mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Move input code to zeek namespaces
This commit is contained in:
parent
14408235b8
commit
9a800265ff
31 changed files with 227 additions and 162 deletions
|
@ -6,7 +6,7 @@
|
||||||
#include "../Desc.h"
|
#include "../Desc.h"
|
||||||
#include "../util.h"
|
#include "../util.h"
|
||||||
|
|
||||||
using namespace input;
|
namespace zeek::input {
|
||||||
|
|
||||||
Component::Component(const std::string& name, factory_callback arg_factory)
|
Component::Component(const std::string& name, factory_callback arg_factory)
|
||||||
: zeek::plugin::Component(zeek::plugin::component::READER, name)
|
: zeek::plugin::Component(zeek::plugin::component::READER, name)
|
||||||
|
@ -29,3 +29,5 @@ void Component::DoDescribe(zeek::ODesc* d) const
|
||||||
d->Add("Input::READER_");
|
d->Add("Input::READER_");
|
||||||
d->Add(CanonicalName());
|
d->Add(CanonicalName());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input
|
||||||
|
|
|
@ -6,16 +6,16 @@
|
||||||
#include "plugin/Component.h"
|
#include "plugin/Component.h"
|
||||||
#include "plugin/TaggedComponent.h"
|
#include "plugin/TaggedComponent.h"
|
||||||
|
|
||||||
namespace input {
|
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
|
||||||
|
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderBackend, zeek, input);
|
||||||
|
|
||||||
class ReaderFrontend;
|
namespace zeek::input {
|
||||||
class ReaderBackend;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Component description for plugins providing log readers.
|
* Component description for plugins providing log readers.
|
||||||
*/
|
*/
|
||||||
class Component : public zeek::plugin::Component,
|
class Component : public zeek::plugin::Component,
|
||||||
public plugin::TaggedComponent<input::Tag> {
|
public plugin::TaggedComponent<zeek::input::Tag> {
|
||||||
public:
|
public:
|
||||||
typedef ReaderBackend* (*factory_callback)(ReaderFrontend* frontend);
|
typedef ReaderBackend* (*factory_callback)(ReaderFrontend* frontend);
|
||||||
|
|
||||||
|
@ -60,4 +60,8 @@ private:
|
||||||
factory_callback factory;
|
factory_callback factory;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::input
|
||||||
|
|
||||||
|
namespace input {
|
||||||
|
using Component [[deprecated("Remove in v4.1. Use zeek::input::Component.")]] = zeek::input::Component;
|
||||||
}
|
}
|
||||||
|
|
|
@ -22,11 +22,12 @@
|
||||||
#include "../file_analysis/Manager.h"
|
#include "../file_analysis/Manager.h"
|
||||||
#include "../threading/SerialTypes.h"
|
#include "../threading/SerialTypes.h"
|
||||||
|
|
||||||
using namespace input;
|
|
||||||
using namespace std;
|
using namespace std;
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
|
namespace zeek::input {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* InputHashes are used as Dictionaries to store the value and index hashes
|
* InputHashes are used as Dictionaries to store the value and index hashes
|
||||||
* for all lines currently stored in a table. Index hash is stored as
|
* for all lines currently stored in a table. Index hash is stored as
|
||||||
|
@ -2511,3 +2512,5 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co
|
||||||
|
|
||||||
free(buf);
|
free(buf);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input
|
||||||
|
|
|
@ -13,12 +13,12 @@
|
||||||
#include "Tag.h"
|
#include "Tag.h"
|
||||||
|
|
||||||
ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
|
ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
|
||||||
|
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
|
||||||
|
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderBackend, zeek, input);
|
||||||
|
|
||||||
|
namespace zeek {
|
||||||
namespace input {
|
namespace input {
|
||||||
|
|
||||||
class ReaderFrontend;
|
|
||||||
class ReaderBackend;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Singleton class for managing input streams.
|
* Singleton class for managing input streams.
|
||||||
*/
|
*/
|
||||||
|
@ -256,7 +256,14 @@ private:
|
||||||
zeek::EventHandlerPtr end_of_data;
|
zeek::EventHandlerPtr end_of_data;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace input
|
||||||
}
|
|
||||||
|
|
||||||
extern input::Manager* input_mgr;
|
extern input::Manager* input_mgr;
|
||||||
|
|
||||||
|
} // namespace zeek
|
||||||
|
|
||||||
|
extern zeek::input::Manager*& input_mgr [[deprecated("Remove in v4.1. Use zeek::input_mgr.")]];
|
||||||
|
|
||||||
|
namespace input {
|
||||||
|
using Manager [[deprecated("Remove in v4.1. Use zeek::input::Manager.")]] = zeek::input::Manager;
|
||||||
|
}
|
||||||
|
|
|
@ -7,7 +7,7 @@
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
namespace input {
|
namespace zeek::input {
|
||||||
|
|
||||||
class PutMessage final : public threading::OutputMessage<ReaderFrontend> {
|
class PutMessage final : public threading::OutputMessage<ReaderFrontend> {
|
||||||
public:
|
public:
|
||||||
|
@ -340,4 +340,4 @@ void ReaderBackend::Error(const char* msg)
|
||||||
DisableFrontend();
|
DisableFrontend();
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
} // namespace zeek::input
|
||||||
|
|
|
@ -9,7 +9,9 @@
|
||||||
|
|
||||||
#include "Component.h"
|
#include "Component.h"
|
||||||
|
|
||||||
namespace input {
|
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek::input);
|
||||||
|
|
||||||
|
namespace zeek::input {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* The modes a reader can be in.
|
* The modes a reader can be in.
