 	 * Ordered from greatest to least strength.  Matches of the same strength
 	 * will be in the set in lexicographic order of the MIME type string.
 	 */
-	typedef map<int, set<string>, std::greater<int> > MIME_Matches;
+	using MIME_Matches = std::map<int, std::set<std::string>, std::greater<int>>;
 
 	/**
 	 * Matches a chunk of data against file magic signatures.

src/Scope.cc

@@ -121,9 +121,9 @@ IntrusivePtr<ID> lookup_ID(const char* name, const char* curr_module,
                            bool no_global, bool same_module_only,
                            bool check_export)
 	{
-	string fullname = make_full_var_name(curr_module, name);
+	std::string fullname = make_full_var_name(curr_module, name);
 
-	string ID_module = extract_module_name(fullname.c_str());
+	std::string ID_module = extract_module_name(fullname.c_str());
 	bool need_export = check_export && (ID_module != GLOBAL_MODULE_NAME &&
 	                                    ID_module != curr_module);
 
@@ -143,7 +143,7 @@ IntrusivePtr<ID> lookup_ID(const char* name, const char* curr_module,
 	if ( ! no_global && (strcmp(GLOBAL_MODULE_NAME, curr_module) == 0 ||
 			     ! same_module_only) )
 		{
-		string globalname = make_full_var_name(GLOBAL_MODULE_NAME, name);
+		std::string globalname = make_full_var_name(GLOBAL_MODULE_NAME, name);
 		ID* id = global_scope()->Lookup(globalname);
 		if ( id )
 			return {NewRef{}, id};
@@ -168,7 +168,7 @@ IntrusivePtr<ID> install_ID(const char* name, const char* module_name,
 	else
 		scope = SCOPE_FUNCTION;
 
-	string full_name = make_full_var_name(module_name, name);
+	std::string full_name = make_full_var_name(module_name, name);
 
 	auto id = make_intrusive<ID>(full_name.data(), scope, is_export);
 

src/SerializationFormat.cc

@@ -219,7 +219,7 @@ bool BinarySerializationFormat::Read(char** str, int* len, const char* tag)
 	return true;
 	}
 
-bool BinarySerializationFormat::Read(string* v, const char* tag)
+bool BinarySerializationFormat::Read(std::string* v, const char* tag)
 	{
 	char* buffer;
 	int len;
@@ -227,7 +227,7 @@ bool BinarySerializationFormat::Read(string* v, const char* tag)
 	if ( ! Read(&buffer, &len, tag) )
 		return false;
 
-	*v = string(buffer, len);
+	*v = std::string(buffer, len);
 
 	delete [] buffer;
 	return true;
@@ -362,7 +362,7 @@ bool BinarySerializationFormat::Write(const char* s, const char* tag)
 	return Write(s, strlen(s), tag);
 	}
 
-bool BinarySerializationFormat::Write(const string& s, const char* tag)
+bool BinarySerializationFormat::Write(const std::string& s, const char* tag)
 	{
 	return Write(s.data(), s.size(), tag);
 	}

src/Sessions.cc

@@ -1196,7 +1196,7 @@ Connection* NetSessions::LookupConn(const ConnectionMap& conns, const ConnIDKey&
 bool NetSessions::IsLikelyServerPort(uint32_t port, TransportProto proto) const
 	{
 	// We keep a cached in-core version of the table to speed up the lookup.
-	static set<bro_uint_t> port_cache;
+	static std::set<bro_uint_t> port_cache;
 	static bool have_cache = false;
 
 	if ( ! have_cache )

src/Sessions.h

@@ -221,9 +221,9 @@ protected:
 
 	SessionStats stats;
 
-	typedef pair<IPAddr, IPAddr> IPPair;
+	using IPPair = std::pair<IPAddr, IPAddr>;
-	typedef pair<EncapsulatingConn, double> TunnelActivity;
+	using TunnelActivity = std::pair<EncapsulatingConn, double>;
-	typedef std::map<IPPair, TunnelActivity> IPTunnelMap;
+	using IPTunnelMap = std::map<IPPair, TunnelActivity>;
 	IPTunnelMap ip_tunnels;
 
 	analyzer::arp::ARP_Analyzer* arp_analyzer;

src/SmithWaterman.cc

@@ -143,7 +143,7 @@ BroSubstring::Vec* BroSubstring::VecFromPolicy(VectorVal* vec)
 
 char* BroSubstring::VecToString(Vec* vec)
 	{
-	string result("[");
+	std::string result("[");
 
 	for ( BroSubstring::VecIt it = vec->begin(); it != vec->end(); ++it )
 		{
@@ -276,7 +276,7 @@ private:
 static void sw_collect_single(BroSubstring::Vec* result, SWNodeMatrix& matrix,
 			      SWNode* node, SWParams& params)
 	{
-	string substring("");
+	std::string substring("");
 	int row = 0, col = 0;
 
 	while ( node )
@@ -340,7 +340,7 @@ static void sw_collect_single(BroSubstring::Vec* result, SWNodeMatrix& matrix,
 static void sw_collect_multiple(BroSubstring::Vec* result,
 				SWNodeMatrix& matrix, SWParams& params)
 	{
-	vector<BroSubstring::Vec*> als;
+	std::vector<BroSubstring::Vec*> als;
 
 	for ( int i = matrix.GetHeight() - 1; i > 0; --i )
 		{
@@ -354,7 +354,7 @@ static void sw_collect_multiple(BroSubstring::Vec* result,
 			BroSubstring::Vec* new_al = new BroSubstring::Vec();
 			sw_collect_single(new_al, matrix, node, params);
 
-			for ( vector<BroSubstring::Vec*>::iterator it = als.begin();
+			for ( std::vector<BroSubstring::Vec*>::iterator it = als.begin();
 			      it != als.end(); ++it )
 				{
 				BroSubstring::Vec* old_al = *it;
@@ -393,7 +393,7 @@ end_loop:
 			}
 		}
 
-	for ( vector<BroSubstring::Vec*>::iterator it = als.begin();
+	for ( std::vector<BroSubstring::Vec*>::iterator it = als.begin();
 	      it != als.end(); ++it )
 		{
 		BroSubstring::Vec* al = *it;
@@ -506,7 +506,7 @@ BroSubstring::Vec* smith_waterman(const BroString* s1, const BroString* s2,
 			if ( current->swn_byte_assigned )
 				current->swn_score = score_tl;
 			else
-				current->swn_score = max(max(score_t, score_l), score_tl);
+				current->swn_score = std::max(std::max(score_t, score_l), score_tl);
 
 			// Establish predecessor chain according to neighbor
 			// with best score.

src/Trigger.h

@@ -20,8 +20,6 @@ namespace trigger {
 // Triggers are the heart of "when" statements: expressions that when
 // they become true execute a body of statements.
 
