Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Update deprecated ValManager::GetCount usages

Browse source
This commit is contained in:
Jon Siwek 2020-04-07 23:27:02 -07:00
parent 0ddac4abcf
commit 93f4c5871b
89 changed files with 830 additions and 844 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/CompHash.cc
View file

@ -787,7 +787,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
switch ( tag ) { switch ( tag ) {
case TYPE_COUNT: case TYPE_COUNT:
case TYPE_COUNTER: case TYPE_COUNTER:
*pval = {AdoptRef{}, val_mgr->GetCount(*kp)}; *pval = val_mgr->Count(*kp);
break; break;
case TYPE_PORT: case TYPE_PORT:

20
src/Conn.cc
View file

@ -262,7 +262,7 @@ void Connection::HistoryThresholdEvent(EventHandlerPtr e, bool is_orig,
EnqueueEvent(e, nullptr, EnqueueEvent(e, nullptr,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)} val_mgr->Count(threshold)
); );
} }
@ -344,9 +344,9 @@ RecordVal* Connection::BuildConnVal()
id_val->Assign(3, val_mgr->GetPort(ntohs(resp_port), prot_type)); id_val->Assign(3, val_mgr->GetPort(ntohs(resp_port), prot_type));
auto orig_endp = make_intrusive<RecordVal>(endpoint); auto orig_endp = make_intrusive<RecordVal>(endpoint);
orig_endp->Assign(0, val_mgr->GetCount(0)); orig_endp->Assign(0, val_mgr->Count(0));
orig_endp->Assign(1, val_mgr->GetCount(0)); orig_endp->Assign(1, val_mgr->Count(0));
orig_endp->Assign(4, val_mgr->GetCount(orig_flow_label)); orig_endp->Assign(4, val_mgr->Count(orig_flow_label));
const int l2_len = sizeof(orig_l2_addr); const int l2_len = sizeof(orig_l2_addr);
char null[l2_len]{}; char null[l2_len]{};
@ -355,9 +355,9 @@ RecordVal* Connection::BuildConnVal()
orig_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(orig_l2_addr, l2_len))); orig_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(orig_l2_addr, l2_len)));
auto resp_endp = make_intrusive<RecordVal>(endpoint); auto resp_endp = make_intrusive<RecordVal>(endpoint);
resp_endp->Assign(0, val_mgr->GetCount(0)); resp_endp->Assign(0, val_mgr->Count(0));
resp_endp->Assign(1, val_mgr->GetCount(0)); resp_endp->Assign(1, val_mgr->Count(0));
resp_endp->Assign(4, val_mgr->GetCount(resp_flow_label)); resp_endp->Assign(4, val_mgr->Count(resp_flow_label));
if ( memcmp(&resp_l2_addr, &null, l2_len) != 0 ) if ( memcmp(&resp_l2_addr, &null, l2_len) != 0 )
resp_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(resp_l2_addr, l2_len))); resp_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(resp_l2_addr, l2_len)));
@ -690,7 +690,7 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label)
if ( conn_val ) if ( conn_val )
{ {
RecordVal *endp = conn_val->Lookup(is_orig ? 1 : 2)->AsRecordVal(); RecordVal *endp = conn_val->Lookup(is_orig ? 1 : 2)->AsRecordVal();
endp->Assign(4, val_mgr->GetCount(flow_label)); endp->Assign(4, val_mgr->Count(flow_label));
} }
if ( connection_flow_label_changed && if ( connection_flow_label_changed &&
@ -699,8 +699,8 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label)
EnqueueEvent(connection_flow_label_changed, nullptr, EnqueueEvent(connection_flow_label_changed, nullptr,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(my_flow_label)}, val_mgr->Count(my_flow_label),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flow_label)} val_mgr->Count(flow_label)
); );
} }

8
src/Expr.cc
View file

@ -682,7 +682,7 @@ IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
else if ( ret_type->InternalType() == TYPE_INTERNAL_DOUBLE ) else if ( ret_type->InternalType() == TYPE_INTERNAL_DOUBLE )
return make_intrusive<Val>(d3, ret_type->Tag()); return make_intrusive<Val>(d3, ret_type->Tag());
else if ( ret_type->InternalType() == TYPE_INTERNAL_UNSIGNED ) else if ( ret_type->InternalType() == TYPE_INTERNAL_UNSIGNED )
return {AdoptRef{}, val_mgr->GetCount(u3)}; return val_mgr->Count(u3);
else if ( ret_type->Tag() == TYPE_BOOL ) else if ( ret_type->Tag() == TYPE_BOOL )
return val_mgr->Bool(i3); return val_mgr->Bool(i3);
else else
@ -960,7 +960,7 @@ IntrusivePtr<Val> IncrExpr::DoSingleEval(Frame* f, Val* v) const
if ( ret_type->Tag() == TYPE_INT ) if ( ret_type->Tag() == TYPE_INT )
return val_mgr->Int(k); return val_mgr->Int(k);
else else
return {AdoptRef{}, val_mgr->GetCount(k)}; return val_mgr->Count(k);
} }
@ -1018,7 +1018,7 @@ ComplementExpr::ComplementExpr(IntrusivePtr<Expr> arg_op)
IntrusivePtr<Val> ComplementExpr::Fold(Val* v) const IntrusivePtr<Val> ComplementExpr::Fold(Val* v) const
{ {
return {AdoptRef{}, val_mgr->GetCount(~ v->InternalUnsigned())}; return val_mgr->Count(~ v->InternalUnsigned());
} }
NotExpr::NotExpr(IntrusivePtr<Expr> arg_op) NotExpr::NotExpr(IntrusivePtr<Expr> arg_op)
@ -3488,7 +3488,7 @@ IntrusivePtr<Val> ArithCoerceExpr::FoldSingleVal(Val* v, InternalTypeTag t) cons
return val_mgr->Int(v->CoerceToInt()); return val_mgr->Int(v->CoerceToInt());
case TYPE_INTERNAL_UNSIGNED: case TYPE_INTERNAL_UNSIGNED:
return {AdoptRef{}, val_mgr->GetCount(v->CoerceToUnsigned())}; return val_mgr->Count(v->CoerceToUnsigned());
default: default:
RuntimeErrorWithCallStack("bad type in CoerceExpr::Fold"); RuntimeErrorWithCallStack("bad type in CoerceExpr::Fold");

136
src/IP.cc
View file

@ -50,12 +50,12 @@ static VectorVal* BuildOptionsVal(const u_char* data, int len)
{ {
const struct ip6_opt* opt = (const struct ip6_opt*) data; const struct ip6_opt* opt = (const struct ip6_opt*) data;
RecordVal* rv = new RecordVal(hdrType(ip6_option_type, "ip6_option")); RecordVal* rv = new RecordVal(hdrType(ip6_option_type, "ip6_option"));
rv->Assign(0, val_mgr->GetCount(opt->ip6o_type)); rv->Assign(0, val_mgr->Count(opt->ip6o_type));
if ( opt->ip6o_type == 0 ) if ( opt->ip6o_type == 0 )
{ {
// Pad1 option // Pad1 option
rv->Assign(1, val_mgr->GetCount(0)); rv->Assign(1, val_mgr->Count(0));
rv->Assign(2, val_mgr->GetEmptyString()); rv->Assign(2, val_mgr->GetEmptyString());
data += sizeof(uint8_t); data += sizeof(uint8_t);
len -= sizeof(uint8_t); len -= sizeof(uint8_t);
@ -64,7 +64,7 @@ static VectorVal* BuildOptionsVal(const u_char* data, int len)
{ {
// PadN or other option // PadN or other option
uint16_t off = 2 * sizeof(uint8_t); uint16_t off = 2 * sizeof(uint8_t);
rv->Assign(1, val_mgr->GetCount(opt->ip6o_len)); rv->Assign(1, val_mgr->Count(opt->ip6o_len));
rv->Assign(2, make_intrusive<StringVal>( rv->Assign(2, make_intrusive<StringVal>(
new BroString(data + off, opt->ip6o_len, true))); new BroString(data + off, opt->ip6o_len, true)));
data += opt->ip6o_len + off; data += opt->ip6o_len + off;
@ -86,11 +86,11 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
{ {
rv = new RecordVal(hdrType(ip6_hdr_type, "ip6_hdr")); rv = new RecordVal(hdrType(ip6_hdr_type, "ip6_hdr"));
const struct ip6_hdr* ip6 = (const struct ip6_hdr*)data; const struct ip6_hdr* ip6 = (const struct ip6_hdr*)data;
rv->Assign(0, val_mgr->GetCount((ntohl(ip6->ip6_flow) & 0x0ff00000)>>20)); rv->Assign(0, val_mgr->Count((ntohl(ip6->ip6_flow) & 0x0ff00000)>>20));
rv->Assign(1, val_mgr->GetCount(ntohl(ip6->ip6_flow) & 0x000fffff)); rv->Assign(1, val_mgr->Count(ntohl(ip6->ip6_flow) & 0x000fffff));
rv->Assign(2, val_mgr->GetCount(ntohs(ip6->ip6_plen))); rv->Assign(2, val_mgr->Count(ntohs(ip6->ip6_plen)));
rv->Assign(3, val_mgr->GetCount(ip6->ip6_nxt)); rv->Assign(3, val_mgr->Count(ip6->ip6_nxt));
rv->Assign(4, val_mgr->GetCount(ip6->ip6_hlim)); rv->Assign(4, val_mgr->Count(ip6->ip6_hlim));
rv->Assign(5, make_intrusive<AddrVal>(IPAddr(ip6->ip6_src))); rv->Assign(5, make_intrusive<AddrVal>(IPAddr(ip6->ip6_src)));
rv->Assign(6, make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst))); rv->Assign(6, make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst)));
if ( ! chain ) if ( ! chain )
@ -104,8 +104,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
{ {
rv = new RecordVal(hdrType(ip6_hopopts_type, "ip6_hopopts")); rv = new RecordVal(hdrType(ip6_hopopts_type, "ip6_hopopts"));
const struct ip6_hbh* hbh = (const struct ip6_hbh*)data; const struct ip6_hbh* hbh = (const struct ip6_hbh*)data;
rv->Assign(0, val_mgr->GetCount(hbh->ip6h_nxt)); rv->Assign(0, val_mgr->Count(hbh->ip6h_nxt));
rv->Assign(1, val_mgr->GetCount(hbh->ip6h_len)); rv->Assign(1, val_mgr->Count(hbh->ip6h_len));
uint16_t off = 2 * sizeof(uint8_t); uint16_t off = 2 * sizeof(uint8_t);
rv->Assign(2, BuildOptionsVal(data + off, Length() - off)); rv->Assign(2, BuildOptionsVal(data + off, Length() - off));
@ -116,8 +116,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
{ {
rv = new RecordVal(hdrType(ip6_dstopts_type, "ip6_dstopts")); rv = new RecordVal(hdrType(ip6_dstopts_type, "ip6_dstopts"));
const struct ip6_dest* dst = (const struct ip6_dest*)data; const struct ip6_dest* dst = (const struct ip6_dest*)data;
rv->Assign(0, val_mgr->GetCount(dst->ip6d_nxt)); rv->Assign(0, val_mgr->Count(dst->ip6d_nxt));
rv->Assign(1, val_mgr->GetCount(dst->ip6d_len)); rv->Assign(1, val_mgr->Count(dst->ip6d_len));
uint16_t off = 2 * sizeof(uint8_t); uint16_t off = 2 * sizeof(uint8_t);
rv->Assign(2, BuildOptionsVal(data + off, Length() - off)); rv->Assign(2, BuildOptionsVal(data + off, Length() - off));
} }
@ -127,10 +127,10 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
{ {
rv = new RecordVal(hdrType(ip6_routing_type, "ip6_routing")); rv = new RecordVal(hdrType(ip6_routing_type, "ip6_routing"));
const struct ip6_rthdr* rt = (const struct ip6_rthdr*)data; const struct ip6_rthdr* rt = (const struct ip6_rthdr*)data;
rv->Assign(0, val_mgr->GetCount(rt->ip6r_nxt)); rv->Assign(0, val_mgr->Count(rt->ip6r_nxt));
rv->Assign(1, val_mgr->GetCount(rt->ip6r_len)); rv->Assign(1, val_mgr->Count(rt->ip6r_len));
rv->Assign(2, val_mgr->GetCount(rt->ip6r_type)); rv->Assign(2, val_mgr->Count(rt->ip6r_type));
rv->Assign(3, val_mgr->GetCount(rt->ip6r_segleft)); rv->Assign(3, val_mgr->Count(rt->ip6r_segleft));
uint16_t off = 4 * sizeof(uint8_t); uint16_t off = 4 * sizeof(uint8_t);
rv->Assign(4, make_intrusive<StringVal>(new BroString(data + off, Length() - off, true))); rv->Assign(4, make_intrusive<StringVal>(new BroString(data + off, Length() - off, true)));
} }
@ -140,28 +140,28 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
{ {
rv = new RecordVal(hdrType(ip6_fragment_type, "ip6_fragment")); rv = new RecordVal(hdrType(ip6_fragment_type, "ip6_fragment"));
const struct ip6_frag* frag = (const struct ip6_frag*)data; const struct ip6_frag* frag = (const struct ip6_frag*)data;
rv->Assign(0, val_mgr->GetCount(frag->ip6f_nxt)); rv->Assign(0, val_mgr->Count(frag->ip6f_nxt));
rv->Assign(1, val_mgr->GetCount(frag->ip6f_reserved)); rv->Assign(1, val_mgr->Count(frag->ip6f_reserved));
rv->Assign(2, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0xfff8)>>3)); rv->Assign(2, val_mgr->Count((ntohs(frag->ip6f_offlg) & 0xfff8)>>3));
rv->Assign(3, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0x0006)>>1)); rv->Assign(3, val_mgr->Count((ntohs(frag->ip6f_offlg) & 0x0006)>>1));
rv->Assign(4, val_mgr->Bool(ntohs(frag->ip6f_offlg) & 0x0001)); rv->Assign(4, val_mgr->Bool(ntohs(frag->ip6f_offlg) & 0x0001));
rv->Assign(5, val_mgr->GetCount(ntohl(frag->ip6f_ident))); rv->Assign(5, val_mgr->Count(ntohl(frag->ip6f_ident)));
} }
break; break;
case IPPROTO_AH: case IPPROTO_AH:
{ {
rv = new RecordVal(hdrType(ip6_ah_type, "ip6_ah")); rv = new RecordVal(hdrType(ip6_ah_type, "ip6_ah"));
rv->Assign(0, val_mgr->GetCount(((ip6_ext*)data)->ip6e_nxt)); rv->Assign(0, val_mgr->Count(((ip6_ext*)data)->ip6e_nxt));
rv->Assign(1, val_mgr->GetCount(((ip6_ext*)data)->ip6e_len)); rv->Assign(1, val_mgr->Count(((ip6_ext*)data)->ip6e_len));
rv->Assign(2, val_mgr->GetCount(ntohs(((uint16_t*)data)[1]))); rv->Assign(2, val_mgr->Count(ntohs(((uint16_t*)data)[1])));
rv->Assign(3, val_mgr->GetCount(ntohl(((uint32_t*)data)[1]))); rv->Assign(3, val_mgr->Count(ntohl(((uint32_t*)data)[1])));
if ( Length() >= 12 ) if ( Length() >= 12 )
{ {
// Sequence Number and ICV fields can only be extracted if // Sequence Number and ICV fields can only be extracted if
// Payload Len was non-zero for this header. // Payload Len was non-zero for this header.
rv->Assign(4, val_mgr->GetCount(ntohl(((uint32_t*)data)[2]))); rv->Assign(4, val_mgr->Count(ntohl(((uint32_t*)data)[2])));
uint16_t off = 3 * sizeof(uint32_t); uint16_t off = 3 * sizeof(uint32_t);
rv->Assign(5, make_intrusive<StringVal>(new BroString(data + off, Length() - off, true))); rv->Assign(5, make_intrusive<StringVal>(new BroString(data + off, Length() - off, true)));
} }
@ -172,8 +172,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
{ {
rv = new RecordVal(hdrType(ip6_esp_type, "ip6_esp")); rv = new RecordVal(hdrType(ip6_esp_type, "ip6_esp"));
const uint32_t* esp = (const uint32_t*)data; const uint32_t* esp = (const uint32_t*)data;
rv->Assign(0, val_mgr->GetCount(ntohl(esp[0]))); rv->Assign(0, val_mgr->Count(ntohl(esp[0])));
rv->Assign(1, val_mgr->GetCount(ntohl(esp[1]))); rv->Assign(1, val_mgr->Count(ntohl(esp[1])));
} }
break; break;
@ -182,14 +182,14 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
{ {
rv = new RecordVal(hdrType(ip6_mob_type, "ip6_mobility_hdr")); rv = new RecordVal(hdrType(ip6_mob_type, "ip6_mobility_hdr"));
const struct ip6_mobility* mob = (const struct ip6_mobility*) data; const struct ip6_mobility* mob = (const struct ip6_mobility*) data;
rv->Assign(0, val_mgr->GetCount(mob->ip6mob_payload)); rv->Assign(0, val_mgr->Count(mob->ip6mob_payload));
rv->Assign(1, val_mgr->GetCount(mob->ip6mob_len)); rv->Assign(1, val_mgr->Count(mob->ip6mob_len));
rv->Assign(2, val_mgr->GetCount(mob->ip6mob_type)); rv->Assign(2, val_mgr->Count(mob->ip6mob_type));
rv->Assign(3, val_mgr->GetCount(mob->ip6mob_rsv)); rv->Assign(3, val_mgr->Count(mob->ip6mob_rsv));
rv->Assign(4, val_mgr->GetCount(ntohs(mob->ip6mob_chksum))); rv->Assign(4, val_mgr->Count(ntohs(mob->ip6mob_chksum)));
RecordVal* msg = new RecordVal(hdrType(ip6_mob_msg_type, "ip6_mobility_msg")); RecordVal* msg = new RecordVal(hdrType(ip6_mob_msg_type, "ip6_mobility_msg"));
msg->Assign(0, val_mgr->GetCount(mob->ip6mob_type)); msg->Assign(0, val_mgr->Count(mob->ip6mob_type));
uint16_t off = sizeof(ip6_mobility); uint16_t off = sizeof(ip6_mobility);
const u_char* msg_data = data + off; const u_char* msg_data = data + off;
@ -198,7 +198,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 0: case 0:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_brr")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_brr"));
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data)))); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
off += sizeof(uint16_t); off += sizeof(uint16_t);
m->Assign(1, BuildOptionsVal(data + off, Length() - off)); m->Assign(1, BuildOptionsVal(data + off, Length() - off));
msg->Assign(1, m); msg->Assign(1, m);
@ -208,8 +208,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 1: case 1:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_hoti")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_hoti"));
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data)))); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
m->Assign(1, val_mgr->GetCount(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
off += sizeof(uint16_t) + sizeof(uint64_t); off += sizeof(uint16_t) + sizeof(uint64_t);
m->Assign(2, BuildOptionsVal(data + off, Length() - off)); m->Assign(2, BuildOptionsVal(data + off, Length() - off));
msg->Assign(2, m); msg->Assign(2, m);
@ -219,8 +219,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 2: case 2:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_coti")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_coti"));
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data)))); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
m->Assign(1, val_mgr->GetCount(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
off += sizeof(uint16_t) + sizeof(uint64_t); off += sizeof(uint16_t) + sizeof(uint64_t);
m->Assign(2, BuildOptionsVal(data + off, Length() - off)); m->Assign(2, BuildOptionsVal(data + off, Length() - off));
msg->Assign(3, m); msg->Assign(3, m);
@ -230,9 +230,9 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 3: case 3:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_hot")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_hot"));
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data)))); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
m->Assign(1, val_mgr->GetCount(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
m->Assign(2, val_mgr->GetCount(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t)))))); m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))));
off += sizeof(uint16_t) + 2 * sizeof(uint64_t); off += sizeof(uint16_t) + 2 * sizeof(uint64_t);
m->Assign(3, BuildOptionsVal(data + off, Length() - off)); m->Assign(3, BuildOptionsVal(data + off, Length() - off));
msg->Assign(4, m); msg->Assign(4, m);
@ -242,9 +242,9 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 4: case 4:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_cot")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_cot"));
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data)))); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
m->Assign(1, val_mgr->GetCount(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
m->Assign(2, val_mgr->GetCount(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t)))))); m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))));
off += sizeof(uint16_t) + 2 * sizeof(uint64_t); off += sizeof(uint16_t) + 2 * sizeof(uint64_t);
m->Assign(3, BuildOptionsVal(data + off, Length() - off)); m->Assign(3, BuildOptionsVal(data + off, Length() - off));
msg->Assign(5, m); msg->Assign(5, m);
@ -254,12 +254,12 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 5: case 5:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_bu")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_bu"));
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data)))); m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000)); m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000));
m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000)); m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000));
m->Assign(3, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000)); m->Assign(3, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000));
m->Assign(4, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000)); m->Assign(4, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000));
m->Assign(5, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t)))))); m->Assign(5, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
off += 3 * sizeof(uint16_t); off += 3 * sizeof(uint16_t);
m->Assign(6, BuildOptionsVal(data + off, Length() - off)); m->Assign(6, BuildOptionsVal(data + off, Length() - off));
msg->Assign(6, m); msg->Assign(6, m);
@ -269,10 +269,10 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 6: case 6:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_back")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_back"));
m->Assign(0, val_mgr->GetCount(*((uint8_t*)msg_data))); m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data)));
m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80)); m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80));
m->Assign(2, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(2, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t))))));
m->Assign(3, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t)))))); m->Assign(3, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
off += 3 * sizeof(uint16_t); off += 3 * sizeof(uint16_t);
m->Assign(4, BuildOptionsVal(data + off, Length() - off)); m->Assign(4, BuildOptionsVal(data + off, Length() - off));
msg->Assign(7, m); msg->Assign(7, m);
@ -282,7 +282,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
case 7: case 7:
{ {
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_be")); RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_be"));
m->Assign(0, val_mgr->GetCount(*((uint8_t*)msg_data))); m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data)));
const in6_addr* hoa = (const in6_addr*)(msg_data + sizeof(uint16_t)); const in6_addr* hoa = (const in6_addr*)(msg_data + sizeof(uint16_t));
m->Assign(1, make_intrusive<AddrVal>(IPAddr(*hoa))); m->Assign(1, make_intrusive<AddrVal>(IPAddr(*hoa)));
off += sizeof(uint16_t) + sizeof(in6_addr); off += sizeof(uint16_t) + sizeof(in6_addr);
@ -335,12 +335,12 @@ RecordVal* IP_Hdr::BuildIPHdrVal() const
if ( ip4 ) if ( ip4 )
{ {
rval = new RecordVal(hdrType(ip4_hdr_type, "ip4_hdr")); rval = new RecordVal(hdrType(ip4_hdr_type, "ip4_hdr"));
rval->Assign(0, val_mgr->GetCount(ip4->ip_hl * 4)); rval->Assign(0, val_mgr->Count(ip4->ip_hl * 4));
rval->Assign(1, val_mgr->GetCount(ip4->ip_tos)); rval->Assign(1, val_mgr->Count(ip4->ip_tos));
rval->Assign(2, val_mgr->GetCount(ntohs(ip4->ip_len))); rval->Assign(2, val_mgr->Count(ntohs(ip4->ip_len)));
rval->Assign(3, val_mgr->GetCount(ntohs(ip4->ip_id))); rval->Assign(3, val_mgr->Count(ntohs(ip4->ip_id)));
rval->Assign(4, val_mgr->GetCount(ip4->ip_ttl)); rval->Assign(4, val_mgr->Count(ip4->ip_ttl));
rval->Assign(5, val_mgr->GetCount(ip4->ip_p)); rval->Assign(5, val_mgr->Count(ip4->ip_p));
rval->Assign(6, make_intrusive<AddrVal>(ip4->ip_src.s_addr)); rval->Assign(6, make_intrusive<AddrVal>(ip4->ip_src.s_addr));
rval->Assign(7, make_intrusive<AddrVal>(ip4->ip_dst.s_addr)); rval->Assign(7, make_intrusive<AddrVal>(ip4->ip_dst.s_addr));
} }
@ -396,13 +396,13 @@ RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
tcp_hdr->Assign(0, val_mgr->GetPort(ntohs(tp->th_sport), TRANSPORT_TCP)); tcp_hdr->Assign(0, val_mgr->GetPort(ntohs(tp->th_sport), TRANSPORT_TCP));
tcp_hdr->Assign(1, val_mgr->GetPort(ntohs(tp->th_dport), TRANSPORT_TCP)); tcp_hdr->Assign(1, val_mgr->GetPort(ntohs(tp->th_dport), TRANSPORT_TCP));
tcp_hdr->Assign(2, val_mgr->GetCount(uint32_t(ntohl(tp->th_seq)))); tcp_hdr->Assign(2, val_mgr->Count(uint32_t(ntohl(tp->th_seq))));
tcp_hdr->Assign(3, val_mgr->GetCount(uint32_t(ntohl(tp->th_ack)))); tcp_hdr->Assign(3, val_mgr->Count(uint32_t(ntohl(tp->th_ack))));
tcp_hdr->Assign(4, val_mgr->GetCount(tcp_hdr_len)); tcp_hdr->Assign(4, val_mgr->Count(tcp_hdr_len));
tcp_hdr->Assign(5, val_mgr->GetCount(data_len)); tcp_hdr->Assign(5, val_mgr->Count(data_len));
tcp_hdr->Assign(6, val_mgr->GetCount(tp->th_x2)); tcp_hdr->Assign(6, val_mgr->Count(tp->th_x2));
tcp_hdr->Assign(7, val_mgr->GetCount(tp->th_flags)); tcp_hdr->Assign(7, val_mgr->Count(tp->th_flags));
tcp_hdr->Assign(8, val_mgr->GetCount(ntohs(tp->th_win))); tcp_hdr->Assign(8, val_mgr->Count(ntohs(tp->th_win)));
pkt_hdr->Assign(sindex + 2, tcp_hdr); pkt_hdr->Assign(sindex + 2, tcp_hdr);
break; break;
@ -415,7 +415,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
udp_hdr->Assign(0, val_mgr->GetPort(ntohs(up->uh_sport), TRANSPORT_UDP)); udp_hdr->Assign(0, val_mgr->GetPort(ntohs(up->uh_sport), TRANSPORT_UDP));
udp_hdr->Assign(1, val_mgr->GetPort(ntohs(up->uh_dport), TRANSPORT_UDP)); udp_hdr->Assign(1, val_mgr->GetPort(ntohs(up->uh_dport), TRANSPORT_UDP));
udp_hdr->Assign(2, val_mgr->GetCount(ntohs(up->uh_ulen))); udp_hdr->Assign(2, val_mgr->Count(ntohs(up->uh_ulen)));
pkt_hdr->Assign(sindex + 3, udp_hdr); pkt_hdr->Assign(sindex + 3, udp_hdr);
break; break;
@ -426,7 +426,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
const struct icmp* icmpp = (const struct icmp *) data; const struct icmp* icmpp = (const struct icmp *) data;
RecordVal* icmp_hdr = new RecordVal(icmp_hdr_type); RecordVal* icmp_hdr = new RecordVal(icmp_hdr_type);
icmp_hdr->Assign(0, val_mgr->GetCount(icmpp->icmp_type)); icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp_type));
pkt_hdr->Assign(sindex + 4, icmp_hdr); pkt_hdr->Assign(sindex + 4, icmp_hdr);
break; break;
@ -437,7 +437,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
const struct icmp6_hdr* icmpp = (const struct icmp6_hdr*) data; const struct icmp6_hdr* icmpp = (const struct icmp6_hdr*) data;
RecordVal* icmp_hdr = new RecordVal(icmp_hdr_type); RecordVal* icmp_hdr = new RecordVal(icmp_hdr_type);
icmp_hdr->Assign(0, val_mgr->GetCount(icmpp->icmp6_type)); icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp6_type));
pkt_hdr->Assign(sindex + 4, icmp_hdr); pkt_hdr->Assign(sindex + 4, icmp_hdr);
break; break;
@ -696,7 +696,7 @@ VectorVal* IPv6_Hdr_Chain::BuildVal() const
RecordVal* v = chain[i]->BuildRecordVal(); RecordVal* v = chain[i]->BuildRecordVal();
RecordVal* ext_hdr = new RecordVal(ip6_ext_hdr_type); RecordVal* ext_hdr = new RecordVal(ip6_ext_hdr_type);
uint8_t type = chain[i]->Type(); uint8_t type = chain[i]->Type();
ext_hdr->Assign(0, val_mgr->GetCount(type)); ext_hdr->Assign(0, val_mgr->Count(type));
switch (type) { switch (type) {
case IPPROTO_HOPOPTS: case IPPROTO_HOPOPTS:

2
src/RuleMatcher.cc
View file

@ -83,7 +83,7 @@ Val* RuleMatcher::BuildRuleStateValue(const Rule* rule,
val->Assign(0, make_intrusive<StringVal>(rule->ID())); val->Assign(0, make_intrusive<StringVal>(rule->ID()));
val->Assign(1, state->GetAnalyzer()->BuildConnVal()); val->Assign(1, state->GetAnalyzer()->BuildConnVal());
val->Assign(2, val_mgr->Bool(state->is_orig)); val->Assign(2, val_mgr->Bool(state->is_orig));
val->Assign(3, val_mgr->GetCount(state->payload_size)); val->Assign(3, val_mgr->Count(state->payload_size));
return val; return val;
} }

2
src/SmithWaterman.cc
View file

@ -95,7 +95,7 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec)
auto align_val = make_intrusive<RecordVal>(sw_align_type); auto align_val = make_intrusive<RecordVal>(sw_align_type);
align_val->Assign(0, make_intrusive<StringVal>(new BroString(*align.string))); align_val->Assign(0, make_intrusive<StringVal>(new BroString(*align.string)));
align_val->Assign(1, val_mgr->GetCount(align.index)); align_val->Assign(1, val_mgr->Count(align.index));
aligns->Assign(j + 1, std::move(align_val)); aligns->Assign(j + 1, std::move(align_val));
} }

3
src/Stmt.cc
View file

@ -1232,8 +1232,7 @@ IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
// Set the loop variable to the current index, and make // Set the loop variable to the current index, and make
// another pass over the loop body. // another pass over the loop body.
f->SetElement((*loop_vars)[0], f->SetElement((*loop_vars)[0], val_mgr->Count(i).release());
val_mgr->GetCount(i));
flow = FLOW_NEXT; flow = FLOW_NEXT;
ret = body->Exec(f, flow); ret = body->Exec(f, flow);