|
||||||
|
@ -41,8 +43,6 @@ enum ReaderMode {
|
||||||
MODE_NONE
|
MODE_NONE
|
||||||
};
|
};
|
||||||
|
|
||||||
class ReaderFrontend;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Base class for reader implementation. When the input:Manager creates a new
|
* Base class for reader implementation. When the input:Manager creates a new
|
||||||
* input stream, it instantiates a ReaderFrontend. That then in turn creates
|
* input stream, it instantiates a ReaderFrontend. That then in turn creates
|
||||||
|
@ -364,4 +364,16 @@ private:
|
||||||
bool suppress_warnings = false;
|
bool suppress_warnings = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::input
|
||||||
|
|
||||||
|
namespace input {
|
||||||
|
|
||||||
|
using ReaderMode [[deprecated("Remove in v4.1. Use zeek::input::ReaderMode.")]] = zeek::input::ReaderMode;
|
||||||
|
constexpr auto MODE_MANUAL [[deprecated("Remove in v4.1. Use zeek::input::MODE_MANUAL.")]] = zeek::input::MODE_MANUAL;
|
||||||
|
constexpr auto MODE_REREAD [[deprecated("Remove in v4.1. Use zeek::input::MODE_REREAD.")]] = zeek::input::MODE_REREAD;
|
||||||
|
constexpr auto MODE_STREAM [[deprecated("Remove in v4.1. Use zeek::input::MODE_STREAM.")]] = zeek::input::MODE_STREAM;
|
||||||
|
constexpr auto MODE_NONE [[deprecated("Remove in v4.1. Use zeek::input::MODE_NONE.")]] = zeek::input::MODE_NONE;
|
||||||
|
|
||||||
|
using ReaderBackend [[deprecated("Remove in v4.1. Use zeek::input::ReaderBackend.")]] = zeek::input::ReaderBackend;
|
||||||
|
|
||||||
|
} // namespace input
|
||||||
|
|
|
@ -4,7 +4,7 @@
|
||||||
#include "ReaderFrontend.h"
|
#include "ReaderFrontend.h"
|
||||||
#include "ReaderBackend.h"
|
#include "ReaderBackend.h"
|
||||||
|
|
||||||
namespace input {
|
namespace zeek::input {
|
||||||
|
|
||||||
class InitMessage final : public threading::InputMessage<ReaderBackend>
|
class InitMessage final : public threading::InputMessage<ReaderBackend>
|
||||||
{
|
{
|
||||||
|
@ -97,4 +97,4 @@ const char* ReaderFrontend::Name() const
|
||||||
return name;
|
return name;
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
} // namespace zeek::input
|
||||||
|
|
|
@ -6,10 +6,9 @@
|
||||||
#include "threading/SerialTypes.h"
|
#include "threading/SerialTypes.h"
|
||||||
|
|
||||||
ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
|
ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
|
||||||
|
ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, input);
|
||||||
|
|
||||||
namespace input {
|
namespace zeek::input {
|
||||||
|
|
||||||
class Manager;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Bridge class between the input::Manager and backend input threads. The
|
* Bridge class between the input::Manager and backend input threads. The
|
||||||
|
@ -119,7 +118,7 @@ public:
|
||||||
const threading::Field* const * Fields() const { return fields; }
|
const threading::Field* const * Fields() const { return fields; }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
friend class Manager;
|
friend class zeek::input::Manager;
|
||||||
|
|
||||||
private:
|
private:
|
||||||
ReaderBackend* backend; // The backend we have instanatiated.
|
ReaderBackend* backend; // The backend we have instanatiated.
|
||||||
|
@ -131,4 +130,8 @@ private:
|
||||||
const char* name; // Descriptive name.
|
const char* name; // Descriptive name.
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::input
|
||||||
|
|
||||||
|
namespace input {
|
||||||
|
using ReaderFrontend [[deprecated("Remove in v4.1. Use zeek::input::ReaderFrontend.")]] = zeek::input::ReaderFrontend;
|
||||||
}
|
}
|
||||||
|
|
|
@ -3,33 +3,37 @@
|
||||||
#include "Tag.h"
|
#include "Tag.h"
|
||||||
#include "Manager.h"
|
#include "Manager.h"
|
||||||
|
|
||||||
const input::Tag input::Tag::Error;
|
namespace zeek::input {
|
||||||
|
|
||||||
input::Tag::Tag(type_t type, subtype_t subtype)
|
const Tag Tag::Error;
|
||||||
|
|
||||||
|
Tag::Tag(type_t type, subtype_t subtype)
|
||||||
: zeek::Tag(input_mgr->GetTagType(), type, subtype)
|
: zeek::Tag(input_mgr->GetTagType(), type, subtype)
|
||||||
{
|
{
|
||||||
}
|
}
|
||||||
|
|
||||||
input::Tag& input::Tag::operator=(const input::Tag& other)
|
Tag& Tag::operator=(const Tag& other)
|
||||||
{
|
{
|
||||||
zeek::Tag::operator=(other);
|
zeek::Tag::operator=(other);
|
||||||
return *this;
|
return *this;
|
||||||
}
|
}
|
||||||
|
|
||||||
const zeek::EnumValPtr& input::Tag::AsVal() const
|
const zeek::EnumValPtr& Tag::AsVal() const
|
||||||
{
|
{
|
||||||
return zeek::Tag::AsVal(input_mgr->GetTagType());
|
return zeek::Tag::AsVal(input_mgr->GetTagType());
|
||||||
}
|
}
|
||||||
|
|
||||||
zeek::EnumVal* input::Tag::AsEnumVal() const
|
zeek::EnumVal* Tag::AsEnumVal() const
|
||||||
{
|
{
|
||||||
return AsVal().get();
|
return AsVal().get();
|
||||||
}
|
}
|
||||||
|
|
||||||
input::Tag::Tag(zeek::EnumValPtr val)
|
Tag::Tag(zeek::EnumValPtr val)
|
||||||
: zeek::Tag(std::move(val))
|
: zeek::Tag(std::move(val))
|
||||||
{ }
|
{ }
|
||||||
|
|
||||||
input::Tag::Tag(zeek::EnumVal* val)
|
Tag::Tag(zeek::EnumVal* val)
|
||||||
: zeek::Tag({zeek::NewRef{}, val})
|
: zeek::Tag({zeek::NewRef{}, val})
|
||||||
{ }
|
{ }
|
||||||
|
|
||||||
|
} // namespace zeek::input
|
||||||
|
|
|
@ -20,10 +20,10 @@ namespace plugin {
|
||||||
zeek::plugin::ComponentManager<T, C>;
|
zeek::plugin::ComponentManager<T, C>;
|
||||||
}
|
}
|
||||||
|
|
||||||
namespace input {
|
ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, input);
|
||||||
|
ZEEK_FORWARD_DECLARE_NAMESPACED(Component, zeek, input);
|
||||||
|
|
||||||
class Manager;
|
namespace zeek::input {
|
||||||
class Component;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Class to identify a reader type.
|
* Class to identify a reader type.
