Merge remote-tracking branch 'origin/topic/timw/include-cleanup-part-1'

* origin/topic/timw/include-cleanup-part-1:
  Remove including <cinttypes> from util.h
  Remove telemetry #includes from OpaqueVal.h
  Reduce includes in plugin/Component.h
  Remove zeek/Stats.h include from NetVar.h
  Include StmtBase/StmtEnums in Func.h instead of Stmt.h
  Use modern names for standard headers
  Remove fix for CentOS 7 from TCP_Flags.h
  Fix usage of std::string in http analyzer
  Reorder top section of net_util.h to batch includes together
  Use quotes instead of <> for zeek includes
  Fix Obj.h include in IntrusivePtr.h to have full path

CHANGES

@@ -1,3 +1,30 @@
+8.0.0-dev.118 | 2025-05-16 10:27:27 -0700
+
+  * Remove including <cinttypes> from util.h (Tim Wojtulewicz, Corelight)
+
+  * Remove telemetry #includes from OpaqueVal.h (Tim Wojtulewicz, Corelight)
+
+  * Reduce includes in plugin/Component.h (Tim Wojtulewicz, Corelight)
+
+  * Remove zeek/Stats.h include from NetVar.h (Tim Wojtulewicz, Corelight)
+
+  * Include StmtBase/StmtEnums in Func.h instead of Stmt.h (Tim Wojtulewicz, Corelight)
+
+    This requires changes in lots of other files that were depending on Func.h
+    to provide that include for them.
+
+  * Use modern names for standard headers (Tim Wojtulewicz, Corelight)
+
+  * Remove fix for CentOS 7 from TCP_Flags.h (Tim Wojtulewicz, Corelight)
+
+  * Fix usage of std::string in http analyzer (Tim Wojtulewicz, Corelight)
+
+  * Reorder top section of net_util.h to batch includes together (Tim Wojtulewicz, Corelight)
+
+  * Use quotes instead of <> for zeek includes (Tim Wojtulewicz, Corelight)
+
+  * Fix Obj.h include in IntrusivePtr.h to have full path (Tim Wojtulewicz, Corelight)
+
 8.0.0-dev.106 | 2025-05-16 13:39:56 +0200
 
   * Generate --event-trace output explicitly rather than in EventTraceMgr destructor (Vern Paxson, Corelight)

NEWS

@@ -11,6 +11,10 @@ We would like to thank ... for their contributions to this release.
 Breaking Changes
 ----------------
 
+- The code base underwent a big cleanup of #include usage, across almost all of the
+  files. We tested builds of all of the existing third-party packages and only noticed one
+  or two failures, but there is a possibility for breakage related to this cleanup.
+
 New Functionality
 -----------------
 

VERSION

@@ -1 +1 @@
-8.0.0-dev.106
+8.0.0-dev.118

src/CompHash.cc

@@ -8,7 +8,9 @@
 #include <map>
 #include <vector>
 
+#include "zeek/Dict.h"
 #include "zeek/Func.h"
+#include "zeek/Hash.h"
 #include "zeek/IPAddr.h"
 #include "zeek/RE.h"
 #include "zeek/Reporter.h"

src/DNS_Mapping.cc

@@ -3,6 +3,7 @@
 #include "zeek/DNS_Mapping.h"
 
 #include <ares_nameser.h>
+#include <cinttypes>
 
 #include "zeek/DNS_Mgr.h"
 #include "zeek/Reporter.h"

src/DebugLogger.h

@@ -9,7 +9,7 @@
 
 #include "zeek/zeek-config.h"
 
-#include <stdio.h>
+#include <cstdio>
 #include <set>
 #include <string>
 

src/Dict.h

@@ -3,6 +3,7 @@
 #pragma once
 
 #include <algorithm>
+#include <cinttypes>
 #include <cmath>
 #include <cstdint>
 #include <fstream>

src/EquivClass.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include <stdio.h>
+#include <cstdio>
 
 namespace zeek::detail {
 

src/Func.cc

@@ -30,6 +30,7 @@
 #include "zeek/RunState.h"
 #include "zeek/Scope.h"
 #include "zeek/ScriptProfile.h"
+#include "zeek/Stats.h"
 #include "zeek/Stmt.h"
 #include "zeek/Traverse.h"
 #include "zeek/Var.h"
@@ -524,6 +525,8 @@ void ScriptFunc::CreateCaptures(std::unique_ptr<std::vector<ZVal>> cvec) {
     }
 }
 