26
src/Val.cc
View file

@ -250,19 +250,19 @@ IntrusivePtr<Val> Val::SizeVal() const
// Return abs value. However abs() only works on ints and llabs // Return abs value. However abs() only works on ints and llabs
// doesn't work on Mac OS X 10.5. So we do it by hand // doesn't work on Mac OS X 10.5. So we do it by hand
if ( val.int_val < 0 ) if ( val.int_val < 0 )
return {AdoptRef{}, val_mgr->GetCount(-val.int_val)}; return val_mgr->Count(-val.int_val);
else else
return {AdoptRef{}, val_mgr->GetCount(val.int_val)}; return val_mgr->Count(val.int_val);
case TYPE_INTERNAL_UNSIGNED: case TYPE_INTERNAL_UNSIGNED:
return {AdoptRef{}, val_mgr->GetCount(val.uint_val)}; return val_mgr->Count(val.uint_val);
case TYPE_INTERNAL_DOUBLE: case TYPE_INTERNAL_DOUBLE:
return make_intrusive<Val>(fabs(val.double_val), TYPE_DOUBLE); return make_intrusive<Val>(fabs(val.double_val), TYPE_DOUBLE);
case TYPE_INTERNAL_OTHER: case TYPE_INTERNAL_OTHER:
if ( type->Tag() == TYPE_FUNC ) if ( type->Tag() == TYPE_FUNC )
return {AdoptRef{}, val_mgr->GetCount(val.func_val->FType()->ArgTypes()->Types()->length())}; return val_mgr->Count(val.func_val->FType()->ArgTypes()->Types()->length());
if ( type->Tag() == TYPE_FILE ) if ( type->Tag() == TYPE_FILE )
return make_intrusive<Val>(val.file_val->Size(), TYPE_DOUBLE); return make_intrusive<Val>(val.file_val->Size(), TYPE_DOUBLE);
@ -272,7 +272,7 @@ IntrusivePtr<Val> Val::SizeVal() const
break; break;
} }
return {AdoptRef{}, val_mgr->GetCount(0)}; return val_mgr->Count(0);
} }
unsigned int Val::MemoryAllocation() const unsigned int Val::MemoryAllocation() const
@ -851,9 +851,9 @@ unsigned int AddrVal::MemoryAllocation() const
IntrusivePtr<Val> AddrVal::SizeVal() const IntrusivePtr<Val> AddrVal::SizeVal() const
{ {
if ( val.addr_val->GetFamily() == IPv4 ) if ( val.addr_val->GetFamily() == IPv4 )
return {AdoptRef{}, val_mgr->GetCount(32)}; return val_mgr->Count(32);
else else
return {AdoptRef{}, val_mgr->GetCount(128)}; return val_mgr->Count(128);
} }
IntrusivePtr<Val> AddrVal::DoClone(CloneState* state) IntrusivePtr<Val> AddrVal::DoClone(CloneState* state)
@ -979,7 +979,7 @@ StringVal::StringVal(const string& s) : StringVal(s.length(), s.data())
IntrusivePtr<Val> StringVal::SizeVal() const IntrusivePtr<Val> StringVal::SizeVal() const
{ {
return {AdoptRef{}, val_mgr->GetCount(val.string_val->Len())}; return val_mgr->Count(val.string_val->Len());
} }
int StringVal::Len() int StringVal::Len()
@ -1193,7 +1193,7 @@ ListVal::~ListVal()
IntrusivePtr<Val> ListVal::SizeVal() const IntrusivePtr<Val> ListVal::SizeVal() const
{ {
return {AdoptRef{}, val_mgr->GetCount(vals.length())}; return val_mgr->Count(vals.length());
} }
RE_Matcher* ListVal::BuildRE() const RE_Matcher* ListVal::BuildRE() const
@ -1564,7 +1564,7 @@ bool TableVal::Assign(Val* index, HashKey* k, Val* new_val)
IntrusivePtr<Val> TableVal::SizeVal() const IntrusivePtr<Val> TableVal::SizeVal() const
{ {
return {AdoptRef{}, val_mgr->GetCount(Size())}; return val_mgr->Count(Size());
} }
bool TableVal::AddTo(Val* val, bool is_first_init) const bool TableVal::AddTo(Val* val, bool is_first_init) const
@ -2683,7 +2683,7 @@ RecordVal::~RecordVal()
IntrusivePtr<Val> RecordVal::SizeVal() const IntrusivePtr<Val> RecordVal::SizeVal() const
{ {
return {AdoptRef{}, val_mgr->GetCount(Type()->AsRecordType()->NumFields())}; return val_mgr->Count(Type()->AsRecordType()->NumFields());
} }
void RecordVal::Assign(int field, IntrusivePtr<Val> new_val) void RecordVal::Assign(int field, IntrusivePtr<Val> new_val)
@ -2968,7 +2968,7 @@ VectorVal::~VectorVal()
IntrusivePtr<Val> VectorVal::SizeVal() const IntrusivePtr<Val> VectorVal::SizeVal() const
{ {
return {AdoptRef{}, val_mgr->GetCount(uint32_t(val.vector_val->size()))}; return val_mgr->Count(uint32_t(val.vector_val->size()));
} }
bool VectorVal::Assign(unsigned int index, IntrusivePtr<Val> element) bool VectorVal::Assign(unsigned int index, IntrusivePtr<Val> element)
@ -3221,7 +3221,7 @@ IntrusivePtr<Val> check_and_promote(IntrusivePtr<Val> v, const BroType* t,
return nullptr; return nullptr;
} }
else if ( t_tag == TYPE_COUNT || t_tag == TYPE_COUNTER ) else if ( t_tag == TYPE_COUNT || t_tag == TYPE_COUNTER )
promoted_v = {AdoptRef{}, val_mgr->GetCount(v->CoerceToUnsigned())}; promoted_v = val_mgr->Count(v->CoerceToUnsigned());
else // port else // port
{ {
reporter->InternalError("bad internal type in check_and_promote()"); reporter->InternalError("bad internal type in check_and_promote()");

4
src/analyzer/Analyzer.cc
View file

@ -692,7 +692,7 @@ void Analyzer::ProtocolConfirmation(Tag arg_tag)
mgr.Enqueue(protocol_confirmation, mgr.Enqueue(protocol_confirmation,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{NewRef{}, tval}, IntrusivePtr{NewRef{}, tval},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(id)} val_mgr->Count(id)
); );
} }
@ -719,7 +719,7 @@ void Analyzer::ProtocolViolation(const char* reason, const char* data, int len)
mgr.Enqueue(protocol_violation, mgr.Enqueue(protocol_violation,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{NewRef{}, tval}, IntrusivePtr{NewRef{}, tval},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(id)}, val_mgr->Count(id),
IntrusivePtr{AdoptRef{}, r} IntrusivePtr{AdoptRef{}, r}
); );
} }

4
src/analyzer/protocol/asn1/asn1.pac
View file

@ -118,10 +118,10 @@ Val* asn1_integer_to_val(const ASN1Encoding* i, TypeTag t)
return val_mgr->Int(v).release(); return val_mgr->Int(v).release();
case TYPE_COUNT: case TYPE_COUNT:
case TYPE_COUNTER: case TYPE_COUNTER:
return val_mgr->GetCount(v); return val_mgr->Count(v).release();
default: default:
reporter->Error("bad asn1_integer_to_val tag: %s", type_name(t)); reporter->Error("bad asn1_integer_to_val tag: %s", type_name(t));
return val_mgr->GetCount(v); return val_mgr->Count(v).release();
} }
} }

4
src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
View file

@ -403,7 +403,7 @@ bool BitTorrentTracker_Analyzer::ParseResponse(char* line)
if ( bt_tracker_response_not_ok ) if ( bt_tracker_response_not_ok )
EnqueueConnEvent(bt_tracker_response_not_ok, EnqueueConnEvent(bt_tracker_response_not_ok,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(res_status)}, val_mgr->Count(res_status),
IntrusivePtr{AdoptRef{}, res_val_headers} IntrusivePtr{AdoptRef{}, res_val_headers}
); );
res_val_headers = nullptr; res_val_headers = nullptr;
@ -790,7 +790,7 @@ void BitTorrentTracker_Analyzer::EmitResponse(void)
if ( bt_tracker_response ) if ( bt_tracker_response )
EnqueueConnEvent(bt_tracker_response, EnqueueConnEvent(bt_tracker_response,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(res_status)}, val_mgr->Count(res_status),
IntrusivePtr{AdoptRef{}, res_val_headers}, IntrusivePtr{AdoptRef{}, res_val_headers},
IntrusivePtr{AdoptRef{}, res_val_peers}, IntrusivePtr{AdoptRef{}, res_val_peers},
IntrusivePtr{AdoptRef{}, res_val_benc} IntrusivePtr{AdoptRef{}, res_val_benc}

10
src/analyzer/protocol/conn-size/ConnSize.cc
View file

@ -52,7 +52,7 @@ void ConnSize_Analyzer::ThresholdEvent(EventHandlerPtr f, uint64_t threshold, bo
EnqueueConnEvent(f, EnqueueConnEvent(f,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)}, val_mgr->Count(threshold),
val_mgr->Bool(is_orig) val_mgr->Bool(is_orig)
); );
} }
@ -183,10 +183,10 @@ void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val)
if ( bytesidx < 0 ) if ( bytesidx < 0 )
reporter->InternalError("'endpoint' record missing 'num_bytes_ip' field"); reporter->InternalError("'endpoint' record missing 'num_bytes_ip' field");
orig_endp->Assign(pktidx, val_mgr->GetCount(orig_pkts)); orig_endp->Assign(pktidx, val_mgr->Count(orig_pkts));
orig_endp->Assign(bytesidx, val_mgr->GetCount(orig_bytes)); orig_endp->Assign(bytesidx, val_mgr->Count(orig_bytes));
resp_endp->Assign(pktidx, val_mgr->GetCount(resp_pkts)); resp_endp->Assign(pktidx, val_mgr->Count(resp_pkts));
resp_endp->Assign(bytesidx, val_mgr->GetCount(resp_bytes)); resp_endp->Assign(bytesidx, val_mgr->Count(resp_bytes));
Analyzer::UpdateConnVal(conn_val); Analyzer::UpdateConnVal(conn_val);
} }

8
src/analyzer/protocol/conn-size/functions.bif
View file

@ -103,9 +103,9 @@ function get_current_conn_bytes_threshold%(cid: conn_id, is_orig: bool%): count
%{ %{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid); analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a ) if ( ! a )
return val_mgr->GetCount(0); return val_mgr->Count(0);
return val_mgr->GetCount(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetByteAndPacketThreshold(true, is_orig)); return val_mgr->Count(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetByteAndPacketThreshold(true, is_orig));
%} %}
## Gets the current packet threshold size for a connection. ## Gets the current packet threshold size for a connection.
@ -122,9 +122,9 @@ function get_current_conn_packets_threshold%(cid: conn_id, is_orig: bool%): coun
%{ %{
analyzer::Analyzer* a = GetConnsizeAnalyzer(cid); analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
if ( ! a ) if ( ! a )
return val_mgr->GetCount(0); return val_mgr->Count(0);
return val_mgr->GetCount(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetByteAndPacketThreshold(false, is_orig)); return val_mgr->Count(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetByteAndPacketThreshold(false, is_orig));
%} %}
## Gets the current duration threshold size for a connection. ## Gets the current duration threshold size for a connection.

11
src/analyzer/protocol/dhcp/dhcp-analyzer.pac
View file

@ -35,8 +35,7 @@ refine flow DHCP_Flow += {
init_options(); init_options();
if ( code != 255 ) if ( code != 255 )
all_options->Assign(all_options->Size(), all_options->Assign(all_options->Size(), val_mgr->Count(code));
val_mgr->GetCount(code));
return true; return true;
%} %}
@ -58,11 +57,11 @@ refine flow DHCP_Flow += {
double secs = static_cast<double>(${msg.secs}); double secs = static_cast<double>(${msg.secs});
auto dhcp_msg_val = new RecordVal(BifType::Record::DHCP::Msg); auto dhcp_msg_val = new RecordVal(BifType::Record::DHCP::Msg);
dhcp_msg_val->Assign(0, val_mgr->GetCount(${msg.op})); dhcp_msg_val->Assign(0, val_mgr->Count(${msg.op}));
dhcp_msg_val->Assign(1, val_mgr->GetCount(${msg.type})); dhcp_msg_val->Assign(1, val_mgr->Count(${msg.type}));
dhcp_msg_val->Assign(2, val_mgr->GetCount(${msg.xid})); dhcp_msg_val->Assign(2, val_mgr->Count(${msg.xid}));
dhcp_msg_val->Assign(3, make_intrusive<Val>(secs, TYPE_INTERVAL)); dhcp_msg_val->Assign(3, make_intrusive<Val>(secs, TYPE_INTERVAL));
dhcp_msg_val->Assign(4, val_mgr->GetCount(${msg.flags})); dhcp_msg_val->Assign(4, val_mgr->Count(${msg.flags}));
dhcp_msg_val->Assign(5, make_intrusive<AddrVal>(htonl(${msg.ciaddr}))); dhcp_msg_val->Assign(5, make_intrusive<AddrVal>(htonl(${msg.ciaddr})));
dhcp_msg_val->Assign(6, make_intrusive<AddrVal>(htonl(${msg.yiaddr}))); dhcp_msg_val->Assign(6, make_intrusive<AddrVal>(htonl(${msg.yiaddr})));
dhcp_msg_val->Assign(7, make_intrusive<AddrVal>(htonl(${msg.siaddr}))); dhcp_msg_val->Assign(7, make_intrusive<AddrVal>(htonl(${msg.siaddr})));

14
src/analyzer/protocol/dhcp/dhcp-options.pac
View file

@ -469,7 +469,7 @@ refine flow DHCP_Flow += {
for ( int i = 0; i < num_parms; ++i ) for ( int i = 0; i < num_parms; ++i )
{ {
uint8 param = (*plist)[i]; uint8 param = (*plist)[i];
params->Assign(i, val_mgr->GetCount(param)); params->Assign(i, val_mgr->Count(param));
} }
${context.flow}->options->Assign(13, params); ${context.flow}->options->Assign(13, params);
@ -521,7 +521,7 @@ refine casetype OptionValue += {
refine flow DHCP_Flow += { refine flow DHCP_Flow += {
function process_max_message_size_option(v: OptionValue): bool function process_max_message_size_option(v: OptionValue): bool
%{ %{
${context.flow}->options->Assign(15, val_mgr->GetCount(${v.max_msg_size})); ${context.flow}->options->Assign(15, val_mgr->Count(${v.max_msg_size}));
return true; return true;
%} %}
@ -626,7 +626,7 @@ refine flow DHCP_Flow += {
function process_client_id_option(v: OptionValue): bool function process_client_id_option(v: OptionValue): bool
%{ %{
RecordVal* client_id = new RecordVal(BifType::Record::DHCP::ClientID); RecordVal* client_id = new RecordVal(BifType::Record::DHCP::ClientID);
client_id->Assign(0, val_mgr->GetCount(${v.client_id.hwtype})); client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype}));
client_id->Assign(1, make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length()))); client_id->Assign(1, make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length())));
${context.flow}->options->Assign(19, client_id); ${context.flow}->options->Assign(19, client_id);
@ -686,9 +686,9 @@ refine flow DHCP_Flow += {
function process_client_fqdn_option(v: OptionValue): bool function process_client_fqdn_option(v: OptionValue): bool
%{ %{
RecordVal* client_fqdn = new RecordVal(BifType::Record::DHCP::ClientFQDN); RecordVal* client_fqdn = new RecordVal(BifType::Record::DHCP::ClientFQDN);
client_fqdn->Assign(0, val_mgr->GetCount(${v.client_fqdn.flags})); client_fqdn->Assign(0, val_mgr->Count(${v.client_fqdn.flags}));
client_fqdn->Assign(1, val_mgr->GetCount(${v.client_fqdn.rcode1})); client_fqdn->Assign(1, val_mgr->Count(${v.client_fqdn.rcode1}));
client_fqdn->Assign(2, val_mgr->GetCount(${v.client_fqdn.rcode2})); client_fqdn->Assign(2, val_mgr->Count(${v.client_fqdn.rcode2}));
const char* domain_name = reinterpret_cast<const char*>(${v.client_fqdn.domain_name}.begin()); const char* domain_name = reinterpret_cast<const char*>(${v.client_fqdn.domain_name}.begin());
client_fqdn->Assign(3, make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name)); client_fqdn->Assign(3, make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name));
@ -751,7 +751,7 @@ refine flow DHCP_Flow += {
ptrsubopt != ${v.relay_agent_inf}->end(); ++ptrsubopt ) ptrsubopt != ${v.relay_agent_inf}->end(); ++ptrsubopt )
{ {
auto r = new RecordVal(BifType::Record::DHCP::SubOpt); auto r = new RecordVal(BifType::Record::DHCP::SubOpt);
r->Assign(0, val_mgr->GetCount((*ptrsubopt)->code())); r->Assign(0, val_mgr->Count((*ptrsubopt)->code()));
r->Assign(1, bytestring_to_val((*ptrsubopt)->value())); r->Assign(1, bytestring_to_val((*ptrsubopt)->value()));
relay_agent_sub_opt->Assign(i, r); relay_agent_sub_opt->Assign(i, r);

110
src/analyzer/protocol/dns/DNS.cc
View file

@ -52,7 +52,7 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
val_mgr->Bool(is_query), val_mgr->Bool(is_query),
IntrusivePtr{AdoptRef{}, msg.BuildHdrVal()}, IntrusivePtr{AdoptRef{}, msg.BuildHdrVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} val_mgr->Count(len)
); );
// There is a great deal of non-DNS traffic that runs on port 53. // There is a great deal of non-DNS traffic that runs on port 53.
@ -596,7 +596,7 @@ bool DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg,
auto r = make_intrusive<RecordVal>(dns_soa); auto r = make_intrusive<RecordVal>(dns_soa);
r->Assign(0, make_intrusive<StringVal>(new BroString(mname, mname_end - mname, true))); r->Assign(0, make_intrusive<StringVal>(new BroString(mname, mname_end - mname, true)));
r->Assign(1, make_intrusive<StringVal>(new BroString(rname, rname_end - rname, true))); r->Assign(1, make_intrusive<StringVal>(new BroString(rname, rname_end - rname, true)));
r->Assign(2, val_mgr->GetCount(serial)); r->Assign(2, val_mgr->Count(serial));
r->Assign(3, make_intrusive<IntervalVal>(double(refresh), Seconds)); r->Assign(3, make_intrusive<IntervalVal>(double(refresh), Seconds));
r->Assign(4, make_intrusive<IntervalVal>(double(retry), Seconds)); r->Assign(4, make_intrusive<IntervalVal>(double(retry), Seconds));
r->Assign(5, make_intrusive<IntervalVal>(double(expire), Seconds)); r->Assign(5, make_intrusive<IntervalVal>(double(expire), Seconds));
@ -637,7 +637,7 @@ bool DNS_Interpreter::ParseRR_MX(DNS_MsgInfo* msg,
IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
make_intrusive<StringVal>(new BroString(name, name_end - name, true)), make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(preference)} val_mgr->Count(preference)
); );
return true; return true;
@ -678,9 +678,9 @@ bool DNS_Interpreter::ParseRR_SRV(DNS_MsgInfo* msg,
IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
make_intrusive<StringVal>(new BroString(name, name_end - name, true)), make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(priority)}, val_mgr->Count(priority),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(weight)}, val_mgr->Count(weight),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(port)} val_mgr->Count(port)
); );
return true; return true;
@ -1371,7 +1371,7 @@ bool DNS_Interpreter::ParseRR_CAA(DNS_MsgInfo* msg,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}, IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flags)}, val_mgr->Count(flags),
make_intrusive<StringVal>(tag), make_intrusive<StringVal>(tag),
make_intrusive<StringVal>(value) make_intrusive<StringVal>(value)
); );
@ -1399,8 +1399,8 @@ void DNS_Interpreter::SendReplyOrRejectEvent(DNS_MsgInfo* msg,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}, IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
make_intrusive<StringVal>(question_name), make_intrusive<StringVal>(question_name),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(qtype)}, val_mgr->Count(qtype),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(qclass)} val_mgr->Count(qclass)
); );
} }
@ -1446,19 +1446,19 @@ Val* DNS_MsgInfo::BuildHdrVal()
{ {
RecordVal* r = new RecordVal(dns_msg); RecordVal* r = new RecordVal(dns_msg);
r->Assign(0, val_mgr->GetCount(id)); r->Assign(0, val_mgr->Count(id));
r->Assign(1, val_mgr->GetCount(opcode)); r->Assign(1, val_mgr->Count(opcode));
r->Assign(2, val_mgr->GetCount(rcode)); r->Assign(2, val_mgr->Count(rcode));
r->Assign(3, val_mgr->Bool(QR)); r->Assign(3, val_mgr->Bool(QR));
r->Assign(4, val_mgr->Bool(AA)); r->Assign(4, val_mgr->Bool(AA));
r->Assign(5, val_mgr->Bool(TC)); r->Assign(5, val_mgr->Bool(TC));
r->Assign(6, val_mgr->Bool(RD)); r->Assign(6, val_mgr->Bool(RD));
r->Assign(7, val_mgr->Bool(RA)); r->Assign(7, val_mgr->Bool(RA));
r->Assign(8, val_mgr->GetCount(Z)); r->Assign(8, val_mgr->Count(Z));
r->Assign(9, val_mgr->GetCount(qdcount)); r->Assign(9, val_mgr->Count(qdcount));
r->Assign(10, val_mgr->GetCount(ancount)); r->Assign(10, val_mgr->Count(ancount));
r->Assign(11, val_mgr->GetCount(nscount)); r->Assign(11, val_mgr->Count(nscount));
r->Assign(12, val_mgr->GetCount(arcount)); r->Assign(12, val_mgr->Count(arcount));
return r; return r;
} }
@ -1468,10 +1468,10 @@ Val* DNS_MsgInfo::BuildAnswerVal()
RecordVal* r = new RecordVal(dns_answer); RecordVal* r = new RecordVal(dns_answer);
Ref(query_name); Ref(query_name);
r->Assign(0, val_mgr->GetCount(int(answer_type))); r->Assign(0, val_mgr->Count(int(answer_type)));
r->Assign(1, query_name); r->Assign(1, query_name);
r->Assign(2, val_mgr->GetCount(atype)); r->Assign(2, val_mgr->Count(atype));
r->Assign(3, val_mgr->GetCount(aclass)); r->Assign(3, val_mgr->Count(aclass));
r->Assign(4, make_intrusive<IntervalVal>(double(ttl), Seconds)); r->Assign(4, make_intrusive<IntervalVal>(double(ttl), Seconds));
return r; return r;
@ -1484,14 +1484,14 @@ Val* DNS_MsgInfo::BuildEDNS_Val()
RecordVal* r = new RecordVal(dns_edns_additional); RecordVal* r = new RecordVal(dns_edns_additional);
Ref(query_name); Ref(query_name);
r->Assign(0, val_mgr->GetCount(int(answer_type))); r->Assign(0, val_mgr->Count(int(answer_type)));
r->Assign(1, query_name); r->Assign(1, query_name);
// type = 0x29 or 41 = EDNS // type = 0x29 or 41 = EDNS
r->Assign(2, val_mgr->GetCount(atype)); r->Assign(2, val_mgr->Count(atype));
// sender's UDP payload size, per RFC 2671 4.3 // sender's UDP payload size, per RFC 2671 4.3
r->Assign(3, val_mgr->GetCount(aclass)); r->Assign(3, val_mgr->Count(aclass));
// Need to break the TTL field into three components: // Need to break the TTL field into three components:
// initial: [------------- ttl (32) ---------------------] // initial: [------------- ttl (32) ---------------------]
@ -1504,11 +1504,11 @@ Val* DNS_MsgInfo::BuildEDNS_Val()
unsigned int return_error = (ercode << 8) | rcode; unsigned int return_error = (ercode << 8) | rcode;
r->Assign(4, val_mgr->GetCount(return_error)); r->Assign(4, val_mgr->Count(return_error));
r->Assign(5, val_mgr->GetCount(version)); r->Assign(5, val_mgr->Count(version));
r->Assign(6, val_mgr->GetCount(z)); r->Assign(6, val_mgr->Count(z));
r->Assign(7, make_intrusive<IntervalVal>(double(ttl), Seconds)); r->Assign(7, make_intrusive<IntervalVal>(double(ttl), Seconds));
r->Assign(8, val_mgr->GetCount(is_query)); r->Assign(8, val_mgr->Count(is_query));
return r; return r;
} }
@ -1519,16 +1519,16 @@ Val* DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
double rtime = tsig->time_s + tsig->time_ms / 1000.0; double rtime = tsig->time_s + tsig->time_ms / 1000.0;
Ref(query_name); Ref(query_name);
// r->Assign(0, val_mgr->GetCount(int(answer_type))); // r->Assign(0, val_mgr->Count(int(answer_type)));
r->Assign(0, query_name); r->Assign(0, query_name);
r->Assign(1, val_mgr->GetCount(int(answer_type))); r->Assign(1, val_mgr->Count(int(answer_type)));
r->Assign(2, make_intrusive<StringVal>(tsig->alg_name)); r->Assign(2, make_intrusive<StringVal>(tsig->alg_name));
r->Assign(3, make_intrusive<StringVal>(tsig->sig)); r->Assign(3, make_intrusive<StringVal>(tsig->sig));
r->Assign(4, make_intrusive<Val>(rtime, TYPE_TIME)); r->Assign(4, make_intrusive<Val>(rtime, TYPE_TIME));
r->Assign(5, make_intrusive<Val>(double(tsig->fudge), TYPE_TIME)); r->Assign(5, make_intrusive<Val>(double(tsig->fudge), TYPE_TIME));
r->Assign(6, val_mgr->GetCount(tsig->orig_id)); r->Assign(6, val_mgr->Count(tsig->orig_id));
r->Assign(7, val_mgr->GetCount(tsig->rr_error)); r->Assign(7, val_mgr->Count(tsig->rr_error));
r->Assign(8, val_mgr->GetCount(is_query)); r->Assign(8, val_mgr->Count(is_query));
return r; return r;
} }
@ -1539,17 +1539,17 @@ Val* DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
Ref(query_name); Ref(query_name);
r->Assign(0, query_name); r->Assign(0, query_name);
r->Assign(1, val_mgr->GetCount(int(answer_type))); r->Assign(1, val_mgr->Count(int(answer_type)));
r->Assign(2, val_mgr->GetCount(rrsig->type_covered)); r->Assign(2, val_mgr->Count(rrsig->type_covered));
r->Assign(3, val_mgr->GetCount(rrsig->algorithm)); r->Assign(3, val_mgr->Count(rrsig->algorithm));
r->Assign(4, val_mgr->GetCount(rrsig->labels)); r->Assign(4, val_mgr->Count(rrsig->labels));
r->Assign(5, make_intrusive<IntervalVal>(double(rrsig->orig_ttl), Seconds)); r->Assign(5, make_intrusive<IntervalVal>(double(rrsig->orig_ttl), Seconds));
r->Assign(6, make_intrusive<Val>(double(rrsig->sig_exp), TYPE_TIME)); r->Assign(6, make_intrusive<Val>(double(rrsig->sig_exp), TYPE_TIME));
r->Assign(7, make_intrusive<Val>(double(rrsig->sig_incep), TYPE_TIME)); r->Assign(7, make_intrusive<Val>(double(rrsig->sig_incep), TYPE_TIME));
r->Assign(8, val_mgr->GetCount(rrsig->key_tag)); r->Assign(8, val_mgr->Count(rrsig->key_tag));
r->Assign(9, make_intrusive<StringVal>(rrsig->signer_name)); r->Assign(9, make_intrusive<StringVal>(rrsig->signer_name));
r->Assign(10, make_intrusive<StringVal>(rrsig->signature)); r->Assign(10, make_intrusive<StringVal>(rrsig->signature));
r->Assign(11, val_mgr->GetCount(is_query)); r->Assign(11, val_mgr->Count(is_query));
return r; return r;
} }
@ -1560,12 +1560,12 @@ Val* DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
Ref(query_name); Ref(query_name);
r->Assign(0, query_name); r->Assign(0, query_name);
r->Assign(1, val_mgr->GetCount(int(answer_type))); r->Assign(1, val_mgr->Count(int(answer_type)));
r->Assign(2, val_mgr->GetCount(dnskey->dflags)); r->Assign(2, val_mgr->Count(dnskey->dflags));
r->Assign(3, val_mgr->GetCount(dnskey->dprotocol)); r->Assign(3, val_mgr->Count(dnskey->dprotocol));
r->Assign(4, val_mgr->GetCount(dnskey->dalgorithm)); r->Assign(4, val_mgr->Count(dnskey->dalgorithm));
r->Assign(5, make_intrusive<StringVal>(dnskey->public_key)); r->Assign(5, make_intrusive<StringVal>(dnskey->public_key));
r->Assign(6, val_mgr->GetCount(is_query)); r->Assign(6, val_mgr->Count(is_query));
return r; return r;
} }
@ -1576,16 +1576,16 @@ Val* DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
Ref(query_name); Ref(query_name);
r->Assign(0, query_name); r->Assign(0, query_name);
r->Assign(1, val_mgr->GetCount(int(answer_type))); r->Assign(1, val_mgr->Count(int(answer_type)));
r->Assign(2, val_mgr->GetCount(nsec3->nsec_flags)); r->Assign(2, val_mgr->Count(nsec3->nsec_flags));
r->Assign(3, val_mgr->GetCount(nsec3->nsec_hash_algo)); r->Assign(3, val_mgr->Count(nsec3->nsec_hash_algo));
r->Assign(4, val_mgr->GetCount(nsec3->nsec_iter)); r->Assign(4, val_mgr->Count(nsec3->nsec_iter));
r->Assign(5, val_mgr->GetCount(nsec3->nsec_salt_len)); r->Assign(5, val_mgr->Count(nsec3->nsec_salt_len));
r->Assign(6, make_intrusive<StringVal>(nsec3->nsec_salt)); r->Assign(6, make_intrusive<StringVal>(nsec3->nsec_salt));
r->Assign(7, val_mgr->GetCount(nsec3->nsec_hlen)); r->Assign(7, val_mgr->Count(nsec3->nsec_hlen));
r->Assign(8, make_intrusive<StringVal>(nsec3->nsec_hash)); r->Assign(8, make_intrusive<StringVal>(nsec3->nsec_hash));
r->Assign(9, nsec3->bitmaps); r->Assign(9, nsec3->bitmaps);
r->Assign(10, val_mgr->GetCount(is_query)); r->Assign(10, val_mgr->Count(is_query));
return r; return r;
} }
@ -1596,12 +1596,12 @@ Val* DNS_MsgInfo::BuildDS_Val(DS_DATA* ds)
Ref(query_name); Ref(query_name);
r->Assign(0, query_name); r->Assign(0, query_name);
r->Assign(1, val_mgr->GetCount(int(answer_type))); r->Assign(1, val_mgr->Count(int(answer_type)));
r->Assign(2, val_mgr->GetCount(ds->key_tag)); r->Assign(2, val_mgr->Count(ds->key_tag));
r->Assign(3, val_mgr->GetCount(ds->algorithm)); r->Assign(3, val_mgr->Count(ds->algorithm));
r->Assign(4, val_mgr->GetCount(ds->digest_type)); r->Assign(4, val_mgr->Count(ds->digest_type));
r->Assign(5, make_intrusive<StringVal>(ds->digest_val)); r->Assign(5, make_intrusive<StringVal>(ds->digest_val));
r->Assign(6, val_mgr->GetCount(is_query)); r->Assign(6, val_mgr->Count(is_query));
return r; return r;
} }

2
src/analyzer/protocol/ftp/FTP.cc
View file

@ -177,7 +177,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig)
vl = { vl = {
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, val_mgr->Count(reply_code),
make_intrusive<StringVal>(end_of_line - line, line), make_intrusive<StringVal>(end_of_line - line, line),
val_mgr->Bool(cont_resp) val_mgr->Bool(cont_resp)
}; };

12
src/analyzer/protocol/gnutella/Gnutella.cc
View file

@ -75,7 +75,7 @@ void Gnutella_Analyzer::Done()
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
make_intrusive<StringVal>(p->msg), make_intrusive<StringVal>(p->msg),
val_mgr->Bool((i == 0)), val_mgr->Bool((i == 0)),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_pos)} val_mgr->Count(p->msg_pos)
); );
else if ( ! p->msg_sent && p->payload_left ) else if ( ! p->msg_sent && p->payload_left )
@ -217,12 +217,12 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig)
EnqueueConnEvent(gnutella_binary_msg, EnqueueConnEvent(gnutella_binary_msg,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_type)}, val_mgr->Count(p->msg_type),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_ttl)}, val_mgr->Count(p->msg_ttl),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_hops)}, val_mgr->Count(p->msg_hops),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_len)}, val_mgr->Count(p->msg_len),
make_intrusive<StringVal>(p->payload), make_intrusive<StringVal>(p->payload),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->payload_len)}, val_mgr->Count(p->payload_len),
val_mgr->Bool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))), val_mgr->Bool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))),
val_mgr->Bool((p->payload_left == 0)) val_mgr->Bool((p->payload_left == 0))
); );