-using std::map;
-
 class TriggerTimer;
 class TriggerTraversalCallback;
 
@@ -110,7 +108,7 @@ private:
 
 	std::vector<std::pair<BroObj *, notifier::Modifiable*>> objs;
 
-	using ValCache = map<const CallExpr*, Val*>;
+	using ValCache = std::map<const CallExpr*, Val*>;
 	ValCache cache;
 };
 

src/TunnelEncapsulation.h

@@ -10,7 +10,6 @@
 
 #include <vector>
 
-using std::vector;
 class Connection;
 
 /**
@@ -135,7 +134,7 @@ public:
 	EncapsulationStack(const EncapsulationStack& other)
 		{
 		if ( other.conns )
-			conns = new vector<EncapsulatingConn>(*(other.conns));
+			conns = new std::vector<EncapsulatingConn>(*(other.conns));
 		else
 			conns = nullptr;
 		}
@@ -148,7 +147,7 @@ public:
 		delete conns;
 
 		if ( other.conns )
-			conns = new vector<EncapsulatingConn>(*(other.conns));
+			conns = new std::vector<EncapsulatingConn>(*(other.conns));
 		else
 			conns = nullptr;
 
@@ -165,7 +164,7 @@ public:
 	void Add(const EncapsulatingConn& c)
 		{
 		if ( ! conns )
-			conns = new vector<EncapsulatingConn>();
+			conns = new std::vector<EncapsulatingConn>();
 
 		conns->push_back(c);
 		}
@@ -215,5 +214,5 @@ public:
 		}
 
 protected:
-	vector<EncapsulatingConn>* conns;
+	std::vector<EncapsulatingConn>* conns;
 };

src/Type.cc

@@ -20,6 +20,8 @@
 #include <list>
 #include <map>
 
+using namespace std;
+
 BroType::TypeAliasMap BroType::type_aliases;
 
 // Note: This function must be thread-safe.

src/Val.cc

@@ -40,6 +40,8 @@
 
 #include "threading/formatters/JSON.h"
 
+using namespace std;
+
 Val::Val(Func* f)
 	: val(f), type(f->FType()->Ref())
 	{

src/Val.h

@@ -15,9 +15,6 @@
 
 #include <sys/types.h> // for u_char
 
-using std::vector;
-using std::string;
-
 // We have four different port name spaces: TCP, UDP, ICMP, and UNKNOWN.
 // We distinguish between them based on the bits specified in the *_PORT_MASK
 // entries specified below.
@@ -85,7 +82,7 @@ union BroValUnion {
 	PDict<TableEntryVal>* table_val;
 	val_list* val_list_val;
 
-	vector<Val*>* vector_val;
+	std::vector<Val*>* vector_val;
 
 	BroValUnion() = default;
 
@@ -122,7 +119,7 @@ union BroValUnion {
 	constexpr BroValUnion(val_list* value) noexcept
 		: val_list_val(value) {}
 
-	constexpr BroValUnion(vector<Val*> *value) noexcept
+	constexpr BroValUnion(std::vector<Val*> *value) noexcept
 		: vector_val(value) {}
 };
 
@@ -214,7 +211,7 @@ public:
 	CONST_ACCESSOR(TYPE_RECORD, val_list*, val_list_val, AsRecord)
 	CONST_ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile)
 	CONST_ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
-	CONST_ACCESSOR(TYPE_VECTOR, vector<Val*>*, vector_val, AsVector)
+	CONST_ACCESSOR(TYPE_VECTOR, std::vector<Val*>*, vector_val, AsVector)
 
 	const IPPrefix& AsSubNet() const
 		{
@@ -248,7 +245,7 @@ public:
 	ACCESSOR(TYPE_FUNC, Func*, func_val, AsFunc)
 	ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile)
 	ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
-	ACCESSOR(TYPE_VECTOR, vector<Val*>*, vector_val, AsVector)
+	ACCESSOR(TYPE_VECTOR, std::vector<Val*>*, vector_val, AsVector)
 
 	const IPPrefix& AsSubNet()
 		{
@@ -475,7 +472,7 @@ public:
 
 	// Returns the port number in host order (not including the mask).
 	uint32_t Port() const;
-	string Protocol() const;
+	std::string Protocol() const;
 
 	// Tests for protocol types.
 	bool IsTCP() const;
@@ -553,7 +550,7 @@ class StringVal final : public Val {
 public:
 	explicit StringVal(BroString* s);
 	explicit StringVal(const char* s);
-	explicit StringVal(const string& s);
+	explicit StringVal(const std::string& s);
 	StringVal(int length, const char* s);
 
 	IntrusivePtr<Val> SizeVal() const override;

src/Var.cc

@@ -272,8 +272,8 @@ extern IntrusivePtr<Expr> add_and_assign_local(IntrusivePtr<ID> id,
 
 void add_type(ID* id, IntrusivePtr<BroType> t, attr_list* attr)
 	{
-	string new_type_name = id->Name();
+	std::string new_type_name = id->Name();
-	string old_type_name = t->GetName();
+	std::string old_type_name = t->GetName();
 	IntrusivePtr<BroType> tnew;
 
 	if ( (t->Tag() == TYPE_RECORD || t->Tag() == TYPE_ENUM) &&
@@ -427,7 +427,7 @@ public:
 	TraversalCode PostExpr(const Expr*) override;
 
 	std::vector<Scope*> scopes;
-	vector<const NameExpr*> outer_id_references;
+	std::vector<const NameExpr*> outer_id_references;
 };
 
 TraversalCode OuterIDBindingFinder::PreExpr(const Expr* expr)

src/analyzer/Analyzer.h

@@ -2,6 +2,13 @@
 
 #pragma once
 
+#include <sys/types.h> // for u_char
+
+#include <list>
+#include <vector>
+#include <tuple>
+#include <type_traits>
+
 #include "Tag.h"
 
 #include "../Obj.h"
@@ -9,16 +16,6 @@
 #include "../Timer.h"
 #include "../IntrusivePtr.h"
 
-#include <list>
-#include <vector>
-#include <tuple>
-#include <type_traits>
-
-#include <sys/types.h> // for u_char
-
-using std::list;
-using std::string;
-
 class BroFile;
 class Rule;
 class Connection;
@@ -34,7 +31,7 @@ class AnalyzerTimer;
 class SupportAnalyzer;
 class OutputHandler;
 
-typedef list<Analyzer*> analyzer_list;
+using analyzer_list = std::list<Analyzer*>;
 typedef uint32_t ID;
 typedef void (Analyzer::*analyzer_timer_func)(double t);
 
@@ -624,8 +621,8 @@ protected:
 	 * Return a string represantation of an analyzer, containing its name
 	 * and ID.
 	 */
-	static string fmt_analyzer(const Analyzer* a)
+	static std::string fmt_analyzer(const Analyzer* a)
-		{ return string(a->GetAnalyzerName()) + fmt("[%d]", a->GetID()); }
+		{ return std::string(a->GetAnalyzerName()) + fmt("[%d]", a->GetID()); }
 
 	/**
 	 * Associates a connection with this analyzer.  Must be called if

src/analyzer/Manager.cc

@@ -108,8 +108,8 @@ void Manager::DumpDebug()
 	{
 #ifdef DEBUG
 	DBG_LOG(DBG_ANALYZER, "Available analyzers after zeek_init():");
-	list<Component*> all_analyzers = GetComponents();
+	std::list<Component*> all_analyzers = GetComponents();
-	for ( list<Component*>::const_iterator i = all_analyzers.begin(); i != all_analyzers.end(); ++i )
+	for ( std::list<Component*>::const_iterator i = all_analyzers.begin(); i != all_analyzers.end(); ++i )
 		DBG_LOG(DBG_ANALYZER, "    %s (%s)", (*i)->Name().c_str(),
 			IsEnabled((*i)->Tag()) ? "enabled" : "disabled");
 
@@ -118,20 +118,20 @@ void Manager::DumpDebug()
 
 	for ( analyzer_map_by_port::const_iterator i = analyzers_by_port_tcp.begin(); i != analyzers_by_port_tcp.end(); i++ )
 		{
-		string s;
+		std::string s;
 
 		for ( tag_set::const_iterator j = i->second->begin(); j != i->second->end(); j++ )
-			s += string(GetComponentName(*j)) + " ";
+			s += std::string(GetComponentName(*j)) + " ";
 
 		DBG_LOG(DBG_ANALYZER, "    %d/tcp: %s", i->first, s.c_str());
 		}
 
 	for ( analyzer_map_by_port::const_iterator i = analyzers_by_port_udp.begin(); i != analyzers_by_port_udp.end(); i++ )
 		{
-		string s;
+		std::string s;
 
 		for ( tag_set::const_iterator j = i->second->begin(); j != i->second->end(); j++ )
-			s += string(GetComponentName(*j)) + " ";
+			s += std::string(GetComponentName(*j)) + " ";
 