|
||||||
|
@ -123,4 +123,8 @@ protected:
|
||||||
explicit Tag(zeek::EnumVal* val);
|
explicit Tag(zeek::EnumVal* val);
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::input
|
||||||
|
|
||||||
|
namespace input {
|
||||||
|
using Tag [[deprecated("Remove in v4.1. Use zeek::input::Tag.")]] = zeek::input::Tag;
|
||||||
}
|
}
|
||||||
|
|
|
@ -18,31 +18,31 @@ type AnalysisDescription: record;
|
||||||
|
|
||||||
function Input::__create_table_stream%(description: Input::TableDescription%) : bool
|
function Input::__create_table_stream%(description: Input::TableDescription%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->CreateTableStream(description->AsRecordVal());
|
bool res = zeek::input_mgr->CreateTableStream(description->AsRecordVal());
|
||||||
return zeek::val_mgr->Bool(res);
|
return zeek::val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__create_event_stream%(description: Input::EventDescription%) : bool
|
function Input::__create_event_stream%(description: Input::EventDescription%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->CreateEventStream(description->AsRecordVal());
|
bool res = zeek::input_mgr->CreateEventStream(description->AsRecordVal());
|
||||||
return zeek::val_mgr->Bool(res);
|
return zeek::val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__create_analysis_stream%(description: Input::AnalysisDescription%) : bool
|
function Input::__create_analysis_stream%(description: Input::AnalysisDescription%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->CreateAnalysisStream(description->AsRecordVal());
|
bool res = zeek::input_mgr->CreateAnalysisStream(description->AsRecordVal());
|
||||||
return zeek::val_mgr->Bool(res);
|
return zeek::val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__remove_stream%(id: string%) : bool
|
function Input::__remove_stream%(id: string%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->RemoveStream(id->AsString()->CheckString());
|
bool res = zeek::input_mgr->RemoveStream(id->AsString()->CheckString());
|
||||||
return zeek::val_mgr->Bool(res);
|
return zeek::val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__force_update%(id: string%) : bool
|
function Input::__force_update%(id: string%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->ForceUpdate(id->AsString()->CheckString());
|
bool res = zeek::input_mgr->ForceUpdate(id->AsString()->CheckString());
|
||||||
return zeek::val_mgr->Bool(res);
|
return zeek::val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
|
|
|
@ -12,12 +12,13 @@
|
||||||
|
|
||||||
#include "threading/SerialTypes.h"
|
#include "threading/SerialTypes.h"
|
||||||
|
|
||||||
using namespace input::reader;
|
|
||||||
using namespace threading;
|
using namespace threading;
|
||||||
using namespace std;
|
using namespace std;
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
FieldMapping::FieldMapping(const string& arg_name, const zeek::TypeTag& arg_type, int arg_position)
|
FieldMapping::FieldMapping(const string& arg_name, const zeek::TypeTag& arg_type, int arg_position)
|
||||||
: name(arg_name), type(arg_type), subtype(zeek::TYPE_ERROR)
|
: name(arg_name), type(arg_type), subtype(zeek::TYPE_ERROR)
|
||||||
{
|
{
|
||||||
|
@ -47,7 +48,7 @@ FieldMapping FieldMapping::subType()
|
||||||
return FieldMapping(name, subtype, position);
|
return FieldMapping(name, subtype, position);
|
||||||
}
|
}
|
||||||
|
|
||||||
Ascii::Ascii(ReaderFrontend *frontend) : ReaderBackend(frontend)
|
Ascii::Ascii(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend)
|
||||||
{
|
{
|
||||||
mtime = 0;
|
mtime = 0;
|
||||||
ino = 0;
|
ino = 0;
|
||||||
|
@ -274,7 +275,7 @@ bool Ascii::DoUpdate()
|
||||||
return ! fail_on_file_problem;
|
return ! fail_on_file_problem;
|
||||||
|
|
||||||
switch ( Info().mode ) {
|
switch ( Info().mode ) {
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
{
|
{
|
||||||
// check if the file has changed
|
// check if the file has changed
|
||||||
struct stat sb;
|
struct stat sb;
|
||||||
|
@ -301,14 +302,14 @@ bool Ascii::DoUpdate()
|
||||||
// File changed. Fall through to re-read.
|
// File changed. Fall through to re-read.
|
||||||
}
|
}
|
||||||
|
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
{
|
{
|
||||||
// dirty, fix me. (well, apparently after trying seeking, etc
|
// dirty, fix me. (well, apparently after trying seeking, etc
|
||||||
// - this is not that bad)
|
// - this is not that bad)
|
||||||
if ( file.is_open() )
|
if ( file.is_open() )
|
||||||
{
|
{
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
{
|
{
|
||||||
file.clear(); // remove end of file evil bits
|
file.clear(); // remove end of file evil bits
|
||||||
if ( ! ReadHeader(true) )
|
if ( ! ReadHeader(true) )
|
||||||
|
@ -434,13 +435,13 @@ bool Ascii::DoUpdate()
|
||||||
//printf("fpos: %d, second.num_fields: %d\n", fpos, (*it).second.num_fields);
|
//printf("fpos: %d, second.num_fields: %d\n", fpos, (*it).second.num_fields);
|
||||||
assert ( fpos == NumFields() );
|
assert ( fpos == NumFields() );
|
||||||
|
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
Put(fields);
|
Put(fields);
|
||||||
else
|
else
|
||||||
SendEntry(fields);
|
SendEntry(fields);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( Info().mode != MODE_STREAM )
|
if ( Info().mode != zeek::input::MODE_STREAM )
|
||||||
EndCurrentSend();
|
EndCurrentSend();
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
|
@ -453,12 +454,12 @@ bool Ascii::DoHeartbeat(double network_time, double current_time)
|
||||||
|
|
||||||
switch ( Info().mode )
|
switch ( Info().mode )
|
||||||
{
|
{
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
// yay, we do nothing :)
|
// yay, we do nothing :)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
Update(); // Call Update, not DoUpdate, because Update
|
Update(); // Call Update, not DoUpdate, because Update
|
||||||
// checks the "disabled" flag.
|
// checks the "disabled" flag.
|
||||||
break;
|
break;
|
||||||
|
@ -469,3 +470,5 @@ bool Ascii::DoHeartbeat(double network_time, double current_time)
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
|
@ -11,7 +11,7 @@
|
||||||
#include "input/ReaderBackend.h"
|
#include "input/ReaderBackend.h"
|
||||||
#include "threading/formatters/Ascii.h"
|
#include "threading/formatters/Ascii.h"
|
||||||
|
|
||||||
namespace input { namespace reader {
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
// Description for input field mapping.
|
// Description for input field mapping.
|
||||||
struct FieldMapping {
|
struct FieldMapping {
|
||||||
|
@ -34,9 +34,9 @@ struct FieldMapping {
|
||||||
/**
|
/**
|
||||||
* Reader for structured ASCII files.
|
* Reader for structured ASCII files.
|
||||||
*/
|
*/
|
||||||
class Ascii : public ReaderBackend {
|
class Ascii : public zeek::input::ReaderBackend {
|
||||||
public:
|
public:
|
||||||
explicit Ascii(ReaderFrontend* frontend);
|
explicit Ascii(zeek::input::ReaderFrontend* frontend);
|
||||||
~Ascii() override;
|
~Ascii() override;
|
||||||
|
|
||||||
// prohibit copying and moving
|
// prohibit copying and moving
|
||||||
|
@ -45,7 +45,7 @@ public:
|
||||||
Ascii& operator=(const Ascii&) = delete;
|
Ascii& operator=(const Ascii&) = delete;
|
||||||
Ascii& operator=(Ascii&&) = delete;
|
Ascii& operator=(Ascii&&) = delete;
|
||||||
|
|
||||||
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Ascii(frontend); }
|
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Ascii(frontend); }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
||||||
|
@ -85,6 +85,9 @@ private:
|
||||||
std::unique_ptr<threading::formatter::Formatter> formatter;
|
std::unique_ptr<threading::formatter::Formatter> formatter;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
||||||
}
|
namespace input::reader {
|
||||||
}
|
using FieldMapping [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::FieldMapping.")]] = zeek::input::reader::detail::FieldMapping;
|
||||||
|
using Ascii [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Ascii.")]] = zeek::input::reader::detail::Ascii;
|
||||||
|
} // namespace input::reader
|
||||||
|
|
|
@ -4,14 +4,13 @@
|
||||||
|
|
||||||
#include "Ascii.h"
|
#include "Ascii.h"
|
||||||
|
|
||||||
namespace plugin {
|
namespace zeek::plugin::Zeek_AsciiReader {
|
||||||
namespace Zeek_AsciiReader {
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin {
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
public:
|
public:
|
||||||
zeek::plugin::Configuration Configure() override
|
zeek::plugin::Configuration Configure() override
|
||||||
{
|
{
|
||||||
AddComponent(new ::input::Component("Ascii", ::input::reader::Ascii::Instantiate));
|
AddComponent(new zeek::input::Component("Ascii", zeek::input::reader::detail::Ascii::Instantiate));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::AsciiReader";
|
config.name = "Zeek::AsciiReader";
|
||||||
|
@ -21,4 +20,3 @@ public:
|
||||||
} plugin;
|
} plugin;
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
|
@ -11,11 +11,12 @@
|
||||||
#include "threading/SerialTypes.h"
|
#include "threading/SerialTypes.h"
|
||||||
#include "threading/Manager.h"
|
#include "threading/Manager.h"
|
||||||
|
|
||||||
using namespace input::reader;
|
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
Benchmark::Benchmark(ReaderFrontend *frontend) : ReaderBackend(frontend)
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
|
Benchmark::Benchmark(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend)
|
||||||
{
|
{
|
||||||
num_lines = 0;
|
num_lines = 0;
|
||||||
multiplication_factor = double(zeek::BifConst::InputBenchmark::factor);
|
multiplication_factor = double(zeek::BifConst::InputBenchmark::factor);
|
||||||
|
@ -91,7 +92,7 @@ bool Benchmark::DoUpdate()
|
||||||
for (int j = 0; j < NumFields(); j++ )
|
for (int j = 0; j < NumFields(); j++ )
|
||||||
field[j] = EntryToVal(Fields()[j]->type, Fields()[j]->subtype);
|
field[j] = EntryToVal(Fields()[j]->type, Fields()[j]->subtype);
|
||||||
|
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
// do not do tracking, spread out elements over the second that we have...