78
src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
View file

@ -8,86 +8,86 @@ RecordVal* BuildGTPv1Hdr(const GTPv1_Header* pdu)
{ {
RecordVal* rv = new RecordVal(BifType::Record::gtpv1_hdr); RecordVal* rv = new RecordVal(BifType::Record::gtpv1_hdr);
rv->Assign(0, val_mgr->GetCount(pdu->version())); rv->Assign(0, val_mgr->Count(pdu->version()));
rv->Assign(1, val_mgr->Bool(pdu->pt_flag())); rv->Assign(1, val_mgr->Bool(pdu->pt_flag()));
rv->Assign(2, val_mgr->Bool(pdu->rsv())); rv->Assign(2, val_mgr->Bool(pdu->rsv()));
rv->Assign(3, val_mgr->Bool(pdu->e_flag())); rv->Assign(3, val_mgr->Bool(pdu->e_flag()));
rv->Assign(4, val_mgr->Bool(pdu->s_flag())); rv->Assign(4, val_mgr->Bool(pdu->s_flag()));
rv->Assign(5, val_mgr->Bool(pdu->pn_flag())); rv->Assign(5, val_mgr->Bool(pdu->pn_flag()));
rv->Assign(6, val_mgr->GetCount(pdu->msg_type())); rv->Assign(6, val_mgr->Count(pdu->msg_type()));
rv->Assign(7, val_mgr->GetCount(pdu->length())); rv->Assign(7, val_mgr->Count(pdu->length()));
rv->Assign(8, val_mgr->GetCount(pdu->teid())); rv->Assign(8, val_mgr->Count(pdu->teid()));
if ( pdu->has_opt() ) if ( pdu->has_opt() )
{ {
rv->Assign(9, val_mgr->GetCount(pdu->opt_hdr()->seq())); rv->Assign(9, val_mgr->Count(pdu->opt_hdr()->seq()));
rv->Assign(10, val_mgr->GetCount(pdu->opt_hdr()->n_pdu())); rv->Assign(10, val_mgr->Count(pdu->opt_hdr()->n_pdu()));
rv->Assign(11, val_mgr->GetCount(pdu->opt_hdr()->next_type())); rv->Assign(11, val_mgr->Count(pdu->opt_hdr()->next_type()));
} }
return rv; return rv;
} }
Val* BuildIMSI(const InformationElement* ie) static IntrusivePtr<Val> BuildIMSI(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->imsi()->value()); return val_mgr->Count(ie->imsi()->value());
} }
Val* BuildRAI(const InformationElement* ie) static IntrusivePtr<Val> BuildRAI(const InformationElement* ie)
{ {
RecordVal* ev = new RecordVal(BifType::Record::gtp_rai); auto ev = make_intrusive<RecordVal>(BifType::Record::gtp_rai);
ev->Assign(0, val_mgr->GetCount(ie->rai()->mcc())); ev->Assign(0, val_mgr->Count(ie->rai()->mcc()));
ev->Assign(1, val_mgr->GetCount(ie->rai()->mnc())); ev->Assign(1, val_mgr->Count(ie->rai()->mnc()));
ev->Assign(2, val_mgr->GetCount(ie->rai()->lac())); ev->Assign(2, val_mgr->Count(ie->rai()->lac()));
ev->Assign(3, val_mgr->GetCount(ie->rai()->rac())); ev->Assign(3, val_mgr->Count(ie->rai()->rac()));
return ev; return ev;
} }
Val* BuildRecovery(const InformationElement* ie) static IntrusivePtr<Val> BuildRecovery(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->recovery()->restart_counter()); return val_mgr->Count(ie->recovery()->restart_counter());
} }
Val* BuildSelectionMode(const InformationElement* ie) static IntrusivePtr<Val> BuildSelectionMode(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->selection_mode()->mode()); return val_mgr->Count(ie->selection_mode()->mode());
} }
Val* BuildTEID1(const InformationElement* ie) static IntrusivePtr<Val> BuildTEID1(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->teid1()->value()); return val_mgr->Count(ie->teid1()->value());
} }
Val* BuildTEID_ControlPlane(const InformationElement* ie) static IntrusivePtr<Val> BuildTEID_ControlPlane(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->teidcp()->value()); return val_mgr->Count(ie->teidcp()->value());
} }
Val* BuildNSAPI(const InformationElement* ie) static IntrusivePtr<Val> BuildNSAPI(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->nsapi()->nsapi()); return val_mgr->Count(ie->nsapi()->nsapi());
} }
Val* BuildChargingCharacteristics(const InformationElement* ie) static IntrusivePtr<Val> BuildChargingCharacteristics(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->charging_characteristics()->value()); return val_mgr->Count(ie->charging_characteristics()->value());
} }
Val* BuildTraceReference(const InformationElement* ie) static IntrusivePtr<Val> BuildTraceReference(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->trace_reference()->value()); return val_mgr->Count(ie->trace_reference()->value());
} }
Val* BuildTraceType(const InformationElement* ie) static IntrusivePtr<Val> BuildTraceType(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->trace_type()->value()); return val_mgr->Count(ie->trace_type()->value());
} }
Val* BuildEndUserAddr(const InformationElement* ie) Val* BuildEndUserAddr(const InformationElement* ie)
{ {
RecordVal* ev = new RecordVal(BifType::Record::gtp_end_user_addr); RecordVal* ev = new RecordVal(BifType::Record::gtp_end_user_addr);
ev->Assign(0, val_mgr->GetCount(ie->end_user_addr()->pdp_type_org())); ev->Assign(0, val_mgr->Count(ie->end_user_addr()->pdp_type_org()));
ev->Assign(1, val_mgr->GetCount(ie->end_user_addr()->pdp_type_num())); ev->Assign(1, val_mgr->Count(ie->end_user_addr()->pdp_type_num()));
int len = ie->end_user_addr()->pdp_addr().length(); int len = ie->end_user_addr()->pdp_addr().length();
@ -161,7 +161,7 @@ Val* BuildQoS_Profile(const InformationElement* ie)
const u_char* d = (const u_char*) ie->qos_profile()->data().data(); const u_char* d = (const u_char*) ie->qos_profile()->data().data();
int len = ie->qos_profile()->data().length(); int len = ie->qos_profile()->data().length();
ev->Assign(0, val_mgr->GetCount(ie->qos_profile()->alloc_retention_priority())); ev->Assign(0, val_mgr->Count(ie->qos_profile()->alloc_retention_priority()));
ev->Assign(1, make_intrusive<StringVal>(new BroString(d, len, false))); ev->Assign(1, make_intrusive<StringVal>(new BroString(d, len, false)));
return ev; return ev;
@ -195,15 +195,15 @@ Val* BuildPrivateExt(const InformationElement* ie)
const uint8* d = ie->private_ext()->value().data(); const uint8* d = ie->private_ext()->value().data();
int len = ie->private_ext()->value().length(); int len = ie->private_ext()->value().length();
ev->Assign(0, val_mgr->GetCount(ie->private_ext()->id())); ev->Assign(0, val_mgr->Count(ie->private_ext()->id()));
ev->Assign(1, make_intrusive<StringVal>(new BroString((const u_char*) d, len, false))); ev->Assign(1, make_intrusive<StringVal>(new BroString((const u_char*) d, len, false)));
return ev; return ev;
} }
Val* BuildCause(const InformationElement* ie) static IntrusivePtr<Val> BuildCause(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->cause()->value()); return val_mgr->Count(ie->cause()->value());
} }
static IntrusivePtr<Val> BuildReorderReq(const InformationElement* ie) static IntrusivePtr<Val> BuildReorderReq(const InformationElement* ie)
@ -211,9 +211,9 @@ static IntrusivePtr<Val> BuildReorderReq(const InformationElement* ie)
return val_mgr->Bool(ie->reorder_req()->req()); return val_mgr->Bool(ie->reorder_req()->req());
} }
Val* BuildChargingID(const InformationElement* ie) static IntrusivePtr<Val> BuildChargingID(const InformationElement* ie)
{ {
return val_mgr->GetCount(ie->charging_id()->value());; return val_mgr->Count(ie->charging_id()->value());;
} }
Val* BuildChargingGatewayAddr(const InformationElement* ie) Val* BuildChargingGatewayAddr(const InformationElement* ie)

14
src/analyzer/protocol/http/HTTP.cc
View file

@ -620,9 +620,9 @@ Val* HTTP_Message::BuildMessageStat(bool interrupted, const char* msg)
stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME)); stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME));
stat->Assign(field++, val_mgr->Bool(interrupted)); stat->Assign(field++, val_mgr->Bool(interrupted));
stat->Assign(field++, make_intrusive<StringVal>(msg)); stat->Assign(field++, make_intrusive<StringVal>(msg));
stat->Assign(field++, val_mgr->GetCount(body_length)); stat->Assign(field++, val_mgr->Count(body_length));
stat->Assign(field++, val_mgr->GetCount(content_gap_length)); stat->Assign(field++, val_mgr->Count(content_gap_length));
stat->Assign(field++, val_mgr->GetCount(header_length)); stat->Assign(field++, val_mgr->Count(header_length));
return stat; return stat;
} }
@ -1172,8 +1172,8 @@ void HTTP_Analyzer::GenStats()
if ( http_stats ) if ( http_stats )
{ {
auto r = make_intrusive<RecordVal>(http_stats_rec); auto r = make_intrusive<RecordVal>(http_stats_rec);
r->Assign(0, val_mgr->GetCount(num_requests)); r->Assign(0, val_mgr->Count(num_requests));
r->Assign(1, val_mgr->GetCount(num_replies)); r->Assign(1, val_mgr->Count(num_replies));
r->Assign(2, make_intrusive<Val>(request_version.ToDouble(), TYPE_DOUBLE)); r->Assign(2, make_intrusive<Val>(request_version.ToDouble(), TYPE_DOUBLE));
r->Assign(3, make_intrusive<Val>(reply_version.ToDouble(), TYPE_DOUBLE)); r->Assign(3, make_intrusive<Val>(reply_version.ToDouble(), TYPE_DOUBLE));
@ -1431,7 +1431,7 @@ void HTTP_Analyzer::HTTP_Reply()
EnqueueConnEvent(http_reply, EnqueueConnEvent(http_reply,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
make_intrusive<StringVal>(fmt("%.1f", reply_version.ToDouble())), make_intrusive<StringVal>(fmt("%.1f", reply_version.ToDouble())),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, val_mgr->Count(reply_code),
reply_reason_phrase ? reply_reason_phrase ?
IntrusivePtr{NewRef{}, reply_reason_phrase} : IntrusivePtr{NewRef{}, reply_reason_phrase} :
make_intrusive<StringVal>("<empty>") make_intrusive<StringVal>("<empty>")
@ -1684,7 +1684,7 @@ void HTTP_Analyzer::HTTP_EntityData(bool is_orig, BroString* entity_data)
EnqueueConnEvent(http_entity_data, EnqueueConnEvent(http_entity_data,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(entity_data->Len())}, val_mgr->Count(entity_data->Len()),
make_intrusive<StringVal>(entity_data) make_intrusive<StringVal>(entity_data)
); );
else else

50
src/analyzer/protocol/icmp/ICMP.cc
View file

@ -228,10 +228,10 @@ RecordVal* ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
icmp_conn_val->Assign(0, make_intrusive<AddrVal>(Conn()->OrigAddr())); icmp_conn_val->Assign(0, make_intrusive<AddrVal>(Conn()->OrigAddr()));
icmp_conn_val->Assign(1, make_intrusive<AddrVal>(Conn()->RespAddr())); icmp_conn_val->Assign(1, make_intrusive<AddrVal>(Conn()->RespAddr()));
icmp_conn_val->Assign(2, val_mgr->GetCount(icmpp->icmp_type)); icmp_conn_val->Assign(2, val_mgr->Count(icmpp->icmp_type));
icmp_conn_val->Assign(3, val_mgr->GetCount(icmpp->icmp_code)); icmp_conn_val->Assign(3, val_mgr->Count(icmpp->icmp_code));
icmp_conn_val->Assign(4, val_mgr->GetCount(len)); icmp_conn_val->Assign(4, val_mgr->Count(len));
icmp_conn_val->Assign(5, val_mgr->GetCount(ip_hdr->TTL())); icmp_conn_val->Assign(5, val_mgr->Count(ip_hdr->TTL()));
icmp_conn_val->Assign(6, val_mgr->Bool(icmpv6)); icmp_conn_val->Assign(6, val_mgr->Bool(icmpv6));
} }
@ -360,9 +360,9 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
id_val->Assign(3, val_mgr->GetPort(dst_port, proto)); id_val->Assign(3, val_mgr->GetPort(dst_port, proto));
iprec->Assign(0, id_val); iprec->Assign(0, id_val);
iprec->Assign(1, val_mgr->GetCount(ip_len)); iprec->Assign(1, val_mgr->Count(ip_len));
iprec->Assign(2, val_mgr->GetCount(proto)); iprec->Assign(2, val_mgr->Count(proto));
iprec->Assign(3, val_mgr->GetCount(frag_offset)); iprec->Assign(3, val_mgr->Count(frag_offset));
iprec->Assign(4, val_mgr->Bool(bad_hdr_len)); iprec->Assign(4, val_mgr->Bool(bad_hdr_len));
iprec->Assign(5, val_mgr->Bool(bad_checksum)); iprec->Assign(5, val_mgr->Bool(bad_checksum));
iprec->Assign(6, val_mgr->Bool(MF)); iprec->Assign(6, val_mgr->Bool(MF));
@ -419,9 +419,9 @@ RecordVal* ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
id_val->Assign(3, val_mgr->GetPort(dst_port, proto)); id_val->Assign(3, val_mgr->GetPort(dst_port, proto));
iprec->Assign(0, id_val); iprec->Assign(0, id_val);
iprec->Assign(1, val_mgr->GetCount(ip_len)); iprec->Assign(1, val_mgr->Count(ip_len));
iprec->Assign(2, val_mgr->GetCount(proto)); iprec->Assign(2, val_mgr->Count(proto));
iprec->Assign(3, val_mgr->GetCount(frag_offset)); iprec->Assign(3, val_mgr->Count(frag_offset));
iprec->Assign(4, val_mgr->Bool(bad_hdr_len)); iprec->Assign(4, val_mgr->Bool(bad_hdr_len));
// bad_checksum is always false since IPv6 layer doesn't have a checksum. // bad_checksum is always false since IPv6 layer doesn't have a checksum.
iprec->Assign(5, val_mgr->False()); iprec->Assign(5, val_mgr->False());
@ -474,14 +474,14 @@ void ICMP_Analyzer::UpdateEndpointVal(RecordVal* endp, bool is_orig)
int size = is_orig ? request_len : reply_len; int size = is_orig ? request_len : reply_len;
if ( size < 0 ) if ( size < 0 )
{ {
endp->Assign(0, val_mgr->GetCount(0)); endp->Assign(0, val_mgr->Count(0));
endp->Assign(1, val_mgr->GetCount(int(ICMP_INACTIVE))); endp->Assign(1, val_mgr->Count(int(ICMP_INACTIVE)));
} }
else else
{ {
endp->Assign(0, val_mgr->GetCount(size)); endp->Assign(0, val_mgr->Count(size));
endp->Assign(1, val_mgr->GetCount(int(ICMP_ACTIVE))); endp->Assign(1, val_mgr->Count(int(ICMP_ACTIVE)));
} }
} }
@ -517,8 +517,8 @@ void ICMP_Analyzer::Echo(double t, const struct icmp* icmpp, int len,
EnqueueConnEvent(f, EnqueueConnEvent(f,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr)}, IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr)},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(iid)}, val_mgr->Count(iid),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(iseq)}, val_mgr->Count(iseq),
make_intrusive<StringVal>(payload) make_intrusive<StringVal>(payload)
); );
} }
@ -545,13 +545,13 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
EnqueueConnEvent(f, EnqueueConnEvent(f,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_num_addrs)}, // Cur Hop Limit val_mgr->Count(icmpp->icmp_num_addrs), // Cur Hop Limit
val_mgr->Bool(icmpp->icmp_wpa & 0x80), // Managed val_mgr->Bool(icmpp->icmp_wpa & 0x80), // Managed
val_mgr->Bool(icmpp->icmp_wpa & 0x40), // Other val_mgr->Bool(icmpp->icmp_wpa & 0x40), // Other
val_mgr->Bool(icmpp->icmp_wpa & 0x20), // Home Agent val_mgr->Bool(icmpp->icmp_wpa & 0x20), // Home Agent
IntrusivePtr{AdoptRef{}, val_mgr->GetCount((icmpp->icmp_wpa & 0x18)>>3)}, // Pref val_mgr->Count((icmpp->icmp_wpa & 0x18)>>3), // Pref
val_mgr->Bool(icmpp->icmp_wpa & 0x04), // Proxy val_mgr->Bool(icmpp->icmp_wpa & 0x04), // Proxy
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_wpa & 0x02)}, // Reserved val_mgr->Count(icmpp->icmp_wpa & 0x02), // Reserved
make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds), make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds),
make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds), make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds),
make_intrusive<IntervalVal>((double)ntohl(retrans), Milliseconds), make_intrusive<IntervalVal>((double)ntohl(retrans), Milliseconds),
@ -675,7 +675,7 @@ void ICMP_Analyzer::Context4(double t, const struct icmp* icmpp,
EnqueueConnEvent(f, EnqueueConnEvent(f,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 0, ip_hdr)}, IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 0, ip_hdr)},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_code)}, val_mgr->Count(icmpp->icmp_code),
IntrusivePtr{AdoptRef{}, ExtractICMP4Context(caplen, data)} IntrusivePtr{AdoptRef{}, ExtractICMP4Context(caplen, data)}
); );
} }
@ -713,7 +713,7 @@ void ICMP_Analyzer::Context6(double t, const struct icmp* icmpp,
EnqueueConnEvent(f, EnqueueConnEvent(f,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_code)}, val_mgr->Count(icmpp->icmp_code),
IntrusivePtr{AdoptRef{}, ExtractICMP6Context(caplen, data)} IntrusivePtr{AdoptRef{}, ExtractICMP6Context(caplen, data)}
); );
} }
@ -752,8 +752,8 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
} }
RecordVal* rv = new RecordVal(icmp6_nd_option_type); RecordVal* rv = new RecordVal(icmp6_nd_option_type);
rv->Assign(0, val_mgr->GetCount(type)); rv->Assign(0, val_mgr->Count(type));
rv->Assign(1, val_mgr->GetCount(length)); rv->Assign(1, val_mgr->Count(length));
// Adjust length to be in units of bytes, exclude type/length fields. // Adjust length to be in units of bytes, exclude type/length fields.
length = length * 8 - 2; length = length * 8 - 2;
@ -792,7 +792,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
uint32_t valid_life = *((const uint32_t*)(data + 2)); uint32_t valid_life = *((const uint32_t*)(data + 2));
uint32_t prefer_life = *((const uint32_t*)(data + 6)); uint32_t prefer_life = *((const uint32_t*)(data + 6));
in6_addr prefix = *((const in6_addr*)(data + 14)); in6_addr prefix = *((const in6_addr*)(data + 14));
info->Assign(0, val_mgr->GetCount(prefix_len)); info->Assign(0, val_mgr->Count(prefix_len));
info->Assign(1, val_mgr->Bool(L_flag)); info->Assign(1, val_mgr->Bool(L_flag));
info->Assign(2, val_mgr->Bool(A_flag)); info->Assign(2, val_mgr->Bool(A_flag));
info->Assign(3, make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds)); info->Assign(3, make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds));
@ -825,7 +825,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
// MTU option // MTU option
{ {
if ( caplen >= 6 ) if ( caplen >= 6 )
rv->Assign(5, val_mgr->GetCount(ntohl(*((const uint32_t*)(data + 2))))); rv->Assign(5, val_mgr->Count(ntohl(*((const uint32_t*)(data + 2)))));
else else
set_payload_field = true; set_payload_field = true;

8
src/analyzer/protocol/irc/IRC.cc
View file

@ -588,7 +588,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(orig), val_mgr->Bool(orig),
make_intrusive<StringVal>(prefix.c_str()), make_intrusive<StringVal>(prefix.c_str()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(code)}, val_mgr->Count(code),
make_intrusive<StringVal>(params.c_str()) make_intrusive<StringVal>(params.c_str())
); );
break; break;
@ -663,10 +663,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
make_intrusive<StringVal>(parts[1].c_str()), make_intrusive<StringVal>(parts[1].c_str()),
make_intrusive<StringVal>(parts[2].c_str()), make_intrusive<StringVal>(parts[2].c_str()),
make_intrusive<AddrVal>(htonl(raw_ip)), make_intrusive<AddrVal>(htonl(raw_ip)),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(atoi(parts[4].c_str()))}, val_mgr->Count(atoi(parts[4].c_str())),
IntrusivePtr{AdoptRef{}, parts.size() >= 6 ? parts.size() >= 6 ? val_mgr->Count(atoi(parts[5].c_str())) : val_mgr->Count(0)
val_mgr->GetCount(atoi(parts[5].c_str())) :
val_mgr->GetCount(0)}
); );
} }

8
src/analyzer/protocol/krb/krb-padata.pac
View file

@ -37,7 +37,7 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
case PA_PW_SALT: case PA_PW_SALT:
{ {
RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value); RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
type_val->Assign(0, val_mgr->GetCount(element->data_type())); type_val->Assign(0, val_mgr->Count(element->data_type()));
type_val->Assign(1, bytestring_to_val(element->pa_data_element()->pa_pw_salt()->encoding()->content())); type_val->Assign(1, bytestring_to_val(element->pa_data_element()->pa_pw_salt()->encoding()->content()));
vv->Assign(vv->Size(), type_val); vv->Assign(vv->Size(), type_val);
break; break;
@ -45,7 +45,7 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
case PA_ENCTYPE_INFO: case PA_ENCTYPE_INFO:
{ {
RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value); RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
type_val->Assign(0, val_mgr->GetCount(element->data_type())); type_val->Assign(0, val_mgr->Count(element->data_type()));
type_val->Assign(1, bytestring_to_val(element->pa_data_element()->pf_enctype_info()->salt())); type_val->Assign(1, bytestring_to_val(element->pa_data_element()->pf_enctype_info()->salt()));
vv->Assign(vv->Size(), type_val); vv->Assign(vv->Size(), type_val);
break; break;
@ -53,7 +53,7 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
case PA_ENCTYPE_INFO2: case PA_ENCTYPE_INFO2:
{ {
RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value); RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
type_val->Assign(0, val_mgr->GetCount(element->data_type())); type_val->Assign(0, val_mgr->Count(element->data_type()));
type_val->Assign(1, bytestring_to_val(element->pa_data_element()->pf_enctype_info2()->salt())); type_val->Assign(1, bytestring_to_val(element->pa_data_element()->pf_enctype_info2()->salt()));
vv->Assign(vv->Size(), type_val); vv->Assign(vv->Size(), type_val);
break; break;
@ -111,7 +111,7 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
if ( ! is_error && element->pa_data_element()->unknown()->meta()->length() > 0 ) if ( ! is_error && element->pa_data_element()->unknown()->meta()->length() > 0 )
{ {
RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value); RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
type_val->Assign(0, val_mgr->GetCount(element->data_type())); type_val->Assign(0, val_mgr->Count(element->data_type()));
type_val->Assign(1, bytestring_to_val(element->pa_data_element()->unknown()->content())); type_val->Assign(1, bytestring_to_val(element->pa_data_element()->unknown()->content()));
vv->Assign(vv->Size(), type_val); vv->Assign(vv->Size(), type_val);
} }

2
src/analyzer/protocol/login/functions.bif
View file

@ -34,7 +34,7 @@ function get_login_state%(cid: conn_id%): count
if ( ! la ) if ( ! la )
return val_mgr->False(); return val_mgr->False();
return val_mgr->GetCount(int(static_cast<analyzer::login::Login_Analyzer*>(la)->LoginState())); return val_mgr->Count(int(static_cast<analyzer::login::Login_Analyzer*>(la)->LoginState()));
%} %}
## Sets the login state of a connection with a login analyzer. ## Sets the login state of a connection with a login analyzer.

14
src/analyzer/protocol/mime/MIME.cc
View file

@ -1303,14 +1303,12 @@ TableVal* MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist)
for ( unsigned int i = 0; i < hlist.size(); ++i ) for ( unsigned int i = 0; i < hlist.size(); ++i )
{ {
Val* index = val_mgr->GetCount(i+1); // index starting from 1 auto index = val_mgr->Count(i + 1); // index starting from 1
MIME_Header* h = hlist[i]; MIME_Header* h = hlist[i];
RecordVal* header_record = BuildHeaderVal(h); RecordVal* header_record = BuildHeaderVal(h);
t->Assign(index, header_record); t->Assign(index.get(), header_record);
Unref(index);
} }
return t; return t;
@ -1367,7 +1365,7 @@ void MIME_Mail::Done()
analyzer->EnqueueConnEvent(mime_content_hash, analyzer->EnqueueConnEvent(mime_content_hash,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(content_hash_length)}, val_mgr->Count(content_hash_length),
make_intrusive<StringVal>(new BroString(true, digest, 16)) make_intrusive<StringVal>(new BroString(true, digest, 16))
); );
} }
@ -1407,7 +1405,7 @@ void MIME_Mail::EndEntity(MIME_Entity* /* entity */)
analyzer->EnqueueConnEvent(mime_entity_data, analyzer->EnqueueConnEvent(mime_entity_data,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(s->Len())}, val_mgr->Count(s->Len()),
make_intrusive<StringVal>(s) make_intrusive<StringVal>(s)
); );
@ -1474,7 +1472,7 @@ void MIME_Mail::SubmitData(int len, const char* buf)
analyzer->EnqueueConnEvent(mime_segment_data, analyzer->EnqueueConnEvent(mime_segment_data,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(data_len)}, val_mgr->Count(data_len),
make_intrusive<StringVal>(data_len, data) make_intrusive<StringVal>(data_len, data)
); );
} }
@ -1521,7 +1519,7 @@ void MIME_Mail::SubmitAllData()
analyzer->EnqueueConnEvent(mime_all_data, analyzer->EnqueueConnEvent(mime_all_data,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(s->Len())}, val_mgr->Count(s->Len()),
make_intrusive<StringVal>(s) make_intrusive<StringVal>(s)
); );
} }

44
src/analyzer/protocol/modbus/modbus-analyzer.pac
View file

@ -29,10 +29,10 @@
RecordVal* HeaderToBro(ModbusTCP_TransportHeader *header) RecordVal* HeaderToBro(ModbusTCP_TransportHeader *header)
{ {
RecordVal* modbus_header = new RecordVal(BifType::Record::ModbusHeaders); RecordVal* modbus_header = new RecordVal(BifType::Record::ModbusHeaders);
modbus_header->Assign(0, val_mgr->GetCount(header->tid())); modbus_header->Assign(0, val_mgr->Count(header->tid()));
modbus_header->Assign(1, val_mgr->GetCount(header->pid())); modbus_header->Assign(1, val_mgr->Count(header->pid()));
modbus_header->Assign(2, val_mgr->GetCount(header->uid())); modbus_header->Assign(2, val_mgr->Count(header->uid()));
modbus_header->Assign(3, val_mgr->GetCount(header->fc())); modbus_header->Assign(3, val_mgr->Count(header->fc()));
return modbus_header; return modbus_header;
} }
@ -213,7 +213,7 @@ refine flow ModbusTCP_Flow += {
VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters); VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
for ( unsigned int i=0; i < ${message.registers}->size(); ++i ) for ( unsigned int i=0; i < ${message.registers}->size(); ++i )
{ {
Val* r = val_mgr->GetCount(${message.registers[i]}); auto r = val_mgr->Count(${message.registers[i]});
t->Assign(i, r); t->Assign(i, r);
} }
@ -256,7 +256,7 @@ refine flow ModbusTCP_Flow += {
VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters); VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
for ( unsigned int i=0; i < (${message.registers})->size(); ++i ) for ( unsigned int i=0; i < (${message.registers})->size(); ++i )
{ {
Val* r = val_mgr->GetCount(${message.registers[i]}); auto r = val_mgr->Count(${message.registers[i]});
t->Assign(i, r); t->Assign(i, r);
} }
@ -399,7 +399,7 @@ refine flow ModbusTCP_Flow += {
VectorVal * t = new VectorVal(BifType::Vector::ModbusRegisters); VectorVal * t = new VectorVal(BifType::Vector::ModbusRegisters);
for ( unsigned int i = 0; i < (${message.registers}->size()); ++i ) for ( unsigned int i = 0; i < (${message.registers}->size()); ++i )
{ {
Val* r = val_mgr->GetCount(${message.registers[i]}); auto r = val_mgr->Count(${message.registers[i]});
t->Assign(i, r); t->Assign(i, r);
} }
@ -435,13 +435,13 @@ refine flow ModbusTCP_Flow += {
//VectorVal *t = create_vector_of_count(); //VectorVal *t = create_vector_of_count();
//for ( unsigned int i = 0; i < (${message.references}->size()); ++i ) //for ( unsigned int i = 0; i < (${message.references}->size()); ++i )
// { // {
// Val* r = val_mgr->GetCount((${message.references[i].ref_type})); // auto r = val_mgr->Count((${message.references[i].ref_type}));
// t->Assign(i, r); // t->Assign(i, r);
// //
// Val* k = val_mgr->GetCount((${message.references[i].file_num})); // auto k = val_mgr->Count((${message.references[i].file_num}));
// t->Assign(i, k); // t->Assign(i, k);
// //
// Val* l = val_mgr->GetCount((${message.references[i].record_num})); // auto l = val_mgr->Count((${message.references[i].record_num}));
// t->Assign(i, l); // t->Assign(i, l);
// } // }
@ -462,7 +462,7 @@ refine flow ModbusTCP_Flow += {
//for ( unsigned int i = 0; i < ${message.references}->size(); ++i ) //for ( unsigned int i = 0; i < ${message.references}->size(); ++i )
// { // {
// //TODO: work the reference type in here somewhere // //TODO: work the reference type in here somewhere
// Val* r = val_mgr->GetCount(${message.references[i].record_data})); // auto r = val_mgr->Count(${message.references[i].record_data}));
// t->Assign(i, r); // t->Assign(i, r);
// } // }
@ -482,18 +482,18 @@ refine flow ModbusTCP_Flow += {
//VectorVal* t = create_vector_of_count(); //VectorVal* t = create_vector_of_count();
//for ( unsigned int i = 0; i < (${message.references}->size()); ++i ) //for ( unsigned int i = 0; i < (${message.references}->size()); ++i )
// { // {
// Val* r = val_mgr->GetCount((${message.references[i].ref_type})); // auto r = val_mgr->Count((${message.references[i].ref_type}));
// t->Assign(i, r); // t->Assign(i, r);
// //
// Val* k = val_mgr->GetCount((${message.references[i].file_num})); // auto k = val_mgr->Count((${message.references[i].file_num}));
// t->Assign(i, k); // t->Assign(i, k);
// //
// Val* n = val_mgr->GetCount((${message.references[i].record_num})); // auto n = val_mgr->Count((${message.references[i].record_num}));
// t->Assign(i, n); // t->Assign(i, n);
// //
// for ( unsigned int j = 0; j < (${message.references[i].register_value}->size()); ++j ) // for ( unsigned int j = 0; j < (${message.references[i].register_value}->size()); ++j )
// { // {
// k = val_mgr->GetCount((${message.references[i].register_value[j]})); // k = val_mgr->Count((${message.references[i].register_value[j]}));
// t->Assign(i, k); // t->Assign(i, k);
// } // }
// } // }
@ -515,18 +515,18 @@ refine flow ModbusTCP_Flow += {
//VectorVal* t = create_vector_of_count(); //VectorVal* t = create_vector_of_count();
//for ( unsigned int i = 0; i < (${messages.references}->size()); ++i ) //for ( unsigned int i = 0; i < (${messages.references}->size()); ++i )
// { // {
// Val* r = val_mgr->GetCount((${message.references[i].ref_type})); // auto r = val_mgr->Count((${message.references[i].ref_type}));
// t->Assign(i, r); // t->Assign(i, r);
// //
// Val* f = val_mgr->GetCount((${message.references[i].file_num})); // auto f = val_mgr->Count((${message.references[i].file_num}));
// t->Assign(i, f); // t->Assign(i, f);
// //
// Val* rn = val_mgr->GetCount((${message.references[i].record_num})); // auto rn = val_mgr->Count((${message.references[i].record_num}));
// t->Assign(i, rn); // t->Assign(i, rn);
// //
// for ( unsigned int j = 0; j<(${message.references[i].register_value}->size()); ++j ) // for ( unsigned int j = 0; j<(${message.references[i].register_value}->size()); ++j )
// { // {
// Val* k = val_mgr->GetCount((${message.references[i].register_value[j]})); // auto k = val_mgr->Count((${message.references[i].register_value[j]}));
// t->Assign(i, k); // t->Assign(i, k);
// } // }
@ -583,7 +583,7 @@ refine flow ModbusTCP_Flow += {
VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters); VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
for ( unsigned int i = 0; i < ${message.write_register_values}->size(); ++i ) for ( unsigned int i = 0; i < ${message.write_register_values}->size(); ++i )
{ {
Val* r = val_mgr->GetCount(${message.write_register_values[i]}); auto r = val_mgr->Count(${message.write_register_values[i]});
t->Assign(i, r); t->Assign(i, r);
} }
@ -614,7 +614,7 @@ refine flow ModbusTCP_Flow += {
VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters); VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
for ( unsigned int i = 0; i < ${message.registers}->size(); ++i ) for ( unsigned int i = 0; i < ${message.registers}->size(); ++i )
{ {
Val* r = val_mgr->GetCount(${message.registers[i]}); auto r = val_mgr->Count(${message.registers[i]});
t->Assign(i, r); t->Assign(i, r);
} }
@ -657,7 +657,7 @@ refine flow ModbusTCP_Flow += {
VectorVal* t = create_vector_of_count(); VectorVal* t = create_vector_of_count();
for ( unsigned int i = 0; i < (${message.register_data})->size(); ++i ) for ( unsigned int i = 0; i < (${message.register_data})->size(); ++i )
{ {
Val* r = val_mgr->GetCount(${message.register_data[i]}); auto r = val_mgr->Count(${message.register_data[i]});
t->Assign(i, r); t->Assign(i, r);
} }

2
src/analyzer/protocol/mqtt/commands/connack.pac
View file

@ -16,7 +16,7 @@ refine flow MQTT_Flow += {
if ( mqtt_connack ) if ( mqtt_connack )
{ {
auto m = new RecordVal(BifType::Record::MQTT::ConnectAckMsg); auto m = new RecordVal(BifType::Record::MQTT::ConnectAckMsg);
m->Assign(0, val_mgr->GetCount(${msg.return_code})); m->Assign(0, val_mgr->Count(${msg.return_code}));
m->Assign(1, val_mgr->Bool(${msg.session_present})); m->Assign(1, val_mgr->Bool(${msg.session_present}));
BifEvent::generate_mqtt_connack(connection()->bro_analyzer(), BifEvent::generate_mqtt_connack(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(), connection()->bro_analyzer()->Conn(),