 		DBG_LOG(DBG_ANALYZER, "    %d/udp: %s", i->first, s.c_str());
 		}
@@ -199,8 +199,8 @@ void Manager::DisableAllAnalyzers()
 	{
 	DBG_LOG(DBG_ANALYZER, "Disabling all analyzers");
 
-	list<Component*> all_analyzers = GetComponents();
+	std::list<Component*> all_analyzers = GetComponents();
-	for ( list<Component*>::const_iterator i = all_analyzers.begin(); i != all_analyzers.end(); ++i )
+	for ( std::list<Component*>::const_iterator i = all_analyzers.begin(); i != all_analyzers.end(); ++i )
 		(*i)->SetEnabled(false);
 	}
 

src/analyzer/Manager.h

@@ -342,8 +342,9 @@ public:
 		{ return vxlan_ports; }
 
 private:
-	typedef set<Tag> tag_set;
+
-	typedef map<uint32_t, tag_set*> analyzer_map_by_port;
+	using tag_set = std::set<Tag>;
+	using analyzer_map_by_port = std::map<uint32_t, tag_set*>;
 
 	tag_set* LookupPort(PortVal* val, bool add_if_not_found);
 	tag_set* LookupPort(TransportProto proto, uint32_t port, bool add_if_not_found);
@@ -387,10 +388,10 @@ private:
 		};
 	};
 
-	typedef std::multimap<ConnIndex, ScheduledAnalyzer*> conns_map;
+	using conns_map = std::multimap<ConnIndex, ScheduledAnalyzer*>;
-	typedef std::priority_queue<ScheduledAnalyzer*,
+	using conns_queue = std::priority_queue<ScheduledAnalyzer*,
-				    vector<ScheduledAnalyzer*>,
+	                                        std::vector<ScheduledAnalyzer*>,
-				    ScheduledAnalyzer::Comparator> conns_queue;
+	                                        ScheduledAnalyzer::Comparator>;
 
 	conns_map conns;
 	conns_queue conns_by_timeout;

src/analyzer/protocol/bittorrent/BitTorrentTracker.cc

@@ -745,7 +745,7 @@ int BitTorrentTracker_Analyzer::ResponseParseBenc(void)
 			if ( benc_str_have < benc_str_len )
 				{
 				unsigned int seek =
-					min(len, benc_str_len - benc_str_have);
+					std::min(len, benc_str_len - benc_str_have);
 				benc_str_have += seek;
 
 				if ( benc_raw_type != BENC_TYPE_NONE )

src/analyzer/protocol/bittorrent/BitTorrentTracker.h

@@ -106,8 +106,8 @@ protected:
 	TableVal* res_val_peers;
 	TableVal* res_val_benc;
 
-	vector<char> benc_stack;
+	std::vector<char> benc_stack;
-	vector<unsigned int> benc_count;
+	std::vector<unsigned int> benc_count;
 	enum btt_benc_states benc_state;
 
 	char* benc_raw;

src/analyzer/protocol/file/File.cc

@@ -21,7 +21,7 @@ void File_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 	{
 	tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
 
-	int n = min(len, BUFFER_SIZE - buffer_len);
+	int n = std::min(len, BUFFER_SIZE - buffer_len);
 
 	if ( n )
 		{
@@ -75,7 +75,7 @@ void File_Analyzer::Identify()
 	RuleMatcher::MIME_Matches matches;
 	file_mgr->DetectMIME(reinterpret_cast<const u_char*>(buffer), buffer_len,
 	                     &matches);
-	string match = matches.empty() ? "<unknown>"
+	std::string match = matches.empty() ? "<unknown>"
 	                               : *(matches.begin()->second.begin());
 
 	if ( file_transferred )

src/analyzer/protocol/file/File.h

@@ -27,8 +27,8 @@ protected:
 	static const int BUFFER_SIZE = 1024;
 	char buffer[BUFFER_SIZE];
 	int buffer_len;
-	string file_id_orig;
+	std::string file_id_orig;
-	string file_id_resp;
+	std::string file_id_resp;
 };
 
 class IRC_Data : public File_Analyzer {
@@ -51,4 +51,4 @@ public:
 		{ return new FTP_Data(conn); }
 };
 
-} } // namespace analyzer::* 
+} } // namespace analyzer::*

src/analyzer/protocol/ftp/FTP.cc

@@ -107,7 +107,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig)
 
 		if ( strncmp((const char*) cmd_str->Bytes(),
 			     "AUTH", cmd_len) == 0 )
-			auth_requested = string(line, end_of_line - line);
+			auth_requested = std::string(line, end_of_line - line);
 
 		if ( rule_matcher )
 			Conn()->Match(Rule::FTP, (const u_char *) cmd,

src/analyzer/protocol/ftp/FTP.h

@@ -24,7 +24,7 @@ protected:
 	login::NVT_Analyzer* nvt_orig;
 	login::NVT_Analyzer* nvt_resp;
 	uint32_t pending_reply;	// code associated with multi-line reply, or 0
-	string auth_requested;	// AUTH method requested
+	std::string auth_requested;	// AUTH method requested
 };
 
 /**

src/analyzer/protocol/ftp/functions.bif

@@ -86,7 +86,7 @@ static Val* parse_eftp(const char* line)
 					good = 0;
 					}
 
-				string s(line, nptr-line); // extract IP address
+				std::string s(line, nptr-line); // extract IP address
 				IPAddr tmp(s);
 				// on error, "tmp" will have all 128 bits zero
 				if ( tmp == addr )

src/analyzer/protocol/gnutella/Gnutella.cc

@@ -112,9 +112,9 @@ bool Gnutella_Analyzer::NextLine(const u_char* data, int len)
 	}
 
 
-bool Gnutella_Analyzer::IsHTTP(string header)
+bool Gnutella_Analyzer::IsHTTP(std::string header)
 	{
-	if ( header.find(" HTTP/1.") == string::npos )
+	if ( header.find(" HTTP/1.") == std::string::npos )
 		return false;
 
 	if ( gnutella_http_notify )
@@ -139,7 +139,7 @@ bool Gnutella_Analyzer::IsHTTP(string header)
 	}
 
 
-bool Gnutella_Analyzer::GnutellaOK(string header)
+bool Gnutella_Analyzer::GnutellaOK(std::string header)
 	{
 	if ( strncmp("GNUTELLA", header.data(), 8) )
 		return false;
@@ -223,7 +223,7 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig)
 			IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_len)},
 			make_intrusive<StringVal>(p->payload),
 			IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->payload_len)},
-			IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_len < min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD)))},
+			IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD)))},
 			IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_left == 0))}
 		);
 	}

src/analyzer/protocol/gnutella/Gnutella.h

@@ -16,10 +16,10 @@ class GnutellaMsgState {
 public:
 	GnutellaMsgState ();
 
-	string buffer;
+	std::string buffer;
 	int current_offset;
 	int got_CR;
-	string headers;
+	std::string headers;
 	char msg[GNUTELLA_MSG_SIZE];
 	u_char msg_hops;
 	unsigned int msg_len;
@@ -47,8 +47,8 @@ public:
 private:
 	bool NextLine(const u_char* data, int len);
 
-	bool GnutellaOK(string header);
+	bool GnutellaOK(std::string header);
-	bool IsHTTP(string header);
+	bool IsHTTP(std::string header);
 
 	bool Established() const	{ return state == (ORIG_OK | RESP_OK); }
 

src/analyzer/protocol/icmp/ICMP.cc

@@ -45,7 +45,7 @@ void ICMP_Analyzer::DeliverPacket(int len, const u_char* data,
 	// caplen > len.
 	if ( packet_contents )
 		// Subtract off the common part of ICMP header.
-		PacketContents(data + 8, min(len, caplen) - 8);
+		PacketContents(data + 8, std::min(len, caplen) - 8);
 
 	const struct icmp* icmpp = (const struct icmp*) data;
 