+void ScriptFunc::SetCapturesVec(std::unique_ptr<std::vector<ZVal>> cv) { captures_vec = std::move(cv); }
+
 void ScriptFunc::SetCaptures(Frame* f) {
     const auto& captures = type->GetCaptures();
     ASSERT(captures);

src/Func.h

@@ -11,9 +11,16 @@
 
 #include "zeek/Obj.h"
 #include "zeek/Scope.h"
-#include "zeek/Stmt.h"
+#include "zeek/StmtBase.h"
+#include "zeek/StmtEnums.h"
 #include "zeek/TraverseTypes.h"
-#include "zeek/Type.h" /* for function_flavor */
+#include "zeek/Type.h" /* for FunctionFlavor */
+
+// This is needed in order to chain-include ZVal.h, which is what's
+// actually needed by Func.h. If you don't include Val.h along with
+// ZVal.h, Windows fails to build because of the forward declarations
+// in ZVal.h.
+#include "zeek/Val.h"
 #include "zeek/ZeekArgs.h"
 #include "zeek/ZeekList.h"
 
@@ -223,7 +230,7 @@ public:
      *
      * @param cv The value used for captures_vec.
      */
-    void SetCapturesVec(std::unique_ptr<std::vector<ZVal>> cv) { captures_vec = std::move(cv); }
+    void SetCapturesVec(std::unique_ptr<std::vector<ZVal>> cv);
 
     // Same definition as in Frame.h.
     using OffsetMap = std::unordered_map<std::string, int>;

src/Hash.cc

@@ -2,11 +2,10 @@
 
 #include "zeek/Hash.h"
 
-#include "zeek/zeek-config.h"
-
 #include <highwayhash/highwayhash_target.h>
 #include <highwayhash/instruction_sets.h>
 #include <highwayhash/sip_hash.h>
+#include <cinttypes>
 
 #include "zeek/DebugLogger.h"
 #include "zeek/Desc.h"

src/ID.cc

@@ -6,6 +6,7 @@
 
 #include "zeek/Attr.h"
 #include "zeek/Desc.h"
+#include "zeek/Dict.h"
 #include "zeek/EventRegistry.h"
 #include "zeek/Expr.h"
 #include "zeek/File.h"

src/IntrusivePtr.h

@@ -6,7 +6,7 @@
 #include <type_traits>
 #include <utility>
 
-#include "Obj.h"
+#include "zeek/Obj.h"
 
 namespace zeek {
 

src/List.h

@@ -21,11 +21,10 @@
 //	Entries must be either a pointer to the data or nonzero data with
 //	sizeof(data) <= sizeof(void*).
 
-#include <stdarg.h>
 #include <cassert>
+#include <cstdarg>
 #include <initializer_list>
 #include <iterator>
-#include <utility>
 
 #include "zeek/util.h"
 

src/NetVar.h

@@ -3,7 +3,6 @@
 #pragma once
 
 #include "zeek/EventRegistry.h"
-#include "zeek/Stats.h"
 #include "zeek/Val.h"
 
 namespace zeek::detail {

src/OpaqueVal.h

@@ -15,9 +15,6 @@
 #include "zeek/RandTest.h"
 #include "zeek/Val.h"
 #include "zeek/digest.h"
-#include "zeek/telemetry/Counter.h"
-#include "zeek/telemetry/Gauge.h"
-#include "zeek/telemetry/Histogram.h"
 
 namespace broker {
 class data;

src/Reassem.cc

@@ -5,6 +5,7 @@
 #include "zeek/zeek-config.h"
 
 #include <algorithm>
+#include <cinttypes>
 #include <limits>
 
 #include "zeek/Desc.h"

src/Reporter.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include <stdarg.h>
+#include <cstdarg>
 #include <list>
 #include <map>
 #include <string>

src/ScriptCoverageManager.cc

@@ -4,6 +4,7 @@
 
 #include <sys/stat.h>
 #include <algorithm>
+#include <cinttypes>
 #include <cstdio>
 #include <cstring>
 #include <fstream>

src/SerializationFormat.cc

@@ -3,6 +3,7 @@
 #include "zeek/SerializationFormat.h"
 
 #include <cctype>
+#include <cinttypes>
 
 #include "zeek/DebugLogger.h"
 #include "zeek/IPAddr.h"

src/Stats.cc

@@ -8,6 +8,7 @@
 
 #include "zeek/Conn.h"
 #include "zeek/DNS_Mgr.h"
+#include "zeek/Dict.h"
 #include "zeek/Event.h"
 #include "zeek/File.h"
 #include "zeek/Func.h"

src/Tag.cc

@@ -2,6 +2,8 @@
 
 #include "zeek/Tag.h"
 
+#include <cinttypes>
+
 #include "zeek/Val.h"
 
 namespace zeek {

src/Type.cc

@@ -4,6 +4,7 @@
 
 #include "zeek/zeek-config.h"
 
+#include <cinttypes>
 #include <list>
 #include <map>
 #include <string>

src/analyzer/protocol/http/HTTP.cc

@@ -2,11 +2,8 @@
 
 #include "zeek/analyzer/protocol/http/HTTP.h"
 