4
src/analyzer/protocol/mqtt/commands/connect.pac
View file

@ -47,14 +47,14 @@ refine flow MQTT_Flow += {
auto m = new RecordVal(BifType::Record::MQTT::ConnectMsg); auto m = new RecordVal(BifType::Record::MQTT::ConnectMsg);
m->Assign(0, make_intrusive<StringVal>(${msg.protocol_name.str}.length(), m->Assign(0, make_intrusive<StringVal>(${msg.protocol_name.str}.length(),
reinterpret_cast<const char*>(${msg.protocol_name.str}.begin()))); reinterpret_cast<const char*>(${msg.protocol_name.str}.begin())));
m->Assign(1, val_mgr->GetCount(${msg.protocol_version})); m->Assign(1, val_mgr->Count(${msg.protocol_version}));
m->Assign(2, make_intrusive<StringVal>(${msg.client_id.str}.length(), m->Assign(2, make_intrusive<StringVal>(${msg.client_id.str}.length(),
reinterpret_cast<const char*>(${msg.client_id.str}.begin()))); reinterpret_cast<const char*>(${msg.client_id.str}.begin())));
m->Assign(3, make_intrusive<IntervalVal>(double(${msg.keep_alive}), Seconds)); m->Assign(3, make_intrusive<IntervalVal>(double(${msg.keep_alive}), Seconds));
m->Assign(4, val_mgr->Bool(${msg.clean_session})); m->Assign(4, val_mgr->Bool(${msg.clean_session}));
m->Assign(5, val_mgr->Bool(${msg.will_retain})); m->Assign(5, val_mgr->Bool(${msg.will_retain}));
m->Assign(6, val_mgr->GetCount(${msg.will_qos})); m->Assign(6, val_mgr->Count(${msg.will_qos}));
if ( ${msg.will_flag} ) if ( ${msg.will_flag} )
{ {

4
src/analyzer/protocol/mqtt/commands/publish.pac
View file

@ -25,7 +25,7 @@ refine flow MQTT_Flow += {
{ {
auto m = new RecordVal(BifType::Record::MQTT::PublishMsg); auto m = new RecordVal(BifType::Record::MQTT::PublishMsg);
m->Assign(0, val_mgr->Bool(${msg.dup})); m->Assign(0, val_mgr->Bool(${msg.dup}));
m->Assign(1, val_mgr->GetCount(${msg.qos})); m->Assign(1, val_mgr->Count(${msg.qos}));
m->Assign(2, val_mgr->Bool(${msg.retain})); m->Assign(2, val_mgr->Bool(${msg.retain}));
m->Assign(3, new StringVal(${msg.topic.str}.length(), m->Assign(3, new StringVal(${msg.topic.str}.length(),
reinterpret_cast<const char*>(${msg.topic.str}.begin()))); reinterpret_cast<const char*>(${msg.topic.str}.begin())));
@ -39,7 +39,7 @@ refine flow MQTT_Flow += {
m->Assign(4, new StringVal(len, m->Assign(4, new StringVal(len,
reinterpret_cast<const char*>(${msg.payload}.begin()))); reinterpret_cast<const char*>(${msg.payload}.begin())));
m->Assign(5, val_mgr->GetCount(${msg.payload}.length())); m->Assign(5, val_mgr->Count(${msg.payload}.length()));
BifEvent::generate_mqtt_publish(connection()->bro_analyzer(), BifEvent::generate_mqtt_publish(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(), connection()->bro_analyzer()->Conn(),

2
src/analyzer/protocol/mqtt/commands/subscribe.pac
View file

@ -26,7 +26,7 @@ refine flow MQTT_Flow += {
{ {
auto subscribe_topic = new StringVal(${topic.name.str}.length(), auto subscribe_topic = new StringVal(${topic.name.str}.length(),
reinterpret_cast<const char*>(${topic.name.str}.begin())); reinterpret_cast<const char*>(${topic.name.str}.begin()));
auto qos = val_mgr->GetCount(${topic.requested_QoS}); auto qos = val_mgr->Count(${topic.requested_QoS});
topics->Assign(topics->Size(), subscribe_topic); topics->Assign(topics->Size(), subscribe_topic);
qos_levels->Assign(qos_levels->Size(), qos); qos_levels->Assign(qos_levels->Size(), qos);
} }

16
src/analyzer/protocol/ncp/NCP.cc
View file

@ -64,18 +64,18 @@ void NCP_Session::DeliverFrame(const binpac::NCP::ncp_frame* frame)
if ( frame->is_orig() ) if ( frame->is_orig() )
analyzer->EnqueueConnEvent(f, analyzer->EnqueueConnEvent(f,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->frame_type())}, val_mgr->Count(frame->frame_type()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->body_length())}, val_mgr->Count(frame->body_length()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(req_func)} val_mgr->Count(req_func)
); );
else else
analyzer->EnqueueConnEvent(f, analyzer->EnqueueConnEvent(f,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->frame_type())}, val_mgr->Count(frame->frame_type()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->body_length())}, val_mgr->Count(frame->body_length()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(req_frame_type)}, val_mgr->Count(req_frame_type),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(req_func)}, val_mgr->Count(req_func),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(frame->reply()->completion_code())} val_mgr->Count(frame->reply()->completion_code())
); );
} }
} }

4
src/analyzer/protocol/netbios/NetbiosSSN.cc
View file

@ -62,8 +62,8 @@ void NetbiosSSN_Interpreter::ParseMessage(unsigned int type, unsigned int flags,
analyzer->EnqueueConnEvent(netbios_session_message, analyzer->EnqueueConnEvent(netbios_session_message,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
val_mgr->Bool(is_query), val_mgr->Bool(is_query),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(type)}, val_mgr->Count(type),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} val_mgr->Count(len)
); );
switch ( type ) { switch ( type ) {

2
src/analyzer/protocol/netbios/functions.bif
View file

@ -49,5 +49,5 @@ function decode_netbios_name_type%(name: string%): count
%{ %{
const u_char* s = name->Bytes(); const u_char* s = name->Bytes();
char return_val = ((toupper(s[30]) - 'A') << 4) + (toupper(s[31]) - 'A'); char return_val = ((toupper(s[30]) - 'A') << 4) + (toupper(s[31]) - 'A');
return val_mgr->GetCount(return_val); return val_mgr->Count(return_val);
%} %}

10
src/analyzer/protocol/ntlm/ntlm-analyzer.pac
View file

@ -16,10 +16,10 @@ refine connection NTLM_Conn += {
function build_version_record(val: NTLM_Version): BroVal function build_version_record(val: NTLM_Version): BroVal
%{ %{
RecordVal* result = new RecordVal(BifType::Record::NTLM::Version); RecordVal* result = new RecordVal(BifType::Record::NTLM::Version);
result->Assign(0, val_mgr->GetCount(${val.major_version})); result->Assign(0, val_mgr->Count(${val.major_version}));
result->Assign(1, val_mgr->GetCount(${val.minor_version})); result->Assign(1, val_mgr->Count(${val.minor_version}));
result->Assign(2, val_mgr->GetCount(${val.build_number})); result->Assign(2, val_mgr->Count(${val.build_number}));
result->Assign(3, val_mgr->GetCount(${val.ntlm_revision})); result->Assign(3, val_mgr->Count(${val.ntlm_revision}));
return result; return result;
%} %}
@ -66,7 +66,7 @@ refine connection NTLM_Conn += {
result->Assign(6, filetime2brotime(${val.pairs[i].timestamp})); result->Assign(6, filetime2brotime(${val.pairs[i].timestamp}));
break; break;
case 8: case 8:
result->Assign(7, val_mgr->GetCount(${val.pairs[i].single_host.machine_id})); result->Assign(7, val_mgr->Count(${val.pairs[i].single_host.machine_id}));
break; break;
case 9: case 9:
result->Assign(8, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].target_name.data})); result->Assign(8, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].target_name.data}));

30
src/analyzer/protocol/ntp/ntp-analyzer.pac
View file

@ -37,7 +37,7 @@ refine flow NTP_Flow += {
%{ %{
RecordVal* rv = new RecordVal(BifType::Record::NTP::StandardMessage); RecordVal* rv = new RecordVal(BifType::Record::NTP::StandardMessage);
rv->Assign(0, val_mgr->GetCount(${nsm.stratum})); rv->Assign(0, val_mgr->Count(${nsm.stratum}));
rv->Assign(1, make_intrusive<Val>(pow(2, ${nsm.poll}), TYPE_INTERVAL)); rv->Assign(1, make_intrusive<Val>(pow(2, ${nsm.poll}), TYPE_INTERVAL));
rv->Assign(2, make_intrusive<Val>(pow(2, ${nsm.precision}), TYPE_INTERVAL)); rv->Assign(2, make_intrusive<Val>(pow(2, ${nsm.precision}), TYPE_INTERVAL));
rv->Assign(3, proc_ntp_short(${nsm.root_delay})); rv->Assign(3, proc_ntp_short(${nsm.root_delay}));
@ -67,19 +67,19 @@ refine flow NTP_Flow += {
if ( ${nsm.mac_len} == 20 ) if ( ${nsm.mac_len} == 20 )
{ {
rv->Assign(12, val_mgr->GetCount(${nsm.mac.key_id})); rv->Assign(12, val_mgr->Count(${nsm.mac.key_id}));
rv->Assign(13, bytestring_to_val(${nsm.mac.digest})); rv->Assign(13, bytestring_to_val(${nsm.mac.digest}));
} }
else if ( ${nsm.mac_len} == 24 ) else if ( ${nsm.mac_len} == 24 )
{ {
rv->Assign(12, val_mgr->GetCount(${nsm.mac_ext.key_id})); rv->Assign(12, val_mgr->Count(${nsm.mac_ext.key_id}));
rv->Assign(13, bytestring_to_val(${nsm.mac_ext.digest})); rv->Assign(13, bytestring_to_val(${nsm.mac_ext.digest}));
} }
if ( ${nsm.has_exts} ) if ( ${nsm.has_exts} )
{ {
// TODO: add extension fields // TODO: add extension fields
rv->Assign(14, val_mgr->GetCount((uint32) ${nsm.exts}->size())); rv->Assign(14, val_mgr->Count((uint32) ${nsm.exts}->size()));
} }
return rv; return rv;
@ -90,20 +90,20 @@ refine flow NTP_Flow += {
%{ %{
RecordVal* rv = new RecordVal(BifType::Record::NTP::ControlMessage); RecordVal* rv = new RecordVal(BifType::Record::NTP::ControlMessage);
rv->Assign(0, val_mgr->GetCount(${ncm.OpCode})); rv->Assign(0, val_mgr->Count(${ncm.OpCode}));
rv->Assign(1, val_mgr->Bool(${ncm.R})); rv->Assign(1, val_mgr->Bool(${ncm.R}));
rv->Assign(2, val_mgr->Bool(${ncm.E})); rv->Assign(2, val_mgr->Bool(${ncm.E}));
rv->Assign(3, val_mgr->Bool(${ncm.M})); rv->Assign(3, val_mgr->Bool(${ncm.M}));
rv->Assign(4, val_mgr->GetCount(${ncm.sequence})); rv->Assign(4, val_mgr->Count(${ncm.sequence}));
rv->Assign(5, val_mgr->GetCount(${ncm.status})); rv->Assign(5, val_mgr->Count(${ncm.status}));
rv->Assign(6, val_mgr->GetCount(${ncm.association_id})); rv->Assign(6, val_mgr->Count(${ncm.association_id}));
if ( ${ncm.c} > 0 ) if ( ${ncm.c} > 0 )
rv->Assign(7, bytestring_to_val(${ncm.data})); rv->Assign(7, bytestring_to_val(${ncm.data}));
if ( ${ncm.has_control_mac} ) if ( ${ncm.has_control_mac} )
{ {
rv->Assign(8, val_mgr->GetCount(${ncm.mac.key_id})); rv->Assign(8, val_mgr->Count(${ncm.mac.key_id}));
rv->Assign(9, bytestring_to_val(${ncm.mac.crypto_checksum})); rv->Assign(9, bytestring_to_val(${ncm.mac.crypto_checksum}));
} }
@ -115,11 +115,11 @@ refine flow NTP_Flow += {
%{ %{
RecordVal* rv = new RecordVal(BifType::Record::NTP::Mode7Message); RecordVal* rv = new RecordVal(BifType::Record::NTP::Mode7Message);
rv->Assign(0, val_mgr->GetCount(${m7.request_code})); rv->Assign(0, val_mgr->Count(${m7.request_code}));
rv->Assign(1, val_mgr->Bool(${m7.auth_bit})); rv->Assign(1, val_mgr->Bool(${m7.auth_bit}));
rv->Assign(2, val_mgr->GetCount(${m7.sequence})); rv->Assign(2, val_mgr->Count(${m7.sequence}));
rv->Assign(3, val_mgr->GetCount(${m7.implementation})); rv->Assign(3, val_mgr->Count(${m7.implementation}));
rv->Assign(4, val_mgr->GetCount(${m7.error_code})); rv->Assign(4, val_mgr->Count(${m7.error_code}));
if ( ${m7.data_len} > 0 ) if ( ${m7.data_len} > 0 )
rv->Assign(5, bytestring_to_val(${m7.data})); rv->Assign(5, bytestring_to_val(${m7.data}));
@ -136,8 +136,8 @@ refine flow NTP_Flow += {
return false; return false;
RecordVal* rv = new RecordVal(BifType::Record::NTP::Message); RecordVal* rv = new RecordVal(BifType::Record::NTP::Message);
rv->Assign(0, val_mgr->GetCount(${msg.version})); rv->Assign(0, val_mgr->Count(${msg.version}));
rv->Assign(1, val_mgr->GetCount(${msg.mode})); rv->Assign(1, val_mgr->Count(${msg.mode}));
// The standard record // The standard record
if ( ${msg.mode} >=1 && ${msg.mode} <= 5 ) if ( ${msg.mode} >=1 && ${msg.mode} <= 5 )

15
src/analyzer/protocol/radius/radius-analyzer.pac
View file

@ -8,19 +8,20 @@ refine flow RADIUS_Flow += {
return false; return false;
RecordVal* result = new RecordVal(BifType::Record::RADIUS::Message); RecordVal* result = new RecordVal(BifType::Record::RADIUS::Message);
result->Assign(0, val_mgr->GetCount(${msg.code})); result->Assign(0, val_mgr->Count(${msg.code}));
result->Assign(1, val_mgr->GetCount(${msg.trans_id})); result->Assign(1, val_mgr->Count(${msg.trans_id}));
result->Assign(2, bytestring_to_val(${msg.authenticator})); result->Assign(2, bytestring_to_val(${msg.authenticator}));
if ( ${msg.attributes}->size() ) if ( ${msg.attributes}->size() )
{ {
TableVal* attributes = new TableVal({NewRef{}, BifType::Table::RADIUS::Attributes}); TableVal* attributes = new TableVal({NewRef{}, BifType::Table::RADIUS::Attributes});
for ( uint i = 0; i < ${msg.attributes}->size(); ++i ) { for ( uint i = 0; i < ${msg.attributes}->size(); ++i )
Val* index = val_mgr->GetCount(${msg.attributes[i].code}); {
auto index = val_mgr->Count(${msg.attributes[i].code});
// Do we already have a vector of attributes for this type? // Do we already have a vector of attributes for this type?
auto current = attributes->Lookup(index); auto current = attributes->Lookup(index.get());
Val* val = bytestring_to_val(${msg.attributes[i].value}); Val* val = bytestring_to_val(${msg.attributes[i].value});
if ( current ) if ( current )
@ -33,10 +34,8 @@ refine flow RADIUS_Flow += {
{ {
VectorVal* attribute_list = new VectorVal(BifType::Vector::RADIUS::AttributeList); VectorVal* attribute_list = new VectorVal(BifType::Vector::RADIUS::AttributeList);
attribute_list->Assign((unsigned int)0, val); attribute_list->Assign((unsigned int)0, val);
attributes->Assign(index, attribute_list); attributes->Assign(index.get(), attribute_list);
} }
Unref(index);
} }
result->Assign(3, attributes); result->Assign(3, attributes);

44
src/analyzer/protocol/rdp/rdp-analyzer.pac
View file

@ -73,24 +73,24 @@ refine flow RDP_Flow += {
ec_flags->Assign(8, val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU})); ec_flags->Assign(8, val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU}));
RecordVal* ccd = new RecordVal(BifType::Record::RDP::ClientCoreData); RecordVal* ccd = new RecordVal(BifType::Record::RDP::ClientCoreData);
ccd->Assign(0, val_mgr->GetCount(${ccore.version_major})); ccd->Assign(0, val_mgr->Count(${ccore.version_major}));
ccd->Assign(1, val_mgr->GetCount(${ccore.version_minor})); ccd->Assign(1, val_mgr->Count(${ccore.version_minor}));
ccd->Assign(2, val_mgr->GetCount(${ccore.desktop_width})); ccd->Assign(2, val_mgr->Count(${ccore.desktop_width}));
ccd->Assign(3, val_mgr->GetCount(${ccore.desktop_height})); ccd->Assign(3, val_mgr->Count(${ccore.desktop_height}));
ccd->Assign(4, val_mgr->GetCount(${ccore.color_depth})); ccd->Assign(4, val_mgr->Count(${ccore.color_depth}));
ccd->Assign(5, val_mgr->GetCount(${ccore.sas_sequence})); ccd->Assign(5, val_mgr->Count(${ccore.sas_sequence}));
ccd->Assign(6, val_mgr->GetCount(${ccore.keyboard_layout})); ccd->Assign(6, val_mgr->Count(${ccore.keyboard_layout}));
ccd->Assign(7, val_mgr->GetCount(${ccore.client_build})); ccd->Assign(7, val_mgr->Count(${ccore.client_build}));
ccd->Assign(8, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.client_name})); ccd->Assign(8, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.client_name}));
ccd->Assign(9, val_mgr->GetCount(${ccore.keyboard_type})); ccd->Assign(9, val_mgr->Count(${ccore.keyboard_type}));
ccd->Assign(10, val_mgr->GetCount(${ccore.keyboard_sub})); ccd->Assign(10, val_mgr->Count(${ccore.keyboard_sub}));
ccd->Assign(11, val_mgr->GetCount(${ccore.keyboard_function_key})); ccd->Assign(11, val_mgr->Count(${ccore.keyboard_function_key}));
ccd->Assign(12, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.ime_file_name})); ccd->Assign(12, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.ime_file_name}));
ccd->Assign(13, val_mgr->GetCount(${ccore.post_beta2_color_depth})); ccd->Assign(13, val_mgr->Count(${ccore.post_beta2_color_depth}));
ccd->Assign(14, val_mgr->GetCount(${ccore.client_product_id})); ccd->Assign(14, val_mgr->Count(${ccore.client_product_id}));
ccd->Assign(15, val_mgr->GetCount(${ccore.serial_number})); ccd->Assign(15, val_mgr->Count(${ccore.serial_number}));
ccd->Assign(16, val_mgr->GetCount(${ccore.high_color_depth})); ccd->Assign(16, val_mgr->Count(${ccore.high_color_depth}));
ccd->Assign(17, val_mgr->GetCount(${ccore.supported_color_depths})); ccd->Assign(17, val_mgr->Count(${ccore.supported_color_depths}));
ccd->Assign(18, ec_flags); ccd->Assign(18, ec_flags);
ccd->Assign(19, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.dig_product_id})); ccd->Assign(19, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.dig_product_id}));
@ -108,8 +108,8 @@ refine flow RDP_Flow += {
return false; return false;
RecordVal* csd = new RecordVal(BifType::Record::RDP::ClientSecurityData); RecordVal* csd = new RecordVal(BifType::Record::RDP::ClientSecurityData);
csd->Assign(0, val_mgr->GetCount(${csec.encryption_methods})); csd->Assign(0, val_mgr->Count(${csec.encryption_methods}));
csd->Assign(1, val_mgr->GetCount(${csec.ext_encryption_methods})); csd->Assign(1, val_mgr->Count(${csec.ext_encryption_methods}));
BifEvent::generate_rdp_client_security_data(connection()->bro_analyzer(), BifEvent::generate_rdp_client_security_data(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(), connection()->bro_analyzer()->Conn(),
@ -131,7 +131,7 @@ refine flow RDP_Flow += {
RecordVal* channel_def = new RecordVal(BifType::Record::RDP::ClientChannelDef); RecordVal* channel_def = new RecordVal(BifType::Record::RDP::ClientChannelDef);
channel_def->Assign(0, bytestring_to_val(${cnetwork.channel_def_array[i].name})); channel_def->Assign(0, bytestring_to_val(${cnetwork.channel_def_array[i].name}));
channel_def->Assign(1, val_mgr->GetCount(${cnetwork.channel_def_array[i].options})); channel_def->Assign(1, val_mgr->Count(${cnetwork.channel_def_array[i].options}));
channel_def->Assign(2, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED})); channel_def->Assign(2, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED}));
channel_def->Assign(3, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP})); channel_def->Assign(3, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP}));
@ -162,10 +162,10 @@ refine flow RDP_Flow += {
return false; return false;
RecordVal* ccld = new RecordVal(BifType::Record::RDP::ClientClusterData); RecordVal* ccld = new RecordVal(BifType::Record::RDP::ClientClusterData);
ccld->Assign(0, val_mgr->GetCount(${ccluster.flags})); ccld->Assign(0, val_mgr->Count(${ccluster.flags}));
ccld->Assign(1, val_mgr->GetCount(${ccluster.redir_session_id})); ccld->Assign(1, val_mgr->Count(${ccluster.redir_session_id}));
ccld->Assign(2, val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED})); ccld->Assign(2, val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED}));
ccld->Assign(3, val_mgr->GetCount(${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK})); ccld->Assign(3, val_mgr->Count(${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK}));
ccld->Assign(4, val_mgr->Bool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID})); ccld->Assign(4, val_mgr->Bool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID}));
ccld->Assign(5, val_mgr->Bool(${ccluster.REDIRECTED_SMARTCARD})); ccld->Assign(5, val_mgr->Bool(${ccluster.REDIRECTED_SMARTCARD}));

12
src/analyzer/protocol/rpc/MOUNT.cc
View file

@ -196,7 +196,7 @@ zeek::Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c,
for (size_t i = 0; i < c->AuxGIDs().size(); ++i) for (size_t i = 0; i < c->AuxGIDs().size(); ++i)
{ {
auxgids->Assign(i, val_mgr->GetCount(c->AuxGIDs()[i])); auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i]));
} }
auto info = make_intrusive<RecordVal>(BifType::Record::MOUNT3::info_t); auto info = make_intrusive<RecordVal>(BifType::Record::MOUNT3::info_t);
@ -204,13 +204,13 @@ zeek::Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c,
info->Assign(1, BifType::Enum::MOUNT3::status_t->GetVal(mount_status)); info->Assign(1, BifType::Enum::MOUNT3::status_t->GetVal(mount_status));
info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME)); info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME));
info->Assign(3, make_intrusive<Val>(c->LastTime() - c->StartTime(), TYPE_INTERVAL)); info->Assign(3, make_intrusive<Val>(c->LastTime() - c->StartTime(), TYPE_INTERVAL));
info->Assign(4, val_mgr->GetCount(c->RPCLen())); info->Assign(4, val_mgr->Count(c->RPCLen()));
info->Assign(5, make_intrusive<Val>(rep_start_time, TYPE_TIME)); info->Assign(5, make_intrusive<Val>(rep_start_time, TYPE_TIME));
info->Assign(6, make_intrusive<Val>(rep_last_time - rep_start_time, TYPE_INTERVAL)); info->Assign(6, make_intrusive<Val>(rep_last_time - rep_start_time, TYPE_INTERVAL));
info->Assign(7, val_mgr->GetCount(reply_len)); info->Assign(7, val_mgr->Count(reply_len));
info->Assign(8, val_mgr->GetCount(c->Uid())); info->Assign(8, val_mgr->Count(c->Uid()));
info->Assign(9, val_mgr->GetCount(c->Gid())); info->Assign(9, val_mgr->Count(c->Gid()));
info->Assign(10, val_mgr->GetCount(c->Stamp())); info->Assign(10, val_mgr->Count(c->Stamp()));
info->Assign(11, make_intrusive<StringVal>(c->MachineName())); info->Assign(11, make_intrusive<StringVal>(c->MachineName()));
info->Assign(12, std::move(auxgids)); info->Assign(12, std::move(auxgids));

22
src/analyzer/protocol/rpc/NFS.cc
View file

@ -331,20 +331,20 @@ zeek::Args NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_
auto auxgids = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType()); auto auxgids = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
for ( size_t i = 0; i < c->AuxGIDs().size(); ++i ) for ( size_t i = 0; i < c->AuxGIDs().size(); ++i )
auxgids->Assign(i, val_mgr->GetCount(c->AuxGIDs()[i])); auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i]));
auto info = make_intrusive<RecordVal>(BifType::Record::NFS3::info_t); auto info = make_intrusive<RecordVal>(BifType::Record::NFS3::info_t);
info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status)); info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status));
info->Assign(1, BifType::Enum::NFS3::status_t->GetVal(nfs_status)); info->Assign(1, BifType::Enum::NFS3::status_t->GetVal(nfs_status));
info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME)); info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME));
info->Assign(3, make_intrusive<Val>(c->LastTime()-c->StartTime(), TYPE_INTERVAL)); info->Assign(3, make_intrusive<Val>(c->LastTime()-c->StartTime(), TYPE_INTERVAL));
info->Assign(4, val_mgr->GetCount(c->RPCLen())); info->Assign(4, val_mgr->Count(c->RPCLen()));
info->Assign(5, make_intrusive<Val>(rep_start_time, TYPE_TIME)); info->Assign(5, make_intrusive<Val>(rep_start_time, TYPE_TIME));
info->Assign(6, make_intrusive<Val>(rep_last_time-rep_start_time, TYPE_INTERVAL)); info->Assign(6, make_intrusive<Val>(rep_last_time-rep_start_time, TYPE_INTERVAL));
info->Assign(7, val_mgr->GetCount(reply_len)); info->Assign(7, val_mgr->Count(reply_len));
info->Assign(8, val_mgr->GetCount(c->Uid())); info->Assign(8, val_mgr->Count(c->Uid()));
info->Assign(9, val_mgr->GetCount(c->Gid())); info->Assign(9, val_mgr->Count(c->Gid()));
info->Assign(10, val_mgr->GetCount(c->Stamp())); info->Assign(10, val_mgr->Count(c->Stamp()));
info->Assign(11, make_intrusive<StringVal>(c->MachineName())); info->Assign(11, make_intrusive<StringVal>(c->MachineName()));
info->Assign(12, std::move(auxgids)); info->Assign(12, std::move(auxgids));
@ -577,7 +577,7 @@ RecordVal* NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3
rep->Assign(0, nfs3_post_op_attr(buf, n)); rep->Assign(0, nfs3_post_op_attr(buf, n));
bytes_read = extract_XDR_uint32(buf, n); bytes_read = extract_XDR_uint32(buf, n);
rep->Assign(1, val_mgr->GetCount(bytes_read)); rep->Assign(1, val_mgr->Count(bytes_read));
rep->Assign(2, ExtractBool(buf, n)); rep->Assign(2, ExtractBool(buf, n));
rep->Assign(3, nfs3_file_data(buf, n, offset, bytes_read)); rep->Assign(3, nfs3_file_data(buf, n, offset, bytes_read));
} }
@ -660,9 +660,9 @@ RecordVal *NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n)
writeargs->Assign(0, nfs3_fh(buf, n)); writeargs->Assign(0, nfs3_fh(buf, n));
offset = extract_XDR_uint64(buf, n); offset = extract_XDR_uint64(buf, n);
writeargs->Assign(1, val_mgr->GetCount(offset)); // offset writeargs->Assign(1, val_mgr->Count(offset)); // offset
bytes = extract_XDR_uint32(buf, n); bytes = extract_XDR_uint32(buf, n);
writeargs->Assign(2, val_mgr->GetCount(bytes)); // size writeargs->Assign(2, val_mgr->Count(bytes)); // size
writeargs->Assign(3, nfs3_stable_how(buf, n)); writeargs->Assign(3, nfs3_stable_how(buf, n));
writeargs->Assign(4, nfs3_file_data(buf, n, offset, bytes)); writeargs->Assign(4, nfs3_file_data(buf, n, offset, bytes));
@ -806,12 +806,12 @@ RecordVal* NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
Val* NFS_Interp::ExtractUint32(const u_char*& buf, int& n) Val* NFS_Interp::ExtractUint32(const u_char*& buf, int& n)
{ {
return val_mgr->GetCount(extract_XDR_uint32(buf, n)); return val_mgr->Count(extract_XDR_uint32(buf, n)).release();
} }
Val* NFS_Interp::ExtractUint64(const u_char*& buf, int& n) Val* NFS_Interp::ExtractUint64(const u_char*& buf, int& n)
{ {
return val_mgr->GetCount(extract_XDR_uint64(buf, n)); return val_mgr->Count(extract_XDR_uint64(buf, n)).release();
} }
Val* NFS_Interp::ExtractTime(const u_char*& buf, int& n) Val* NFS_Interp::ExtractTime(const u_char*& buf, int& n)

23
src/analyzer/protocol/rpc/Portmap.cc
View file

@ -150,9 +150,8 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
if ( ! m ) if ( ! m )
break; break;
Val* index = val_mgr->GetCount(++nmap); auto index = val_mgr->Count(++nmap);
mappings->Assign(index, m); mappings->Assign(index.get(), m);
Unref(index);
} }
if ( ! buf ) if ( ! buf )
@ -197,8 +196,8 @@ Val* PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
{ {
RecordVal* mapping = new RecordVal(pm_mapping); RecordVal* mapping = new RecordVal(pm_mapping);
mapping->Assign(0, val_mgr->GetCount(extract_XDR_uint32(buf, len))); mapping->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
mapping->Assign(1, val_mgr->GetCount(extract_XDR_uint32(buf, len))); mapping->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP; bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP;
uint32_t port = extract_XDR_uint32(buf, len); uint32_t port = extract_XDR_uint32(buf, len);
@ -218,8 +217,8 @@ Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
{ {
RecordVal* pr = new RecordVal(pm_port_request); RecordVal* pr = new RecordVal(pm_port_request);
pr->Assign(0, val_mgr->GetCount(extract_XDR_uint32(buf, len))); pr->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
pr->Assign(1, val_mgr->GetCount(extract_XDR_uint32(buf, len))); pr->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP; bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP;
pr->Assign(2, val_mgr->Bool(is_tcp)); pr->Assign(2, val_mgr->Bool(is_tcp));
@ -238,13 +237,13 @@ Val* PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len)
{ {
RecordVal* c = new RecordVal(pm_callit_request); RecordVal* c = new RecordVal(pm_callit_request);
c->Assign(0, val_mgr->GetCount(extract_XDR_uint32(buf, len))); c->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
c->Assign(1, val_mgr->GetCount(extract_XDR_uint32(buf, len))); c->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
c->Assign(2, val_mgr->GetCount(extract_XDR_uint32(buf, len))); c->Assign(2, val_mgr->Count(extract_XDR_uint32(buf, len)));
int arg_n; int arg_n;
(void) extract_XDR_opaque(buf, len, arg_n); (void) extract_XDR_opaque(buf, len, arg_n);
c->Assign(3, val_mgr->GetCount(arg_n)); c->Assign(3, val_mgr->Count(arg_n));
if ( ! buf ) if ( ! buf )
{ {
@ -263,7 +262,7 @@ uint32_t PortmapperInterp::CheckPort(uint32_t port)
{ {
analyzer->EnqueueConnEvent(pm_bad_port, analyzer->EnqueueConnEvent(pm_bad_port,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(port)} val_mgr->Count(port)
); );
} }