|
// do not do tracking, spread out elements over the second that we have...
|
||||||
Put(field);
|
Put(field);
|
||||||
else
|
else
|
||||||
|
@ -117,7 +118,7 @@ bool Benchmark::DoUpdate()
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( Info().mode != MODE_STREAM )
|
if ( Info().mode != zeek::input::MODE_STREAM )
|
||||||
EndCurrentSend();
|
EndCurrentSend();
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
|
@ -240,12 +241,12 @@ bool Benchmark::DoHeartbeat(double network_time, double current_time)
|
||||||
heartbeatstarttime = CurrTime();
|
heartbeatstarttime = CurrTime();
|
||||||
|
|
||||||
switch ( Info().mode ) {
|
switch ( Info().mode ) {
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
// yay, we do nothing :)
|
// yay, we do nothing :)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
if ( multiplication_factor != 1 || add != 0 )
|
if ( multiplication_factor != 1 || add != 0 )
|
||||||
{
|
{
|
||||||
// we have to document at what time we changed the factor to what value.
|
// we have to document at what time we changed the factor to what value.
|
||||||
|
@ -273,3 +274,5 @@ bool Benchmark::DoHeartbeat(double network_time, double current_time)
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
|
@ -5,17 +5,17 @@
|
||||||
#include "input/ReaderBackend.h"
|
#include "input/ReaderBackend.h"
|
||||||
#include "threading/formatters/Ascii.h"
|
#include "threading/formatters/Ascii.h"
|
||||||
|
|
||||||
namespace input { namespace reader {
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* A benchmark reader to measure performance of the input framework.
|
* A benchmark reader to measure performance of the input framework.
|
||||||
*/
|
*/
|
||||||
class Benchmark : public ReaderBackend {
|
class Benchmark : public zeek::input::ReaderBackend {
|
||||||
public:
|
public:
|
||||||
explicit Benchmark(ReaderFrontend* frontend);
|
explicit Benchmark(zeek::input::ReaderFrontend* frontend);
|
||||||
~Benchmark() override;
|
~Benchmark() override;
|
||||||
|
|
||||||
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Benchmark(frontend); }
|
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Benchmark(frontend); }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
||||||
|
@ -42,6 +42,8 @@ private:
|
||||||
threading::formatter::Ascii* ascii;
|
threading::formatter::Ascii* ascii;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader
|
||||||
|
|
||||||
}
|
namespace input::reader {
|
||||||
|
using Benchmark [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Benchmark.")]] = zeek::input::reader::detail::Benchmark;
|
||||||
}
|
}
|
||||||
|
|
|
@ -4,14 +4,13 @@
|
||||||
|
|
||||||
#include "Benchmark.h"
|
#include "Benchmark.h"
|
||||||
|
|
||||||
namespace plugin {
|
namespace zeek::plugin::Zeek_BenchmarkReader {
|
||||||
namespace Zeek_BenchmarkReader {
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin {
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
public:
|
public:
|
||||||
zeek::plugin::Configuration Configure() override
|
zeek::plugin::Configuration Configure() override
|
||||||
{
|
{
|
||||||
AddComponent(new ::input::Component("Benchmark", ::input::reader::Benchmark::Instantiate));
|
AddComponent(new zeek::input::Component("Benchmark", zeek::input::reader::detail::Benchmark::Instantiate));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::BenchmarkReader";
|
config.name = "Zeek::BenchmarkReader";
|
||||||
|
@ -21,4 +20,3 @@ public:
|
||||||
} plugin;
|
} plugin;
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
|
@ -7,15 +7,16 @@
|
||||||
|
|
||||||
#include "threading/SerialTypes.h"
|
#include "threading/SerialTypes.h"
|
||||||
|
|
||||||
using namespace input::reader;
|
|
||||||
using namespace std;
|
using namespace std;
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
streamsize Binary::chunk_size = 0;
|
streamsize Binary::chunk_size = 0;
|
||||||
|
|
||||||
Binary::Binary(ReaderFrontend *frontend)
|
Binary::Binary(zeek::input::ReaderFrontend *frontend)
|
||||||
: ReaderBackend(frontend), in(nullptr), mtime(0), ino(0), firstrun(true)
|
: zeek::input::ReaderBackend(frontend), in(nullptr), mtime(0), ino(0), firstrun(true)
|
||||||
{
|
{
|
||||||
if ( ! chunk_size )
|
if ( ! chunk_size )
|
||||||
{
|
{
|
||||||
|
@ -197,7 +198,7 @@ bool Binary::DoUpdate()
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
switch ( Info().mode ) {
|
switch ( Info().mode ) {
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
{
|
{
|
||||||
switch ( UpdateModificationTime() ) {
|
switch ( UpdateModificationTime() ) {
|
||||||
case -1:
|
case -1:
|
||||||
|
@ -212,9 +213,9 @@ bool Binary::DoUpdate()
|
||||||
// fallthrough
|
// fallthrough
|
||||||
}
|
}
|
||||||
|
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
if ( Info().mode == MODE_STREAM && in )
|
if ( Info().mode == zeek::input::MODE_STREAM && in )
|
||||||
{
|
{
|
||||||
in->clear(); // remove end of file evil bits
|
in->clear(); // remove end of file evil bits
|
||||||
break;
|
break;
|
||||||
|
@ -246,13 +247,13 @@ bool Binary::DoUpdate()
|
||||||
val->val.string_val.length = size;
|
val->val.string_val.length = size;
|
||||||
fields[0] = val;
|
fields[0] = val;
|
||||||
|
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
Put(fields);
|
Put(fields);
|
||||||
else
|
else
|
||||||
SendEntry(fields);
|
SendEntry(fields);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( Info().mode != MODE_STREAM )
|
if ( Info().mode != zeek::input::MODE_STREAM )
|
||||||
EndCurrentSend();
|
EndCurrentSend();
|
||||||
|
|
||||||
#ifdef DEBUG
|
#ifdef DEBUG
|
||||||
|
@ -265,12 +266,12 @@ bool Binary::DoUpdate()
|
||||||
bool Binary::DoHeartbeat(double network_time, double current_time)
|
bool Binary::DoHeartbeat(double network_time, double current_time)
|
||||||
{
|
{
|
||||||
switch ( Info().mode ) {
|
switch ( Info().mode ) {
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
// yay, we do nothing :)
|
// yay, we do nothing :)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
#ifdef DEBUG
|
#ifdef DEBUG
|
||||||
Debug(zeek::DBG_INPUT, "Starting Heartbeat update");
|
Debug(zeek::DBG_INPUT, "Starting Heartbeat update");
|
||||||
#endif
|
#endif
|
||||||
|
@ -286,3 +287,5 @@ bool Binary::DoHeartbeat(double network_time, double current_time)
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
|
@ -7,17 +7,17 @@
|
||||||
|
|
||||||
#include "input/ReaderBackend.h"
|
#include "input/ReaderBackend.h"
|
||||||
|
|
||||||
namespace input { namespace reader {
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Binary mode file reader.