@@ -209,7 +209,7 @@ void ICMP_Analyzer::ICMP_Sent(const struct icmp* icmpp, int len, int caplen,
 
 	if ( icmp_sent_payload )
 		{
-		BroString* payload = new BroString(data, min(len, caplen), false);
+		BroString* payload = new BroString(data, std::min(len, caplen), false);
 
 		EnqueueConnEvent(icmp_sent_payload,
 			IntrusivePtr{AdoptRef{}, BuildConnVal()},
@@ -841,7 +841,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 
 		if ( set_payload_field )
 			{
-			BroString* payload = new BroString(data, min((int)length, caplen), false);
+			BroString* payload = new BroString(data, std::min((int)length, caplen), false);
 			rv->Assign(6, make_intrusive<StringVal>(payload));
 			}
 

src/analyzer/protocol/irc/IRC.cc

@@ -10,6 +10,7 @@
 #include "events.bif.h"
 
 using namespace analyzer::irc;
+using namespace std;
 
 IRC_Analyzer::IRC_Analyzer(Connection* conn)
 : tcp::TCP_ApplicationAnalyzer("IRC", conn)

src/analyzer/protocol/irc/IRC.h

@@ -46,7 +46,7 @@ protected:
 private:
 	void StartTLS();
 
-	inline void SkipLeadingWhitespace(string& str);
+	inline void SkipLeadingWhitespace(std::string& str);
 
 	/** \brief counts number of invalid IRC messages */
 	int invalid_msg_count;
@@ -62,7 +62,7 @@ private:
 	* \param split character which separates the words
 	* \return vector containing words
 	*/
-	vector<string> SplitWords(const string& input, char split);
+	std::vector<std::string> SplitWords(const std::string& input, char split);
 
 	tcp::ContentLine_Analyzer* cl_orig;
 	tcp::ContentLine_Analyzer* cl_resp;

src/analyzer/protocol/mime/MIME.cc

@@ -1215,7 +1215,7 @@ void MIME_Entity::DataOctets(int len, const char* data)
 		if ( data_buf_offset < 0 && ! GetDataBuffer() )
 			return;
 
-		int n = min(data_buf_length - data_buf_offset, len);
+		int n = std::min(data_buf_length - data_buf_offset, len);
 		memcpy(data_buf_data + data_buf_offset, data, n);
 		data += n;
 		data_buf_offset += n;

src/analyzer/protocol/mime/MIME.h

@@ -5,7 +5,6 @@
 #include <stdio.h>
 #include <vector>
 #include <queue>
-using namespace std;
 
 #include "BroString.h"
 #include "Reporter.h"
@@ -61,7 +60,7 @@ public:
 	BroString* get_concatenated_line();
 
 protected:
-	vector<const BroString*> buffer;
+	std::vector<const BroString*> buffer;
 	BroString* line;
 };
 
@@ -86,7 +85,7 @@ protected:
 };
 
 
-typedef vector<MIME_Header*> MIME_HeaderList;
+using MIME_HeaderList = std::vector<MIME_Header*>;
 
 class MIME_Entity {
 public:
@@ -255,13 +254,13 @@ protected:
 	int compute_content_hash;
 	int content_hash_length;
 	EVP_MD_CTX* md5_hash;
-	vector<const BroString*> entity_content;
+	std::vector<const BroString*> entity_content;
-	vector<const BroString*> all_content;
+	std::vector<const BroString*> all_content;
 
 	BroString* data_buffer;
 
 	uint64_t cur_entity_len;
-	string cur_entity_id;
+	std::string cur_entity_id;
 };
 
 

src/analyzer/protocol/pop3/POP3.cc

@@ -86,7 +86,7 @@ void POP3_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 		ProcessReply(len, (char*) terminated_string.Bytes());
 	}
 
-static string trim_whitespace(const char* in)
+static std::string trim_whitespace(const char* in)
 	{
 	int n = strlen(in);
 	char* out = new char[n + 1];
@@ -121,7 +121,7 @@ static string trim_whitespace(const char* in)
 
 	*out_p = 0;
 
-	string rval(out);
+	std::string rval(out);
 	delete [] out;
 	return rval;
 	}
@@ -231,7 +231,7 @@ void POP3_Analyzer::ProcessRequest(int length, const char* line)
 		// Some clients pipeline their commands (i.e., keep sending
 		// without waiting for a server's responses). Therefore we
 		// keep a list of pending commands.
-		cmds.push_back(string(line));
+		cmds.push_back(std::string(line));
 
 		if ( cmds.size() == 1 )
 			// Not waiting for another server response,
@@ -241,7 +241,7 @@ void POP3_Analyzer::ProcessRequest(int length, const char* line)
 
 	}
 
-static string commands[] = {
+static std::string commands[] = {
 	"OK", "ERR", "USER", "PASS", "APOP", "AUTH",
 	"STAT", "LIST", "RETR", "DELE", "RSET", "NOOP", "LAST", "QUIT",
 	"TOP", "CAPA", "UIDL", "STLS", "XSENDER",
@@ -258,8 +258,8 @@ void POP3_Analyzer::ProcessClientCmd()
 	if ( ! cmds.size() )
 		return;
 
-	string str = trim_whitespace(cmds.front().c_str());
+	std::string str = trim_whitespace(cmds.front().c_str());
-	vector<string> tokens = TokenizeLine(str, ' ');
+	std::vector<std::string> tokens = TokenizeLine(str, ' ');
 
 	int cmd_code = -1;
 	const char* cmd = "";
@@ -593,7 +593,7 @@ void POP3_Analyzer::FinishClientCmd()
 void POP3_Analyzer::ProcessReply(int length, const char* line)
 	{
 	const char* end_of_line = line + length;
-	string str = trim_whitespace(line);
+	std::string str = trim_whitespace(line);
 
 	if ( multiLine == true )
 		{
@@ -631,7 +631,7 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
 	int cmd_code = -1;
 	const char* cmd = "";
 
-	vector<string> tokens = TokenizeLine(str, ' ');
+	std::vector<std::string> tokens = TokenizeLine(str, ' ');
 	if ( tokens.size() > 0 )
 		cmd_code = ParseCmd(tokens[0]);
 
@@ -863,7 +863,7 @@ void POP3_Analyzer::ProcessData(int length, const char* line)
 	mail->Deliver(length, line, true);
 	}
 
-int POP3_Analyzer::ParseCmd(string cmd)
+int POP3_Analyzer::ParseCmd(std::string cmd)
 	{
 	if ( cmd.size() == 0 )
 		return -1;
@@ -884,18 +884,18 @@ int POP3_Analyzer::ParseCmd(string cmd)
 	return -1;
 	}
 
-vector<string> POP3_Analyzer::TokenizeLine(const string& input, char split)
+std::vector<std::string> POP3_Analyzer::TokenizeLine(const std::string& input, char split)
 	{
-	vector<string> tokens;
+	std::vector<std::string> tokens;
 
 	if ( input.size() < 1 )
 		return tokens;
 
 	int start = 0;
 	unsigned int splitPos = 0;
-	string token = "";
+	std::string token = "";
 
-	if ( input.find(split, 0) == string::npos )
+	if ( input.find(split, 0) == std::string::npos )
 		{
 		tokens.push_back(input);
 		return tokens;

src/analyzer/protocol/pop3/POP3.h

@@ -86,8 +86,8 @@ protected:
 	int lastRequiredCommand;
 	int authLines;
 
-	string user;
+	std::string user;
-	string password;
+	std::string password;
 
 	void ProcessRequest(int length, const char* line);
 	void ProcessReply(int length, const char* line);
@@ -99,14 +99,14 @@ protected:
 	void EndData();
 	void StartTLS();
 