24
src/analyzer/protocol/rpc/RPC.cc
View file

@ -340,13 +340,13 @@ void RPC_Interpreter::Event_RPC_Dialogue(RPC_CallInfo* c, BifEnum::rpc_status st
if ( rpc_dialogue ) if ( rpc_dialogue )
analyzer->EnqueueConnEvent(rpc_dialogue, analyzer->EnqueueConnEvent(rpc_dialogue,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Program())}, val_mgr->Count(c->Program()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Version())}, val_mgr->Count(c->Version()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Proc())}, val_mgr->Count(c->Proc()),
BifType::Enum::rpc_status->GetVal(status), BifType::Enum::rpc_status->GetVal(status),
make_intrusive<Val>(c->StartTime(), TYPE_TIME), make_intrusive<Val>(c->StartTime(), TYPE_TIME),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->CallLen())}, val_mgr->Count(c->CallLen()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_len)} val_mgr->Count(reply_len)
); );
} }
@ -355,11 +355,11 @@ void RPC_Interpreter::Event_RPC_Call(RPC_CallInfo* c)
if ( rpc_call ) if ( rpc_call )
analyzer->EnqueueConnEvent(rpc_call, analyzer->EnqueueConnEvent(rpc_call,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->XID())}, val_mgr->Count(c->XID()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Program())}, val_mgr->Count(c->Program()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Version())}, val_mgr->Count(c->Version()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->Proc())}, val_mgr->Count(c->Proc()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(c->CallLen())} val_mgr->Count(c->CallLen())
); );
} }
@ -368,9 +368,9 @@ void RPC_Interpreter::Event_RPC_Reply(uint32_t xid, BifEnum::rpc_status status,
if ( rpc_reply ) if ( rpc_reply )
analyzer->EnqueueConnEvent(rpc_reply, analyzer->EnqueueConnEvent(rpc_reply,
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(xid)}, val_mgr->Count(xid),
BifType::Enum::rpc_status->GetVal(status), BifType::Enum::rpc_status->GetVal(status),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_len)} val_mgr->Count(reply_len)
); );
} }

5
src/analyzer/protocol/sip/sip-analyzer.pac
View file

@ -69,9 +69,8 @@ refine flow SIP_Flow += {
for ( unsigned int i = 0; i < headers.size(); ++i ) for ( unsigned int i = 0; i < headers.size(); ++i )
{ // index starting from 1 { // index starting from 1
Val* index = val_mgr->GetCount(i + 1); auto index = val_mgr->Count(i + 1);
t->Assign(index, headers[i]); t->Assign(index.get(), headers[i]);
Unref(index);
} }
return t; return t;

28
src/analyzer/protocol/smb/smb1-com-negotiate.pac
View file

@ -46,7 +46,7 @@ refine connection SMB_Conn += {
{ {
case 0x01: case 0x01:
core = new RecordVal(BifType::Record::SMB1::NegotiateResponseCore); core = new RecordVal(BifType::Record::SMB1::NegotiateResponseCore);
core->Assign(0, val_mgr->GetCount(${val.dialect_index})); core->Assign(0, val_mgr->Count(${val.dialect_index}));
response->Assign(0, core); response->Assign(0, core);
break; break;
@ -61,15 +61,15 @@ refine connection SMB_Conn += {
raw->Assign(1, val_mgr->Bool(${val.lanman.raw_write_supported})); raw->Assign(1, val_mgr->Bool(${val.lanman.raw_write_supported}));
lanman = new RecordVal(BifType::Record::SMB1::NegotiateResponseLANMAN); lanman = new RecordVal(BifType::Record::SMB1::NegotiateResponseLANMAN);
lanman->Assign(0, val_mgr->GetCount(${val.word_count})); lanman->Assign(0, val_mgr->Count(${val.word_count}));
lanman->Assign(1, val_mgr->GetCount(${val.dialect_index})); lanman->Assign(1, val_mgr->Count(${val.dialect_index}));
lanman->Assign(2, security); lanman->Assign(2, security);
lanman->Assign(3, val_mgr->GetCount(${val.lanman.max_buffer_size})); lanman->Assign(3, val_mgr->Count(${val.lanman.max_buffer_size}));
lanman->Assign(4, val_mgr->GetCount(${val.lanman.max_mpx_count})); lanman->Assign(4, val_mgr->Count(${val.lanman.max_mpx_count}));
lanman->Assign(5, val_mgr->GetCount(${val.lanman.max_number_vcs})); lanman->Assign(5, val_mgr->Count(${val.lanman.max_number_vcs}));
lanman->Assign(6, raw); lanman->Assign(6, raw);
lanman->Assign(7, val_mgr->GetCount(${val.lanman.session_key})); lanman->Assign(7, val_mgr->Count(${val.lanman.session_key}));
lanman->Assign(8, time_from_lanman(${val.lanman.server_time}, ${val.lanman.server_date}, ${val.lanman.server_tz})); lanman->Assign(8, time_from_lanman(${val.lanman.server_time}, ${val.lanman.server_date}, ${val.lanman.server_tz}));
lanman->Assign(9, bytestring_to_val(${val.lanman.encryption_key})); lanman->Assign(9, bytestring_to_val(${val.lanman.encryption_key}));
@ -109,15 +109,15 @@ refine connection SMB_Conn += {
capabilities->Assign(17, val_mgr->Bool(${val.ntlm.capabilities_extended_security})); capabilities->Assign(17, val_mgr->Bool(${val.ntlm.capabilities_extended_security}));
ntlm = new RecordVal(BifType::Record::SMB1::NegotiateResponseNTLM); ntlm = new RecordVal(BifType::Record::SMB1::NegotiateResponseNTLM);
ntlm->Assign(0, val_mgr->GetCount(${val.word_count})); ntlm->Assign(0, val_mgr->Count(${val.word_count}));
ntlm->Assign(1, val_mgr->GetCount(${val.dialect_index})); ntlm->Assign(1, val_mgr->Count(${val.dialect_index}));
ntlm->Assign(2, security); ntlm->Assign(2, security);
ntlm->Assign(3, val_mgr->GetCount(${val.ntlm.max_buffer_size})); ntlm->Assign(3, val_mgr->Count(${val.ntlm.max_buffer_size}));
ntlm->Assign(4, val_mgr->GetCount(${val.ntlm.max_mpx_count})); ntlm->Assign(4, val_mgr->Count(${val.ntlm.max_mpx_count}));
ntlm->Assign(5, val_mgr->GetCount(${val.ntlm.max_number_vcs})); ntlm->Assign(5, val_mgr->Count(${val.ntlm.max_number_vcs}));
ntlm->Assign(6, val_mgr->GetCount(${val.ntlm.max_raw_size})); ntlm->Assign(6, val_mgr->Count(${val.ntlm.max_raw_size}));
ntlm->Assign(7, val_mgr->GetCount(${val.ntlm.session_key})); ntlm->Assign(7, val_mgr->Count(${val.ntlm.session_key}));
ntlm->Assign(8, capabilities); ntlm->Assign(8, capabilities);
ntlm->Assign(9, filetime2brotime(${val.ntlm.server_time})); ntlm->Assign(9, filetime2brotime(${val.ntlm.server_time}));

28
src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
View file

@ -15,13 +15,13 @@ refine connection SMB_Conn += {
RecordVal* request = new RecordVal(BifType::Record::SMB1::SessionSetupAndXRequest); RecordVal* request = new RecordVal(BifType::Record::SMB1::SessionSetupAndXRequest);
RecordVal* capabilities; RecordVal* capabilities;
request->Assign(0, val_mgr->GetCount(${val.word_count})); request->Assign(0, val_mgr->Count(${val.word_count}));
switch ( ${val.word_count} ) { switch ( ${val.word_count} ) {
case 10: // pre NT LM 0.12 case 10: // pre NT LM 0.12
request->Assign(1, val_mgr->GetCount(${val.lanman.max_buffer_size})); request->Assign(1, val_mgr->Count(${val.lanman.max_buffer_size}));
request->Assign(2, val_mgr->GetCount(${val.lanman.max_mpx_count})); request->Assign(2, val_mgr->Count(${val.lanman.max_mpx_count}));
request->Assign(3, val_mgr->GetCount(${val.lanman.vc_number})); request->Assign(3, val_mgr->Count(${val.lanman.vc_number}));
request->Assign(4, val_mgr->GetCount(${val.lanman.session_key})); request->Assign(4, val_mgr->Count(${val.lanman.session_key}));
request->Assign(5, smb_string2stringval(${val.lanman.native_os})); request->Assign(5, smb_string2stringval(${val.lanman.native_os}));
request->Assign(6, smb_string2stringval(${val.lanman.native_lanman})); request->Assign(6, smb_string2stringval(${val.lanman.native_lanman}));
@ -39,10 +39,10 @@ refine connection SMB_Conn += {
capabilities->Assign(4, val_mgr->Bool(${val.ntlm_extended_security.capabilities.level_2_oplocks})); capabilities->Assign(4, val_mgr->Bool(${val.ntlm_extended_security.capabilities.level_2_oplocks}));
capabilities->Assign(5, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_find})); capabilities->Assign(5, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_find}));
request->Assign(1, val_mgr->GetCount(${val.ntlm_extended_security.max_buffer_size})); request->Assign(1, val_mgr->Count(${val.ntlm_extended_security.max_buffer_size}));
request->Assign(2, val_mgr->GetCount(${val.ntlm_extended_security.max_mpx_count})); request->Assign(2, val_mgr->Count(${val.ntlm_extended_security.max_mpx_count}));
request->Assign(3, val_mgr->GetCount(${val.ntlm_extended_security.vc_number})); request->Assign(3, val_mgr->Count(${val.ntlm_extended_security.vc_number}));
request->Assign(4, val_mgr->GetCount(${val.ntlm_extended_security.session_key})); request->Assign(4, val_mgr->Count(${val.ntlm_extended_security.session_key}));
request->Assign(5, smb_string2stringval(${val.ntlm_extended_security.native_os})); request->Assign(5, smb_string2stringval(${val.ntlm_extended_security.native_os}));
request->Assign(6, smb_string2stringval(${val.ntlm_extended_security.native_lanman})); request->Assign(6, smb_string2stringval(${val.ntlm_extended_security.native_lanman}));
@ -59,10 +59,10 @@ refine connection SMB_Conn += {
capabilities->Assign(4, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks})); capabilities->Assign(4, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks}));
capabilities->Assign(5, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_find})); capabilities->Assign(5, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_find}));
request->Assign(1, val_mgr->GetCount(${val.ntlm_nonextended_security.max_buffer_size})); request->Assign(1, val_mgr->Count(${val.ntlm_nonextended_security.max_buffer_size}));
request->Assign(2, val_mgr->GetCount(${val.ntlm_nonextended_security.max_mpx_count})); request->Assign(2, val_mgr->Count(${val.ntlm_nonextended_security.max_mpx_count}));
request->Assign(3, val_mgr->GetCount(${val.ntlm_nonextended_security.vc_number})); request->Assign(3, val_mgr->Count(${val.ntlm_nonextended_security.vc_number}));
request->Assign(4, val_mgr->GetCount(${val.ntlm_nonextended_security.session_key})); request->Assign(4, val_mgr->Count(${val.ntlm_nonextended_security.session_key}));
request->Assign(5, smb_string2stringval(${val.ntlm_nonextended_security.native_os})); request->Assign(5, smb_string2stringval(${val.ntlm_nonextended_security.native_os}));
request->Assign(6, smb_string2stringval(${val.ntlm_nonextended_security.native_lanman})); request->Assign(6, smb_string2stringval(${val.ntlm_nonextended_security.native_lanman}));
@ -86,7 +86,7 @@ refine connection SMB_Conn += {
{ {
RecordVal* response = new RecordVal(BifType::Record::SMB1::SessionSetupAndXResponse); RecordVal* response = new RecordVal(BifType::Record::SMB1::SessionSetupAndXResponse);
response->Assign(0, val_mgr->GetCount(${val.word_count})); response->Assign(0, val_mgr->Count(${val.word_count}));
switch ( ${val.word_count} ) switch ( ${val.word_count} )
{ {
case 3: // pre NT LM 0.12 case 3: // pre NT LM 0.12

16
src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac
View file

@ -6,14 +6,14 @@ refine connection SMB_Conn += {
return false; return false;
RecordVal* args = new RecordVal(BifType::Record::SMB1::Trans_Sec_Args); RecordVal* args = new RecordVal(BifType::Record::SMB1::Trans_Sec_Args);
args->Assign(0, val_mgr->GetCount(${val.total_param_count})); args->Assign(0, val_mgr->Count(${val.total_param_count}));
args->Assign(1, val_mgr->GetCount(${val.total_data_count})); args->Assign(1, val_mgr->Count(${val.total_data_count}));
args->Assign(2, val_mgr->GetCount(${val.param_count})); args->Assign(2, val_mgr->Count(${val.param_count}));
args->Assign(3, val_mgr->GetCount(${val.param_offset})); args->Assign(3, val_mgr->Count(${val.param_offset}));
args->Assign(4, val_mgr->GetCount(${val.param_displacement})); args->Assign(4, val_mgr->Count(${val.param_displacement}));
args->Assign(5, val_mgr->GetCount(${val.data_count})); args->Assign(5, val_mgr->Count(${val.data_count}));
args->Assign(6, val_mgr->GetCount(${val.data_offset})); args->Assign(6, val_mgr->Count(${val.data_offset}));
args->Assign(7, val_mgr->GetCount(${val.data_displacement})); args->Assign(7, val_mgr->Count(${val.data_displacement}));
StringVal* parameters = new StringVal(${val.parameters}.length(), StringVal* parameters = new StringVal(${val.parameters}.length(),
(const char*)${val.parameters}.data()); (const char*)${val.parameters}.data());

18
src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac
View file

@ -6,15 +6,15 @@ refine connection SMB_Conn += {
return false; return false;
RecordVal* args = new RecordVal(BifType::Record::SMB1::Trans2_Sec_Args); RecordVal* args = new RecordVal(BifType::Record::SMB1::Trans2_Sec_Args);
args->Assign(0, val_mgr->GetCount(${val.total_param_count})); args->Assign(0, val_mgr->Count(${val.total_param_count}));
args->Assign(1, val_mgr->GetCount(${val.total_data_count})); args->Assign(1, val_mgr->Count(${val.total_data_count}));
args->Assign(2, val_mgr->GetCount(${val.param_count})); args->Assign(2, val_mgr->Count(${val.param_count}));
args->Assign(3, val_mgr->GetCount(${val.param_offset})); args->Assign(3, val_mgr->Count(${val.param_offset}));
args->Assign(4, val_mgr->GetCount(${val.param_displacement})); args->Assign(4, val_mgr->Count(${val.param_displacement}));
args->Assign(5, val_mgr->GetCount(${val.data_count})); args->Assign(5, val_mgr->Count(${val.data_count}));
args->Assign(6, val_mgr->GetCount(${val.data_offset})); args->Assign(6, val_mgr->Count(${val.data_offset}));
args->Assign(7, val_mgr->GetCount(${val.data_displacement})); args->Assign(7, val_mgr->Count(${val.data_displacement}));
args->Assign(8, val_mgr->GetCount(${val.FID})); args->Assign(8, val_mgr->Count(${val.FID}));
StringVal* parameters = new StringVal(${val.parameters}.length(), (const char*)${val.parameters}.data()); StringVal* parameters = new StringVal(${val.parameters}.length(), (const char*)${val.parameters}.data());
StringVal* payload = new StringVal(${val.data}.length(), (const char*)${val.data}.data()); StringVal* payload = new StringVal(${val.data}.length(), (const char*)${val.data}.data());

34
src/analyzer/protocol/smb/smb1-com-transaction2.pac
View file

@ -25,18 +25,18 @@ refine connection SMB_Conn += {
if ( smb1_transaction2_request ) if ( smb1_transaction2_request )
{ {
RecordVal* args = new RecordVal(BifType::Record::SMB1::Trans2_Args); RecordVal* args = new RecordVal(BifType::Record::SMB1::Trans2_Args);
args->Assign(0, val_mgr->GetCount(${val.total_param_count})); args->Assign(0, val_mgr->Count(${val.total_param_count}));
args->Assign(1, val_mgr->GetCount(${val.total_data_count})); args->Assign(1, val_mgr->Count(${val.total_data_count}));
args->Assign(2, val_mgr->GetCount(${val.max_param_count})); args->Assign(2, val_mgr->Count(${val.max_param_count}));
args->Assign(3, val_mgr->GetCount(${val.max_data_count})); args->Assign(3, val_mgr->Count(${val.max_data_count}));
args->Assign(4, val_mgr->GetCount(${val.max_setup_count})); args->Assign(4, val_mgr->Count(${val.max_setup_count}));
args->Assign(5, val_mgr->GetCount(${val.flags})); args->Assign(5, val_mgr->Count(${val.flags}));
args->Assign(6, val_mgr->GetCount(${val.timeout})); args->Assign(6, val_mgr->Count(${val.timeout}));
args->Assign(7, val_mgr->GetCount(${val.param_count})); args->Assign(7, val_mgr->Count(${val.param_count}));
args->Assign(8, val_mgr->GetCount(${val.param_offset})); args->Assign(8, val_mgr->Count(${val.param_offset}));
args->Assign(9, val_mgr->GetCount(${val.data_count})); args->Assign(9, val_mgr->Count(${val.data_count}));
args->Assign(10, val_mgr->GetCount(${val.data_offset})); args->Assign(10, val_mgr->Count(${val.data_offset}));
args->Assign(11, val_mgr->GetCount(${val.setup_count})); args->Assign(11, val_mgr->Count(${val.setup_count}));
BifEvent::generate_smb1_transaction2_request(bro_analyzer(), bro_analyzer()->Conn(), BuildHeaderVal(header), args, ${val.sub_cmd}); BifEvent::generate_smb1_transaction2_request(bro_analyzer(), bro_analyzer()->Conn(), BuildHeaderVal(header), args, ${val.sub_cmd});
} }
@ -128,11 +128,11 @@ refine connection SMB_Conn += {
if ( smb1_trans2_find_first2_request ) if ( smb1_trans2_find_first2_request )
{ {
RecordVal* result = new RecordVal(BifType::Record::SMB1::Find_First2_Request_Args); RecordVal* result = new RecordVal(BifType::Record::SMB1::Find_First2_Request_Args);
result->Assign(0, val_mgr->GetCount(${val.search_attrs})); result->Assign(0, val_mgr->Count(${val.search_attrs}));
result->Assign(1, val_mgr->GetCount(${val.search_count})); result->Assign(1, val_mgr->Count(${val.search_count}));
result->Assign(2, val_mgr->GetCount(${val.flags})); result->Assign(2, val_mgr->Count(${val.flags}));
result->Assign(3, val_mgr->GetCount(${val.info_level})); result->Assign(3, val_mgr->Count(${val.info_level}));
result->Assign(4, val_mgr->GetCount(${val.search_storage_type})); result->Assign(4, val_mgr->Count(${val.search_storage_type}));
result->Assign(5, smb_string2stringval(${val.file_name})); result->Assign(5, smb_string2stringval(${val.file_name}));
BifEvent::generate_smb1_trans2_find_first2_request(bro_analyzer(), bro_analyzer()->Conn(), \ BifEvent::generate_smb1_trans2_find_first2_request(bro_analyzer(), bro_analyzer()->Conn(), \
BuildHeaderVal(header), result); BuildHeaderVal(header), result);

16
src/analyzer/protocol/smb/smb1-protocol.pac
View file

@ -21,14 +21,14 @@ refine connection SMB_Conn += {
// { // do nothing // { // do nothing
// } // }
r->Assign(0, val_mgr->GetCount(${hdr.command})); r->Assign(0, val_mgr->Count(${hdr.command}));
r->Assign(1, val_mgr->GetCount(${hdr.status})); r->Assign(1, val_mgr->Count(${hdr.status}));
r->Assign(2, val_mgr->GetCount(${hdr.flags})); r->Assign(2, val_mgr->Count(${hdr.flags}));
r->Assign(3, val_mgr->GetCount(${hdr.flags2})); r->Assign(3, val_mgr->Count(${hdr.flags2}));
r->Assign(4, val_mgr->GetCount(${hdr.tid})); r->Assign(4, val_mgr->Count(${hdr.tid}));
r->Assign(5, val_mgr->GetCount(${hdr.pid})); r->Assign(5, val_mgr->Count(${hdr.pid}));
r->Assign(6, val_mgr->GetCount(${hdr.uid})); r->Assign(6, val_mgr->Count(${hdr.uid}));
r->Assign(7, val_mgr->GetCount(${hdr.mid})); r->Assign(7, val_mgr->Count(${hdr.mid}));
return r; return r;
%} %}

4
src/analyzer/protocol/smb/smb2-com-close.pac
View file

@ -22,8 +22,8 @@ refine connection SMB_Conn += {
{ {
RecordVal* resp = new RecordVal(BifType::Record::SMB2::CloseResponse); RecordVal* resp = new RecordVal(BifType::Record::SMB2::CloseResponse);
resp->Assign(0, val_mgr->GetCount(${val.alloc_size})); resp->Assign(0, val_mgr->Count(${val.alloc_size}));
resp->Assign(1, val_mgr->GetCount(${val.eof})); resp->Assign(1, val_mgr->Count(${val.eof}));
resp->Assign(2, SMB_BuildMACTimes(${val.last_write_time}, resp->Assign(2, SMB_BuildMACTimes(${val.last_write_time},
${val.last_access_time}, ${val.last_access_time},
${val.creation_time}, ${val.creation_time},

8
src/analyzer/protocol/smb/smb2-com-create.pac
View file

@ -17,8 +17,8 @@ refine connection SMB_Conn += {
{ {
RecordVal* requestinfo = new RecordVal(BifType::Record::SMB2::CreateRequest); RecordVal* requestinfo = new RecordVal(BifType::Record::SMB2::CreateRequest);
requestinfo->Assign(0, filename); requestinfo->Assign(0, filename);
requestinfo->Assign(1, val_mgr->GetCount(${val.disposition})); requestinfo->Assign(1, val_mgr->Count(${val.disposition}));
requestinfo->Assign(2, val_mgr->GetCount(${val.create_options})); requestinfo->Assign(2, val_mgr->Count(${val.create_options}));
BifEvent::generate_smb2_create_request(bro_analyzer(), BifEvent::generate_smb2_create_request(bro_analyzer(),
bro_analyzer()->Conn(), bro_analyzer()->Conn(),
BuildSMB2HeaderVal(h), BuildSMB2HeaderVal(h),
@ -38,13 +38,13 @@ refine connection SMB_Conn += {
{ {
RecordVal* responseinfo = new RecordVal(BifType::Record::SMB2::CreateResponse); RecordVal* responseinfo = new RecordVal(BifType::Record::SMB2::CreateResponse);
responseinfo->Assign(0, BuildSMB2GUID(${val.file_id})); responseinfo->Assign(0, BuildSMB2GUID(${val.file_id}));
responseinfo->Assign(1, val_mgr->GetCount(${val.eof})); responseinfo->Assign(1, val_mgr->Count(${val.eof}));
responseinfo->Assign(2, SMB_BuildMACTimes(${val.last_write_time}, responseinfo->Assign(2, SMB_BuildMACTimes(${val.last_write_time},
${val.last_access_time}, ${val.last_access_time},
${val.creation_time}, ${val.creation_time},
${val.change_time})); ${val.change_time}));
responseinfo->Assign(3, smb2_file_attrs_to_bro(${val.file_attrs})); responseinfo->Assign(3, smb2_file_attrs_to_bro(${val.file_attrs}));
responseinfo->Assign(4, val_mgr->GetCount(${val.create_action})); responseinfo->Assign(4, val_mgr->Count(${val.create_action}));
BifEvent::generate_smb2_create_response(bro_analyzer(), BifEvent::generate_smb2_create_response(bro_analyzer(),
bro_analyzer()->Conn(), bro_analyzer()->Conn(),
BuildSMB2HeaderVal(h), BuildSMB2HeaderVal(h),

8
src/analyzer/protocol/smb/smb2-com-negotiate.pac
View file

@ -25,7 +25,7 @@ refine connection SMB_Conn += {
VectorVal* dialects = new VectorVal(index_vec); VectorVal* dialects = new VectorVal(index_vec);
for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i ) for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i )
{ {
dialects->Assign(i, val_mgr->GetCount((*${val.dialects})[i])); dialects->Assign(i, val_mgr->Count((*${val.dialects})[i]));
} }
BifEvent::generate_smb2_negotiate_request(bro_analyzer(), bro_analyzer()->Conn(), BifEvent::generate_smb2_negotiate_request(bro_analyzer(), bro_analyzer()->Conn(),
BuildSMB2HeaderVal(h), BuildSMB2HeaderVal(h),
@ -41,12 +41,12 @@ refine connection SMB_Conn += {
{ {
RecordVal* nr = new RecordVal(BifType::Record::SMB2::NegotiateResponse); RecordVal* nr = new RecordVal(BifType::Record::SMB2::NegotiateResponse);
nr->Assign(0, val_mgr->GetCount(${val.dialect_revision})); nr->Assign(0, val_mgr->Count(${val.dialect_revision}));
nr->Assign(1, val_mgr->GetCount(${val.security_mode})); nr->Assign(1, val_mgr->Count(${val.security_mode}));
nr->Assign(2, BuildSMB2GUID(${val.server_guid})); nr->Assign(2, BuildSMB2GUID(${val.server_guid}));
nr->Assign(3, filetime2brotime(${val.system_time})); nr->Assign(3, filetime2brotime(${val.system_time}));
nr->Assign(4, filetime2brotime(${val.server_start_time})); nr->Assign(4, filetime2brotime(${val.server_start_time}));
nr->Assign(5, val_mgr->GetCount(${val.negotiate_context_count})); nr->Assign(5, val_mgr->Count(${val.negotiate_context_count}));
VectorVal* cv = new VectorVal(BifType::Vector::SMB2::NegotiateContextValues); VectorVal* cv = new VectorVal(BifType::Vector::SMB2::NegotiateContextValues);

2
src/analyzer/protocol/smb/smb2-com-session-setup.pac
View file

@ -5,7 +5,7 @@ refine connection SMB_Conn += {
if ( smb2_session_setup_request ) if ( smb2_session_setup_request )
{ {
RecordVal* req = new RecordVal(BifType::Record::SMB2::SessionSetupRequest); RecordVal* req = new RecordVal(BifType::Record::SMB2::SessionSetupRequest);
req->Assign(0, val_mgr->GetCount(${val.security_mode})); req->Assign(0, val_mgr->Count(${val.security_mode}));
BifEvent::generate_smb2_session_setup_request(bro_analyzer(), BifEvent::generate_smb2_session_setup_request(bro_analyzer(),
bro_analyzer()->Conn(), bro_analyzer()->Conn(),

6
src/analyzer/protocol/smb/smb2-com-set-info.pac
View file

@ -196,9 +196,9 @@ refine connection SMB_Conn += {
r->Assign(0, val_mgr->Int(${val.free_space_start_filtering})); r->Assign(0, val_mgr->Int(${val.free_space_start_filtering}));
r->Assign(1, val_mgr->Int(${val.free_space_start_threshold})); r->Assign(1, val_mgr->Int(${val.free_space_start_threshold}));
r->Assign(2, val_mgr->Int(${val.free_space_stop_filtering})); r->Assign(2, val_mgr->Int(${val.free_space_stop_filtering}));
r->Assign(3, val_mgr->GetCount(${val.default_quota_threshold})); r->Assign(3, val_mgr->Count(${val.default_quota_threshold}));
r->Assign(4, val_mgr->GetCount(${val.default_quota_limit})); r->Assign(4, val_mgr->Count(${val.default_quota_limit}));
r->Assign(5, val_mgr->GetCount(${val.file_system_control_flags})); r->Assign(5, val_mgr->Count(${val.file_system_control_flags}));
BifEvent::generate_smb2_file_fscontrol(bro_analyzer(), BifEvent::generate_smb2_file_fscontrol(bro_analyzer(),
bro_analyzer()->Conn(), bro_analyzer()->Conn(),

6
src/analyzer/protocol/smb/smb2-com-transform-header.pac
View file

@ -6,9 +6,9 @@ refine connection SMB_Conn += {
r->Assign(0, bytestring_to_val(${hdr.signature})); r->Assign(0, bytestring_to_val(${hdr.signature}));
r->Assign(1, bytestring_to_val(${hdr.nonce})); r->Assign(1, bytestring_to_val(${hdr.nonce}));
r->Assign(2, val_mgr->GetCount(${hdr.orig_msg_size})); r->Assign(2, val_mgr->Count(${hdr.orig_msg_size}));
r->Assign(3, val_mgr->GetCount(${hdr.flags})); r->Assign(3, val_mgr->Count(${hdr.flags}));
r->Assign(4, val_mgr->GetCount(${hdr.session_id})); r->Assign(4, val_mgr->Count(${hdr.session_id}));
return r; return r;
%} %}

2
src/analyzer/protocol/smb/smb2-com-tree-connect.pac
View file

@ -19,7 +19,7 @@ refine connection SMB_Conn += {
if ( smb2_tree_connect_response ) if ( smb2_tree_connect_response )
{ {
RecordVal* resp = new RecordVal(BifType::Record::SMB2::TreeConnectResponse); RecordVal* resp = new RecordVal(BifType::Record::SMB2::TreeConnectResponse);
resp->Assign(0, val_mgr->GetCount(${val.share_type})); resp->Assign(0, val_mgr->Count(${val.share_type}));
BifEvent::generate_smb2_tree_connect_response(bro_analyzer(), BifEvent::generate_smb2_tree_connect_response(bro_analyzer(),
bro_analyzer()->Conn(), bro_analyzer()->Conn(),

40
src/analyzer/protocol/smb/smb2-protocol.pac
View file

@ -104,20 +104,20 @@ refine connection SMB_Conn += {
%{ %{
RecordVal* r = new RecordVal(BifType::Record::SMB2::NegotiateContextValue); RecordVal* r = new RecordVal(BifType::Record::SMB2::NegotiateContextValue);
r->Assign(0, val_mgr->GetCount(${ncv.context_type})); r->Assign(0, val_mgr->Count(${ncv.context_type}));
r->Assign(1, val_mgr->GetCount(${ncv.data_length})); r->Assign(1, val_mgr->Count(${ncv.data_length}));
switch ( ${ncv.context_type} ) { switch ( ${ncv.context_type} ) {
case SMB2_PREAUTH_INTEGRITY_CAPABILITIES: case SMB2_PREAUTH_INTEGRITY_CAPABILITIES:
{ {
RecordVal* rpreauth = new RecordVal(BifType::Record::SMB2::PreAuthIntegrityCapabilities); RecordVal* rpreauth = new RecordVal(BifType::Record::SMB2::PreAuthIntegrityCapabilities);
rpreauth->Assign(0, val_mgr->GetCount(${ncv.preauth_integrity_capabilities.hash_alg_count})); rpreauth->Assign(0, val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg_count}));
rpreauth->Assign(1, val_mgr->GetCount(${ncv.preauth_integrity_capabilities.salt_length})); rpreauth->Assign(1, val_mgr->Count(${ncv.preauth_integrity_capabilities.salt_length}));
VectorVal* ha = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* ha = new VectorVal(internal_type("index_vec")->AsVectorType());
for ( int i = 0; i < (${ncv.preauth_integrity_capabilities.hash_alg_count}); ++i ) for ( int i = 0; i < (${ncv.preauth_integrity_capabilities.hash_alg_count}); ++i )
ha->Assign(i, val_mgr->GetCount(${ncv.preauth_integrity_capabilities.hash_alg[i]})); ha->Assign(i, val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg[i]}));
rpreauth->Assign(2, ha); rpreauth->Assign(2, ha);
rpreauth->Assign(3, bytestring_to_val(${ncv.preauth_integrity_capabilities.salt})); rpreauth->Assign(3, bytestring_to_val(${ncv.preauth_integrity_capabilities.salt}));
@ -128,12 +128,12 @@ refine connection SMB_Conn += {
case SMB2_ENCRYPTION_CAPABILITIES: case SMB2_ENCRYPTION_CAPABILITIES:
{ {
RecordVal* rencr = new RecordVal(BifType::Record::SMB2::EncryptionCapabilities); RecordVal* rencr = new RecordVal(BifType::Record::SMB2::EncryptionCapabilities);
rencr->Assign(0, val_mgr->GetCount(${ncv.encryption_capabilities.cipher_count})); rencr->Assign(0, val_mgr->Count(${ncv.encryption_capabilities.cipher_count}));
VectorVal* c = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* c = new VectorVal(internal_type("index_vec")->AsVectorType());
for ( int i = 0; i < (${ncv.encryption_capabilities.cipher_count}); ++i ) for ( int i = 0; i < (${ncv.encryption_capabilities.cipher_count}); ++i )
c->Assign(i, val_mgr->GetCount(${ncv.encryption_capabilities.ciphers[i]})); c->Assign(i, val_mgr->Count(${ncv.encryption_capabilities.ciphers[i]}));
rencr->Assign(1, c); rencr->Assign(1, c);
r->Assign(3, rencr); r->Assign(3, rencr);
@ -143,12 +143,12 @@ refine connection SMB_Conn += {
case SMB2_COMPRESSION_CAPABILITIES: case SMB2_COMPRESSION_CAPABILITIES:
{ {
RecordVal* rcomp = new RecordVal(BifType::Record::SMB2::CompressionCapabilities); RecordVal* rcomp = new RecordVal(BifType::Record::SMB2::CompressionCapabilities);
rcomp->Assign(0, val_mgr->GetCount(${ncv.compression_capabilities.alg_count})); rcomp->Assign(0, val_mgr->Count(${ncv.compression_capabilities.alg_count}));
VectorVal* c = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* c = new VectorVal(internal_type("index_vec")->AsVectorType());
for ( int i = 0; i < (${ncv.compression_capabilities.alg_count}); ++i ) for ( int i = 0; i < (${ncv.compression_capabilities.alg_count}); ++i )
c->Assign(i, val_mgr->GetCount(${ncv.compression_capabilities.algs[i]})); c->Assign(i, val_mgr->Count(${ncv.compression_capabilities.algs[i]}));
rcomp->Assign(1, c); rcomp->Assign(1, c);
r->Assign(4, rcomp); r->Assign(4, rcomp);
@ -172,15 +172,15 @@ refine connection SMB_Conn += {
%{ %{
RecordVal* r = new RecordVal(BifType::Record::SMB2::Header); RecordVal* r = new RecordVal(BifType::Record::SMB2::Header);
r->Assign(0, val_mgr->GetCount(${hdr.credit_charge})); r->Assign(0, val_mgr->Count(${hdr.credit_charge}));
r->Assign(1, val_mgr->GetCount(${hdr.status})); r->Assign(1, val_mgr->Count(${hdr.status}));
r->Assign(2, val_mgr->GetCount(${hdr.command})); r->Assign(2, val_mgr->Count(${hdr.command}));
r->Assign(3, val_mgr->GetCount(${hdr.credits})); r->Assign(3, val_mgr->Count(${hdr.credits}));
r->Assign(4, val_mgr->GetCount(${hdr.flags})); r->Assign(4, val_mgr->Count(${hdr.flags}));
r->Assign(5, val_mgr->GetCount(${hdr.message_id})); r->Assign(5, val_mgr->Count(${hdr.message_id}));
r->Assign(6, val_mgr->GetCount(${hdr.process_id})); r->Assign(6, val_mgr->Count(${hdr.process_id}));
r->Assign(7, val_mgr->GetCount(${hdr.tree_id})); r->Assign(7, val_mgr->Count(${hdr.tree_id}));
r->Assign(8, val_mgr->GetCount(${hdr.session_id})); r->Assign(8, val_mgr->Count(${hdr.session_id}));
r->Assign(9, bytestring_to_val(${hdr.signature})); r->Assign(9, bytestring_to_val(${hdr.signature}));
return r; return r;
@ -190,8 +190,8 @@ refine connection SMB_Conn += {
%{ %{
RecordVal* r = new RecordVal(BifType::Record::SMB2::GUID); RecordVal* r = new RecordVal(BifType::Record::SMB2::GUID);
r->Assign(0, val_mgr->GetCount(${file_id.persistent})); r->Assign(0, val_mgr->Count(${file_id.persistent}));
r->Assign(1, val_mgr->GetCount(${file_id._volatile})); r->Assign(1, val_mgr->Count(${file_id._volatile}));
return r; return r;
%} %}