-#include "zeek/zeek-config.h"
-
 #include <algorithm>
 #include <cctype>
-#include <cmath>
 #include <cstdlib>
 #include <string>
 
@@ -346,9 +343,9 @@ void HTTP_Entity::SubmitHeader(analyzer::mime::MIME_Header* h) {
     else if ( analyzer::mime::istrequal(h->get_name(), "content-range") &&
               http_message->MyHTTP_Analyzer()->HTTP_ReplyCode() == 206 ) {
         data_chunk_t vt = h->get_value_token();
-        string byte_unit(vt.data, vt.length);
+        std::string byte_unit(vt.data, vt.length);
         vt = h->get_value_after_token();
-        string byte_range(vt.data, vt.length);
+        std::string byte_range(vt.data, vt.length);
         byte_range.erase(remove(byte_range.begin(), byte_range.end(), ' '), byte_range.end());
 
         if ( byte_unit != "bytes" ) {
@@ -357,22 +354,22 @@ void HTTP_Entity::SubmitHeader(analyzer::mime::MIME_Header* h) {
         }
 
         size_t p = byte_range.find('/');
-        if ( p == string::npos ) {
+        if ( p == std::string::npos ) {
             http_message->Weird("HTTP_content_range_cannot_parse");
             return;
         }
 
-        string byte_range_resp_spec = byte_range.substr(0, p);
+        std::string byte_range_resp_spec = byte_range.substr(0, p);
-        string instance_length_str = byte_range.substr(p + 1);
+        std::string instance_length_str = byte_range.substr(p + 1);
 
         p = byte_range_resp_spec.find('-');
-        if ( p == string::npos ) {
+        if ( p == std::string::npos ) {
             http_message->Weird("HTTP_content_range_cannot_parse");
             return;
         }
 
-        string first_byte_pos = byte_range_resp_spec.substr(0, p);
+        std::string first_byte_pos = byte_range_resp_spec.substr(0, p);
-        string last_byte_pos = byte_range_resp_spec.substr(p + 1);
+        std::string last_byte_pos = byte_range_resp_spec.substr(p + 1);
 
         if ( DEBUG_http )
             DEBUG_MSG("Parsed Content-Range: %s %s-%s/%s\n", byte_unit.c_str(), first_byte_pos.c_str(),

src/analyzer/protocol/http/HTTP.h

@@ -2,6 +2,9 @@
 
 #pragma once
 
+#include <queue>
+#include <string>
+
 #include "zeek/IPAddr.h"
 #include "zeek/analyzer/protocol/http/events.bif.h"
 #include "zeek/analyzer/protocol/mime/MIME.h"
@@ -9,7 +12,6 @@
 #include "zeek/analyzer/protocol/tcp/ContentLine.h"
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/analyzer/protocol/zip/ZIP.h"
-#include "zeek/binpac_zeek.h"
 
 namespace zeek::analyzer::http {
 
@@ -43,7 +45,7 @@ public:
     int64_t BodyLength() const { return body_length; }
     int64_t HeaderLength() const { return header_length; }
     void SkipBody() { deliver_body = 0; }
-    const string& FileID() const { return precomputed_file_id; }
+    const std::string& FileID() const { return precomputed_file_id; }
 
 protected:
     class UncompressedOutput;

src/analyzer/protocol/smb/smb1-com-nt-create-andx.pac

@@ -1,3 +1,7 @@
+%extern{
+#include "zeek/Dict.h"
+%}
+
 refine connection SMB_Conn += {
 	function proc_smb1_nt_create_andx_request(header: SMB_Header, val: SMB1_nt_create_andx_request): bool
 		%{

src/analyzer/protocol/smb/smb2-com-create.pac

@@ -1,3 +1,7 @@
+%extern{
+#include "zeek/Dict.h"
+%}
+
 refine connection SMB_Conn += {
 
 	function proc_smb2_create_request(h: SMB2_Header, val: SMB2_create_request): bool

src/analyzer/protocol/tcp/TCP_Flags.h

@@ -2,15 +2,9 @@
 
 #pragma once
 
-// This needs to remain the first include in this file, or some defines aren't
-// set correctly when netinet/tcp.h is included and the CentOS 7 build breaks.
-// clang-format off
-#include "zeek/net_util.h"
-
 #include <netinet/tcp.h>
 #include <sys/types.h>
 #include <string>
-// clang-format on
 
 namespace zeek::analyzer::tcp {
 

src/analyzer/protocol/tcp/TCP_Reassembler.cc

@@ -7,6 +7,7 @@
 #include "zeek/File.h"
 #include "zeek/Reporter.h"
 #include "zeek/RuleMatcher.h"
+#include "zeek/Stats.h"
 #include "zeek/ZeekString.h"
 #include "zeek/analyzer/Analyzer.h"
 #include "zeek/analyzer/protocol/tcp/TCP.h"