|
* Binary mode file reader.
|
||||||
*/
|
*/
|
||||||
class Binary : public ReaderBackend {
|
class Binary : public zeek::input::ReaderBackend {
|
||||||
public:
|
public:
|
||||||
explicit Binary(ReaderFrontend* frontend);
|
explicit Binary(zeek::input::ReaderFrontend* frontend);
|
||||||
~Binary() override;
|
~Binary() override;
|
||||||
|
|
||||||
static ReaderBackend* Instantiate(ReaderFrontend* frontend)
|
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend)
|
||||||
{ return new Binary(frontend); }
|
{ return new Binary(frontend); }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
|
@ -44,5 +44,8 @@ private:
|
||||||
std::string path_prefix;
|
std::string path_prefix;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
||||||
|
namespace input::reader {
|
||||||
|
using Binary [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Binary.")]] = zeek::input::reader::detail::Binary;
|
||||||
}
|
}
|
||||||
|
|
|
@ -4,14 +4,13 @@
|
||||||
|
|
||||||
#include "Binary.h"
|
#include "Binary.h"
|
||||||
|
|
||||||
namespace plugin {
|
namespace zeek::plugin::Zeek_BinaryReader {
|
||||||
namespace Zeek_BinaryReader {
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin {
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
public:
|
public:
|
||||||
zeek::plugin::Configuration Configure() override
|
zeek::plugin::Configuration Configure() override
|
||||||
{
|
{
|
||||||
AddComponent(new ::input::Component("Binary", ::input::reader::Binary::Instantiate));
|
AddComponent(new zeek::input::Component("Binary", zeek::input::reader::detail::Binary::Instantiate));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::BinaryReader";
|
config.name = "Zeek::BinaryReader";
|
||||||
|
@ -21,4 +20,3 @@ public:
|
||||||
} plugin;
|
} plugin;
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
|
@ -15,12 +15,13 @@
|
||||||
#include "input/Manager.h"
|
#include "input/Manager.h"
|
||||||
#include "threading/SerialTypes.h"
|
#include "threading/SerialTypes.h"
|
||||||
|
|
||||||
using namespace input::reader;
|
|
||||||
using namespace threading;
|
using namespace threading;
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
Config::Config(ReaderFrontend *frontend) : ReaderBackend(frontend)
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
|
Config::Config(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend)
|
||||||
{
|
{
|
||||||
mtime = 0;
|
mtime = 0;
|
||||||
ino = 0;
|
ino = 0;
|
||||||
|
@ -36,7 +37,7 @@ Config::Config(ReaderFrontend *frontend) : ReaderBackend(frontend)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
if ( id->GetType()->Tag() == zeek::TYPE_RECORD ||
|
if ( id->GetType()->Tag() == zeek::TYPE_RECORD ||
|
||||||
! input::Manager::IsCompatibleType(id->GetType().get()) )
|
! zeek::input::Manager::IsCompatibleType(id->GetType().get()) )
|
||||||
{
|
{
|
||||||
option_types[id->Name()] = std::make_tuple(zeek::TYPE_ERROR, id->GetType()->Tag());
|
option_types[id->Name()] = std::make_tuple(zeek::TYPE_ERROR, id->GetType()->Tag());
|
||||||
continue;
|
continue;
|
||||||
|
@ -118,7 +119,7 @@ bool Config::DoUpdate()
|
||||||
return ! fail_on_file_problem;
|
return ! fail_on_file_problem;
|
||||||
|
|
||||||
switch ( Info().mode ) {
|
switch ( Info().mode ) {
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
{
|
{
|
||||||
// check if the file has changed
|
// check if the file has changed
|
||||||
struct stat sb;
|
struct stat sb;
|
||||||
|
@ -145,14 +146,14 @@ bool Config::DoUpdate()
|
||||||
// File changed. Fall through to re-read.
|
// File changed. Fall through to re-read.
|
||||||
}
|
}
|
||||||
|
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
{
|
{
|
||||||
// dirty, fix me. (well, apparently after trying seeking, etc
|
// dirty, fix me. (well, apparently after trying seeking, etc
|
||||||
// - this is not that bad)
|
// - this is not that bad)
|
||||||
if ( file.is_open() )
|
if ( file.is_open() )
|
||||||
{
|
{
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
{
|
{
|
||||||
file.clear(); // remove end of file evil bits
|
file.clear(); // remove end of file evil bits
|
||||||
break;
|
break;
|
||||||
|
@ -254,7 +255,7 @@ bool Config::DoUpdate()
|
||||||
val->val.string_val.data = copy_string(value.c_str());
|
val->val.string_val.data = copy_string(value.c_str());
|
||||||
fields[1] = val;
|
fields[1] = val;
|
||||||
|
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
Put(fields);
|
Put(fields);
|
||||||
else
|
else
|
||||||
SendEntry(fields);
|
SendEntry(fields);
|
||||||
|
@ -279,7 +280,7 @@ bool Config::DoUpdate()
|
||||||
|
|
||||||
regfree(&re);
|
regfree(&re);
|
||||||
|
|
||||||
if ( Info().mode != MODE_STREAM )
|
if ( Info().mode != zeek::input::MODE_STREAM )
|
||||||
EndCurrentSend();
|
EndCurrentSend();
|
||||||
|
|
||||||
// clean up all options we did not see
|
// clean up all options we did not see
|
||||||
|
@ -293,12 +294,12 @@ bool Config::DoHeartbeat(double network_time, double current_time)
|
||||||
{
|
{
|
||||||
switch ( Info().mode )
|
switch ( Info().mode )
|
||||||
{
|
{
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
// yay, we do nothing :)
|
// yay, we do nothing :)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
Update(); // Call Update, not DoUpdate, because Update
|
Update(); // Call Update, not DoUpdate, because Update
|
||||||
// checks the "disabled" flag.