-	vector<string> TokenizeLine(const string& input, char split);
+	std::vector<std::string> TokenizeLine(const std::string& input, char split);
-	int ParseCmd(string cmd);
+	int ParseCmd(std::string cmd);
 	void AuthSuccessfull();
 	void POP3Event(EventHandlerPtr event, bool is_orig,
 			const char* arg1 = nullptr, const char* arg2 = nullptr);
 
 	mime::MIME_Mail* mail;
-	list<string> cmds;
+	std::list<std::string> cmds;
 
 private:
 	bool tls;

src/analyzer/protocol/rpc/NFS.cc

@@ -309,8 +309,8 @@ StringVal* NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offse
 		return nullptr;
 
 	// Ok, so we want to return some data
-	data_n = min(data_n, size);
+	data_n = std::min(data_n, size);
-	data_n = min(data_n, int(BifConst::NFS3::return_data_max));
+	data_n = std::min(data_n, int(BifConst::NFS3::return_data_max));
 
 	if ( data && data_n > 0 )
 		return new StringVal(new BroString(data, data_n, false));

src/analyzer/protocol/rpc/RPC.cc

@@ -394,14 +394,14 @@ bool RPC_Reasm_Buffer::ConsumeChunk(const u_char*& data, int& len)
 	// How many bytes do we want to process with this call?  Either the
 	// all of the bytes available or the number of bytes that we are
 	// still missing.
-	int64_t to_process = min(int64_t(len), (expected-processed));
+	int64_t to_process = std::min(int64_t(len), (expected-processed));
 
 	if ( fill < maxsize )
 		{
 		// We haven't yet filled the buffer. How many bytes to copy
 		// into the buff. Either all of the bytes we want to process
 		// or the number of bytes until we reach maxsize.
-		int64_t to_copy = min( to_process, (maxsize-fill) );
+		int64_t to_copy = std::min( to_process, (maxsize-fill) );
 		if ( to_copy )
 			memcpy(buf+fill, data, to_copy);
 
@@ -741,7 +741,7 @@ void RPC_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 					uint64_t seq, const IP_Hdr* ip, int caplen)
 	{
 	tcp::TCP_ApplicationAnalyzer::DeliverPacket(len, data, orig, seq, ip, caplen);
-	len = min(len, caplen);
+	len = std::min(len, caplen);
 
 	if ( orig )
 		{

src/analyzer/protocol/smtp/SMTP.h

@@ -3,7 +3,6 @@
 #pragma once
 
 #include <list>
-using namespace std;
 
 #include "analyzer/protocol/tcp/TCP.h"
 #include "analyzer/protocol/tcp/ContentLine.h"
@@ -83,7 +82,7 @@ protected:
 	int last_replied_cmd;
 	int first_cmd;			// first un-replied SMTP cmd, or -1
 	int pending_reply;		// code assoc. w/ multi-line reply, or 0
-	list<int> pending_cmd_q;	// to support pipelining
+	std::list<int> pending_cmd_q;	// to support pipelining
 	bool skip_data;			// whether to skip message body
 	BroString* line_after_gap;	// last line before the first reply
 					// after a gap

src/analyzer/protocol/tcp/ContentLine.cc

@@ -145,7 +145,7 @@ void ContentLine_Analyzer::DoDeliver(int len, const u_char* data)
 
 		if ( plain_delivery_length > 0 )
 			{
-			int deliver_plain = min(plain_delivery_length, (int64_t)len);
+			int deliver_plain = std::min(plain_delivery_length, (int64_t)len);
 
 			last_char = 0; // clear last_char
 			plain_delivery_length -= deliver_plain;

src/analyzer/protocol/tcp/TCP.cc

@@ -794,7 +794,7 @@ void TCP_Analyzer::GeneratePacketEvent(
 		IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)},
 		// We need the min() here because Ethernet padding can lead to
 		// caplen > len.
-		make_intrusive<StringVal>(min(caplen, len), (const char*) data)
+		make_intrusive<StringVal>(std::min(caplen, len), (const char*) data)
 	);
 	}
 
@@ -1055,7 +1055,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 	// We need the min() here because Ethernet frame padding can lead to
 	// caplen > len.
 	if ( packet_contents )
-		PacketContents(data, min(len, caplen));
+		PacketContents(data, std::min(len, caplen));
 
 	TCP_Endpoint* endpoint = is_orig ? orig : resp;
 	TCP_Endpoint* peer = endpoint->peer;
@@ -1906,7 +1906,7 @@ void TCP_ApplicationAnalyzer::DeliverPacket(int len, const u_char* data,
 	Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
 	DBG_LOG(DBG_ANALYZER, "TCP_ApplicationAnalyzer ignoring DeliverPacket(%d, %s, %" PRIu64", %p, %d) [%s%s]",
 			len, is_orig ? "T" : "F", seq, ip, caplen,
-			fmt_bytes((const char*) data, min(40, len)), len > 40 ? "..." : "");
+			fmt_bytes((const char*) data, std::min(40, len)), len > 40 ? "..." : "");
 	}
 
 void TCP_ApplicationAnalyzer::SetEnv(bool /* is_orig */, char* name, char* val)

src/analyzer/protocol/tcp/TCP.h

@@ -169,7 +169,7 @@ private:
 	TCP_Endpoint* orig;
 	TCP_Endpoint* resp;
 
-	typedef list<analyzer::Analyzer*> analyzer_list;
+	using analyzer_list = std::list<analyzer::Analyzer*>;
 	analyzer_list packet_children;
 
 	unsigned int first_packet_seen: 2;

src/analyzer/protocol/tcp/TCP_Flags.h

@@ -14,13 +14,13 @@ public:
 	bool URG() const	{ return flags & TH_URG; }
 	bool PUSH() const	{ return flags & TH_PUSH; }
 
-	string AsString() const;
+	std::string AsString() const;
 
 protected:
 	u_char flags;
 };
 
-inline string TCP_Flags::AsString() const
+inline std::string TCP_Flags::AsString() const
 	{
 	char tcp_flags[10];
 	char* p = tcp_flags;

src/analyzer/protocol/udp/UDP.cc

@@ -58,7 +58,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 	// We need the min() here because Ethernet frame padding can lead to
 	// caplen > len.
 	if ( packet_contents )
-		PacketContents(data, min(len, caplen) - sizeof(struct udphdr));
+		PacketContents(data, std::min(len, caplen) - sizeof(struct udphdr));
 
 	int chksum = up->uh_sum;
 

src/broker/Manager.h

@@ -194,7 +194,7 @@ public:
 	 * See the Broker::SendFlags record type.
 	 * @return true if the message is sent successfully.
 	 */
-	bool PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int num_vals,
+	bool PublishLogWrite(EnumVal* stream, EnumVal* writer, std::string path, int num_vals,
 			     const threading::Value* const * vals);
 
 	/**

src/broker/Store.h

@@ -52,7 +52,7 @@ class StoreQueryCallback {
 public:
 	StoreQueryCallback(trigger::Trigger* arg_trigger, const CallExpr* arg_call,
 			   broker::store store)
-		: trigger(arg_trigger), call(arg_call), store(move(store))
+		: trigger(arg_trigger), call(arg_call), store(std::move(store))
 		{
 		Ref(trigger);
 		}

src/file_analysis/AnalyzerSet.h

@@ -7,8 +7,6 @@
 #include "Dict.h"
 #include "Tag.h"
 
-using std::queue;
-
 class CompositeHash;
 class RecordVal;
 
@@ -204,7 +202,7 @@ private:
 		HashKey* key;
 	};
 
-	typedef queue<Modification*> ModQueue;
+	using ModQueue = std::queue<Modification*>;
 	ModQueue mod_queue;	/**< A queue of analyzer additions/removals requests. */
 };
 

src/file_analysis/File.cc

@@ -80,7 +80,7 @@ void File::StaticInit()
 	meta_inferred_idx = Idx("inferred", fa_metadata_type);
 	}
 