src/broker/Data.cc

@@ -5,6 +5,7 @@
 #include <broker/error.hh>
 
 #include "zeek/Desc.h"
+#include "zeek/Dict.h"
 #include "zeek/File.h"
 #include "zeek/Func.h"
 #include "zeek/ID.h"

src/cluster/Backend.h

@@ -10,22 +10,16 @@
 #include <variant>
 
 #include "zeek/EventHandler.h"
-#include "zeek/IntrusivePtr.h"
 #include "zeek/Span.h"
 #include "zeek/Tag.h"
+#include "zeek/Val.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/cluster/BifSupport.h"
 #include "zeek/cluster/Serializer.h"
 #include "zeek/logging/Types.h"
 
 namespace zeek {
 
-class FuncVal;
-
-using FuncValPtr = IntrusivePtr<FuncVal>;
-
-class Val;
-using ValPtr = IntrusivePtr<Val>;
-using ArgsSpan = Span<const ValPtr>;
-
 namespace detail {
 template<class Proc, class Work>
 class OnLoopProcess;

src/digest.h

@@ -7,10 +7,11 @@
 #pragma once
 
 #include <sys/types.h> // for u_char
-#include <zeek/util.h>
 #include <cstdint>
 #include <cstdio>
 
+#include "zeek/util.h"
+
 // Required buffer size for an MD5 digest.
 #define ZEEK_MD5_DIGEST_LENGTH 16
 

src/input/Manager.cc

@@ -7,6 +7,7 @@
 
 #include "zeek/CompHash.h"
 #include "zeek/Desc.h"
+#include "zeek/Dict.h"
 #include "zeek/Event.h"
 #include "zeek/EventHandler.h"
 #include "zeek/Expr.h"

src/iosource/Component.cc

@@ -4,6 +4,7 @@
 
 #include "zeek/Desc.h"
 #include "zeek/Reporter.h"
+#include "zeek/Type.h"
 
 namespace zeek::iosource {
 

src/iosource/pcap/Source.cc

@@ -10,7 +10,7 @@
 #include <pcap-int.h>
 #endif
 
-#include <stdio.h>
+#include <cstdio>
 
 #include "zeek/Event.h"
 #include "zeek/iosource/BPF_Program.h"

src/logging/Manager.cc

@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "zeek/Desc.h"
+#include "zeek/Dict.h"
 #include "zeek/Event.h"
 #include "zeek/EventHandler.h"
 #include "zeek/File.h"

src/main.cc

@@ -3,8 +3,10 @@
 #include "zeek/zeek-config.h"
 
 #include <unistd.h>
+#include <cinttypes>
 
 #include "zeek/RunState.h"
+#include "zeek/Stats.h"
 #include "zeek/iosource/Manager.h"
 #include "zeek/supervisor/Supervisor.h"
 #include "zeek/zeek-setup.h"

src/mmdb.bif

@@ -1,5 +1,5 @@
 %%{
-#include <zeek/MMDB.h>
+#include "zeek/MMDB.h"
 %%}
 
 ## Initializes MMDB for later use of lookup_location.

src/net_util.h

@@ -5,18 +5,9 @@
 #include "zeek/zeek-config.h"
 
 #include <cstdint>
-
+#include <memory>
-// Define first.
+#include <string>
-enum TransportProto : uint8_t {
+#include <utility>
-    TRANSPORT_UNKNOWN,
-    TRANSPORT_TCP,
-    TRANSPORT_UDP,
-    TRANSPORT_ICMP,
-};
-
-extern const char* transport_proto_string(TransportProto proto);
-
-enum IPFamily { IPv4, IPv6 };
 
 // Force these files to stay in this order. Normally, clang-format
 // wants to move sys/types.h to the end of this block, but that
@@ -36,8 +27,6 @@ enum IPFamily { IPv4, IPv6 };
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
 
-#include "zeek/util.h"
-
 #ifdef HAVE_NETINET_IP6_H
 #include <netinet/ip6.h>
 
@@ -126,6 +115,18 @@ struct ip6_rthdr {
 #define TCPOPT_TIMESTAMP TCPOPT_TSTAMP
 #endif
 
+// Define first.
+enum TransportProto : uint8_t {
+    TRANSPORT_UNKNOWN,
+    TRANSPORT_TCP,
+    TRANSPORT_UDP,
+    TRANSPORT_ICMP,
+};
+
+extern const char* transport_proto_string(TransportProto proto);
+
+enum IPFamily { IPv4, IPv6 };
+
 namespace zeek {
 
 class IPAddr;

src/parse.y

@@ -83,6 +83,7 @@
 
 %{
 #include <cassert>
+#include <cinttypes>
 #include <cstdlib>
 #include <cstring>
 #include <set>

src/plugin/Component.cc

@@ -4,6 +4,8 @@
 
 #include "zeek/Desc.h"
 #include "zeek/Reporter.h"
+#include "zeek/Type.h"
+#include "zeek/Val.h"
 
 namespace zeek::plugin {
 
@@ -16,6 +18,8 @@ Component::Component(component::Type arg_type, const std::string& arg_name, Tag:
     canon_name_val = make_intrusive<StringVal>(canon_name);
 }
 