|
// checks the "disabled" flag.
|
||||||
break;
|
break;
|
||||||
|
@ -309,3 +310,5 @@ bool Config::DoHeartbeat(double network_time, double current_time)
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
|
@ -12,14 +12,14 @@
|
||||||
#include "input/ReaderBackend.h"
|
#include "input/ReaderBackend.h"
|
||||||
#include "threading/formatters/Ascii.h"
|
#include "threading/formatters/Ascii.h"
|
||||||
|
|
||||||
namespace input { namespace reader {
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Reader for Configuration files.
|
* Reader for Configuration files.
|
||||||
*/
|
*/
|
||||||
class Config : public ReaderBackend {
|
class Config : public zeek::input::ReaderBackend {
|
||||||
public:
|
public:
|
||||||
explicit Config(ReaderFrontend* frontend);
|
explicit Config(zeek::input::ReaderFrontend* frontend);
|
||||||
~Config() override;
|
~Config() override;
|
||||||
|
|
||||||
// prohibit copying and moving
|
// prohibit copying and moving
|
||||||
|
@ -28,7 +28,7 @@ public:
|
||||||
Config& operator=(const Config&) = delete;
|
Config& operator=(const Config&) = delete;
|
||||||
Config& operator=(Config&&) = delete;
|
Config& operator=(Config&&) = delete;
|
||||||
|
|
||||||
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Config(frontend); }
|
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Config(frontend); }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
||||||
|
@ -54,6 +54,8 @@ private:
|
||||||
std::unordered_map<std::string, std::string> option_values;
|
std::unordered_map<std::string, std::string> option_values;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
||||||
}
|
namespace input::reader {
|
||||||
|
using Config [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Config.")]] = zeek::input::reader::detail::Config;
|
||||||
}
|
}
|
||||||
|
|
|
@ -4,14 +4,13 @@
|
||||||
|
|
||||||
#include "Config.h"
|
#include "Config.h"
|
||||||
|
|
||||||
namespace plugin {
|
namespace zeek::plugin::Zeek_ConfigReader {
|
||||||
namespace Zeek_ConfigReader {
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin {
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
public:
|
public:
|
||||||
zeek::plugin::Configuration Configure() override
|
zeek::plugin::Configuration Configure() override
|
||||||
{
|
{
|
||||||
AddComponent(new ::input::Component("Config", ::input::reader::Config::Instantiate));
|
AddComponent(new zeek::input::Component("Config", zeek::input::reader::detail::Config::Instantiate));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::ConfigReader";
|
config.name = "Zeek::ConfigReader";
|
||||||
|
@ -21,4 +20,3 @@ public:
|
||||||
} plugin;
|
} plugin;
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
|
@ -2,9 +2,9 @@
|
||||||
|
|
||||||
#include "Plugin.h"
|
#include "Plugin.h"
|
||||||
|
|
||||||
namespace plugin { namespace Zeek_RawReader { Plugin plugin; } }
|
namespace zeek::plugin::Zeek_RawReader {
|
||||||
|
|
||||||
using namespace plugin::Zeek_RawReader;
|
Plugin plugin;
|
||||||
|
|
||||||
Plugin::Plugin()
|
Plugin::Plugin()
|
||||||
{
|
{
|
||||||
|
@ -12,7 +12,7 @@ Plugin::Plugin()
|
||||||
|
|
||||||
zeek::plugin::Configuration Plugin::Configure()
|
zeek::plugin::Configuration Plugin::Configure()
|
||||||
{
|
{
|
||||||
AddComponent(new ::input::Component("Raw", ::input::reader::Raw::Instantiate));
|
AddComponent(new zeek::input::Component("Raw", zeek::input::reader::detail::Raw::Instantiate));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::RawReader";
|
config.name = "Zeek::RawReader";
|
||||||
|
@ -32,3 +32,5 @@ std::unique_lock<std::mutex> Plugin::ForkMutex()
|
||||||
{
|
{
|
||||||
return std::unique_lock<std::mutex>(fork_mutex, std::defer_lock);
|
return std::unique_lock<std::mutex>(fork_mutex, std::defer_lock);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::plugin::Zeek_RawReader
|
||||||
|
|
|
@ -8,8 +8,7 @@
|
||||||
|
|
||||||
#include "Raw.h"
|
#include "Raw.h"
|
||||||
|
|
||||||
namespace plugin {
|
namespace zeek::plugin::Zeek_RawReader {
|
||||||
namespace Zeek_RawReader {
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin {
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
public:
|
public:
|
||||||
|
@ -29,5 +28,4 @@ private:
|
||||||
|
|
||||||
extern Plugin plugin;
|
extern Plugin plugin;
|
||||||
|
|
||||||
}
|
} // namespace zeek::plugin::Zeek_RawReader
|
||||||
}
|
|
||||||
|
|
|
@ -20,13 +20,14 @@ extern "C" {
|
||||||
#include "setsignal.h"
|
#include "setsignal.h"
|
||||||
}
|
}
|
||||||
|
|
||||||
using namespace input::reader;
|
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
const int Raw::block_size = 4096; // how big do we expect our chunks of data to be.
|
const int Raw::block_size = 4096; // how big do we expect our chunks of data to be.
|
||||||
|
|
||||||
Raw::Raw(ReaderFrontend *frontend) : ReaderBackend(frontend), file(nullptr, fclose), stderrfile(nullptr, fclose)
|
Raw::Raw(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend), file(nullptr, fclose), stderrfile(nullptr, fclose)
|
||||||
{
|
{
|
||||||
execute = false;
|
execute = false;
|
||||||
firstrun = true;
|
firstrun = true;
|
||||||
|
@ -207,7 +208,7 @@ bool Raw::Execute()
|
||||||
|
|
||||||
ClosePipeEnd(stdout_out);
|
ClosePipeEnd(stdout_out);
|
||||||
|
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
{
|
{
|
||||||
if ( ! SetFDFlags(pipes[stdout_in], F_SETFL, O_NONBLOCK) )
|
if ( ! SetFDFlags(pipes[stdout_in], F_SETFL, O_NONBLOCK) )
|
||||||
return false;
|
return false;
|
||||||
|
@ -377,14 +378,15 @@ bool Raw::DoInit(const ReaderInfo& info, int num_fields, const Field* const* fie
|
||||||
}
|
}
|
||||||
|
|
||||||
it = info.config.find("offset"); // we want to seek to a given offset inside the file
|
it = info.config.find("offset"); // we want to seek to a given offset inside the file
|
||||||
if ( it != info.config.end() && ! execute && (Info().mode == MODE_STREAM || Info().mode == MODE_MANUAL) )
|
if ( it != info.config.end() && ! execute && (Info().mode == zeek::input::MODE_STREAM ||
|
||||||
|
Info().mode == zeek::input::MODE_MANUAL) )
|
||||||
{
|
{
|
||||||
std::string offset_s = it->second;
|
std::string offset_s = it->second;
|
||||||
offset = strtoll(offset_s.c_str(), 0, 10);
|
offset = strtoll(offset_s.c_str(), 0, 10);
|
||||||
}
|
}
|
||||||
else if ( it != info.config.end() )
|
else if ( it != info.config.end() )
|
||||||
{
|
{
|
||||||
Error("Offset only is supported for MODE_STREAM and MODE_MANUAL; it is also not supported when executing a command");
|
Error("Offset only is supported for zeek::input::MODE_STREAM and zeek::input::MODE_MANUAL; it is also not supported when executing a command");
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -407,7 +409,7 @@ bool Raw::DoInit(const ReaderInfo& info, int num_fields, const Field* const* fie
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( execute && Info().mode == MODE_REREAD )
|
if ( execute && Info().mode == zeek::input::MODE_REREAD )
|
||||||
{
|
{
|
||||||
// for execs this makes no sense - would have to execute each heartbeat?