-File::File(const string& file_id, const string& source_name, Connection* conn,
+File::File(const std::string& file_id, const std::string& source_name, Connection* conn,
            analyzer::Tag tag, bool is_orig)
 	: id(file_id), val(nullptr), file_reassembler(nullptr), stream_offset(0),
 	  reassembly_max_buffer(0), did_metadata_inference(false),
@@ -174,7 +174,7 @@ double File::LookupFieldDefaultInterval(int idx) const
 	return v->AsInterval();
 	}
 
-int File::Idx(const string& field, const RecordType* type)
+int File::Idx(const std::string& field, const RecordType* type)
 	{
 	int rval = type->FieldOffset(field.c_str());
 
@@ -185,14 +185,14 @@ int File::Idx(const string& field, const RecordType* type)
 	return rval;
 	}
 
-string File::GetSource() const
+std::string File::GetSource() const
 	{
 	Val* v = val->Lookup(source_idx);
 
-	return v ? v->AsString()->CheckString() : string();
+	return v ? v->AsString()->CheckString() : std::string();
 	}
 
-void File::SetSource(const string& source)
+void File::SetSource(const std::string& source)
 	{
 	val->Assign(source_idx, make_intrusive<StringVal>(source.c_str()));
 	}
@@ -288,7 +288,7 @@ void File::SetReassemblyBuffer(uint64_t max)
 	reassembly_max_buffer = max;
 	}
 
-bool File::SetMime(const string& mime_type)
+bool File::SetMime(const std::string& mime_type)
 	{
 	if ( mime_type.empty() || bof_buffer.size != 0 || did_metadata_inference )
 		return false;
@@ -329,7 +329,7 @@ void File::InferMetadata()
 	RuleMatcher::MIME_Matches matches;
 	const u_char* data = bof_buffer_val->AsString()->Bytes();
 	uint64_t len = bof_buffer_val->AsString()->Len();
-	len = min(len, LookupFieldDefaultCount(bof_buffer_size_idx));
+	len = std::min(len, LookupFieldDefaultCount(bof_buffer_size_idx));
 	file_mgr->DetectMIME(data, len, &matches);
 
 	auto meta = make_intrusive<RecordVal>(fa_metadata_type);
@@ -383,7 +383,7 @@ void File::DeliverStream(const u_char* data, uint64_t len)
 	        "[%s] %" PRIu64 " stream bytes in at offset %" PRIu64 "; %s [%s%s]",
 	        id.c_str(), len, stream_offset,
 	        IsComplete() ? "complete" : "incomplete",
-	        fmt_bytes((const char*) data, min((uint64_t)40, len)),
+	        fmt_bytes((const char*) data, std::min((uint64_t)40, len)),
 	        len > 40 ? "..." : "");
 
 	file_analysis::Analyzer* a = nullptr;
@@ -487,7 +487,7 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
 	        "[%s] %" PRIu64 " chunk bytes in at offset %" PRIu64 "; %s [%s%s]",
 	        id.c_str(), len, offset,
 	        IsComplete() ? "complete" : "incomplete",
-	        fmt_bytes((const char*) data, min((uint64_t)40, len)),
+	        fmt_bytes((const char*) data, std::min((uint64_t)40, len)),
 	        len > 40 ? "..." : "");
 
 	file_analysis::Analyzer* a = nullptr;

src/file_analysis/File.h

@@ -13,8 +13,6 @@
 #include "ZeekArgs.h"
 #include "WeirdState.h"
 
-using std::string;
-
 class Connection;
 class RecordType;
 class RecordVal;
@@ -46,13 +44,13 @@ public:
 	 * @return the value of the "source" field from #val record or an empty
 	 * string if it's not initialized.
 	 */
-	string GetSource() const;
+	std::string GetSource() const;
 
 	/**
 	 * Set the "source" field from #val record to \a source.
 	 * @param source the new value of the "source" field.
 	 */
-	void SetSource(const string& source);
+	void SetSource(const std::string& source);
 
 	/**
 	 * @return value (seconds) of the "timeout_interval" field from #val record.
@@ -76,7 +74,7 @@ public:
 	/**
 	 * @return value of the "id" field from #val record.
 	 */
-	string GetID() const { return id; }
+	std::string GetID() const { return id; }
 
 	/**
 	 * @return value of "last_active" field in #val record;
@@ -212,7 +210,7 @@ public:
 	 * @return true if the mime type was set. False if it could not be set because
 	 *         a mime type was already set or inferred.
 	 */
-	bool SetMime(const string& mime_type);
+	bool SetMime(const std::string& mime_type);
 
 	/**
 	 * Whether to permit a weird to carry on through the full reporter/weird
@@ -236,7 +234,7 @@ protected:
 	 *        of the connection to the responder.  False indicates the other
 	 *        direction.
 	 */
-	File(const string& file_id, const string& source_name, Connection* conn = nullptr,
+	File(const std::string& file_id, const std::string& source_name, Connection* conn = nullptr,
 	     analyzer::Tag tag = analyzer::Tag::Error, bool is_orig = false);
 
 	/**
@@ -313,7 +311,7 @@ protected:
 	 */
 	void DeliverStream(const u_char* data, uint64_t len);
 
-	/** 
+	/**
 	 * Perform chunk-wise delivery for analyzers that need it.
 	 */
 	void DeliverChunk(const u_char* data, uint64_t len, uint64_t offset);
@@ -324,7 +322,7 @@ protected:
 	 * @param type the record type for which the field will be looked up.
 	 * @return the field offset in #val record corresponding to \a field_name.
 	 */
-	static int Idx(const string& field_name, const RecordType* type);
+	static int Idx(const std::string& field_name, const RecordType* type);
 
 	/**
 	 * Initializes static member.
@@ -332,7 +330,7 @@ protected:
 	static void StaticInit();
 
 protected:
-	string id;                 /**< A pretty hash that likely identifies file */
+	std::string id;                 /**< A pretty hash that likely identifies file */
 	RecordVal* val;            /**< \c fa_file from script layer. */
 	FileReassembler* file_reassembler; /**< A reassembler for the file if it's needed. */
 	uint64_t stream_offset;      /**< The offset of the file which has been forwarded. */

src/file_analysis/FileTimer.cc

@@ -6,7 +6,7 @@
 
 using namespace file_analysis;
 
-FileTimer::FileTimer(double t, const string& id, double interval)
+FileTimer::FileTimer(double t, const std::string& id, double interval)
     : Timer(t + interval, TIMER_FILE_ANALYSIS_INACTIVITY), file_id(id)
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "New %f second timeout timer for %s",

src/file_analysis/FileTimer.h

@@ -2,11 +2,8 @@
 
 #pragma once
 
-#include "Timer.h"
-
 #include <string>
-
+#include "Timer.h"
-using std::string;
 
 namespace file_analysis {
 
@@ -22,7 +19,7 @@ public:
 	 * @param id the file identifier which will be checked for inactivity.
 	 * @param interval amount of time after \a t to check for inactivity.
 	 */
-	FileTimer(double t, const string& id, double interval);
+	FileTimer(double t, const std::string& id, double interval);
 
 	/**
 	 * Check inactivity of file_analysis::File corresponding to #file_id,
@@ -33,7 +30,7 @@ public:
 	void Dispatch(double t, bool is_expire) override;
 
 private:
-	string file_id;
+	std::string file_id;
 };
 
 } // namespace file_analysis

src/file_analysis/Manager.cc

@@ -15,6 +15,7 @@
 #include <openssl/md5.h>
 
 using namespace file_analysis;
+using namespace std;
 
 TableVal* Manager::disabled = nullptr;
 TableType* Manager::tag_set_type = nullptr;

src/file_analysis/Manager.h

@@ -14,9 +14,6 @@
 
 #include "analyzer/Tag.h"
 