+Component::~Component() {}
+
 void Component::Describe(ODesc* d) const {
     d->Add("    ");
     d->Add("[");
@@ -95,4 +99,7 @@ void Component::SetEnabled(bool arg_enabled) {
             break;
     }
 }
+
+StringValPtr Component::CanonicalNameVal() const { return canon_name_val; }
+
 } // namespace zeek::plugin

src/plugin/Component.h

@@ -2,17 +2,20 @@
 
 #pragma once
 
-#include "zeek/zeek-config.h"
-
 #include <string>
 
+#include "zeek/IntrusivePtr.h"
 #include "zeek/Tag.h"
-#include "zeek/Type.h"
-#include "zeek/Val.h"
 
 namespace zeek {
 
 class ODesc;
+class EnumType;
+using EnumTypePtr = IntrusivePtr<EnumType>;
+class EnumVal;
+using EnumValPtr = IntrusivePtr<EnumVal>;
+class StringVal;
+using StringValPtr = IntrusivePtr<StringVal>;
 
 namespace plugin {
 namespace component {
@@ -69,7 +72,7 @@ public:
     /**
      * Destructor.
      */
-    virtual ~Component() = default;
+    virtual ~Component();
 
     // Disable.
     Component(const Component& other) = delete;
@@ -99,7 +102,7 @@ public:
      * ID.
      */
     const std::string& CanonicalName() const { return canon_name; }
-    StringValPtr CanonicalNameVal() const { return canon_name_val; }
+    StringValPtr CanonicalNameVal() const;
 
     /**
      * Returns a textual representation of the component. This goes into

src/probabilistic/BloomFilter.cc

@@ -2,6 +2,7 @@
 
 #include "zeek/probabilistic/BloomFilter.h"
 
+#include <cinttypes>
 #include <cmath>
 #include <limits>
 

src/probabilistic/CardinalityCounter.cc

@@ -2,6 +2,7 @@
 
 #include "zeek/probabilistic/CardinalityCounter.h"
 
+#include <cinttypes>
 #include <cmath>
 #include <cstdint>
 #include <utility>

src/re-scan.l

@@ -5,11 +5,11 @@
  */
 
 %top{
-// Include stdint.h at the start of the generated file. Typically
+// Include cstdint at the start of the generated file. Typically
 // MSVC will include this header later, after the definitions of
 // the integral type macros. MSVC then complains that about the
-// redefinition of the types. Including stdint.h early avoids this.
+// redefinition of the types. Including cstdint early avoids this.
-#include <stdint.h>
+#include <cstdint>
 }
 
 %{

src/rule-parse.y

@@ -1,6 +1,6 @@
 %{
 #include "zeek/zeek-config.h"
-#include <stdio.h>
+#include <cstdio>
 #include <netinet/in.h>
 #include <vector>
 

src/rule-scan.l

@@ -1,9 +1,9 @@
 %top{
-// Include stdint.h at the start of the generated file. Typically
+// Include cstdint at the start of the generated file. Typically
 // MSVC will include this header later, after the definitions of
 // the integral type macros. MSVC then complains that about the
-// redefinition of the types. Including stdint.h early avoids this.
+// redefinition of the types. Including cstdint early avoids this.
-#include <stdint.h>
+#include <cstdint>
 }
 
 %{

src/scan.l

@@ -1,9 +1,9 @@
 %top{
-// Include stdint.h at the start of the generated file. Typically
+// Include cstdint at the start of the generated file. Typically
 // MSVC will include this header later, after the definitions of
 // the integral type macros. MSVC then complains that about the
-// redefinition of the types. Including stdint.h early avoids this.
+// redefinition of the types. Including cstdint early avoids this.
-#include <stdint.h>
+#include <cstdint>
 }
 