2
src/analyzer/protocol/smtp/SMTP.cc
View file

@ -352,7 +352,7 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig)
EnqueueConnEvent(smtp_reply, EnqueueConnEvent(smtp_reply,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(orig), val_mgr->Bool(orig),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, val_mgr->Count(reply_code),
make_intrusive<StringVal>(cmd), make_intrusive<StringVal>(cmd),
make_intrusive<StringVal>(end_of_line - line, line), make_intrusive<StringVal>(end_of_line - line, line),
val_mgr->Bool((pending_reply > 0)) val_mgr->Bool((pending_reply > 0))

6
src/analyzer/protocol/snmp/snmp-analyzer.pac
View file

@ -47,7 +47,7 @@ Val* asn1_obj_to_val(const ASN1Encoding* obj)
RecordVal* rval = new RecordVal(BifType::Record::SNMP::ObjectValue); RecordVal* rval = new RecordVal(BifType::Record::SNMP::ObjectValue);
uint8 tag = obj->meta()->tag(); uint8 tag = obj->meta()->tag();
rval->Assign(0, val_mgr->GetCount(tag)); rval->Assign(0, val_mgr->Count(tag));
switch ( tag ) { switch ( tag ) {
case VARBIND_UNSPECIFIED_TAG: case VARBIND_UNSPECIFIED_TAG:
@ -93,7 +93,7 @@ Val* time_ticks_to_val(const TimeTicks* tt)
RecordVal* build_hdr(const Header* header) RecordVal* build_hdr(const Header* header)
{ {
RecordVal* rv = new RecordVal(BifType::Record::SNMP::Header); RecordVal* rv = new RecordVal(BifType::Record::SNMP::Header);
rv->Assign(0, val_mgr->GetCount(header->version())); rv->Assign(0, val_mgr->Count(header->version()));
switch ( header->version() ) { switch ( header->version() ) {
case SNMPV1_TAG: case SNMPV1_TAG:
@ -133,7 +133,7 @@ RecordVal* build_hdrV3(const Header* header)
v3->Assign(0, asn1_integer_to_val(global_data->id(), TYPE_COUNT)); v3->Assign(0, asn1_integer_to_val(global_data->id(), TYPE_COUNT));
v3->Assign(1, asn1_integer_to_val(global_data->max_size(), v3->Assign(1, asn1_integer_to_val(global_data->max_size(),
TYPE_COUNT)); TYPE_COUNT));
v3->Assign(2, val_mgr->GetCount(flags_byte)); v3->Assign(2, val_mgr->Count(flags_byte));
v3->Assign(3, val_mgr->Bool(flags_byte & 0x01)); v3->Assign(3, val_mgr->Bool(flags_byte & 0x01));
v3->Assign(4, val_mgr->Bool(flags_byte & 0x02)); v3->Assign(4, val_mgr->Bool(flags_byte & 0x02));
v3->Assign(5, val_mgr->Bool(flags_byte & 0x04)); v3->Assign(5, val_mgr->Bool(flags_byte & 0x04));

4
src/analyzer/protocol/ssl/proc-client-hello.pac
View file

@ -25,7 +25,7 @@
VectorVal* cipher_vec = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* cipher_vec = new VectorVal(internal_type("index_vec")->AsVectorType());
for ( unsigned int i = 0; i < cipher_suites->size(); ++i ) for ( unsigned int i = 0; i < cipher_suites->size(); ++i )
{ {
Val* ciph = val_mgr->GetCount((*cipher_suites)[i]); auto ciph = val_mgr->Count((*cipher_suites)[i]);
cipher_vec->Assign(i, ciph); cipher_vec->Assign(i, ciph);
} }
@ -34,7 +34,7 @@
{ {
for ( unsigned int i = 0; i < compression_methods->size(); ++i ) for ( unsigned int i = 0; i < compression_methods->size(); ++i )
{ {
Val* comp = val_mgr->GetCount((*compression_methods)[i]); auto comp = val_mgr->Count((*compression_methods)[i]);
comp_vec->Assign(i, comp); comp_vec->Assign(i, comp);
} }
} }

42
src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
View file

@ -80,7 +80,7 @@ refine connection Handshake_Conn += {
if ( point_format_list ) if ( point_format_list )
{ {
for ( unsigned int i = 0; i < point_format_list->size(); ++i ) for ( unsigned int i = 0; i < point_format_list->size(); ++i )
points->Assign(i, val_mgr->GetCount((*point_format_list)[i])); points->Assign(i, val_mgr->Count((*point_format_list)[i]));
} }
BifEvent::generate_ssl_extension_ec_point_formats(bro_analyzer(), bro_analyzer()->Conn(), BifEvent::generate_ssl_extension_ec_point_formats(bro_analyzer(), bro_analyzer()->Conn(),
@ -99,7 +99,7 @@ refine connection Handshake_Conn += {
if ( list ) if ( list )
{ {
for ( unsigned int i = 0; i < list->size(); ++i ) for ( unsigned int i = 0; i < list->size(); ++i )
curves->Assign(i, val_mgr->GetCount((*list)[i])); curves->Assign(i, val_mgr->Count((*list)[i]));
} }
BifEvent::generate_ssl_extension_elliptic_curves(bro_analyzer(), bro_analyzer()->Conn(), BifEvent::generate_ssl_extension_elliptic_curves(bro_analyzer(), bro_analyzer()->Conn(),
@ -118,7 +118,7 @@ refine connection Handshake_Conn += {
if ( keyshare ) if ( keyshare )
{ {
for ( unsigned int i = 0; i < keyshare->size(); ++i ) for ( unsigned int i = 0; i < keyshare->size(); ++i )
nglist->Assign(i, val_mgr->GetCount((*keyshare)[i]->namedgroup())); nglist->Assign(i, val_mgr->Count((*keyshare)[i]->namedgroup()));
} }
BifEvent::generate_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, nglist); BifEvent::generate_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, nglist);
@ -133,7 +133,7 @@ refine connection Handshake_Conn += {
VectorVal* nglist = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* nglist = new VectorVal(internal_type("index_vec")->AsVectorType());
nglist->Assign(0u, val_mgr->GetCount(keyshare->namedgroup())); nglist->Assign(0u, val_mgr->Count(keyshare->namedgroup()));
BifEvent::generate_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, nglist); BifEvent::generate_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, nglist);
return true; return true;
%} %}
@ -145,7 +145,7 @@ refine connection Handshake_Conn += {
VectorVal* nglist = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* nglist = new VectorVal(internal_type("index_vec")->AsVectorType());
nglist->Assign(0u, val_mgr->GetCount(namedgroup)); nglist->Assign(0u, val_mgr->Count(namedgroup));
BifEvent::generate_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, nglist); BifEvent::generate_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, nglist);
return true; return true;
%} %}
@ -162,8 +162,8 @@ refine connection Handshake_Conn += {
for ( unsigned int i = 0; i < supported_signature_algorithms->size(); ++i ) for ( unsigned int i = 0; i < supported_signature_algorithms->size(); ++i )
{ {
RecordVal* el = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm); RecordVal* el = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm);
el->Assign(0, val_mgr->GetCount((*supported_signature_algorithms)[i]->HashAlgorithm())); el->Assign(0, val_mgr->Count((*supported_signature_algorithms)[i]->HashAlgorithm()));
el->Assign(1, val_mgr->GetCount((*supported_signature_algorithms)[i]->SignatureAlgorithm())); el->Assign(1, val_mgr->Count((*supported_signature_algorithms)[i]->SignatureAlgorithm()));
slist->Assign(i, el); slist->Assign(i, el);
} }
} }
@ -233,7 +233,7 @@ refine connection Handshake_Conn += {
if ( versions_list ) if ( versions_list )
{ {
for ( unsigned int i = 0; i < versions_list->size(); ++i ) for ( unsigned int i = 0; i < versions_list->size(); ++i )
versions->Assign(i, val_mgr->GetCount((*versions_list)[i])); versions->Assign(i, val_mgr->Count((*versions_list)[i]));
} }
BifEvent::generate_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(), BifEvent::generate_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(),
@ -248,7 +248,7 @@ refine connection Handshake_Conn += {
return true; return true;
VectorVal* versions = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* versions = new VectorVal(internal_type("index_vec")->AsVectorType());
versions->Assign(0u, val_mgr->GetCount(version)); versions->Assign(0u, val_mgr->Count(version));
BifEvent::generate_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(), BifEvent::generate_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(),
${rec.is_orig}, versions); ${rec.is_orig}, versions);
@ -266,7 +266,7 @@ refine connection Handshake_Conn += {
if ( mode_list ) if ( mode_list )
{ {
for ( unsigned int i = 0; i < mode_list->size(); ++i ) for ( unsigned int i = 0; i < mode_list->size(); ++i )
modes->Assign(i, val_mgr->GetCount((*mode_list)[i])); modes->Assign(i, val_mgr->Count((*mode_list)[i]));
} }
BifEvent::generate_ssl_extension_psk_key_exchange_modes(bro_analyzer(), bro_analyzer()->Conn(), BifEvent::generate_ssl_extension_psk_key_exchange_modes(bro_analyzer(), bro_analyzer()->Conn(),
@ -345,14 +345,14 @@ refine connection Handshake_Conn += {
RecordVal* ha = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm); RecordVal* ha = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm);
if ( ${kex.signed_params.uses_signature_and_hashalgorithm} ) if ( ${kex.signed_params.uses_signature_and_hashalgorithm} )
{ {
ha->Assign(0, val_mgr->GetCount(${kex.signed_params.algorithm.HashAlgorithm})); ha->Assign(0, val_mgr->Count(${kex.signed_params.algorithm.HashAlgorithm}));
ha->Assign(1, val_mgr->GetCount(${kex.signed_params.algorithm.SignatureAlgorithm})); ha->Assign(1, val_mgr->Count(${kex.signed_params.algorithm.SignatureAlgorithm}));
} }
else else
{ {
// set to impossible value // set to impossible value
ha->Assign(0, val_mgr->GetCount(256)); ha->Assign(0, val_mgr->Count(256));
ha->Assign(1, val_mgr->GetCount(256)); ha->Assign(1, val_mgr->Count(256));
} }
BifEvent::generate_ssl_server_signature(bro_analyzer(), BifEvent::generate_ssl_server_signature(bro_analyzer(),
@ -404,8 +404,8 @@ refine connection Handshake_Conn += {
return true; return true;
RecordVal* ha = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm); RecordVal* ha = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm);
ha->Assign(0, val_mgr->GetCount(digitally_signed_algorithms->HashAlgorithm())); ha->Assign(0, val_mgr->Count(digitally_signed_algorithms->HashAlgorithm()));
ha->Assign(1, val_mgr->GetCount(digitally_signed_algorithms->SignatureAlgorithm())); ha->Assign(1, val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm()));
BifEvent::generate_ssl_extension_signed_certificate_timestamp(bro_analyzer(), BifEvent::generate_ssl_extension_signed_certificate_timestamp(bro_analyzer(),
bro_analyzer()->Conn(), ${rec.is_orig}, bro_analyzer()->Conn(), ${rec.is_orig},
@ -434,14 +434,14 @@ refine connection Handshake_Conn += {
RecordVal* ha = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm); RecordVal* ha = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm);
if ( ${signed_params.uses_signature_and_hashalgorithm} ) if ( ${signed_params.uses_signature_and_hashalgorithm} )
{ {
ha->Assign(0, val_mgr->GetCount(${signed_params.algorithm.HashAlgorithm})); ha->Assign(0, val_mgr->Count(${signed_params.algorithm.HashAlgorithm}));
ha->Assign(1, val_mgr->GetCount(${signed_params.algorithm.SignatureAlgorithm})); ha->Assign(1, val_mgr->Count(${signed_params.algorithm.SignatureAlgorithm}));
} }
else else
{ {
// set to impossible value // set to impossible value
ha->Assign(0, val_mgr->GetCount(256)); ha->Assign(0, val_mgr->Count(256));
ha->Assign(1, val_mgr->GetCount(256)); ha->Assign(1, val_mgr->Count(256));
} }
BifEvent::generate_ssl_server_signature(bro_analyzer(), BifEvent::generate_ssl_server_signature(bro_analyzer(),
@ -488,7 +488,7 @@ refine connection Handshake_Conn += {
{ {
RecordVal* el = new RecordVal(BifType::Record::SSL::PSKIdentity); RecordVal* el = new RecordVal(BifType::Record::SSL::PSKIdentity);
el->Assign(0, make_intrusive<StringVal>(identity->identity().length(), (const char*) identity->identity().data())); el->Assign(0, make_intrusive<StringVal>(identity->identity().length(), (const char*) identity->identity().data()));
el->Assign(1, val_mgr->GetCount(identity->obfuscated_ticket_age())); el->Assign(1, val_mgr->Count(identity->obfuscated_ticket_age()));
slist->Assign(slist->Size(), el); slist->Assign(slist->Size(), el);
} }
} }

62
src/analyzer/protocol/tcp/TCP.cc
View file

@ -111,11 +111,11 @@ static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip,
v->Assign(0, val_mgr->Bool(is_orig)); v->Assign(0, val_mgr->Bool(is_orig));
v->Assign(1, val_mgr->Bool(int(ip->DF()))); v->Assign(1, val_mgr->Bool(int(ip->DF())));
v->Assign(2, val_mgr->GetCount((ip->TTL()))); v->Assign(2, val_mgr->Count((ip->TTL())));
v->Assign(3, val_mgr->GetCount((ip->TotalLen()))); v->Assign(3, val_mgr->Count((ip->TotalLen())));
v->Assign(4, val_mgr->GetCount(ntohs(tcp->th_win))); v->Assign(4, val_mgr->Count(ntohs(tcp->th_win)));
v->Assign(5, val_mgr->Int(winscale)); v->Assign(5, val_mgr->Int(winscale));
v->Assign(6, val_mgr->GetCount(MSS)); v->Assign(6, val_mgr->Count(MSS));
v->Assign(7, val_mgr->Bool(SACK)); v->Assign(7, val_mgr->Bool(SACK));
return v; return v;
@ -789,9 +789,9 @@ void TCP_Analyzer::GeneratePacketEvent(
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
make_intrusive<StringVal>(flags.AsString()), make_intrusive<StringVal>(flags.AsString()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(rel_seq)}, val_mgr->Count(rel_seq),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flags.ACK() ? rel_ack : 0)}, val_mgr->Count(flags.ACK() ? rel_ack : 0),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}, val_mgr->Count(len),
// We need the min() here because Ethernet padding can lead to // We need the min() here because Ethernet padding can lead to
// caplen > len. // caplen > len.
make_intrusive<StringVal>(std::min(caplen, len), (const char*) data) make_intrusive<StringVal>(std::min(caplen, len), (const char*) data)
@ -1289,10 +1289,10 @@ void TCP_Analyzer::UpdateConnVal(RecordVal *conn_val)
RecordVal *orig_endp_val = conn_val->Lookup("orig")->AsRecordVal(); RecordVal *orig_endp_val = conn_val->Lookup("orig")->AsRecordVal();
RecordVal *resp_endp_val = conn_val->Lookup("resp")->AsRecordVal(); RecordVal *resp_endp_val = conn_val->Lookup("resp")->AsRecordVal();
orig_endp_val->Assign(0, val_mgr->GetCount(orig->Size())); orig_endp_val->Assign(0, val_mgr->Count(orig->Size()));
orig_endp_val->Assign(1, val_mgr->GetCount(int(orig->state))); orig_endp_val->Assign(1, val_mgr->Count(int(orig->state)));
resp_endp_val->Assign(0, val_mgr->GetCount(resp->Size())); resp_endp_val->Assign(0, val_mgr->Count(resp->Size()));
resp_endp_val->Assign(1, val_mgr->GetCount(int(resp->state))); resp_endp_val->Assign(1, val_mgr->Count(int(resp->state)));
// Call children's UpdateConnVal // Call children's UpdateConnVal
Analyzer::UpdateConnVal(conn_val); Analyzer::UpdateConnVal(conn_val);
@ -1348,8 +1348,8 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
EnqueueConnEvent(tcp_option, EnqueueConnEvent(tcp_option,
IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildConnVal()},
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(kind)}, val_mgr->Count(kind),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(length)} val_mgr->Count(length)
); );
} }
@ -1373,8 +1373,8 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
auto length = kind < 2 ? 1 : o[1]; auto length = kind < 2 ? 1 : o[1];
auto option_record = new RecordVal(BifType::Record::TCP::Option); auto option_record = new RecordVal(BifType::Record::TCP::Option);
option_list->Assign(option_list->Size(), option_record); option_list->Assign(option_list->Size(), option_record);
option_record->Assign(0, val_mgr->GetCount(kind)); option_record->Assign(0, val_mgr->Count(kind));
option_record->Assign(1, val_mgr->GetCount(length)); option_record->Assign(1, val_mgr->Count(length));
switch ( kind ) { switch ( kind ) {
case 2: case 2:
@ -1382,7 +1382,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
if ( length == 4 ) if ( length == 4 )
{ {
auto mss = ntohs(*reinterpret_cast<const uint16_t*>(o + 2)); auto mss = ntohs(*reinterpret_cast<const uint16_t*>(o + 2));
option_record->Assign(3, val_mgr->GetCount(mss)); option_record->Assign(3, val_mgr->Count(mss));
} }
else else
{ {
@ -1396,7 +1396,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
if ( length == 3 ) if ( length == 3 )
{ {
auto scale = o[2]; auto scale = o[2];
option_record->Assign(4, val_mgr->GetCount(scale)); option_record->Assign(4, val_mgr->Count(scale));
} }
else else
{ {
@ -1425,7 +1425,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
auto sack = new VectorVal(vt); auto sack = new VectorVal(vt);
for ( auto i = 0; i < num_pointers; ++i ) for ( auto i = 0; i < num_pointers; ++i )
sack->Assign(sack->Size(), val_mgr->GetCount(ntohl(p[i]))); sack->Assign(sack->Size(), val_mgr->Count(ntohl(p[i])));
option_record->Assign(5, sack); option_record->Assign(5, sack);
} }
@ -1442,8 +1442,8 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
{ {
auto send = ntohl(*reinterpret_cast<const uint32_t*>(o + 2)); auto send = ntohl(*reinterpret_cast<const uint32_t*>(o + 2));
auto echo = ntohl(*reinterpret_cast<const uint32_t*>(o + 6)); auto echo = ntohl(*reinterpret_cast<const uint32_t*>(o + 6));
option_record->Assign(6, val_mgr->GetCount(send)); option_record->Assign(6, val_mgr->Count(send));
option_record->Assign(7, val_mgr->GetCount(echo)); option_record->Assign(7, val_mgr->Count(echo));
} }
else else
{ {
@ -2063,10 +2063,10 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl
endp->TCP()->EnqueueConnEvent(tcp_rexmit, endp->TCP()->EnqueueConnEvent(tcp_rexmit,
IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()}, IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()},
val_mgr->Bool(endp->IsOrig()), val_mgr->Bool(endp->IsOrig()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, val_mgr->Count(seq),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}, val_mgr->Count(len),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(data_in_flight)}, val_mgr->Count(data_in_flight),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(endp->peer->window)} val_mgr->Count(endp->peer->window)
); );
} }
else else
@ -2079,13 +2079,13 @@ RecordVal* TCPStats_Endpoint::BuildStats()
{ {
RecordVal* stats = new RecordVal(endpoint_stats); RecordVal* stats = new RecordVal(endpoint_stats);
stats->Assign(0, val_mgr->GetCount(num_pkts)); stats->Assign(0, val_mgr->Count(num_pkts));
stats->Assign(1, val_mgr->GetCount(num_rxmit)); stats->Assign(1, val_mgr->Count(num_rxmit));
stats->Assign(2, val_mgr->GetCount(num_rxmit_bytes)); stats->Assign(2, val_mgr->Count(num_rxmit_bytes));
stats->Assign(3, val_mgr->GetCount(num_in_order)); stats->Assign(3, val_mgr->Count(num_in_order));
stats->Assign(4, val_mgr->GetCount(num_OO)); stats->Assign(4, val_mgr->Count(num_OO));
stats->Assign(5, val_mgr->GetCount(num_repl)); stats->Assign(5, val_mgr->Count(num_repl));
stats->Assign(6, val_mgr->GetCount(endian_type)); stats->Assign(6, val_mgr->Count(endian_type));
return stats; return stats;
} }

6
src/analyzer/protocol/tcp/TCP_Reassembler.cc
View file

@ -154,8 +154,8 @@ void TCP_Reassembler::Gap(uint64_t seq, uint64_t len)
dst_analyzer->EnqueueConnEvent(content_gap, dst_analyzer->EnqueueConnEvent(content_gap,
IntrusivePtr{AdoptRef{}, dst_analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, dst_analyzer->BuildConnVal()},
val_mgr->Bool(IsOrig()), val_mgr->Bool(IsOrig()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, val_mgr->Count(seq),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} val_mgr->Count(len)
); );
if ( type == Direct ) if ( type == Direct )
@ -615,7 +615,7 @@ void TCP_Reassembler::DeliverBlock(uint64_t seq, int len, const u_char* data)
tcp_analyzer->EnqueueConnEvent(tcp_contents, tcp_analyzer->EnqueueConnEvent(tcp_contents,
IntrusivePtr{AdoptRef{}, tcp_analyzer->BuildConnVal()}, IntrusivePtr{AdoptRef{}, tcp_analyzer->BuildConnVal()},
val_mgr->Bool(IsOrig()), val_mgr->Bool(IsOrig()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, val_mgr->Count(seq),
make_intrusive<StringVal>(len, (const char*) data) make_intrusive<StringVal>(len, (const char*) data)
); );

16
src/analyzer/protocol/tcp/functions.bif
View file

@ -20,18 +20,18 @@ function get_orig_seq%(cid: conn_id%): count
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = sessions->FindConnection(cid);
if ( ! c ) if ( ! c )
return val_mgr->GetCount(0); return val_mgr->Count(0);
if ( c->ConnTransport() != TRANSPORT_TCP ) if ( c->ConnTransport() != TRANSPORT_TCP )
return val_mgr->GetCount(0); return val_mgr->Count(0);
analyzer::Analyzer* tc = c->FindAnalyzer("TCP"); analyzer::Analyzer* tc = c->FindAnalyzer("TCP");
if ( tc ) if ( tc )
return val_mgr->GetCount(static_cast<analyzer::tcp::TCP_Analyzer*>(tc)->OrigSeq()); return val_mgr->Count(static_cast<analyzer::tcp::TCP_Analyzer*>(tc)->OrigSeq());
else else
{ {
reporter->Error("connection does not have TCP analyzer"); reporter->Error("connection does not have TCP analyzer");
return val_mgr->GetCount(0); return val_mgr->Count(0);
} }
%} %}
@ -49,18 +49,18 @@ function get_resp_seq%(cid: conn_id%): count
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = sessions->FindConnection(cid);
if ( ! c ) if ( ! c )
return val_mgr->GetCount(0); return val_mgr->Count(0);
if ( c->ConnTransport() != TRANSPORT_TCP ) if ( c->ConnTransport() != TRANSPORT_TCP )
return val_mgr->GetCount(0); return val_mgr->Count(0);
analyzer::Analyzer* tc = c->FindAnalyzer("TCP"); analyzer::Analyzer* tc = c->FindAnalyzer("TCP");
if ( tc ) if ( tc )
return val_mgr->GetCount(static_cast<analyzer::tcp::TCP_Analyzer*>(tc)->RespSeq()); return val_mgr->Count(static_cast<analyzer::tcp::TCP_Analyzer*>(tc)->RespSeq());
else else
{ {
reporter->Error("connection does not have TCP analyzer"); reporter->Error("connection does not have TCP analyzer");
return val_mgr->GetCount(0); return val_mgr->Count(0);
} }
%} %}

4
src/analyzer/protocol/teredo/Teredo.cc
View file

@ -122,8 +122,8 @@ RecordVal* TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
new BroString(auth + 4, id_len, true))); new BroString(auth + 4, id_len, true)));
teredo_auth->Assign(1, make_intrusive<StringVal>( teredo_auth->Assign(1, make_intrusive<StringVal>(
new BroString(auth + 4 + id_len, au_len, true))); new BroString(auth + 4 + id_len, au_len, true)));
teredo_auth->Assign(2, val_mgr->GetCount(nonce)); teredo_auth->Assign(2, val_mgr->Count(nonce));
teredo_auth->Assign(3, val_mgr->GetCount(conf)); teredo_auth->Assign(3, val_mgr->Count(conf));
teredo_hdr->Assign(0, teredo_auth); teredo_hdr->Assign(0, teredo_auth);
} }

8
src/analyzer/protocol/udp/UDP.cc
View file

@ -228,14 +228,14 @@ void UDP_Analyzer::UpdateEndpointVal(RecordVal* endp, bool is_orig)
bro_int_t size = is_orig ? request_len : reply_len; bro_int_t size = is_orig ? request_len : reply_len;
if ( size < 0 ) if ( size < 0 )
{ {
endp->Assign(0, val_mgr->GetCount(0)); endp->Assign(0, val_mgr->Count(0));
endp->Assign(1, val_mgr->GetCount(int(UDP_INACTIVE))); endp->Assign(1, val_mgr->Count(int(UDP_INACTIVE)));
} }
else else
{ {
endp->Assign(0, val_mgr->GetCount(size)); endp->Assign(0, val_mgr->Count(size));
endp->Assign(1, val_mgr->GetCount(int(UDP_ACTIVE))); endp->Assign(1, val_mgr->Count(int(UDP_ACTIVE)));
} }
} }

2
src/analyzer/protocol/vxlan/VXLAN.cc
View file

@ -102,7 +102,7 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
if ( vxlan_packet ) if ( vxlan_packet )
Conn()->Event(vxlan_packet, nullptr, inner->BuildPktHdrVal(), Conn()->Event(vxlan_packet, nullptr, inner->BuildPktHdrVal(),
val_mgr->GetCount(vni)); val_mgr->Count(vni).release());
EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN); EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN);
sessions->DoNextInnerPacket(network_time, &pkt, inner, estack, ec); sessions->DoNextInnerPacket(network_time, &pkt, inner, estack, ec);

4
src/broker/Data.cc
View file

@ -97,9 +97,9 @@ struct val_converter {
result_type operator()(uint64_t a) result_type operator()(uint64_t a)
{ {
if ( type->Tag() == TYPE_COUNT ) if ( type->Tag() == TYPE_COUNT )
return val_mgr->GetCount(a); return val_mgr->Count(a).release();
if ( type->Tag() == TYPE_COUNTER ) if ( type->Tag() == TYPE_COUNTER )
return val_mgr->GetCount(a); return val_mgr->Count(a).release();
return nullptr; return nullptr;
} }

8
src/broker/data.bif
View file

@ -72,7 +72,7 @@ function Broker::__set_size%(s: Broker::Data%): count
%{ %{
auto& v = bro_broker::require_data_type<broker::set>(s->AsRecordVal(), auto& v = bro_broker::require_data_type<broker::set>(s->AsRecordVal(),
TYPE_TABLE, frame); TYPE_TABLE, frame);
return val_mgr->GetCount(static_cast<uint64_t>(v.size())); return val_mgr->Count(static_cast<uint64_t>(v.size()));
%} %}
function Broker::__set_contains%(s: Broker::Data, key: any%): bool function Broker::__set_contains%(s: Broker::Data, key: any%): bool
@ -175,7 +175,7 @@ function Broker::__table_size%(t: Broker::Data%): count
%{ %{
auto& v = bro_broker::require_data_type<broker::table>(t->AsRecordVal(), auto& v = bro_broker::require_data_type<broker::table>(t->AsRecordVal(),
TYPE_TABLE, frame); TYPE_TABLE, frame);
return val_mgr->GetCount(static_cast<uint64_t>(v.size())); return val_mgr->Count(static_cast<uint64_t>(v.size()));
%} %}
function Broker::__table_contains%(t: Broker::Data, key: any%): bool function Broker::__table_contains%(t: Broker::Data, key: any%): bool
@ -334,7 +334,7 @@ function Broker::__vector_size%(v: Broker::Data%): count
%{ %{
auto& vec = bro_broker::require_data_type<broker::vector>(v->AsRecordVal(), auto& vec = bro_broker::require_data_type<broker::vector>(v->AsRecordVal(),
TYPE_VECTOR, frame); TYPE_VECTOR, frame);
return val_mgr->GetCount(static_cast<uint64_t>(vec.size())); return val_mgr->Count(static_cast<uint64_t>(vec.size()));
%} %}
function Broker::__vector_insert%(v: Broker::Data, idx:count, d: any%): bool function Broker::__vector_insert%(v: Broker::Data, idx:count, d: any%): bool
@ -444,7 +444,7 @@ function Broker::__record_size%(r: Broker::Data%): count
%{ %{
auto& v = bro_broker::require_data_type<broker::vector>(r->AsRecordVal(), auto& v = bro_broker::require_data_type<broker::vector>(r->AsRecordVal(),
TYPE_RECORD, frame); TYPE_RECORD, frame);
return val_mgr->GetCount(static_cast<uint64_t>(v.size())); return val_mgr->Count(static_cast<uint64_t>(v.size()));
%} %}
function Broker::__record_assign%(r: Broker::Data, idx: count, d: any%): bool function Broker::__record_assign%(r: Broker::Data, idx: count, d: any%): bool

2
src/broker/messaging.bif
View file

@ -117,7 +117,7 @@ function Broker::publish%(topic: string, ...%): bool
function Broker::__flush_logs%(%): count function Broker::__flush_logs%(%): count
%{ %{
auto rval = broker_mgr->FlushLogBuffers(); auto rval = broker_mgr->FlushLogBuffers();
return val_mgr->GetCount(static_cast<uint64_t>(rval)); return val_mgr->Count(static_cast<uint64_t>(rval));
%} %}
function Broker::__publish_id%(topic: string, id: string%): bool function Broker::__publish_id%(topic: string, id: string%): bool

12
src/file_analysis/File.cc
View file

@ -226,13 +226,13 @@ bool File::SetExtractionLimit(RecordVal* args, uint64_t bytes)
void File::IncrementByteCount(uint64_t size, int field_idx) void File::IncrementByteCount(uint64_t size, int field_idx)
{ {
uint64_t old = LookupFieldDefaultCount(field_idx); uint64_t old = LookupFieldDefaultCount(field_idx);
val->Assign(field_idx, val_mgr->GetCount(old + size)); val->Assign(field_idx, val_mgr->Count(old + size));
} }
void File::SetTotalBytes(uint64_t size) void File::SetTotalBytes(uint64_t size)
{ {
DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Total bytes %" PRIu64, id.c_str(), size); DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Total bytes %" PRIu64, id.c_str(), size);
val->Assign(total_bytes_idx, val_mgr->GetCount(size)); val->Assign(total_bytes_idx, val_mgr->Count(size));
} }
bool File::IsComplete() const bool File::IsComplete() const
@ -455,8 +455,8 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
{ {
FileEvent(file_reassembly_overflow, { FileEvent(file_reassembly_overflow, {
IntrusivePtr{NewRef{}, val}, IntrusivePtr{NewRef{}, val},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(current_offset)}, val_mgr->Count(current_offset),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(gap_bytes)} val_mgr->Count(gap_bytes)
}); });
} }
} }
@ -600,8 +600,8 @@ void File::Gap(uint64_t offset, uint64_t len)
{ {
FileEvent(file_gap, { FileEvent(file_gap, {
IntrusivePtr{NewRef{}, val}, IntrusivePtr{NewRef{}, val},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(offset)}, val_mgr->Count(offset),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} val_mgr->Count(len)
}); });
} }

5
src/file_analysis/Manager.cc
View file

@ -448,9 +448,8 @@ bool Manager::IsDisabled(const analyzer::Tag& tag)
if ( ! disabled ) if ( ! disabled )
disabled = internal_const_val("Files::disable")->AsTableVal(); disabled = internal_const_val("Files::disable")->AsTableVal();
Val* index = val_mgr->GetCount(bool(tag)); auto index = val_mgr->Count(bool(tag));
auto yield = disabled->Lookup(index); auto yield = disabled->Lookup(index.get());
Unref(index);
if ( ! yield ) if ( ! yield )
return false; return false;

2
src/file_analysis/analyzer/data_event/DataEvent.cc
View file

@ -45,7 +45,7 @@ bool DataEvent::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
mgr.Enqueue(chunk_event, mgr.Enqueue(chunk_event,
IntrusivePtr{NewRef{}, GetFile()->GetVal()}, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
make_intrusive<StringVal>(new BroString(data, len, false)), make_intrusive<StringVal>(new BroString(data, len, false)),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(offset)} val_mgr->Count(offset)
); );
return true; return true;

4
src/file_analysis/analyzer/extract/Extract.cc
View file

@ -94,8 +94,8 @@ bool Extract::DeliverStream(const u_char* data, uint64_t len)
f->FileEvent(file_extraction_limit, { f->FileEvent(file_extraction_limit, {
IntrusivePtr{NewRef{}, f->GetVal()}, IntrusivePtr{NewRef{}, f->GetVal()},
IntrusivePtr{NewRef{}, Args()}, IntrusivePtr{NewRef{}, Args()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(limit)}, val_mgr->Count(limit),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} val_mgr->Count(len)
}); });
// Limit may have been modified by a BIF, re-check it. // Limit may have been modified by a BIF, re-check it.