-using std::map;
-using std::set;
-
 class TableVal;
 class VectorVal;
 
@@ -75,7 +72,7 @@ public:
 	 * a single file.
 	 * @return a prettified MD5 hash of \a handle, truncated to *bits_per_uid* bits.
 	 */
-	string HashHandle(const string& handle) const;
+	std::string HashHandle(const std::string& handle) const;
 
 	/**
 	 * Take in a unique file handle string to identify next piece of
@@ -83,7 +80,7 @@ public:
 	 * @param handle a unique string (may contain NULs) which identifies
 	 * a single file.
 	 */
-	void SetHandle(const string& handle);
+	void SetHandle(const std::string& handle);
 
 	/**
 	 * Pass in non-sequential file data.
@@ -150,8 +147,8 @@ public:
 	 *        in human-readable form where the file input is coming from (e.g.
 	 *        a local file path).
 	 */
-	void DataIn(const u_char* data, uint64_t len, const string& file_id,
+	void DataIn(const u_char* data, uint64_t len, const std::string& file_id,
-	            const string& source);
+	            const std::string& source);
 
 	/**
 	 * Signal the end of file data regardless of which direction it is being
@@ -173,7 +170,7 @@ public:
 	 * Signal the end of file data being transferred using the file identifier.
 	 * @param file_id the file identifier/hash.
 	 */
-	void EndOfFile(const string& file_id);
+	void EndOfFile(const std::string& file_id);
 
 	/**
 	 * Signal a gap in the file data stream.
@@ -219,7 +216,7 @@ public:
 	 * @param file_id the file identifier/hash.
 	 * @return false if file identifier did not map to anything, else true.
 	 */
-	bool IgnoreFile(const string& file_id);
+	bool IgnoreFile(const std::string& file_id);
 
 	/**
 	 * Set's an inactivity threshold for the file.
@@ -229,22 +226,22 @@ public:
 	 *        to be considered stale, timed out, and then resource reclaimed.
 	 * @return false if file identifier did not map to anything, else true.
 	 */
-	bool SetTimeoutInterval(const string& file_id, double interval) const;
+	bool SetTimeoutInterval(const std::string& file_id, double interval) const;
 
 	/**
 	 * Enable the reassembler for a file.
 	 */
-	bool EnableReassembly(const string& file_id);
+	bool EnableReassembly(const std::string& file_id);
-	
+
 	/**
 	 * Disable the reassembler for a file.
 	 */
-	bool DisableReassembly(const string& file_id);
+	bool DisableReassembly(const std::string& file_id);
 
 	/**
 	 * Set the reassembly for a file in bytes.
 	 */
-	bool SetReassemblyBuffer(const string& file_id, uint64_t max);
+	bool SetReassemblyBuffer(const std::string& file_id, uint64_t max);
 
 	/**
 	 * Sets a limit on the maximum size allowed for extracting the file
@@ -256,7 +253,7 @@ public:
 	 * @return false if file identifier and analyzer did not map to anything,
 	 *         else true.
 	 */
-	bool SetExtractionLimit(const string& file_id, RecordVal* args,
+	bool SetExtractionLimit(const std::string& file_id, RecordVal* args,
 	                        uint64_t n) const;
 
 	/**
@@ -265,7 +262,7 @@ public:
 	 * @return the File object mapped to \a file_id, or a null pointer if no
 	 *         mapping exists.
 	 */
-	File* LookupFile(const string& file_id) const;
+	File* LookupFile(const std::string& file_id) const;
 
 	/**
 	 * Queue attachment of an analzer to the file identifier.  Multiple
@@ -276,7 +273,7 @@ public:
 	 * @param args a \c AnalyzerArgs value which describes a file analyzer.
 	 * @return false if the analyzer failed to be instantiated, else true.
 	 */
-	bool AddAnalyzer(const string& file_id, const file_analysis::Tag& tag,
+	bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
 	                 RecordVal* args) const;
 
 	/**
@@ -286,7 +283,7 @@ public:
 	 * @param args a \c AnalyzerArgs value which describes a file analyzer.
 	 * @return true if the analyzer is active at the time of call, else false.
 	 */
-	bool RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag,
+	bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
 	                    RecordVal* args) const;
 
 	/**
@@ -294,7 +291,7 @@ public:
 	 * @param file_id the file identifier/hash.
 	 * @return whether the file mapped to \a file_id is being ignored.
 	 */
-	bool IsIgnored(const string& file_id);
+	bool IsIgnored(const std::string& file_id);
 
 	/**
 	 * Instantiates a new file analyzer instance for the file.
@@ -358,7 +355,7 @@ protected:
 	 *         exist, the activity time is refreshed along with any
 	 *         connection-related fields.
 	 */
-	File* GetFile(const string& file_id, Connection* conn = nullptr,
+	File* GetFile(const std::string& file_id, Connection* conn = nullptr,
 	              const analyzer::Tag& tag = analyzer::Tag::Error,
 	              bool is_orig = false, bool update_conn = true,
 	              const char* source_name = nullptr);
@@ -370,14 +367,14 @@ protected:
 	 * @param is_termination whether the Manager (and probably Bro) is in a
 	 *        terminating state.  If true, then the timeout cannot be postponed.
 	 */
-	void Timeout(const string& file_id, bool is_terminating = ::terminating);
+	void Timeout(const std::string& file_id, bool is_terminating = ::terminating);
 
 	/**
 	 * Immediately remove file_analysis::File object associated with \a file_id.
 	 * @param file_id the file identifier/hash.
 	 * @return false if file id string did not map to anything, else true.
 	 */
-	bool RemoveFile(const string& file_id);
+	bool RemoveFile(const std::string& file_id);
 
 	/**
 	 * Sets #current_file_id to a hash of a unique file handle string based on
@@ -403,20 +400,20 @@ protected:
 	static bool IsDisabled(const analyzer::Tag& tag);
 
 private:
-	typedef set<Tag> TagSet;
+	typedef std::set<Tag> TagSet;
-	typedef map<string, TagSet*> MIMEMap;
+	typedef std::map<std::string, TagSet*> MIMEMap;
 
-	TagSet* LookupMIMEType(const string& mtype, bool add_if_not_found);
+	TagSet* LookupMIMEType(const std::string& mtype, bool add_if_not_found);
 
-	std::map<string, File*> id_map;  /**< Map file ID to file_analysis::File records. */
+	std::map<std::string, File*> id_map;  /**< Map file ID to file_analysis::File records. */
-	std::set<string> ignored; /**< Ignored files.  Will be finally removed on EOF. */
+	std::set<std::string> ignored; /**< Ignored files.  Will be finally removed on EOF. */
-	string current_file_id;	/**< Hash of what get_file_handle event sets. */
+	std::string current_file_id;	/**< Hash of what get_file_handle event sets. */
 	RuleFileMagicState* magic_state;	/**< File magic signature match state. */
 	MIMEMap mime_types;/**< Mapping of MIME types to analyzers. */
 
 	static TableVal* disabled;	/**< Table of disabled analyzers. */
 	static TableType* tag_set_type;	/**< Type for set[tag]. */
-	static string salt; /**< A salt added to file handles before hashing. */
+	static std::string salt; /**< A salt added to file handles before hashing. */
 
 	size_t cumulative_files;
 	size_t max_files;

src/file_analysis/analyzer/extract/Extract.cc

@@ -10,7 +10,7 @@
 
 using namespace file_analysis;
 