 %{

src/script_opt/ObjMgr.h

@@ -15,10 +15,10 @@
 
 #pragma once
 
-#include <zeek/Obj.h>
 #include <unordered_map>
 
 #include "zeek/IntrusivePtr.h"
+#include "zeek/Obj.h"
 
 namespace zeek::detail {
 

src/script_opt/ZAM/IterInfo.h

@@ -4,6 +4,7 @@
 
 #pragma once
 
+#include "zeek/Dict.h"
 #include "zeek/Val.h"
 #include "zeek/ZeekString.h"
 #include "zeek/script_opt/ZAM/ZInstAux.h"

src/script_opt/ZAM/ZBody.cc

@@ -4,6 +4,7 @@
 
 #include "zeek/Conn.h"
 #include "zeek/Desc.h"
+#include "zeek/Dict.h"
 #include "zeek/EventHandler.h"
 #include "zeek/File.h"
 #include "zeek/Frame.h"

src/session/Manager.cc

@@ -15,6 +15,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/RuleMatcher.h"
 #include "zeek/RunState.h"
+#include "zeek/Stats.h"
 #include "zeek/Timer.h"
 #include "zeek/TunnelEncapsulation.h"
 #include "zeek/packet_analysis/Manager.h"

src/session/Session.cc

@@ -6,6 +6,7 @@
 #include "zeek/Event.h"
 #include "zeek/IP.h"
 #include "zeek/Reporter.h"
+#include "zeek/Stats.h"
 #include "zeek/Val.h"
 #include "zeek/analyzer/Analyzer.h"
 #include "zeek/session/Manager.h"

src/spicy/manager.cc

@@ -24,10 +24,9 @@
 
 #include <hilti/autogen/config.h>
 
-#include <zeek/analyzer/Manager.h>
+#include "zeek/analyzer/Manager.h"
-#include <zeek/file_analysis/Manager.h>
+#include "zeek/file_analysis/Manager.h"
-#include <zeek/packet_analysis/Manager.h>
+#include "zeek/packet_analysis/Manager.h"
-
 #include "zeek/spicy/file-analyzer.h"
 #include "zeek/spicy/packet-analyzer.h"
 #include "zeek/spicy/protocol-analyzer.h"

src/storage/Component.h

@@ -2,6 +2,9 @@
 
 #pragma once
 
+#include <memory>
+
+#include "zeek/IntrusivePtr.h"
 #include "zeek/plugin/Component.h"
 
 namespace zeek::storage {

src/storage/Manager.cc

@@ -7,6 +7,8 @@
 #include "zeek/RunState.h"
 #include "zeek/storage/ReturnCode.h"
 
+#include "const.bif.netvar_h"
+
 std::atomic_flag expire_running;
 
 namespace zeek::storage {

src/storage/backend/redis/Redis.cc

@@ -3,6 +3,7 @@
 #include "zeek/storage/backend/redis/Redis.h"
 
 #include <algorithm>
+#include <cinttypes>
 
 #include "zeek/DebugLogger.h"
 #include "zeek/Func.h"

src/supervisor/Supervisor.cc

@@ -26,6 +26,7 @@ extern "C" {
 }
 
 #include "zeek/DebugLogger.h"
+#include "zeek/Dict.h"
 #include "zeek/Event.h"
 #include "zeek/EventHandler.h"
 #include "zeek/ID.h"

src/telemetry/Opaques.cc

@@ -2,6 +2,10 @@
 
 #include "Opaques.h"
 
+#include "zeek/telemetry/Counter.h"
+#include "zeek/telemetry/Gauge.h"
+#include "zeek/telemetry/Histogram.h"
+
 using namespace zeek;
 
 TelemetryVal::TelemetryVal(std::shared_ptr<telemetry::Counter>) : OpaqueVal(counter_metric_type) {}
@@ -22,3 +26,33 @@ IMPLEMENT_OPAQUE_VALUE(GaugeMetricVal)
 IMPLEMENT_OPAQUE_VALUE(GaugeMetricFamilyVal)
 IMPLEMENT_OPAQUE_VALUE(HistogramMetricVal)
 IMPLEMENT_OPAQUE_VALUE(HistogramMetricFamilyVal)
+
+template<>
+const char* CounterMetricVal::OpaqueName() const {
+    return telemetry::Counter::OpaqueName;
+}
+
+template<>
+const char* CounterMetricFamilyVal::OpaqueName() const {
+    return telemetry::CounterFamily::OpaqueName;
+}
+
+template<>
+const char* GaugeMetricVal::OpaqueName() const {
+    return telemetry::Gauge::OpaqueName;
+}
+
+template<>
+const char* GaugeMetricFamilyVal::OpaqueName() const {
+    return telemetry::GaugeFamily::OpaqueName;
+}
+
+template<>
+const char* HistogramMetricVal::OpaqueName() const {
+    return telemetry::Histogram::OpaqueName;
+}
+
+template<>
+const char* HistogramMetricFamilyVal::OpaqueName() const {
+    return telemetry::HistogramFamily::OpaqueName;
+}

src/telemetry/Opaques.h

@@ -10,6 +10,17 @@
 
 namespace zeek {
 
+namespace telemetry {
+
+class Counter;
+class CounterFamily;
+class Gauge;
+class GaugeFamily;
+class Histogram;
+class HistogramFamily;
+
+} // namespace telemetry
+
 /**
  * Base class for metric handles. Handle types are not serializable.
  */
@@ -43,7 +54,7 @@ public:
 protected:
     ValPtr DoClone(CloneState*) override { return make_intrusive<TelemetryValImpl>(hdl); }
 