107
src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

@ -13,7 +13,7 @@ VectorVal* process_rvas(const RVAS* rva_table)
{ {
VectorVal* rvas = new VectorVal(internal_type("index_vec")->AsVectorType()); VectorVal* rvas = new VectorVal(internal_type("index_vec")->AsVectorType());
for ( uint16 i=0; i < rva_table->rvas()->size(); ++i ) for ( uint16 i=0; i < rva_table->rvas()->size(); ++i )
rvas->Assign(i, val_mgr->GetCount((*rva_table->rvas())[i]->size())); rvas->Assign(i, val_mgr->Count((*rva_table->rvas())[i]->size()));
return rvas; return rvas;
} }
@ -30,9 +30,8 @@ refine flow File += {
{ {
if ( ((c >> i) & 0x1) == 1 ) if ( ((c >> i) & 0x1) == 1 )
{ {
Val *ch = val_mgr->GetCount((1<<i)&mask); auto ch = val_mgr->Count((1<<i)&mask);
char_set->Assign(ch, 0); char_set->Assign(ch.get(), 0);
Unref(ch);
} }
} }
return char_set; return char_set;
@ -44,22 +43,22 @@ refine flow File += {
{ {
auto dh = make_intrusive<RecordVal>(BifType::Record::PE::DOSHeader); auto dh = make_intrusive<RecordVal>(BifType::Record::PE::DOSHeader);
dh->Assign(0, make_intrusive<StringVal>(${h.signature}.length(), (const char*) ${h.signature}.data())); dh->Assign(0, make_intrusive<StringVal>(${h.signature}.length(), (const char*) ${h.signature}.data()));
dh->Assign(1, val_mgr->GetCount(${h.UsedBytesInTheLastPage})); dh->Assign(1, val_mgr->Count(${h.UsedBytesInTheLastPage}));
dh->Assign(2, val_mgr->GetCount(${h.FileSizeInPages})); dh->Assign(2, val_mgr->Count(${h.FileSizeInPages}));
dh->Assign(3, val_mgr->GetCount(${h.NumberOfRelocationItems})); dh->Assign(3, val_mgr->Count(${h.NumberOfRelocationItems}));
dh->Assign(4, val_mgr->GetCount(${h.HeaderSizeInParagraphs})); dh->Assign(4, val_mgr->Count(${h.HeaderSizeInParagraphs}));
dh->Assign(5, val_mgr->GetCount(${h.MinimumExtraParagraphs})); dh->Assign(5, val_mgr->Count(${h.MinimumExtraParagraphs}));
dh->Assign(6, val_mgr->GetCount(${h.MaximumExtraParagraphs})); dh->Assign(6, val_mgr->Count(${h.MaximumExtraParagraphs}));
dh->Assign(7, val_mgr->GetCount(${h.InitialRelativeSS})); dh->Assign(7, val_mgr->Count(${h.InitialRelativeSS}));
dh->Assign(8, val_mgr->GetCount(${h.InitialSP})); dh->Assign(8, val_mgr->Count(${h.InitialSP}));
dh->Assign(9, val_mgr->GetCount(${h.Checksum})); dh->Assign(9, val_mgr->Count(${h.Checksum}));
dh->Assign(10, val_mgr->GetCount(${h.InitialIP})); dh->Assign(10, val_mgr->Count(${h.InitialIP}));
dh->Assign(11, val_mgr->GetCount(${h.InitialRelativeCS})); dh->Assign(11, val_mgr->Count(${h.InitialRelativeCS}));
dh->Assign(12, val_mgr->GetCount(${h.AddressOfRelocationTable})); dh->Assign(12, val_mgr->Count(${h.AddressOfRelocationTable}));
dh->Assign(13, val_mgr->GetCount(${h.OverlayNumber})); dh->Assign(13, val_mgr->Count(${h.OverlayNumber}));
dh->Assign(14, val_mgr->GetCount(${h.OEMid})); dh->Assign(14, val_mgr->Count(${h.OEMid}));
dh->Assign(15, val_mgr->GetCount(${h.OEMinfo})); dh->Assign(15, val_mgr->Count(${h.OEMinfo}));
dh->Assign(16, val_mgr->GetCount(${h.AddressOfNewExeHeader})); dh->Assign(16, val_mgr->Count(${h.AddressOfNewExeHeader}));
mgr.Enqueue(pe_dos_header, mgr.Enqueue(pe_dos_header,
IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
@ -93,11 +92,11 @@ refine flow File += {
if ( pe_file_header ) if ( pe_file_header )
{ {
auto fh = make_intrusive<RecordVal>(BifType::Record::PE::FileHeader); auto fh = make_intrusive<RecordVal>(BifType::Record::PE::FileHeader);
fh->Assign(0, val_mgr->GetCount(${h.Machine})); fh->Assign(0, val_mgr->Count(${h.Machine}));
fh->Assign(1, make_intrusive<Val>(static_cast<double>(${h.TimeDateStamp}), TYPE_TIME)); fh->Assign(1, make_intrusive<Val>(static_cast<double>(${h.TimeDateStamp}), TYPE_TIME));
fh->Assign(2, val_mgr->GetCount(${h.PointerToSymbolTable})); fh->Assign(2, val_mgr->Count(${h.PointerToSymbolTable}));
fh->Assign(3, val_mgr->GetCount(${h.NumberOfSymbols})); fh->Assign(3, val_mgr->Count(${h.NumberOfSymbols}));
fh->Assign(4, val_mgr->GetCount(${h.SizeOfOptionalHeader})); fh->Assign(4, val_mgr->Count(${h.SizeOfOptionalHeader}));
fh->Assign(5, characteristics_to_bro(${h.Characteristics}, 16)); fh->Assign(5, characteristics_to_bro(${h.Characteristics}, 16));
mgr.Enqueue(pe_file_header, mgr.Enqueue(pe_file_header,
@ -122,31 +121,31 @@ refine flow File += {
{ {
auto oh = make_intrusive<RecordVal>(BifType::Record::PE::OptionalHeader); auto oh = make_intrusive<RecordVal>(BifType::Record::PE::OptionalHeader);
oh->Assign(0, val_mgr->GetCount(${h.magic})); oh->Assign(0, val_mgr->Count(${h.magic}));
oh->Assign(1, val_mgr->GetCount(${h.major_linker_version})); oh->Assign(1, val_mgr->Count(${h.major_linker_version}));
oh->Assign(2, val_mgr->GetCount(${h.minor_linker_version})); oh->Assign(2, val_mgr->Count(${h.minor_linker_version}));
oh->Assign(3, val_mgr->GetCount(${h.size_of_code})); oh->Assign(3, val_mgr->Count(${h.size_of_code}));
oh->Assign(4, val_mgr->GetCount(${h.size_of_init_data})); oh->Assign(4, val_mgr->Count(${h.size_of_init_data}));
oh->Assign(5, val_mgr->GetCount(${h.size_of_uninit_data})); oh->Assign(5, val_mgr->Count(${h.size_of_uninit_data}));
oh->Assign(6, val_mgr->GetCount(${h.addr_of_entry_point})); oh->Assign(6, val_mgr->Count(${h.addr_of_entry_point}));
oh->Assign(7, val_mgr->GetCount(${h.base_of_code})); oh->Assign(7, val_mgr->Count(${h.base_of_code}));
if ( ${h.pe_format} != PE32_PLUS ) if ( ${h.pe_format} != PE32_PLUS )
oh->Assign(8, val_mgr->GetCount(${h.base_of_data})); oh->Assign(8, val_mgr->Count(${h.base_of_data}));
oh->Assign(9, val_mgr->GetCount(${h.image_base})); oh->Assign(9, val_mgr->Count(${h.image_base}));
oh->Assign(10, val_mgr->GetCount(${h.section_alignment})); oh->Assign(10, val_mgr->Count(${h.section_alignment}));
oh->Assign(11, val_mgr->GetCount(${h.file_alignment})); oh->Assign(11, val_mgr->Count(${h.file_alignment}));
oh->Assign(12, val_mgr->GetCount(${h.os_version_major})); oh->Assign(12, val_mgr->Count(${h.os_version_major}));
oh->Assign(13, val_mgr->GetCount(${h.os_version_minor})); oh->Assign(13, val_mgr->Count(${h.os_version_minor}));
oh->Assign(14, val_mgr->GetCount(${h.major_image_version})); oh->Assign(14, val_mgr->Count(${h.major_image_version}));
oh->Assign(15, val_mgr->GetCount(${h.minor_image_version})); oh->Assign(15, val_mgr->Count(${h.minor_image_version}));
oh->Assign(16, val_mgr->GetCount(${h.minor_subsys_version})); oh->Assign(16, val_mgr->Count(${h.minor_subsys_version}));
oh->Assign(17, val_mgr->GetCount(${h.minor_subsys_version})); oh->Assign(17, val_mgr->Count(${h.minor_subsys_version}));
oh->Assign(18, val_mgr->GetCount(${h.size_of_image})); oh->Assign(18, val_mgr->Count(${h.size_of_image}));
oh->Assign(19, val_mgr->GetCount(${h.size_of_headers})); oh->Assign(19, val_mgr->Count(${h.size_of_headers}));
oh->Assign(20, val_mgr->GetCount(${h.checksum})); oh->Assign(20, val_mgr->Count(${h.checksum}));
oh->Assign(21, val_mgr->GetCount(${h.subsystem})); oh->Assign(21, val_mgr->Count(${h.subsystem}));
oh->Assign(22, characteristics_to_bro(${h.dll_characteristics}, 16)); oh->Assign(22, characteristics_to_bro(${h.dll_characteristics}, 16));
oh->Assign(23, process_rvas(${h.rvas})); oh->Assign(23, process_rvas(${h.rvas}));
@ -173,14 +172,14 @@ refine flow File += {
name_len = first_null - ${h.name}.data(); name_len = first_null - ${h.name}.data();
section_header->Assign(0, make_intrusive<StringVal>(name_len, (const char*) ${h.name}.data())); section_header->Assign(0, make_intrusive<StringVal>(name_len, (const char*) ${h.name}.data()));
section_header->Assign(1, val_mgr->GetCount(${h.virtual_size})); section_header->Assign(1, val_mgr->Count(${h.virtual_size}));
section_header->Assign(2, val_mgr->GetCount(${h.virtual_addr})); section_header->Assign(2, val_mgr->Count(${h.virtual_addr}));
section_header->Assign(3, val_mgr->GetCount(${h.size_of_raw_data})); section_header->Assign(3, val_mgr->Count(${h.size_of_raw_data}));
section_header->Assign(4, val_mgr->GetCount(${h.ptr_to_raw_data})); section_header->Assign(4, val_mgr->Count(${h.ptr_to_raw_data}));
section_header->Assign(5, val_mgr->GetCount(${h.non_used_ptr_to_relocs})); section_header->Assign(5, val_mgr->Count(${h.non_used_ptr_to_relocs}));
section_header->Assign(6, val_mgr->GetCount(${h.non_used_ptr_to_line_nums})); section_header->Assign(6, val_mgr->Count(${h.non_used_ptr_to_line_nums}));
section_header->Assign(7, val_mgr->GetCount(${h.non_used_num_of_relocs})); section_header->Assign(7, val_mgr->Count(${h.non_used_num_of_relocs}));
section_header->Assign(8, val_mgr->GetCount(${h.non_used_num_of_line_nums})); section_header->Assign(8, val_mgr->Count(${h.non_used_num_of_line_nums}));
section_header->Assign(9, characteristics_to_bro(${h.characteristics}, 32)); section_header->Assign(9, characteristics_to_bro(${h.characteristics}, 32));
mgr.Enqueue(pe_section_header, mgr.Enqueue(pe_section_header,

48
src/file_analysis/analyzer/unified2/unified2-analyzer.pac
View file

@ -67,19 +67,19 @@ refine flow Flow += {
if ( ::unified2_event ) if ( ::unified2_event )
{ {
auto ids_event = make_intrusive<RecordVal>(BifType::Record::Unified2::IDSEvent); auto ids_event = make_intrusive<RecordVal>(BifType::Record::Unified2::IDSEvent);
ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id})); ids_event->Assign(0, val_mgr->Count(${ev.sensor_id}));
ids_event->Assign(1, val_mgr->GetCount(${ev.event_id})); ids_event->Assign(1, val_mgr->Count(${ev.event_id}));
ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME)); ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME));
ids_event->Assign(3, val_mgr->GetCount(${ev.signature_id})); ids_event->Assign(3, val_mgr->Count(${ev.signature_id}));
ids_event->Assign(4, val_mgr->GetCount(${ev.generator_id})); ids_event->Assign(4, val_mgr->Count(${ev.generator_id}));
ids_event->Assign(5, val_mgr->GetCount(${ev.signature_revision})); ids_event->Assign(5, val_mgr->Count(${ev.signature_revision}));
ids_event->Assign(6, val_mgr->GetCount(${ev.classification_id})); ids_event->Assign(6, val_mgr->Count(${ev.classification_id}));
ids_event->Assign(7, val_mgr->GetCount(${ev.priority_id})); ids_event->Assign(7, val_mgr->Count(${ev.priority_id}));
ids_event->Assign(8, unified2_addr_to_bro_addr(${ev.src_ip})); ids_event->Assign(8, unified2_addr_to_bro_addr(${ev.src_ip}));
ids_event->Assign(9, unified2_addr_to_bro_addr(${ev.dst_ip})); ids_event->Assign(9, unified2_addr_to_bro_addr(${ev.dst_ip}));
ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol})); ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol}));
ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol})); ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol}));
ids_event->Assign(17, val_mgr->GetCount(${ev.packet_action})); ids_event->Assign(17, val_mgr->Count(${ev.packet_action}));
mgr.Enqueue(::unified2_event, mgr.Enqueue(::unified2_event,
IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
@ -93,23 +93,23 @@ refine flow Flow += {
if ( ::unified2_event ) if ( ::unified2_event )
{ {
auto ids_event = make_intrusive<RecordVal>(BifType::Record::Unified2::IDSEvent); auto ids_event = make_intrusive<RecordVal>(BifType::Record::Unified2::IDSEvent);
ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id})); ids_event->Assign(0, val_mgr->Count(${ev.sensor_id}));
ids_event->Assign(1, val_mgr->GetCount(${ev.event_id})); ids_event->Assign(1, val_mgr->Count(${ev.event_id}));
ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME)); ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME));
ids_event->Assign(3, val_mgr->GetCount(${ev.signature_id})); ids_event->Assign(3, val_mgr->Count(${ev.signature_id}));
ids_event->Assign(4, val_mgr->GetCount(${ev.generator_id})); ids_event->Assign(4, val_mgr->Count(${ev.generator_id}));
ids_event->Assign(5, val_mgr->GetCount(${ev.signature_revision})); ids_event->Assign(5, val_mgr->Count(${ev.signature_revision}));
ids_event->Assign(6, val_mgr->GetCount(${ev.classification_id})); ids_event->Assign(6, val_mgr->Count(${ev.classification_id}));
ids_event->Assign(7, val_mgr->GetCount(${ev.priority_id})); ids_event->Assign(7, val_mgr->Count(${ev.priority_id}));
ids_event->Assign(8, unified2_addr_to_bro_addr(${ev.src_ip})); ids_event->Assign(8, unified2_addr_to_bro_addr(${ev.src_ip}));
ids_event->Assign(9, unified2_addr_to_bro_addr(${ev.dst_ip})); ids_event->Assign(9, unified2_addr_to_bro_addr(${ev.dst_ip}));
ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol})); ids_event->Assign(10, to_port(${ev.src_p}, ${ev.protocol}));
ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol})); ids_event->Assign(11, to_port(${ev.dst_p}, ${ev.protocol}));
ids_event->Assign(12, val_mgr->GetCount(${ev.impact_flag})); ids_event->Assign(12, val_mgr->Count(${ev.impact_flag}));
ids_event->Assign(13, val_mgr->GetCount(${ev.impact})); ids_event->Assign(13, val_mgr->Count(${ev.impact}));
ids_event->Assign(14, val_mgr->GetCount(${ev.blocked})); ids_event->Assign(14, val_mgr->Count(${ev.blocked}));
ids_event->Assign(15, val_mgr->GetCount(${ev.mpls_label})); ids_event->Assign(15, val_mgr->Count(${ev.mpls_label}));
ids_event->Assign(16, val_mgr->GetCount(${ev.vlan_id})); ids_event->Assign(16, val_mgr->Count(${ev.vlan_id}));
mgr.Enqueue(::unified2_event, mgr.Enqueue(::unified2_event,
IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()}, IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
@ -124,11 +124,11 @@ refine flow Flow += {
if ( ::unified2_packet ) if ( ::unified2_packet )
{ {
auto packet = make_intrusive<RecordVal>(BifType::Record::Unified2::Packet); auto packet = make_intrusive<RecordVal>(BifType::Record::Unified2::Packet);
packet->Assign(0, val_mgr->GetCount(${pkt.sensor_id})); packet->Assign(0, val_mgr->Count(${pkt.sensor_id}));
packet->Assign(1, val_mgr->GetCount(${pkt.event_id})); packet->Assign(1, val_mgr->Count(${pkt.event_id}));
packet->Assign(2, val_mgr->GetCount(${pkt.event_second})); packet->Assign(2, val_mgr->Count(${pkt.event_second}));
packet->Assign(3, make_intrusive<Val>(ts_to_double(${pkt.packet_ts}), TYPE_TIME)); packet->Assign(3, make_intrusive<Val>(ts_to_double(${pkt.packet_ts}), TYPE_TIME));
packet->Assign(4, val_mgr->GetCount(${pkt.link_type})); packet->Assign(4, val_mgr->Count(${pkt.link_type}));
packet->Assign(5, bytestring_to_val(${pkt.packet_data})); packet->Assign(5, bytestring_to_val(${pkt.packet_data}));
mgr.Enqueue(::unified2_packet, mgr.Enqueue(::unified2_packet,

24
src/file_analysis/analyzer/x509/OCSP.cc
View file

@ -288,7 +288,7 @@ static StringVal* parse_basic_resp_sig_alg(OCSP_BASICRESP* basic_resp,
return rval; return rval;
} }
static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp) static IntrusivePtr<Val> parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
{ {
int der_basic_resp_len = 0; int der_basic_resp_len = 0;
unsigned char* der_basic_resp_dat = nullptr; unsigned char* der_basic_resp_dat = nullptr;
@ -296,7 +296,7 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
der_basic_resp_len = i2d_OCSP_BASICRESP(basic_resp, &der_basic_resp_dat); der_basic_resp_len = i2d_OCSP_BASICRESP(basic_resp, &der_basic_resp_dat);
if ( der_basic_resp_len <= 0 ) if ( der_basic_resp_len <= 0 )
return val_mgr->GetCount(-1); return val_mgr->Count(-1);
const unsigned char* const_der_basic_resp_dat = der_basic_resp_dat; const unsigned char* const_der_basic_resp_dat = der_basic_resp_dat;
@ -305,13 +305,13 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
if ( ! bseq ) if ( ! bseq )
{ {
OPENSSL_free(der_basic_resp_dat); OPENSSL_free(der_basic_resp_dat);
return val_mgr->GetCount(-1); return val_mgr->Count(-1);
} }
if ( sk_ASN1_TYPE_num(bseq) < 3 ) if ( sk_ASN1_TYPE_num(bseq) < 3 )
{ {
OPENSSL_free(der_basic_resp_dat); OPENSSL_free(der_basic_resp_dat);
return val_mgr->GetCount(-1); return val_mgr->Count(-1);
} }
auto constexpr resp_data_idx = 0u; auto constexpr resp_data_idx = 0u;
@ -320,7 +320,7 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
if ( ASN1_TYPE_get(dseq_type) != V_ASN1_SEQUENCE ) if ( ASN1_TYPE_get(dseq_type) != V_ASN1_SEQUENCE )
{ {
OPENSSL_free(der_basic_resp_dat); OPENSSL_free(der_basic_resp_dat);
return val_mgr->GetCount(-1); return val_mgr->Count(-1);
} }
auto dseq_str = dseq_type->value.asn1_string; auto dseq_str = dseq_type->value.asn1_string;
@ -332,13 +332,13 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
if ( ! dseq ) if ( ! dseq )
{ {
OPENSSL_free(der_basic_resp_dat); OPENSSL_free(der_basic_resp_dat);
return val_mgr->GetEmptyString(); return val_mgr->Count(-1);
} }
if ( sk_ASN1_TYPE_num(dseq) < 1 ) if ( sk_ASN1_TYPE_num(dseq) < 1 )
{ {
OPENSSL_free(der_basic_resp_dat); OPENSSL_free(der_basic_resp_dat);
return val_mgr->GetEmptyString(); return val_mgr->Count(-1);
} }
/*- ResponseData ::= SEQUENCE { /*- ResponseData ::= SEQUENCE {
@ -356,12 +356,12 @@ static Val* parse_basic_resp_data_version(OCSP_BASICRESP* basic_resp)
{ {
OPENSSL_free(der_basic_resp_dat); OPENSSL_free(der_basic_resp_dat);
// Not present, use default value. // Not present, use default value.
return val_mgr->GetCount(0); return val_mgr->Count(0);
} }
uint64_t asn1_int = ASN1_INTEGER_get(version_type->value.integer); uint64_t asn1_int = ASN1_INTEGER_get(version_type->value.integer);
OPENSSL_free(der_basic_resp_dat); OPENSSL_free(der_basic_resp_dat);
return val_mgr->GetCount(asn1_int); return val_mgr->Count(asn1_int);
} }
static uint64_t parse_request_version(OCSP_REQUEST* req) static uint64_t parse_request_version(OCSP_REQUEST* req)
@ -422,7 +422,7 @@ void file_analysis::OCSP::ParseRequest(OCSP_REQUEST* req)
if ( ocsp_request ) if ( ocsp_request )
mgr.Enqueue(ocsp_request, mgr.Enqueue(ocsp_request,
IntrusivePtr{NewRef{}, GetFile()->GetVal()}, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(version)} val_mgr->Count(version)
); );
BIO *bio = BIO_new(BIO_s_mem()); BIO *bio = BIO_new(BIO_s_mem());
@ -506,9 +506,9 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
vl.emplace_back(AdoptRef{}, status_val); vl.emplace_back(AdoptRef{}, status_val);
#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER) #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
vl.emplace_back(AdoptRef{}, val_mgr->GetCount((uint64_t)ASN1_INTEGER_get(resp_data->version))); vl.emplace_back(val_mgr->Count((uint64_t)ASN1_INTEGER_get(resp_data->version)));
#else #else
vl.emplace_back(AdoptRef{}, parse_basic_resp_data_version(basic_resp)); vl.emplace_back(parse_basic_resp_data_version(basic_resp));
#endif #endif
// responderID // responderID

6
src/file_analysis/analyzer/x509/X509.cc
View file

@ -121,7 +121,7 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
RecordVal* pX509Cert = new RecordVal(BifType::Record::X509::Certificate); RecordVal* pX509Cert = new RecordVal(BifType::Record::X509::Certificate);
BIO *bio = BIO_new(BIO_s_mem()); BIO *bio = BIO_new(BIO_s_mem());
pX509Cert->Assign(0, val_mgr->GetCount((uint64_t) X509_get_version(ssl_cert) + 1)); pX509Cert->Assign(0, val_mgr->Count((uint64_t) X509_get_version(ssl_cert) + 1));
i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert)); i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert));
int len = BIO_read(bio, buf, sizeof(buf)); int len = BIO_read(bio, buf, sizeof(buf));
pX509Cert->Assign(1, make_intrusive<StringVal>(len, buf)); pX509Cert->Assign(1, make_intrusive<StringVal>(len, buf));
@ -229,7 +229,7 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
unsigned int length = KeyLength(pkey); unsigned int length = KeyLength(pkey);
if ( length > 0 ) if ( length > 0 )
pX509Cert->Assign(10, val_mgr->GetCount(length)); pX509Cert->Assign(10, val_mgr->Count(length));
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
} }
@ -293,7 +293,7 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex)
pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca)); pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca));
if ( constr->pathlen ) if ( constr->pathlen )
pBasicConstraint->Assign(1, val_mgr->GetCount((int32_t) ASN1_INTEGER_get(constr->pathlen))); pBasicConstraint->Assign(1, val_mgr->Count((int32_t) ASN1_INTEGER_get(constr->pathlen)));
mgr.Enqueue(x509_ext_basic_constraints, mgr.Enqueue(x509_ext_basic_constraints,
IntrusivePtr{NewRef{}, GetFile()->GetVal()}, IntrusivePtr{NewRef{}, GetFile()->GetVal()},

8
src/file_analysis/analyzer/x509/x509-extension.pac
View file

@ -40,11 +40,11 @@ refine connection MockConnection += {
mgr.Enqueue(x509_ocsp_ext_signed_certificate_timestamp, mgr.Enqueue(x509_ocsp_ext_signed_certificate_timestamp,
IntrusivePtr{NewRef{}, bro_analyzer()->GetFile()->GetVal()}, IntrusivePtr{NewRef{}, bro_analyzer()->GetFile()->GetVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(version)}, val_mgr->Count(version),
make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())), make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(timestamp)}, val_mgr->Count(timestamp),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(digitally_signed_algorithms->HashAlgorithm())}, val_mgr->Count(digitally_signed_algorithms->HashAlgorithm()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(digitally_signed_algorithms->SignatureAlgorithm())}, val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm()),
make_intrusive<StringVal>(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin())) make_intrusive<StringVal>(digitally_signed_signature.length(), reinterpret_cast<const char*>(digitally_signed_signature.begin()))
); );

4
src/input/Manager.cc
View file

@ -2266,7 +2266,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
case TYPE_COUNT: case TYPE_COUNT:
case TYPE_COUNTER: case TYPE_COUNTER:
return val_mgr->GetCount(val->val.int_val); return val_mgr->Count(val->val.int_val).release();
case TYPE_DOUBLE: case TYPE_DOUBLE:
case TYPE_TIME: case TYPE_TIME:
@ -2414,7 +2414,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
case TYPE_COUNT: case TYPE_COUNT:
case TYPE_COUNTER: case TYPE_COUNTER:
return val_mgr->GetCount(val->val.int_val); return val_mgr->Count(val->val.int_val).release();
case TYPE_DOUBLE: case TYPE_DOUBLE:
case TYPE_TIME: case TYPE_TIME:

10
src/iosource/Packet.cc
View file

@ -628,12 +628,12 @@ RecordVal* Packet::BuildPktHdrVal() const
l2_hdr->Assign(4, FmtEUI48(data)); // dst l2_hdr->Assign(4, FmtEUI48(data)); // dst
if ( vlan ) if ( vlan )
l2_hdr->Assign(5, val_mgr->GetCount(vlan)); l2_hdr->Assign(5, val_mgr->Count(vlan));
if ( inner_vlan ) if ( inner_vlan )
l2_hdr->Assign(6, val_mgr->GetCount(inner_vlan)); l2_hdr->Assign(6, val_mgr->Count(inner_vlan));
l2_hdr->Assign(7, val_mgr->GetCount(eth_type)); l2_hdr->Assign(7, val_mgr->Count(eth_type));
if ( eth_type == ETHERTYPE_ARP || eth_type == ETHERTYPE_REVARP ) if ( eth_type == ETHERTYPE_ARP || eth_type == ETHERTYPE_REVARP )
// We also identify ARP for L3 over ethernet // We also identify ARP for L3 over ethernet
@ -642,8 +642,8 @@ RecordVal* Packet::BuildPktHdrVal() const
else else
l2_hdr->Assign(0, BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN)); l2_hdr->Assign(0, BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN));
l2_hdr->Assign(1, val_mgr->GetCount(len)); l2_hdr->Assign(1, val_mgr->Count(len));
l2_hdr->Assign(2, val_mgr->GetCount(cap_len)); l2_hdr->Assign(2, val_mgr->Count(cap_len));
l2_hdr->Assign(8, BifType::Enum::layer3_proto->GetVal(l3)); l2_hdr->Assign(8, BifType::Enum::layer3_proto->GetVal(l3));

2
src/main.cc
View file

@ -875,7 +875,7 @@ int main(int argc, char** argv)
mgr.Enqueue(zeek_script_loaded, mgr.Enqueue(zeek_script_loaded,
make_intrusive<StringVal>(i->name.c_str()), make_intrusive<StringVal>(i->name.c_str()),
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(i->include_level)} val_mgr->Count(i->include_level)
); );
} }
} }

3
src/parse.y
View file

@ -1319,8 +1319,7 @@ index_slice:
set_location(@1, @6); set_location(@1, @6);
auto low = $3 ? IntrusivePtr<Expr>{AdoptRef{}, $3} : auto low = $3 ? IntrusivePtr<Expr>{AdoptRef{}, $3} :
make_intrusive<ConstExpr>( make_intrusive<ConstExpr>(val_mgr->Count(0));
IntrusivePtr<Val>{AdoptRef{}, val_mgr->GetCount(0)});
auto high = $5 ? IntrusivePtr<Expr>{AdoptRef{}, $5} : auto high = $5 ? IntrusivePtr<Expr>{AdoptRef{}, $5} :
make_intrusive<SizeExpr>( make_intrusive<SizeExpr>(

4
src/probabilistic/bloom-filter.bif
View file

@ -180,9 +180,9 @@ function bloomfilter_lookup%(bf: opaque of bloomfilter, x: any%): count
reporter->Error("incompatible Bloom filter types"); reporter->Error("incompatible Bloom filter types");
else else
return val_mgr->GetCount(static_cast<uint64_t>(bfv->Count(x))); return val_mgr->Count(static_cast<uint64_t>(bfv->Count(x)));
return val_mgr->GetCount(0); return val_mgr->Count(0);
%} %}
## Removes all elements from a Bloom filter. This function resets all bits in ## Removes all elements from a Bloom filter. This function resets all bits in

8
src/probabilistic/top-k.bif
View file

@ -74,7 +74,7 @@ function topk_count%(handle: opaque of topk, value: any%): count
%{ %{
assert(handle); assert(handle);
probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle; probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
return val_mgr->GetCount(h->GetCount(value)); return val_mgr->Count(h->GetCount(value));
%} %}
## Get the maximal overestimation for count. ## Get the maximal overestimation for count.
@ -94,7 +94,7 @@ function topk_epsilon%(handle: opaque of topk, value: any%): count
%{ %{
assert(handle); assert(handle);
probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle; probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
return val_mgr->GetCount(h->GetEpsilon(value)); return val_mgr->Count(h->GetEpsilon(value));
%} %}
## Get the number of elements this data structure is supposed to track (given ## Get the number of elements this data structure is supposed to track (given
@ -113,7 +113,7 @@ function topk_size%(handle: opaque of topk%): count
%{ %{
assert(handle); assert(handle);
probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle; probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
return val_mgr->GetCount(h->GetSize()); return val_mgr->Count(h->GetSize());
%} %}
## Get the sum of all counts of all elements in the data structure. ## Get the sum of all counts of all elements in the data structure.
@ -133,7 +133,7 @@ function topk_sum%(handle: opaque of topk%): count
%{ %{
assert(handle); assert(handle);
probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle; probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
return val_mgr->GetCount(h->GetSum()); return val_mgr->Count(h->GetSum());
%} %}
## Merge the second top-k data structure into the first. ## Merge the second top-k data structure into the first.