-Extract::Extract(RecordVal* args, File* file, const string& arg_filename,
+Extract::Extract(RecordVal* args, File* file, const std::string& arg_filename,
                  uint64_t arg_limit)
     : file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"), args, file),
       filename(arg_filename), limit(arg_limit), depth(0)

src/file_analysis/analyzer/extract/Extract.h

@@ -66,11 +66,11 @@ protected:
 	 *        to which the contents of the file will be extracted/written.
 	 * @param arg_limit the maximum allowed file size.
 	 */
-	Extract(RecordVal* args, File* file, const string& arg_filename,
+	Extract(RecordVal* args, File* file, const std::string& arg_filename,
 	        uint64_t arg_limit);
 
 private:
-	string filename;
+	std::string filename;
 	int fd;
 	uint64_t limit;
 	uint64_t depth;

src/file_analysis/analyzer/x509/functions.bif

@@ -703,7 +703,7 @@ function sct_verify%(cert: opaque of x509, logid: string, log_key: string, signa
 	EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
 	assert(mdctx);
 
-	string errstr;
+	std::string errstr;
 	int success = 0;
 
 	const EVP_MD* hash = hash_to_evp(hash_algorithm);

src/input/Manager.cc

@@ -22,6 +22,7 @@
 #include "../threading/SerialTypes.h"
 
 using namespace input;
+using namespace std;
 using threading::Value;
 using threading::Field;
 

src/input/Manager.h

@@ -4,14 +4,14 @@
 
 #pragma once
 
+#include <map>
+
 #include "Component.h"
 #include "EventHandler.h"
 #include "plugin/ComponentManager.h"
 #include "threading/SerialTypes.h"
 #include "Tag.h"
 
-#include <map>
-
 class RecordVal;
 
 namespace input {
@@ -81,7 +81,7 @@ public:
 	 * This method corresponds directly to the internal BiF defined in
 	 * input.bif, which just forwards here.
 	 */
-	bool ForceUpdate(const string &id);
+	bool ForceUpdate(const std::string &id);
 
 	/**
 	 * Deletes an existing input stream.
@@ -91,7 +91,7 @@ public:
 	 * This method corresponds directly to the internal BiF defined in
 	 * input.bif, which just forwards here.
 	 */
-	bool RemoveStream(const string &id);
+	bool RemoveStream(const std::string &id);
 
 	/**
 	 * Signals the manager to shutdown at Bro's termination.
@@ -145,7 +145,7 @@ protected:
 	// Allows readers to directly send Bro events. The num_vals and vals
 	// must be the same the named event expects. Takes ownership of
 	// threading::Value fields.
-	bool SendEvent(ReaderFrontend* reader, const string& name, const int num_vals, threading::Value* *vals) const;
+	bool SendEvent(ReaderFrontend* reader, const std::string& name, const int num_vals, threading::Value* *vals) const;
 
 	// Instantiates a new ReaderBackend of the given type (note that
 	// doing so creates a new thread!).
@@ -205,11 +205,11 @@ private:
 	// Check if a record is made up of compatible types and return a list
 	// of all fields that are in the record in order. Recursively unrolls
 	// records
-	bool UnrollRecordType(vector<threading::Field*> *fields, const RecordType *rec, const string& nameprepend, bool allow_file_func) const;
+	bool UnrollRecordType(std::vector<threading::Field*> *fields, const RecordType *rec, const std::string& nameprepend, bool allow_file_func) const;
 
 	// Send events
 	void SendEvent(EventHandlerPtr ev, const int numvals, ...) const;
-	void SendEvent(EventHandlerPtr ev, list<Val*> events) const;
+	void SendEvent(EventHandlerPtr ev, std::list<Val*> events) const;
 
 	// Implementation of SendEndOfData (send end_of_data event).
 	void SendEndOfData(const Stream *i);
@@ -257,12 +257,12 @@ private:
 	void ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, const char* fmt, ...) const __attribute__((format(printf, 5, 6)));
 	void ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, const char* fmt, va_list ap) const __attribute__((format(printf, 5, 0)));
 
-	Stream* FindStream(const string &name) const;
+	Stream* FindStream(const std::string &name) const;
 	Stream* FindStream(ReaderFrontend* reader) const;
 
 	enum StreamType { TABLE_STREAM, EVENT_STREAM, ANALYSIS_STREAM };
 
-	map<ReaderFrontend*, Stream*> readers;
+	std::map<ReaderFrontend*, Stream*> readers;
 
 	EventHandlerPtr end_of_data;
 };
@@ -271,4 +271,3 @@ private:
 }
 
 extern input::Manager* input_mgr;
-

src/input/readers/ascii/Ascii.cc

@@ -14,6 +14,7 @@
 
 using namespace input::reader;
 using namespace threading;
+using namespace std;
 using threading::Value;
 using threading::Field;
 
@@ -468,4 +469,3 @@ bool Ascii::DoHeartbeat(double network_time, double current_time)
 
 	return true;
 	}
-

src/input/readers/ascii/Ascii.h

@@ -15,15 +15,15 @@ namespace input { namespace reader {
 
 // Description for input field mapping.
 struct FieldMapping {
-	string name;
+	std::string name;
 	TypeTag type;
 	TypeTag subtype; // internal type for sets and vectors
 	int position;
 	int secondary_position; // for ports: pos of the second field
 	bool present;
 
-	FieldMapping(const string& arg_name, const TypeTag& arg_type, int arg_position);
+	FieldMapping(const std::string& arg_name, const TypeTag& arg_type, int arg_position);
-	FieldMapping(const string& arg_name, const TypeTag& arg_type, const TypeTag& arg_subtype, int arg_position);
+	FieldMapping(const std::string& arg_name, const TypeTag& arg_type, const TypeTag& arg_subtype, int arg_position);
 	FieldMapping(const FieldMapping& arg);
 	FieldMapping() { position = -1; secondary_position = -1; }
 
@@ -54,32 +54,32 @@ protected:
 
 private:
 	bool ReadHeader(bool useCached);
-	bool GetLine(string& str);
+	bool GetLine(std::string& str);
 	bool OpenFile();
 
-	ifstream file;
+	std::ifstream file;
 	time_t mtime;
 	ino_t ino;
 
 	// The name using which we actually load the file -- compared
 	// to the input source name, this one may have a path_prefix
 	// attached to it.
-	string fname;
+	std::string fname;
 
 	// map columns in the file to columns to send back to the manager
-	vector<FieldMapping> columnMap;
+	std::vector<FieldMapping> columnMap;
 
 	// keep a copy of the headerline to determine field locations when stream descriptions change
-	string headerline;
+	std::string headerline;
 
 	// options set from the script-level.
-	string separator;
+	std::string separator;
-	string set_separator;
+	std::string set_separator;
-	string empty_field;
+	std::string empty_field;
-	string unset_field;
+	std::string unset_field;
 	bool fail_on_invalid_lines;
 	bool fail_on_file_problem;
-	string path_prefix;
+	std::string path_prefix;
 
 	std::unique_ptr<threading::formatter::Formatter> formatter;
 };

src/input/readers/benchmark/Benchmark.cc

@@ -55,9 +55,9 @@ bool Benchmark::DoInit(const ReaderInfo& info, int num_fields, const Field* cons
 	return true;
 	}
 
-string Benchmark::RandomString(const int len)
+std::string Benchmark::RandomString(const int len)
 	{
-	string s(len, ' ');
+	std::string s(len, ' ');
 
 	static const char values[] =
 	"0123456789!@#$%^&*()-_=+{}[]\\|"
@@ -135,7 +135,7 @@ threading::Value* Benchmark::EntryToVal(TypeTag type, TypeTag subtype)
 
 	case TYPE_STRING:
 		{
-		string rnd = RandomString(10);
+		std::string rnd = RandomString(10);
 		val->val.string_val.data = copy_string(rnd.c_str());
 		val->val.string_val.length = rnd.size();
 		break;

src/input/readers/benchmark/Benchmark.h

@@ -25,7 +25,7 @@ protected:
 
 private:
 	double CurrTime();
-	string RandomString(const int len);
+	std::string RandomString(const int len);
 	threading::Value* EntryToVal(TypeTag Type, TypeTag subtype);
 
 	int num_lines;