-    const char* OpaqueName() const override { return Handle::OpaqueName; }
+    const char* OpaqueName() const override;
 
 private:
     HandleType hdl;

src/telemetry/ProcessStats.cc

@@ -9,10 +9,10 @@
 #include <libproc.h>
 #include <mach/mach.h>
 #include <mach/task.h>
-#include <math.h>
-#include <stdlib.h>
 #include <sys/resource.h>
 #include <unistd.h>
+#include <cmath>
+#include <cstdlib>
 
 namespace zeek::telemetry::detail {
 

src/threading/BasicThread.cc

@@ -5,6 +5,7 @@
 #include "zeek/zeek-config.h"
 
 #include <pthread.h>
+#include <cinttypes>
 #include <csignal>
 
 #include "zeek/threading/Manager.h"

src/util.h

@@ -16,7 +16,6 @@
 
 #include <libgen.h>
 #include <unistd.h>
-#include <cinttypes>
 #include <cstdarg>
 #include <cstdint>
 #include <cstdio>
@@ -63,8 +62,6 @@
 extern HeapLeakChecker* heap_checker;
 #endif
 
-#include <stdint.h>
-
 extern "C" {
 #include "zeek/3rdparty/modp_numtoa.h"
 }

src/zeek-setup.cc

@@ -43,6 +43,7 @@
 #include "zeek/Scope.h"
 #include "zeek/ScriptCoverageManager.h"
 #include "zeek/Stats.h"
+#include "zeek/Stmt.h"
 #include "zeek/Timer.h"
 #include "zeek/Traverse.h"
 #include "zeek/Trigger.h"

src/zeekygen/Configuration.cc

@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "zeek/Reporter.h"
+#include "zeek/Type.h"
 #include "zeek/zeekygen/utils.h"
 
 using namespace std;

src/zeekygen/Configuration.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include <time.h> // for time_t
+#include <ctime> // for time_t
 #include <string>
 #include <vector>
 

src/zeekygen/IdentifierInfo.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include <time.h> // for time_t
+#include <ctime> // for time_t
 #include <list>
 #include <map>
 #include <string>

src/zeekygen/PackageInfo.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include <time.h> // for time_t
+#include <ctime> // for time_t
 #include <string>
 #include <vector>
 

src/zeekygen/ScriptInfo.h

@@ -4,7 +4,7 @@
 
 #include "zeek/zeek-config.h"
 
-#include <time.h> // for time_t
+#include <ctime> // for time_t
 #include <list>
 #include <map>
 #include <set>

src/zeekygen/SpicyModuleInfo.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include <time.h> // for time_t
+#include <ctime> // for time_t
 #include <list>
 #include <string>
 #include <vector>

src/zeekygen/utils.h

@@ -4,7 +4,7 @@
 
 #include "zeek/zeek-config.h"
 
-#include <time.h> // for time_t
+#include <ctime> // for time_t
 #include <optional>
 #include <string>
 

testing/btest/plugins/api-plugin/src/Plugin.cc

@@ -1,12 +1,14 @@
 
 #include "Plugin.h"
 
-#include <zeek/ID.h>
+#include <cinttypes>
-#include <zeek/Reporter.h>
-#include <zeek/Type.h>
-#include <zeek/Val.h>
 #include <iostream>
 
+#include "zeek/ID.h"
+#include "zeek/Reporter.h"
+#include "zeek/Type.h"
+#include "zeek/Val.h"
+
 namespace btest::plugin::Demo_API {
 Plugin plugin;
 }

testing/btest/plugins/api-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_API {
 

testing/btest/plugins/doctest-plugin/src/Plugin.cc

@@ -1,7 +1,7 @@
 
 #include "Plugin.h"
 
-#include <zeek/3rdparty/doctest.h>
+#include "zeek/3rdparty/doctest.h"
 
 namespace btest::plugin::Demo_Doctest {
 Plugin plugin;

testing/btest/plugins/doctest-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Doctest {
 

testing/btest/plugins/file-plugin/src/Foo.cc

@@ -1,9 +1,10 @@
 #include "Foo.h"
 
-#include <zeek/file_analysis/File.h>
-#include <zeek/file_analysis/Manager.h>
 #include <algorithm>
 
+#include "zeek/file_analysis/File.h"
+#include "zeek/file_analysis/Manager.h"
+
 #include "events.bif.h"
 
 using namespace btest::plugin::Demo_Foo;

testing/btest/plugins/file-plugin/src/Plugin.h

@@ -1,6 +1,6 @@
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Foo {
 

testing/btest/plugins/func-hook-plugin/src/Plugin.cc

@@ -1,12 +1,12 @@
 
 #include "Plugin.h"
 
-#include <zeek/Conn.h>
+#include "zeek/Conn.h"
-#include <zeek/Desc.h>
+#include "zeek/Desc.h"
-#include <zeek/Event.h>
+#include "zeek/Event.h"
-#include <zeek/Func.h>
+#include "zeek/Func.h"
-#include <zeek/Val.h>
+#include "zeek/Val.h"
-#include <zeek/threading/Formatter.h>
+#include "zeek/threading/Formatter.h"
 
 namespace btest::plugin::Demo_Hooks {
 Plugin plugin;

testing/btest/plugins/func-hook-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Hooks {
 

testing/btest/plugins/hooks-plugin/src/Plugin.cc

@@ -1,14 +1,15 @@
 #include "Plugin.h"
 
-#include <zeek/Conn.h>
-#include <zeek/Desc.h>
-#include <zeek/Event.h>
-#include <zeek/Func.h>
-#include <zeek/RunState.h>
-#include <zeek/threading/Formatter.h>
 #include <cstring>
 #include <set>
 
+#include "zeek/Conn.h"
+#include "zeek/Desc.h"
+#include "zeek/Event.h"
+#include "zeek/Func.h"
+#include "zeek/RunState.h"
+#include "zeek/threading/Formatter.h"
+
 namespace btest::plugin::Demo_Hooks {
 Plugin plugin;
 }

testing/btest/plugins/hooks-plugin/src/Plugin.h

@@ -1,7 +1,9 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include <string>
+
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Hooks {
 

testing/btest/plugins/init-hooks-plugin/src/Plugin.h

@@ -1,9 +1,10 @@
 #pragma once
-#include <zeek/plugin/Plugin.h>
+
 #include <cstdio>
 
-namespace btest::plugin::Demo_InitHooks {
+#include "zeek/plugin/Plugin.h"
 
+namespace btest::plugin::Demo_InitHooks {
 
 class Plugin : public zeek::plugin::Plugin {
 protected:

testing/btest/plugins/iosource-plugin/src/Plugin.h

@@ -1,11 +1,12 @@
 
 #pragma once
-#include <zeek/Flare.h>
-#include <zeek/plugin/Plugin.h>
 #include <string>
 #include <string_view>
 
+#include "zeek/Flare.h"
+#include "zeek/RunState.h"
 #include "zeek/iosource/Manager.h"
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Iosource {
 

testing/btest/plugins/meta-hook-plugin/src/Plugin.cc

@@ -1,12 +1,13 @@
 
 #include "Plugin.h"
 
-#include <zeek/Desc.h>
-#include <zeek/Event.h>
-#include <zeek/Func.h>
-#include <zeek/threading/Formatter.h>
 #include <cstdlib>
 
+#include "zeek/Desc.h"
+#include "zeek/Event.h"
+#include "zeek/Func.h"
+#include "zeek/threading/Formatter.h"
+
 namespace btest::plugin::Demo_Meta_Hooks {
 Plugin plugin;
 }

testing/btest/plugins/meta-hook-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Meta_Hooks {
 

testing/btest/plugins/pktdumper-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Foo {
 

testing/btest/plugins/pktsrc-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Foo {
 

testing/btest/plugins/plugin-load-dependency/1/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Testing_Plugin1 {
 

testing/btest/plugins/plugin-load-dependency/2/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Testing_Plugin2 {
 

testing/btest/plugins/plugin-load-dependency/3/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Testing_Plugin3 {
 

testing/btest/plugins/plugin-load-file-extended/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Testing_LoadFileExtended {
 

testing/btest/plugins/plugin-nopatchversion-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Testing_NoPatchVersion {
 

testing/btest/plugins/plugin-withpatchversion-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Testing_WithPatchVersion {
 

testing/btest/plugins/protocol-plugin/src/Plugin.h

@@ -1,7 +1,7 @@
 
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
+#include "zeek/plugin/Plugin.h"
 
 namespace btest::plugin::Demo_Foo {
 

testing/btest/plugins/publish-event-hook-plugin/src/Plugin.cc

@@ -1,11 +1,12 @@
 
 #include "Plugin.h"
 
-#include <zeek/Desc.h>
-#include <zeek/cluster/Backend.h>
 #include <cstdio>
 #include <string>
 
+#include "zeek/Desc.h"
+#include "zeek/cluster/Backend.h"
+
 namespace btest::plugin::Demo_PublishEvent {
 Plugin plugin;
 }

testing/btest/plugins/publish-event-hook-plugin/src/Plugin.h

@@ -1,8 +1,9 @@
 #pragma once
 
-#include <zeek/plugin/Plugin.h>
 #include <string>
 
+#include "zeek/plugin/Plugin.h"
+
 namespace btest::plugin::Demo_PublishEvent {
 
 class Plugin : public zeek::plugin::Plugin {