|
// for execs this makes no sense - would have to execute each heartbeat?
|
||||||
Error("Rereading only supported for files, not for executables.");
|
Error("Rereading only supported for files, not for executables.");
|
||||||
|
@ -528,7 +530,7 @@ void Raw::WriteToStdin()
|
||||||
if ( stdin_towrite == 0 ) // send EOF when we are done.
|
if ( stdin_towrite == 0 ) // send EOF when we are done.
|
||||||
ClosePipeEnd(stdin_out);
|
ClosePipeEnd(stdin_out);
|
||||||
|
|
||||||
if ( Info().mode == MODE_MANUAL && stdin_towrite != 0 )
|
if ( Info().mode == zeek::input::MODE_MANUAL && stdin_towrite != 0 )
|
||||||
{
|
{
|
||||||
Error(Fmt("Could not write whole string to stdin of child process in one go. Please use STREAM mode to pass more data to child."));
|
Error(Fmt("Could not write whole string to stdin of child process in one go. Please use STREAM mode to pass more data to child."));
|
||||||
}
|
}
|
||||||
|
@ -544,7 +546,7 @@ bool Raw::DoUpdate()
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
switch ( Info().mode ) {
|
switch ( Info().mode ) {
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
{
|
{
|
||||||
assert(childpid == -1); // mode may not be used to execute child programs
|
assert(childpid == -1); // mode may not be used to execute child programs
|
||||||
// check if the file has changed
|
// check if the file has changed
|
||||||
|
@ -566,9 +568,9 @@ bool Raw::DoUpdate()
|
||||||
// fallthrough
|
// fallthrough
|
||||||
}
|
}
|
||||||
|
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
if ( Info().mode == MODE_STREAM && file )
|
if ( Info().mode == zeek::input::MODE_STREAM && file )
|
||||||
{
|
{
|
||||||
clearerr(file.get()); // remove end of file evil bits
|
clearerr(file.get()); // remove end of file evil bits
|
||||||
break;
|
break;
|
||||||
|
@ -645,7 +647,7 @@ bool Raw::DoUpdate()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ( Info().mode == MODE_MANUAL ) || ( Info().mode == MODE_REREAD ) )
|
if ( ( Info().mode == zeek::input::MODE_MANUAL ) || ( Info().mode == zeek::input::MODE_REREAD ) )
|
||||||
// done with the current data source
|
// done with the current data source
|
||||||
EndCurrentSend();
|
EndCurrentSend();
|
||||||
|
|
||||||
|
@ -687,7 +689,7 @@ bool Raw::DoUpdate()
|
||||||
vals[3]->val.int_val = signal;
|
vals[3]->val.int_val = signal;
|
||||||
|
|
||||||
// and in this case we can signal end_of_data even for the streaming reader
|
// and in this case we can signal end_of_data even for the streaming reader
|
||||||
if ( Info().mode == MODE_STREAM )
|
if ( Info().mode == zeek::input::MODE_STREAM )
|
||||||
EndCurrentSend();
|
EndCurrentSend();
|
||||||
|
|
||||||
SendEvent("InputRaw::process_finished", 4, vals);
|
SendEvent("InputRaw::process_finished", 4, vals);
|
||||||
|
@ -706,12 +708,12 @@ bool Raw::DoUpdate()
|
||||||
bool Raw::DoHeartbeat(double network_time, double current_time)
|
bool Raw::DoHeartbeat(double network_time, double current_time)
|
||||||
{
|
{
|
||||||
switch ( Info().mode ) {
|
switch ( Info().mode ) {
|
||||||
case MODE_MANUAL:
|
case zeek::input::MODE_MANUAL:
|
||||||
// yay, we do nothing :)
|
// yay, we do nothing :)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case MODE_REREAD:
|
case zeek::input::MODE_REREAD:
|
||||||
case MODE_STREAM:
|
case zeek::input::MODE_STREAM:
|
||||||
#ifdef DEBUG
|
#ifdef DEBUG
|
||||||
Debug(zeek::DBG_INPUT, "Starting Heartbeat update");
|
Debug(zeek::DBG_INPUT, "Starting Heartbeat update");
|
||||||
#endif
|
#endif
|
||||||
|
@ -727,3 +729,5 @@ bool Raw::DoHeartbeat(double network_time, double current_time)
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
|
@ -9,15 +9,15 @@
|
||||||
|
|
||||||
#include "input/ReaderBackend.h"
|
#include "input/ReaderBackend.h"
|
||||||
|
|
||||||
namespace input { namespace reader {
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* A reader that returns a file (or the output of a command) as a single
|
* A reader that returns a file (or the output of a command) as a single
|
||||||
* blob.
|
* blob.