4
src/reporter.bif
View file

@ -193,7 +193,7 @@ function Reporter::set_weird_sampling_whitelist%(weird_sampling_whitelist: strin
## Returns: current weird sampling threshold. ## Returns: current weird sampling threshold.
function Reporter::get_weird_sampling_threshold%(%) : count function Reporter::get_weird_sampling_threshold%(%) : count
%{ %{
return val_mgr->GetCount(reporter->GetWeirdSamplingThreshold()); return val_mgr->Count(reporter->GetWeirdSamplingThreshold());
%} %}
## Sets the current weird sampling threshold ## Sets the current weird sampling threshold
@ -213,7 +213,7 @@ function Reporter::set_weird_sampling_threshold%(weird_sampling_threshold: count
## Returns: weird sampling rate. ## Returns: weird sampling rate.
function Reporter::get_weird_sampling_rate%(%) : count function Reporter::get_weird_sampling_rate%(%) : count
%{ %{
return val_mgr->GetCount(reporter->GetWeirdSamplingRate()); return val_mgr->Count(reporter->GetWeirdSamplingRate());
%} %}
## Sets the weird sampling rate. ## Sets the weird sampling rate.

4
src/scan.l
View file

@ -476,7 +476,7 @@ F RET_CONST(val_mgr->False()->Ref())
} }
{D} { {D} {
RET_CONST(val_mgr->GetCount(static_cast<bro_uint_t>(strtoull(yytext, (char**) NULL, 10)))) RET_CONST(val_mgr->Count(static_cast<bro_uint_t>(strtoull(yytext, (char**) NULL, 10))).release())
} }
{FLOAT} RET_CONST(new Val(atof(yytext), TYPE_DOUBLE)) {FLOAT} RET_CONST(new Val(atof(yytext), TYPE_DOUBLE))
@ -524,7 +524,7 @@ F RET_CONST(val_mgr->False()->Ref())
{FLOAT}{OWS}msec(s?) RET_CONST(new IntervalVal(atof(yytext),Milliseconds)) {FLOAT}{OWS}msec(s?) RET_CONST(new IntervalVal(atof(yytext),Milliseconds))
{FLOAT}{OWS}usec(s?) RET_CONST(new IntervalVal(atof(yytext),Microseconds)) {FLOAT}{OWS}usec(s?) RET_CONST(new IntervalVal(atof(yytext),Microseconds))
"0x"{HEX}+ RET_CONST(val_mgr->GetCount(static_cast<bro_uint_t>(strtoull(yytext, 0, 16)))) "0x"{HEX}+ RET_CONST(val_mgr->Count(static_cast<bro_uint_t>(strtoull(yytext, 0, 16))).release())
{H}("."{H})+ RET_CONST(dns_mgr->LookupHost(yytext).release()) {H}("."{H})+ RET_CONST(dns_mgr->LookupHost(yytext).release())

118
src/stats.bif
View file

@ -57,10 +57,10 @@ function get_net_stats%(%): NetStats
RecordVal* r = new RecordVal(NetStats); RecordVal* r = new RecordVal(NetStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(recv)); r->Assign(n++, val_mgr->Count(recv));
r->Assign(n++, val_mgr->GetCount(drop)); r->Assign(n++, val_mgr->Count(drop));
r->Assign(n++, val_mgr->GetCount(link)); r->Assign(n++, val_mgr->Count(link));
r->Assign(n++, val_mgr->GetCount(bytes_recv)); r->Assign(n++, val_mgr->Count(bytes_recv));
return r; return r;
%} %}
@ -86,16 +86,16 @@ function get_conn_stats%(%): ConnStats
RecordVal* r = new RecordVal(ConnStats); RecordVal* r = new RecordVal(ConnStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(Connection::TotalConnections())); r->Assign(n++, val_mgr->Count(Connection::TotalConnections()));
r->Assign(n++, val_mgr->GetCount(Connection::CurrentConnections())); r->Assign(n++, val_mgr->Count(Connection::CurrentConnections()));
r->Assign(n++, val_mgr->GetCount(sessions->CurrentConnections())); r->Assign(n++, val_mgr->Count(sessions->CurrentConnections()));
SessionStats s; SessionStats s;
if ( sessions ) if ( sessions )
sessions->GetStats(s); sessions->GetStats(s);
#define ADD_STAT(x) \ #define ADD_STAT(x) \
r->Assign(n++, val_mgr->GetCount(unsigned(sessions ? x : 0))); r->Assign(n++, val_mgr->Count(unsigned(sessions ? x : 0)));
ADD_STAT(s.num_packets); ADD_STAT(s.num_packets);
ADD_STAT(s.num_fragments); ADD_STAT(s.num_fragments);
@ -110,7 +110,7 @@ function get_conn_stats%(%): ConnStats
ADD_STAT(s.max_ICMP_conns); ADD_STAT(s.max_ICMP_conns);
ADD_STAT(s.cumulative_ICMP_conns); ADD_STAT(s.cumulative_ICMP_conns);
r->Assign(n++, val_mgr->GetCount(killed_by_inactivity)); r->Assign(n++, val_mgr->Count(killed_by_inactivity));
return r; return r;
%} %}
@ -147,9 +147,9 @@ function get_proc_stats%(%): ProcStats
double(ru.ru_stime.tv_sec) + double(ru.ru_stime.tv_usec) / 1e6; double(ru.ru_stime.tv_sec) + double(ru.ru_stime.tv_usec) / 1e6;
#ifdef DEBUG #ifdef DEBUG
r->Assign(n++, val_mgr->GetCount(1)); r->Assign(n++, val_mgr->Count(1));
#else #else
r->Assign(n++, val_mgr->GetCount(0)); r->Assign(n++, val_mgr->Count(0));
#endif #endif
r->Assign(n++, make_intrusive<Val>(bro_start_time, TYPE_TIME)); r->Assign(n++, make_intrusive<Val>(bro_start_time, TYPE_TIME));
@ -160,14 +160,14 @@ function get_proc_stats%(%): ProcStats
uint64_t total_mem; uint64_t total_mem;
get_memory_usage(&total_mem, NULL); get_memory_usage(&total_mem, NULL);
r->Assign(n++, val_mgr->GetCount(unsigned(total_mem))); r->Assign(n++, val_mgr->Count(unsigned(total_mem)));
r->Assign(n++, val_mgr->GetCount(unsigned(ru.ru_minflt))); r->Assign(n++, val_mgr->Count(unsigned(ru.ru_minflt)));
r->Assign(n++, val_mgr->GetCount(unsigned(ru.ru_majflt))); r->Assign(n++, val_mgr->Count(unsigned(ru.ru_majflt)));
r->Assign(n++, val_mgr->GetCount(unsigned(ru.ru_nswap))); r->Assign(n++, val_mgr->Count(unsigned(ru.ru_nswap)));
r->Assign(n++, val_mgr->GetCount(unsigned(ru.ru_inblock))); r->Assign(n++, val_mgr->Count(unsigned(ru.ru_inblock)));
r->Assign(n++, val_mgr->GetCount(unsigned(ru.ru_oublock))); r->Assign(n++, val_mgr->Count(unsigned(ru.ru_oublock)));
r->Assign(n++, val_mgr->GetCount(unsigned(ru.ru_nivcsw))); r->Assign(n++, val_mgr->Count(unsigned(ru.ru_nivcsw)));
return r; return r;
%} %}
@ -193,8 +193,8 @@ function get_event_stats%(%): EventStats
RecordVal* r = new RecordVal(EventStats); RecordVal* r = new RecordVal(EventStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(num_events_queued)); r->Assign(n++, val_mgr->Count(num_events_queued));
r->Assign(n++, val_mgr->GetCount(num_events_dispatched)); r->Assign(n++, val_mgr->Count(num_events_dispatched));
return r; return r;
%} %}
@ -220,10 +220,10 @@ function get_reassembler_stats%(%): ReassemblerStats
RecordVal* r = new RecordVal(ReassemblerStats); RecordVal* r = new RecordVal(ReassemblerStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(Reassembler::MemoryAllocation(REASSEM_FILE))); r->Assign(n++, val_mgr->Count(Reassembler::MemoryAllocation(REASSEM_FILE)));
r->Assign(n++, val_mgr->GetCount(Reassembler::MemoryAllocation(REASSEM_FRAG))); r->Assign(n++, val_mgr->Count(Reassembler::MemoryAllocation(REASSEM_FRAG)));
r->Assign(n++, val_mgr->GetCount(Reassembler::MemoryAllocation(REASSEM_TCP))); r->Assign(n++, val_mgr->Count(Reassembler::MemoryAllocation(REASSEM_TCP)));
r->Assign(n++, val_mgr->GetCount(Reassembler::MemoryAllocation(REASSEM_UNKNOWN))); r->Assign(n++, val_mgr->Count(Reassembler::MemoryAllocation(REASSEM_UNKNOWN)));
return r; return r;
%} %}
@ -252,12 +252,12 @@ function get_dns_stats%(%): DNSStats
DNS_Mgr::Stats dstats; DNS_Mgr::Stats dstats;
dns_mgr->GetStats(&dstats); dns_mgr->GetStats(&dstats);
r->Assign(n++, val_mgr->GetCount(unsigned(dstats.requests))); r->Assign(n++, val_mgr->Count(unsigned(dstats.requests)));
r->Assign(n++, val_mgr->GetCount(unsigned(dstats.successful))); r->Assign(n++, val_mgr->Count(unsigned(dstats.successful)));
r->Assign(n++, val_mgr->GetCount(unsigned(dstats.failed))); r->Assign(n++, val_mgr->Count(unsigned(dstats.failed)));
r->Assign(n++, val_mgr->GetCount(unsigned(dstats.pending))); r->Assign(n++, val_mgr->Count(unsigned(dstats.pending)));
r->Assign(n++, val_mgr->GetCount(unsigned(dstats.cached_hosts))); r->Assign(n++, val_mgr->Count(unsigned(dstats.cached_hosts)));
r->Assign(n++, val_mgr->GetCount(unsigned(dstats.cached_addresses))); r->Assign(n++, val_mgr->Count(unsigned(dstats.cached_addresses)));
return r; return r;
%} %}
@ -283,9 +283,9 @@ function get_timer_stats%(%): TimerStats
RecordVal* r = new RecordVal(TimerStats); RecordVal* r = new RecordVal(TimerStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(unsigned(timer_mgr->Size()))); r->Assign(n++, val_mgr->Count(unsigned(timer_mgr->Size())));
r->Assign(n++, val_mgr->GetCount(unsigned(timer_mgr->PeakSize()))); r->Assign(n++, val_mgr->Count(unsigned(timer_mgr->PeakSize())));
r->Assign(n++, val_mgr->GetCount(timer_mgr->CumulativeNum())); r->Assign(n++, val_mgr->Count(timer_mgr->CumulativeNum()));
return r; return r;
%} %}
@ -311,9 +311,9 @@ function get_file_analysis_stats%(%): FileAnalysisStats
RecordVal* r = new RecordVal(FileAnalysisStats); RecordVal* r = new RecordVal(FileAnalysisStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(file_mgr->CurrentFiles())); r->Assign(n++, val_mgr->Count(file_mgr->CurrentFiles()));
r->Assign(n++, val_mgr->GetCount(file_mgr->MaxFiles())); r->Assign(n++, val_mgr->Count(file_mgr->MaxFiles()));
r->Assign(n++, val_mgr->GetCount(file_mgr->CumulativeFiles())); r->Assign(n++, val_mgr->Count(file_mgr->CumulativeFiles()));
return r; return r;
%} %}
@ -339,7 +339,7 @@ function get_thread_stats%(%): ThreadStats
RecordVal* r = new RecordVal(ThreadStats); RecordVal* r = new RecordVal(ThreadStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(thread_mgr->NumThreads())); r->Assign(n++, val_mgr->Count(thread_mgr->NumThreads()));
return r; return r;
%} %}
@ -365,10 +365,10 @@ function get_gap_stats%(%): GapStats
RecordVal* r = new RecordVal(GapStats); RecordVal* r = new RecordVal(GapStats);
int n = 0; int n = 0;
r->Assign(n++, val_mgr->GetCount(tot_ack_events)); r->Assign(n++, val_mgr->Count(tot_ack_events));
r->Assign(n++, val_mgr->GetCount(tot_ack_bytes)); r->Assign(n++, val_mgr->Count(tot_ack_bytes));
r->Assign(n++, val_mgr->GetCount(tot_gap_events)); r->Assign(n++, val_mgr->Count(tot_gap_events));
r->Assign(n++, val_mgr->GetCount(tot_gap_bytes)); r->Assign(n++, val_mgr->Count(tot_gap_bytes));
return r; return r;
%} %}
@ -402,13 +402,13 @@ function get_matcher_stats%(%): MatcherStats
if ( rule_matcher ) if ( rule_matcher )
rule_matcher->GetStats(&s); rule_matcher->GetStats(&s);
r->Assign(n++, val_mgr->GetCount(s.matchers)); r->Assign(n++, val_mgr->Count(s.matchers));
r->Assign(n++, val_mgr->GetCount(s.nfa_states)); r->Assign(n++, val_mgr->Count(s.nfa_states));
r->Assign(n++, val_mgr->GetCount(s.dfa_states)); r->Assign(n++, val_mgr->Count(s.dfa_states));
r->Assign(n++, val_mgr->GetCount(s.computed)); r->Assign(n++, val_mgr->Count(s.computed));
r->Assign(n++, val_mgr->GetCount(s.mem)); r->Assign(n++, val_mgr->Count(s.mem));
r->Assign(n++, val_mgr->GetCount(s.hits)); r->Assign(n++, val_mgr->Count(s.hits));
r->Assign(n++, val_mgr->GetCount(s.misses)); r->Assign(n++, val_mgr->Count(s.misses));
return r; return r;
%} %}
@ -436,15 +436,15 @@ function get_broker_stats%(%): BrokerStats
int n = 0; int n = 0;
auto cs = broker_mgr->GetStatistics(); auto cs = broker_mgr->GetStatistics();
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_peers))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_peers)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_stores))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_stores)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_pending_queries))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_pending_queries)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_events_incoming))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_events_incoming)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_events_outgoing))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_events_outgoing)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_logs_incoming))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_logs_incoming)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_logs_outgoing))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_logs_outgoing)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_ids_incoming))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_ids_incoming)));
r->Assign(n++, val_mgr->GetCount(static_cast<uint64_t>(cs.num_ids_outgoing))); r->Assign(n++, val_mgr->Count(static_cast<uint64_t>(cs.num_ids_outgoing)));
return r; return r;
%} %}
@ -475,11 +475,11 @@ function get_reporter_stats%(%): ReporterStats
for ( auto& kv : reporter->GetWeirdsByType() ) for ( auto& kv : reporter->GetWeirdsByType() )
{ {
Val* weird = new StringVal(kv.first); Val* weird = new StringVal(kv.first);
weirds_by_type->Assign(weird, val_mgr->GetCount(kv.second)); weirds_by_type->Assign(weird, val_mgr->Count(kv.second));
Unref(weird); Unref(weird);
} }
r->Assign(n++, val_mgr->GetCount(reporter->GetWeirdCount())); r->Assign(n++, val_mgr->Count(reporter->GetWeirdCount()));
r->Assign(n++, weirds_by_type); r->Assign(n++, weirds_by_type);
return r; return r;

18
src/strings.bif
View file

@ -25,10 +25,10 @@ function levenshtein_distance%(s1: string, s2: string%): count
unsigned int m = s2->Len(); unsigned int m = s2->Len();
if ( ! n ) if ( ! n )
return val_mgr->GetCount(m); return val_mgr->Count(m);
if ( ! m ) if ( ! m )
return val_mgr->GetCount(n); return val_mgr->Count(n);
vector<vector<unsigned int> > d(n + 1, vector<unsigned int>(m + 1)); vector<vector<unsigned int> > d(n + 1, vector<unsigned int>(m + 1));
@ -47,7 +47,7 @@ function levenshtein_distance%(s1: string, s2: string%): count
d[i-1][j-1] + (s1->Bytes()[i-1] == s2->Bytes()[j-1] ? 0 : 1)); d[i-1][j-1] + (s1->Bytes()[i-1] == s2->Bytes()[j-1] ? 0 : 1));
} }
return val_mgr->GetCount(d[n][m]); return val_mgr->Count(d[n][m]);
%} %}
## Concatenates all arguments into a single string. The function takes a ## Concatenates all arguments into a single string. The function takes a
@ -285,9 +285,8 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep)
n=0; n=0;
} }
Val* ind = val_mgr->GetCount(++num); auto ind = val_mgr->Count(++num);
a->Assign(ind, make_intrusive<StringVal>(offset, (const char*) s)); a->Assign(ind.get(), make_intrusive<StringVal>(offset, (const char*) s));
Unref(ind);
// No more separators will be needed if this is the end of string. // No more separators will be needed if this is the end of string.
if ( n <= 0 ) if ( n <= 0 )
@ -295,9 +294,8 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep)
if ( incl_sep ) if ( incl_sep )
{ // including the part that matches the pattern { // including the part that matches the pattern
ind = val_mgr->GetCount(++num); ind = val_mgr->Count(++num);
a->Assign(ind, make_intrusive<StringVal>(end_of_match, (const char*) s+offset)); a->Assign(ind.get(), make_intrusive<StringVal>(end_of_match, (const char*) s+offset));
Unref(ind);
} }
if ( max_num_sep && num_sep >= max_num_sep ) if ( max_num_sep && num_sep >= max_num_sep )
@ -459,7 +457,7 @@ function strcmp%(s1: string, s2: string%): int
## .. zeek:see:: find_all find_last ## .. zeek:see:: find_all find_last
function strstr%(big: string, little: string%): count function strstr%(big: string, little: string%): count
%{ %{
return val_mgr->GetCount( return val_mgr->Count(
1 + big->AsString()->FindSubstring(little->AsString())); 1 + big->AsString()->FindSubstring(little->AsString()));
%} %}

76
src/zeek.bif
View file

@ -885,7 +885,7 @@ function fnv1a32%(input: any%): count
rval *= prime32; rval *= prime32;
} }
return val_mgr->GetCount(rval); return val_mgr->Count(rval);
%} %}
## Calculates a weight value for use in a Rendezvous Hashing algorithm. ## Calculates a weight value for use in a Rendezvous Hashing algorithm.
@ -912,7 +912,7 @@ function hrw_weight%(key_digest: count, site_id: count%): count
uint32_t rval = (a * ((a * si + b) ^ d) + b) % m; uint32_t rval = (a * ((a * si + b) ^ d) + b) % m;
return val_mgr->GetCount(rval); return val_mgr->Count(rval);
%} %}
## Generates a random number. ## Generates a random number.
@ -930,7 +930,7 @@ function hrw_weight%(key_digest: count, site_id: count%): count
function rand%(max: count%): count function rand%(max: count%): count
%{ %{
auto result = bro_uint_t(double(max) * double(bro_random()) / (RAND_MAX + 1.0)); auto result = bro_uint_t(double(max) * double(bro_random()) / (RAND_MAX + 1.0));
return val_mgr->GetCount(result); return val_mgr->Count(result);
%} %}
## Sets the seed for subsequent :zeek:id:`rand` calls. ## Sets the seed for subsequent :zeek:id:`rand` calls.
@ -1248,7 +1248,7 @@ function same_object%(o1: any, o2: any%): bool
## Returns: The number of bytes that *v* occupies. ## Returns: The number of bytes that *v* occupies.
function val_size%(v: any%): count function val_size%(v: any%): count
%{ %{
return val_mgr->GetCount(v->MemoryAllocation()); return val_mgr->Count(v->MemoryAllocation());
%} %}
## Resizes a vector. ## Resizes a vector.
@ -1266,7 +1266,7 @@ function resize%(aggr: any, newsize: count%) : count
return 0; return 0;
} }
return val_mgr->GetCount(aggr->AsVectorVal()->Resize(newsize)); return val_mgr->Count(aggr->AsVectorVal()->Resize(newsize));
%} %}
## Tests whether a boolean vector (``vector of bool``) has *any* true ## Tests whether a boolean vector (``vector of bool``) has *any* true
@ -1541,7 +1541,7 @@ function order%(v: any, ...%) : index_vec
for ( i = 0; i < n; ++i ) for ( i = 0; i < n; ++i )
{ {
int ind = ind_vv[i]; int ind = ind_vv[i];
result_v->Assign(i, val_mgr->GetCount(ind)); result_v->Assign(i, val_mgr->Count(ind));
} }
return result_v; return result_v;
@ -1791,7 +1791,7 @@ function log10%(d: double%): double
## none. ## none.
function current_analyzer%(%) : count function current_analyzer%(%) : count
%{ %{
return val_mgr->GetCount(mgr.CurrentAnalyzer()); return val_mgr->Count(mgr.CurrentAnalyzer());
%} %}
## Returns Zeek's process ID. ## Returns Zeek's process ID.
@ -1799,7 +1799,7 @@ function current_analyzer%(%) : count
## Returns: Zeek's process ID. ## Returns: Zeek's process ID.
function getpid%(%) : count function getpid%(%) : count
%{ %{
return val_mgr->GetCount(getpid()); return val_mgr->Count(getpid());
%} %}
%%{ %%{
@ -1902,7 +1902,7 @@ function packet_source%(%): PacketSource
r->Assign(0, val_mgr->Bool(ps->IsLive())); r->Assign(0, val_mgr->Bool(ps->IsLive()));
r->Assign(1, make_intrusive<StringVal>(ps->Path())); r->Assign(1, make_intrusive<StringVal>(ps->Path()));
r->Assign(2, val_mgr->Int(ps->LinkType())); r->Assign(2, val_mgr->Int(ps->LinkType()));
r->Assign(3, val_mgr->GetCount(ps->Netmask())); r->Assign(3, val_mgr->Count(ps->Netmask()));
} }
return r.release(); return r.release();
@ -1925,8 +1925,8 @@ function global_sizes%(%): var_sizes
if ( id->HasVal() ) if ( id->HasVal() )
{ {
Val* id_name = new StringVal(id->Name()); Val* id_name = new StringVal(id->Name());
Val* id_size = val_mgr->GetCount(id->ID_Val()->MemoryAllocation()); auto id_size = val_mgr->Count(id->ID_Val()->MemoryAllocation());
sizes->Assign(id_name, id_size); sizes->Assign(id_name, std::move(id_size));
Unref(id_name); Unref(id_name);
} }
} }
@ -2228,7 +2228,7 @@ function addr_to_counts%(a: addr%): index_vec
int len = a->AsAddr().GetBytes(&bytes); int len = a->AsAddr().GetBytes(&bytes);
for ( int i = 0; i < len; ++i ) for ( int i = 0; i < len; ++i )
rval->Assign(i, val_mgr->GetCount(ntohl(bytes[i]))); rval->Assign(i, val_mgr->Count(ntohl(bytes[i])));
return rval; return rval;
%} %}
@ -2316,7 +2316,7 @@ function int_to_count%(n: int%): count
builtin_error("bad conversion to count", @ARG@[0]); builtin_error("bad conversion to count", @ARG@[0]);
n = 0; n = 0;
} }
return val_mgr->GetCount(n); return val_mgr->Count(n);
%} %}
## Converts a :zeek:type:`double` to a :zeek:type:`count`. ## Converts a :zeek:type:`double` to a :zeek:type:`count`.
@ -2331,7 +2331,7 @@ function double_to_count%(d: double%): count
if ( d < 0.0 ) if ( d < 0.0 )
builtin_error("bad conversion to count", @ARG@[0]); builtin_error("bad conversion to count", @ARG@[0]);
return val_mgr->GetCount(bro_uint_t(rint(d))); return val_mgr->Count(bro_uint_t(rint(d)));
%} %}
## Converts a :zeek:type:`string` to a :zeek:type:`count`. ## Converts a :zeek:type:`string` to a :zeek:type:`count`.
@ -2355,7 +2355,7 @@ function to_count%(str: string%): count
u = 0; u = 0;
} }
return val_mgr->GetCount(u); return val_mgr->Count(u);
%} %}
## Converts an :zeek:type:`interval` to a :zeek:type:`double`. ## Converts an :zeek:type:`interval` to a :zeek:type:`double`.
@ -2415,7 +2415,7 @@ function double_to_interval%(d: double%): interval
## .. zeek:see:: count_to_port ## .. zeek:see:: count_to_port
function port_to_count%(p: port%): count function port_to_count%(p: port%): count
%{ %{
return val_mgr->GetCount(p->Port()); return val_mgr->Count(p->Port());
%} %}
## Converts a :zeek:type:`count` and ``transport_proto`` to a :zeek:type:`port`. ## Converts a :zeek:type:`count` and ``transport_proto`` to a :zeek:type:`port`.
@ -2529,7 +2529,7 @@ function subnet_to_addr%(sn: subnet%): addr
## .. zeek:see:: to_subnet ## .. zeek:see:: to_subnet
function subnet_width%(sn: subnet%): count function subnet_width%(sn: subnet%): count
%{ %{
return val_mgr->GetCount(sn->Width()); return val_mgr->Count(sn->Width());
%} %}
## Converts a :zeek:type:`string` to a :zeek:type:`double`. ## Converts a :zeek:type:`string` to a :zeek:type:`double`.
@ -2673,7 +2673,7 @@ function bytestring_to_count%(s: string, is_le: bool &default=F%): count
{ {
uint8_t value = 0; uint8_t value = 0;
memcpy(&value, p, sizeof(uint8_t)); memcpy(&value, p, sizeof(uint8_t));
return val_mgr->GetCount(value); return val_mgr->Count(value);
} }
case sizeof(uint16_t): case sizeof(uint16_t):
@ -2693,7 +2693,7 @@ function bytestring_to_count%(s: string, is_le: bool &default=F%): count
else else
memcpy(&value, p, sizeof(uint16_t)); memcpy(&value, p, sizeof(uint16_t));
return val_mgr->GetCount(value); return val_mgr->Count(value);
} }
case sizeof(uint32_t): case sizeof(uint32_t):
@ -2713,7 +2713,7 @@ function bytestring_to_count%(s: string, is_le: bool &default=F%): count
else else
memcpy(&value, p, sizeof(uint32_t)); memcpy(&value, p, sizeof(uint32_t));
return val_mgr->GetCount(value); return val_mgr->Count(value);
} }
case sizeof(uint64_t): case sizeof(uint64_t):
@ -2733,12 +2733,12 @@ function bytestring_to_count%(s: string, is_le: bool &default=F%): count
else else
memcpy(&value, p, sizeof(uint64_t)); memcpy(&value, p, sizeof(uint64_t));
return val_mgr->GetCount(value); return val_mgr->Count(value);
} }
} }
builtin_error("unsupported byte length for bytestring_to_count"); builtin_error("unsupported byte length for bytestring_to_count");
return val_mgr->GetCount(0); return val_mgr->Count(0);
%} %}
## Converts a reverse pointer name to an address. For example, ## Converts a reverse pointer name to an address. For example,
@ -3314,12 +3314,12 @@ function lookup_connection%(cid: conn_id%): connection
c->Assign(0, id_val); c->Assign(0, id_val);
auto orig_endp = make_intrusive<RecordVal>(endpoint); auto orig_endp = make_intrusive<RecordVal>(endpoint);
orig_endp->Assign(0, val_mgr->GetCount(0)); orig_endp->Assign(0, val_mgr->Count(0));
orig_endp->Assign(1, val_mgr->GetCount(int(0))); orig_endp->Assign(1, val_mgr->Count(int(0)));
auto resp_endp = make_intrusive<RecordVal>(endpoint); auto resp_endp = make_intrusive<RecordVal>(endpoint);
resp_endp->Assign(0, val_mgr->GetCount(0)); resp_endp->Assign(0, val_mgr->Count(0));
resp_endp->Assign(1, val_mgr->GetCount(int(0))); resp_endp->Assign(1, val_mgr->Count(int(0)));
c->Assign(1, std::move(orig_endp)); c->Assign(1, std::move(orig_endp));
c->Assign(2, std::move(resp_endp)); c->Assign(2, std::move(resp_endp));
@ -3394,19 +3394,19 @@ function get_current_packet%(%) : pcap_packet
if ( ! current_pktsrc || if ( ! current_pktsrc ||
! current_pktsrc->GetCurrentPacket(&p) ) ! current_pktsrc->GetCurrentPacket(&p) )
{ {
pkt->Assign(0, val_mgr->GetCount(0)); pkt->Assign(0, val_mgr->Count(0));
pkt->Assign(1, val_mgr->GetCount(0)); pkt->Assign(1, val_mgr->Count(0));
pkt->Assign(2, val_mgr->GetCount(0)); pkt->Assign(2, val_mgr->Count(0));
pkt->Assign(3, val_mgr->GetCount(0)); pkt->Assign(3, val_mgr->Count(0));
pkt->Assign(4, val_mgr->GetEmptyString()); pkt->Assign(4, val_mgr->GetEmptyString());
pkt->Assign(5, BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN)); pkt->Assign(5, BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN));
return pkt; return pkt;
} }
pkt->Assign(0, val_mgr->GetCount(uint32_t(p->ts.tv_sec))); pkt->Assign(0, val_mgr->Count(uint32_t(p->ts.tv_sec)));
pkt->Assign(1, val_mgr->GetCount(uint32_t(p->ts.tv_usec))); pkt->Assign(1, val_mgr->Count(uint32_t(p->ts.tv_usec)));
pkt->Assign(2, val_mgr->GetCount(p->cap_len)); pkt->Assign(2, val_mgr->Count(p->cap_len));
pkt->Assign(3, val_mgr->GetCount(p->len)); pkt->Assign(3, val_mgr->Count(p->len));
pkt->Assign(4, make_intrusive<StringVal>(p->cap_len, (const char*)p->data)); pkt->Assign(4, make_intrusive<StringVal>(p->cap_len, (const char*)p->data));
pkt->Assign(5, BifType::Enum::link_encap->GetVal(p->link_type)); pkt->Assign(5, BifType::Enum::link_encap->GetVal(p->link_type));
@ -3860,7 +3860,7 @@ static Val* mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
break; break;
case MMDB_DATA_TYPE_UINT32: case MMDB_DATA_TYPE_UINT32:
return val_mgr->GetCount(entry_data->uint32); return val_mgr->Count(entry_data->uint32);
default: default:
break; break;
@ -4072,7 +4072,7 @@ function lookup_asn%(a: addr%) : count
builtin_error("Failed to open GeoIP ASN database"); builtin_error("Failed to open GeoIP ASN database");
} }
return val_mgr->GetCount(0); return val_mgr->Count(0);
} }
} }
@ -4087,7 +4087,7 @@ function lookup_asn%(a: addr%) : count
status = MMDB_get_value(&result.entry, &entry_data, status = MMDB_get_value(&result.entry, &entry_data,
"autonomous_system_number", nullptr); "autonomous_system_number", nullptr);
Val* asn = mmdb_getvalue(&entry_data, status, MMDB_DATA_TYPE_UINT32); Val* asn = mmdb_getvalue(&entry_data, status, MMDB_DATA_TYPE_UINT32);
return asn == nullptr ? val_mgr->GetCount(0) : asn; return asn == nullptr ? val_mgr->Count(0) : asn;
} }
#else // not USE_GEOIP #else // not USE_GEOIP
@ -4103,7 +4103,7 @@ function lookup_asn%(a: addr%) : count
// We can get here even if we have GeoIP support, if we weren't // We can get here even if we have GeoIP support, if we weren't
// able to initialize it or it didn't return any information for // able to initialize it or it didn't return any information for
// the address. // the address.
return val_mgr->GetCount(0); return val_mgr->Count(0);
%} %}
## Calculates distance between two geographic locations using the haversine ## Calculates distance between two geographic locations using the haversine