|
||||||
*/
|
*/
|
||||||
class Raw : public ReaderBackend {
|
class Raw : public zeek::input::ReaderBackend {
|
||||||
public:
|
public:
|
||||||
explicit Raw(ReaderFrontend* frontend);
|
explicit Raw(zeek::input::ReaderFrontend* frontend);
|
||||||
~Raw() override;
|
~Raw() override;
|
||||||
|
|
||||||
// prohibit copying and moving
|
// prohibit copying and moving
|
||||||
|
@ -26,7 +26,7 @@ public:
|
||||||
Raw& operator=(const Raw&) = delete;
|
Raw& operator=(const Raw&) = delete;
|
||||||
Raw& operator=(Raw&&) = delete;
|
Raw& operator=(Raw&&) = delete;
|
||||||
|
|
||||||
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Raw(frontend); }
|
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Raw(frontend); }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
|
||||||
|
@ -89,5 +89,8 @@ private:
|
||||||
static const int block_size;
|
static const int block_size;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
||||||
|
namespace input::reader {
|
||||||
|
using Raw [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Raw.")]] = zeek::input::reader::detail::Raw;
|
||||||
}
|
}
|
||||||
|
|
|
@ -4,14 +4,13 @@
|
||||||
|
|
||||||
#include "SQLite.h"
|
#include "SQLite.h"
|
||||||
|
|
||||||
namespace plugin {
|
namespace zeek::plugin::Zeek_SQLiteReader {
|
||||||
namespace Zeek_SQLiteReader {
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin {
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
public:
|
public:
|
||||||
zeek::plugin::Configuration Configure() override
|
zeek::plugin::Configuration Configure() override
|
||||||
{
|
{
|
||||||
AddComponent(new ::input::Component("SQLite", ::input::reader::SQLite::Instantiate));
|
AddComponent(new zeek::input::Component("SQLite", zeek::input::reader::detail::SQLite::Instantiate));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::SQLiteReader";
|
config.name = "Zeek::SQLiteReader";
|
||||||
|
@ -21,4 +20,3 @@ public:
|
||||||
} plugin;
|
} plugin;
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
|
@ -15,12 +15,13 @@
|
||||||
|
|
||||||
#include "threading/SerialTypes.h"
|
#include "threading/SerialTypes.h"
|
||||||
|
|
||||||
using namespace input::reader;
|
|
||||||
using threading::Value;
|
using threading::Value;
|
||||||
using threading::Field;
|
using threading::Field;
|
||||||
|
|
||||||
SQLite::SQLite(ReaderFrontend *frontend)
|
namespace zeek::input::reader::detail {
|
||||||
: ReaderBackend(frontend),
|
|
||||||
|
SQLite::SQLite(zeek::input::ReaderFrontend *frontend)
|
||||||
|
: zeek::input::ReaderBackend(frontend),
|
||||||
fields(), num_fields(), mode(), started(), query(), db(), st()
|
fields(), num_fields(), mode(), started(), query(), db(), st()
|
||||||
{
|
{
|
||||||
set_separator.assign(
|
set_separator.assign(
|
||||||
|
@ -38,7 +39,8 @@ SQLite::SQLite(ReaderFrontend *frontend)
|
||||||
zeek::BifConst::InputSQLite::empty_field->Len()
|
zeek::BifConst::InputSQLite::empty_field->Len()
|
||||||
);
|
);
|
||||||
|
|
||||||
io = new threading::formatter::Ascii(this, threading::formatter::Ascii::SeparatorInfo(std::string(), set_separator, unset_field, empty_field));
|
io = new threading::formatter::Ascii(this, threading::formatter::Ascii::SeparatorInfo(std::string(),
|
||||||
|
set_separator, unset_field, empty_field));
|
||||||
}
|
}
|
||||||
|
|
||||||
SQLite::~SQLite()
|
SQLite::~SQLite()
|
||||||
|
@ -82,7 +84,7 @@ bool SQLite::DoInit(const ReaderInfo& info, int arg_num_fields, const threading:
|
||||||
// allows simultaneous writes to one file.
|
// allows simultaneous writes to one file.
|
||||||
sqlite3_enable_shared_cache(1);
|
sqlite3_enable_shared_cache(1);
|
||||||
|
|
||||||
if ( Info().mode != MODE_MANUAL )
|
if ( Info().mode != zeek::input::MODE_MANUAL )
|
||||||
{
|
{
|
||||||
Error("SQLite only supports manual reading mode.");
|
Error("SQLite only supports manual reading mode.");
|
||||||
return false;
|
return false;
|
||||||
|
@ -341,3 +343,5 @@ bool SQLite::DoUpdate()
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader::detail
|
||||||
|
|
|
@ -11,14 +11,14 @@
|
||||||
#include "threading/formatters/Ascii.h"
|
#include "threading/formatters/Ascii.h"
|
||||||
#include "3rdparty/sqlite3.h"
|
#include "3rdparty/sqlite3.h"
|
||||||
|
|
||||||
namespace input { namespace reader {
|
namespace zeek::input::reader::detail {
|
||||||
|
|
||||||
class SQLite : public ReaderBackend {
|
class SQLite : public zeek::input::ReaderBackend {
|
||||||
public:
|
public:
|
||||||
explicit SQLite(ReaderFrontend* frontend);
|
explicit SQLite(zeek::input::ReaderFrontend* frontend);
|
||||||
~SQLite() override;
|
~SQLite() override;
|
||||||
|
|
||||||
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new SQLite(frontend); }
|
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new SQLite(frontend); }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* arg_fields) override;
|
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* arg_fields) override;
|
||||||
|
@ -45,6 +45,8 @@ private:
|
||||||
std::string empty_field;
|
std::string empty_field;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::input::reader
|
||||||
|
|
||||||
}
|
namespace input::reader {
|
||||||
|
using SQLite [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::SQLite.")]] = zeek::input::reader::detail::SQLite;
|
||||||
}
|
}
|
||||||
|
|
|
@ -104,7 +104,8 @@ zeek::detail::TimerMgr*& timer_mgr = zeek::detail::timer_mgr;
|
||||||
|
|
||||||
logging::Manager* log_mgr = nullptr;
|
logging::Manager* log_mgr = nullptr;
|
||||||
threading::Manager* thread_mgr = nullptr;
|
threading::Manager* thread_mgr = nullptr;
|
||||||
input::Manager* input_mgr = nullptr;
|
zeek::input::Manager* zeek::input_mgr = nullptr;
|
||||||
|
zeek::input::Manager*& input_mgr = zeek::input_mgr;
|
||||||
zeek::file_analysis::Manager* zeek::file_mgr = nullptr;
|
zeek::file_analysis::Manager* zeek::file_mgr = nullptr;
|
||||||
zeek::file_analysis::Manager*& file_mgr = zeek::file_mgr;
|
zeek::file_analysis::Manager*& file_mgr = zeek::file_mgr;
|
||||||
zeekygen::Manager* zeekygen_mgr = nullptr;
|
zeekygen::Manager* zeekygen_mgr = nullptr;
|
||||||
|
@ -305,7 +306,7 @@ void terminate_bro()
|
||||||
|
|
||||||
notifier::registry.Terminate();
|
notifier::registry.Terminate();
|
||||||
log_mgr->Terminate();
|
log_mgr->Terminate();
|
||||||
input_mgr->Terminate();
|
zeek::input_mgr->Terminate();
|
||||||
thread_mgr->Terminate();
|
thread_mgr->Terminate();
|
||||||
broker_mgr->Terminate();
|
broker_mgr->Terminate();
|
||||||
zeek::detail::dns_mgr->Terminate();
|
zeek::detail::dns_mgr->Terminate();
|
||||||
|
@ -581,7 +582,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
|
||||||
event_registry = new EventRegistry();
|
event_registry = new EventRegistry();
|
||||||
zeek::analyzer_mgr = new analyzer::Manager();
|
zeek::analyzer_mgr = new analyzer::Manager();
|
||||||
log_mgr = new logging::Manager();
|
log_mgr = new logging::Manager();
|
||||||
input_mgr = new input::Manager();
|
zeek::input_mgr = new input::Manager();
|
||||||
zeek::file_mgr = new file_analysis::Manager();
|
zeek::file_mgr = new file_analysis::Manager();
|
||||||
auto broker_real_time = ! options.pcap_file && ! options.deterministic_mode;
|
auto broker_real_time = ! options.pcap_file && ! options.deterministic_mode;
|
||||||
broker_mgr = new bro_broker::Manager(broker_real_time);
|
broker_mgr = new bro_broker::Manager(broker_real_time);
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue