Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Move input code to zeek namespaces

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-08-01 10:47:51 -07:00
parent 14408235b8
commit 9a800265ff
31 changed files with 227 additions and 162 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/input/Component.cc
View file

@ -6,7 +6,7 @@
#include "../Desc.h"
#include "../util.h"
using namespace input;
namespace zeek::input {
Component::Component(const std::string& name, factory_callback arg_factory)
: zeek::plugin::Component(zeek::plugin::component::READER, name)
@ -29,3 +29,5 @@ void Component::DoDescribe(zeek::ODesc* d) const
d->Add("Input::READER_");
d->Add(CanonicalName());
}
} // namespace zeek::input

12
src/input/Component.h
View file

@ -6,16 +6,16 @@
#include "plugin/Component.h"
#include "plugin/TaggedComponent.h"
namespace input {
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderBackend, zeek, input);
class ReaderFrontend;
class ReaderBackend;
namespace zeek::input {
/**
* Component description for plugins providing log readers.
*/
class Component : public zeek::plugin::Component,
public plugin::TaggedComponent<input::Tag> {
public plugin::TaggedComponent<zeek::input::Tag> {
public:
typedef ReaderBackend* (*factory_callback)(ReaderFrontend* frontend);
@ -60,4 +60,8 @@ private:
factory_callback factory;
};
} // namespace zeek::input
namespace input {
using Component [[deprecated("Remove in v4.1. Use zeek::input::Component.")]] = zeek::input::Component;
}

5
src/input/Manager.cc
View file

@ -22,11 +22,12 @@
#include "../file_analysis/Manager.h"
#include "../threading/SerialTypes.h"
using namespace input;
using namespace std;
using threading::Value;
using threading::Field;
namespace zeek::input {
/**
* InputHashes are used as Dictionaries to store the value and index hashes
* for all lines currently stored in a table. Index hash is stored as
@ -2511,3 +2512,5 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co
free(buf);
}
} // namespace zeek::input

17
src/input/Manager.h
View file

@ -13,12 +13,12 @@
#include "Tag.h"
ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek, input);
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderBackend, zeek, input);
namespace zeek {
namespace input {
class ReaderFrontend;
class ReaderBackend;
/**
* Singleton class for managing input streams.
*/
@ -256,7 +256,14 @@ private:
zeek::EventHandlerPtr end_of_data;
};
}
} // namespace input
extern input::Manager* input_mgr;
} // namespace zeek
extern zeek::input::Manager*& input_mgr [[deprecated("Remove in v4.1. Use zeek::input_mgr.")]];
namespace input {
using Manager [[deprecated("Remove in v4.1. Use zeek::input::Manager.")]] = zeek::input::Manager;
}

4
src/input/ReaderBackend.cc
View file

@ -7,7 +7,7 @@
using threading::Value;
using threading::Field;
namespace input {
namespace zeek::input {
class PutMessage final : public threading::OutputMessage<ReaderFrontend> {
public:
@ -340,4 +340,4 @@ void ReaderBackend::Error(const char* msg)
DisableFrontend();
}
}
} // namespace zeek::input

20
src/input/ReaderBackend.h
View file

@ -9,7 +9,9 @@
#include "Component.h"
namespace input {
ZEEK_FORWARD_DECLARE_NAMESPACED(ReaderFrontend, zeek::input);
namespace zeek::input {
/**
* The modes a reader can be in.
@ -41,8 +43,6 @@ enum ReaderMode {
MODE_NONE
};
class ReaderFrontend;
/**
* Base class for reader implementation. When the input:Manager creates a new
* input stream, it instantiates a ReaderFrontend. That then in turn creates
@ -364,4 +364,16 @@ private:
bool suppress_warnings = false;
};
}
} // namespace zeek::input
namespace input {
using ReaderMode [[deprecated("Remove in v4.1. Use zeek::input::ReaderMode.")]] = zeek::input::ReaderMode;
constexpr auto MODE_MANUAL [[deprecated("Remove in v4.1. Use zeek::input::MODE_MANUAL.")]] = zeek::input::MODE_MANUAL;
constexpr auto MODE_REREAD [[deprecated("Remove in v4.1. Use zeek::input::MODE_REREAD.")]] = zeek::input::MODE_REREAD;
constexpr auto MODE_STREAM [[deprecated("Remove in v4.1. Use zeek::input::MODE_STREAM.")]] = zeek::input::MODE_STREAM;
constexpr auto MODE_NONE [[deprecated("Remove in v4.1. Use zeek::input::MODE_NONE.")]] = zeek::input::MODE_NONE;
using ReaderBackend [[deprecated("Remove in v4.1. Use zeek::input::ReaderBackend.")]] = zeek::input::ReaderBackend;
} // namespace input

4
src/input/ReaderFrontend.cc
View file

@ -4,7 +4,7 @@
#include "ReaderFrontend.h"
#include "ReaderBackend.h"
namespace input {
namespace zeek::input {
class InitMessage final : public threading::InputMessage<ReaderBackend>
{
@ -97,4 +97,4 @@ const char* ReaderFrontend::Name() const
return name;
}
}
} // namespace zeek::input

11
src/input/ReaderFrontend.h
View file

@ -6,10 +6,9 @@
#include "threading/SerialTypes.h"
ZEEK_FORWARD_DECLARE_NAMESPACED(EnumVal, zeek);
ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, input);
namespace input {
class Manager;
namespace zeek::input {
/**
* Bridge class between the input::Manager and backend input threads. The
@ -119,7 +118,7 @@ public:
const threading::Field* const * Fields() const { return fields; }
protected:
friend class Manager;
friend class zeek::input::Manager;
private:
ReaderBackend* backend; // The backend we have instanatiated.
@ -131,4 +130,8 @@ private:
const char* name; // Descriptive name.
};
} // namespace zeek::input
namespace input {
using ReaderFrontend [[deprecated("Remove in v4.1. Use zeek::input::ReaderFrontend.")]] = zeek::input::ReaderFrontend;
}

18
src/input/Tag.cc
View file

@ -3,33 +3,37 @@
#include "Tag.h"
#include "Manager.h"
const input::Tag input::Tag::Error;
namespace zeek::input {
input::Tag::Tag(type_t type, subtype_t subtype)
const Tag Tag::Error;
Tag::Tag(type_t type, subtype_t subtype)
: zeek::Tag(input_mgr->GetTagType(), type, subtype)
{
}
input::Tag& input::Tag::operator=(const input::Tag& other)
Tag& Tag::operator=(const Tag& other)
{
zeek::Tag::operator=(other);
return *this;
}
const zeek::EnumValPtr& input::Tag::AsVal() const
const zeek::EnumValPtr& Tag::AsVal() const
{
return zeek::Tag::AsVal(input_mgr->GetTagType());
}
zeek::EnumVal* input::Tag::AsEnumVal() const
zeek::EnumVal* Tag::AsEnumVal() const
{
return AsVal().get();
}
input::Tag::Tag(zeek::EnumValPtr val)
Tag::Tag(zeek::EnumValPtr val)
: zeek::Tag(std::move(val))
{ }
input::Tag::Tag(zeek::EnumVal* val)
Tag::Tag(zeek::EnumVal* val)
: zeek::Tag({zeek::NewRef{}, val})
{ }
} // namespace zeek::input

10
src/input/Tag.h
View file

@ -20,10 +20,10 @@ namespace plugin {
zeek::plugin::ComponentManager<T, C>;
}
namespace input {
ZEEK_FORWARD_DECLARE_NAMESPACED(Manager, zeek, input);
ZEEK_FORWARD_DECLARE_NAMESPACED(Component, zeek, input);
class Manager;
class Component;
namespace zeek::input {
/**
* Class to identify a reader type.
@ -123,4 +123,8 @@ protected:
explicit Tag(zeek::EnumVal* val);
};
} // namespace zeek::input
namespace input {
using Tag [[deprecated("Remove in v4.1. Use zeek::input::Tag.")]] = zeek::input::Tag;
}

10
src/input/input.bif
View file

@ -18,31 +18,31 @@ type AnalysisDescription: record;
function Input::__create_table_stream%(description: Input::TableDescription%) : bool
%{
bool res = input_mgr->CreateTableStream(description->AsRecordVal());
bool res = zeek::input_mgr->CreateTableStream(description->AsRecordVal());
return zeek::val_mgr->Bool(res);
%}
function Input::__create_event_stream%(description: Input::EventDescription%) : bool
%{
bool res = input_mgr->CreateEventStream(description->AsRecordVal());
bool res = zeek::input_mgr->CreateEventStream(description->AsRecordVal());
return zeek::val_mgr->Bool(res);
%}
function Input::__create_analysis_stream%(description: Input::AnalysisDescription%) : bool
%{
bool res = input_mgr->CreateAnalysisStream(description->AsRecordVal());
bool res = zeek::input_mgr->CreateAnalysisStream(description->AsRecordVal());
return zeek::val_mgr->Bool(res);
%}
function Input::__remove_stream%(id: string%) : bool
%{
bool res = input_mgr->RemoveStream(id->AsString()->CheckString());
bool res = zeek::input_mgr->RemoveStream(id->AsString()->CheckString());
return zeek::val_mgr->Bool(res);
%}
function Input::__force_update%(id: string%) : bool
%{
bool res = input_mgr->ForceUpdate(id->AsString()->CheckString());
bool res = zeek::input_mgr->ForceUpdate(id->AsString()->CheckString());
return zeek::val_mgr->Bool(res);
%}

25
src/input/readers/ascii/Ascii.cc
View file

@ -12,12 +12,13 @@
#include "threading/SerialTypes.h"
using namespace input::reader;
using namespace threading;
using namespace std;
using threading::Value;
using threading::Field;
namespace zeek::input::reader::detail {
FieldMapping::FieldMapping(const string& arg_name, const zeek::TypeTag& arg_type, int arg_position)
: name(arg_name), type(arg_type), subtype(zeek::TYPE_ERROR)
{
@ -47,7 +48,7 @@ FieldMapping FieldMapping::subType()
return FieldMapping(name, subtype, position);
}
Ascii::Ascii(ReaderFrontend *frontend) : ReaderBackend(frontend)
Ascii::Ascii(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend)
{
mtime = 0;
ino = 0;
@ -274,7 +275,7 @@ bool Ascii::DoUpdate()
return ! fail_on_file_problem;
switch ( Info().mode ) {
case MODE_REREAD:
case zeek::input::MODE_REREAD:
{
// check if the file has changed
struct stat sb;
@ -301,14 +302,14 @@ bool Ascii::DoUpdate()
// File changed. Fall through to re-read.
}
case MODE_MANUAL:
case MODE_STREAM:
case zeek::input::MODE_MANUAL:
case zeek::input::MODE_STREAM:
{
// dirty, fix me. (well, apparently after trying seeking, etc
// - this is not that bad)
if ( file.is_open() )
{
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
{
file.clear(); // remove end of file evil bits
if ( ! ReadHeader(true) )
@ -434,13 +435,13 @@ bool Ascii::DoUpdate()
//printf("fpos: %d, second.num_fields: %d\n", fpos, (*it).second.num_fields);
assert ( fpos == NumFields() );
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
Put(fields);
else
SendEntry(fields);
}
if ( Info().mode != MODE_STREAM )
if ( Info().mode != zeek::input::MODE_STREAM )
EndCurrentSend();
return true;
@ -453,12 +454,12 @@ bool Ascii::DoHeartbeat(double network_time, double current_time)
switch ( Info().mode )
{
case MODE_MANUAL:
case zeek::input::MODE_MANUAL:
// yay, we do nothing :)
break;
case MODE_REREAD:
case MODE_STREAM:
case zeek::input::MODE_REREAD:
case zeek::input::MODE_STREAM:
Update(); // Call Update, not DoUpdate, because Update
// checks the "disabled" flag.
break;
@ -469,3 +470,5 @@ bool Ascii::DoHeartbeat(double network_time, double current_time)
return true;
}
} // namespace zeek::input::reader::detail

15
src/input/readers/ascii/Ascii.h
View file

@ -11,7 +11,7 @@
#include "input/ReaderBackend.h"
#include "threading/formatters/Ascii.h"
namespace input { namespace reader {
namespace zeek::input::reader::detail {
// Description for input field mapping.
struct FieldMapping {
@ -34,9 +34,9 @@ struct FieldMapping {
/**
* Reader for structured ASCII files.
*/
class Ascii : public ReaderBackend {
class Ascii : public zeek::input::ReaderBackend {
public:
explicit Ascii(ReaderFrontend* frontend);
explicit Ascii(zeek::input::ReaderFrontend* frontend);
~Ascii() override;
// prohibit copying and moving
@ -45,7 +45,7 @@ public:
Ascii& operator=(const Ascii&) = delete;
Ascii& operator=(Ascii&&) = delete;
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Ascii(frontend); }
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Ascii(frontend); }
protected:
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
@ -85,6 +85,9 @@ private:
std::unique_ptr<threading::formatter::Formatter> formatter;
};
} // namespace zeek::input::reader::detail
}
}
namespace input::reader {
using FieldMapping [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::FieldMapping.")]] = zeek::input::reader::detail::FieldMapping;
using Ascii [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Ascii.")]] = zeek::input::reader::detail::Ascii;
} // namespace input::reader

6
src/input/readers/ascii/Plugin.cc
View file

@ -4,14 +4,13 @@
#include "Ascii.h"
namespace plugin {
namespace Zeek_AsciiReader {
namespace zeek::plugin::Zeek_AsciiReader {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure() override
{
AddComponent(new ::input::Component("Ascii", ::input::reader::Ascii::Instantiate));
AddComponent(new zeek::input::Component("Ascii", zeek::input::reader::detail::Ascii::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::AsciiReader";
@ -21,4 +20,3 @@ public:
} plugin;
}
}

17
src/input/readers/benchmark/Benchmark.cc
View file

@ -11,11 +11,12 @@
#include "threading/SerialTypes.h"
#include "threading/Manager.h"
using namespace input::reader;
using threading::Value;
using threading::Field;
Benchmark::Benchmark(ReaderFrontend *frontend) : ReaderBackend(frontend)
namespace zeek::input::reader::detail {
Benchmark::Benchmark(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend)
{
num_lines = 0;
multiplication_factor = double(zeek::BifConst::InputBenchmark::factor);
@ -91,7 +92,7 @@ bool Benchmark::DoUpdate()
for (int j = 0; j < NumFields(); j++ )
field[j] = EntryToVal(Fields()[j]->type, Fields()[j]->subtype);
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
// do not do tracking, spread out elements over the second that we have...
Put(field);
else
@ -117,7 +118,7 @@ bool Benchmark::DoUpdate()
}
if ( Info().mode != MODE_STREAM )
if ( Info().mode != zeek::input::MODE_STREAM )
EndCurrentSend();
return true;
@ -240,12 +241,12 @@ bool Benchmark::DoHeartbeat(double network_time, double current_time)
heartbeatstarttime = CurrTime();
switch ( Info().mode ) {
case MODE_MANUAL:
case zeek::input::MODE_MANUAL:
// yay, we do nothing :)
break;
case MODE_REREAD:
case MODE_STREAM:
case zeek::input::MODE_REREAD:
case zeek::input::MODE_STREAM:
if ( multiplication_factor != 1 || add != 0 )
{
// we have to document at what time we changed the factor to what value.
@ -273,3 +274,5 @@ bool Benchmark::DoHeartbeat(double network_time, double current_time)
return true;
}
} // namespace zeek::input::reader::detail

12
src/input/readers/benchmark/Benchmark.h
View file

@ -5,17 +5,17 @@
#include "input/ReaderBackend.h"
#include "threading/formatters/Ascii.h"
namespace input { namespace reader {
namespace zeek::input::reader::detail {
/**
* A benchmark reader to measure performance of the input framework.
*/
class Benchmark : public ReaderBackend {
class Benchmark : public zeek::input::ReaderBackend {
public:
explicit Benchmark(ReaderFrontend* frontend);
explicit Benchmark(zeek::input::ReaderFrontend* frontend);
~Benchmark() override;
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Benchmark(frontend); }
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Benchmark(frontend); }
protected:
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
@ -42,6 +42,8 @@ private:
threading::formatter::Ascii* ascii;
};
} // namespace zeek::input::reader
}
namespace input::reader {
using Benchmark [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Benchmark.")]] = zeek::input::reader::detail::Benchmark;
}

6
src/input/readers/benchmark/Plugin.cc
View file

@ -4,14 +4,13 @@
#include "Benchmark.h"
namespace plugin {
namespace Zeek_BenchmarkReader {
namespace zeek::plugin::Zeek_BenchmarkReader {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure() override
{
AddComponent(new ::input::Component("Benchmark", ::input::reader::Benchmark::Instantiate));
AddComponent(new zeek::input::Component("Benchmark", zeek::input::reader::detail::Benchmark::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::BenchmarkReader";
@ -21,4 +20,3 @@ public:
} plugin;
}
}

27
src/input/readers/binary/Binary.cc
View file

@ -7,15 +7,16 @@
#include "threading/SerialTypes.h"
using namespace input::reader;
using namespace std;
using threading::Value;
using threading::Field;
namespace zeek::input::reader::detail {
streamsize Binary::chunk_size = 0;
Binary::Binary(ReaderFrontend *frontend)
: ReaderBackend(frontend), in(nullptr), mtime(0), ino(0), firstrun(true)
Binary::Binary(zeek::input::ReaderFrontend *frontend)
: zeek::input::ReaderBackend(frontend), in(nullptr), mtime(0), ino(0), firstrun(true)
{
if ( ! chunk_size )
{
@ -197,7 +198,7 @@ bool Binary::DoUpdate()
else
{
switch ( Info().mode ) {
case MODE_REREAD:
case zeek::input::MODE_REREAD:
{
switch ( UpdateModificationTime() ) {
case -1:
@ -212,9 +213,9 @@ bool Binary::DoUpdate()
// fallthrough
}
case MODE_MANUAL:
case MODE_STREAM:
if ( Info().mode == MODE_STREAM && in )
case zeek::input::MODE_MANUAL:
case zeek::input::MODE_STREAM:
if ( Info().mode == zeek::input::MODE_STREAM && in )
{
in->clear(); // remove end of file evil bits
break;
@ -246,13 +247,13 @@ bool Binary::DoUpdate()
val->val.string_val.length = size;
fields[0] = val;
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
Put(fields);
else
SendEntry(fields);
}
if ( Info().mode != MODE_STREAM )
if ( Info().mode != zeek::input::MODE_STREAM )
EndCurrentSend();
#ifdef DEBUG
@ -265,12 +266,12 @@ bool Binary::DoUpdate()
bool Binary::DoHeartbeat(double network_time, double current_time)
{
switch ( Info().mode ) {
case MODE_MANUAL:
case zeek::input::MODE_MANUAL:
// yay, we do nothing :)
break;
case MODE_REREAD:
case MODE_STREAM:
case zeek::input::MODE_REREAD:
case zeek::input::MODE_STREAM:
#ifdef DEBUG
Debug(zeek::DBG_INPUT, "Starting Heartbeat update");
#endif
@ -286,3 +287,5 @@ bool Binary::DoHeartbeat(double network_time, double current_time)
return true;
}
} // namespace zeek::input::reader::detail

13
src/input/readers/binary/Binary.h
View file

@ -7,17 +7,17 @@
#include "input/ReaderBackend.h"
namespace input { namespace reader {
namespace zeek::input::reader::detail {
/**
* Binary mode file reader.
*/
class Binary : public ReaderBackend {
class Binary : public zeek::input::ReaderBackend {
public:
explicit Binary(ReaderFrontend* frontend);
explicit Binary(zeek::input::ReaderFrontend* frontend);
~Binary() override;
static ReaderBackend* Instantiate(ReaderFrontend* frontend)
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend)
{ return new Binary(frontend); }
protected:
@ -44,5 +44,8 @@ private:
std::string path_prefix;
};
}
} // namespace zeek::input::reader::detail
namespace input::reader {
using Binary [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Binary.")]] = zeek::input::reader::detail::Binary;
}

6
src/input/readers/binary/Plugin.cc
View file

@ -4,14 +4,13 @@
#include "Binary.h"
namespace plugin {
namespace Zeek_BinaryReader {
namespace zeek::plugin::Zeek_BinaryReader {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure() override
{
AddComponent(new ::input::Component("Binary", ::input::reader::Binary::Instantiate));
AddComponent(new zeek::input::Component("Binary", zeek::input::reader::detail::Binary::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::BinaryReader";
@ -21,4 +20,3 @@ public:
} plugin;
}
}

27
src/input/readers/config/Config.cc
View file

@ -15,12 +15,13 @@
#include "input/Manager.h"
#include "threading/SerialTypes.h"
using namespace input::reader;
using namespace threading;
using threading::Value;
using threading::Field;
Config::Config(ReaderFrontend *frontend) : ReaderBackend(frontend)
namespace zeek::input::reader::detail {
Config::Config(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend)
{
mtime = 0;
ino = 0;
@ -36,7 +37,7 @@ Config::Config(ReaderFrontend *frontend) : ReaderBackend(frontend)
continue;
if ( id->GetType()->Tag() == zeek::TYPE_RECORD ||
! input::Manager::IsCompatibleType(id->GetType().get()) )
! zeek::input::Manager::IsCompatibleType(id->GetType().get()) )
{
option_types[id->Name()] = std::make_tuple(zeek::TYPE_ERROR, id->GetType()->Tag());
continue;
@ -118,7 +119,7 @@ bool Config::DoUpdate()
return ! fail_on_file_problem;
switch ( Info().mode ) {
case MODE_REREAD:
case zeek::input::MODE_REREAD:
{
// check if the file has changed
struct stat sb;
@ -145,14 +146,14 @@ bool Config::DoUpdate()
// File changed. Fall through to re-read.
}
case MODE_MANUAL:
case MODE_STREAM:
case zeek::input::MODE_MANUAL:
case zeek::input::MODE_STREAM:
{
// dirty, fix me. (well, apparently after trying seeking, etc
// - this is not that bad)
if ( file.is_open() )
{
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
{
file.clear(); // remove end of file evil bits
break;
@ -254,7 +255,7 @@ bool Config::DoUpdate()
val->val.string_val.data = copy_string(value.c_str());
fields[1] = val;
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
Put(fields);
else
SendEntry(fields);
@ -279,7 +280,7 @@ bool Config::DoUpdate()
regfree(&re);
if ( Info().mode != MODE_STREAM )
if ( Info().mode != zeek::input::MODE_STREAM )
EndCurrentSend();
// clean up all options we did not see
@ -293,12 +294,12 @@ bool Config::DoHeartbeat(double network_time, double current_time)
{
switch ( Info().mode )
{
case MODE_MANUAL:
case zeek::input::MODE_MANUAL:
// yay, we do nothing :)
break;
case MODE_REREAD:
case MODE_STREAM:
case zeek::input::MODE_REREAD:
case zeek::input::MODE_STREAM:
Update(); // Call Update, not DoUpdate, because Update
// checks the "disabled" flag.
break;
@ -309,3 +310,5 @@ bool Config::DoHeartbeat(double network_time, double current_time)
return true;
}
} // namespace zeek::input::reader::detail

12
src/input/readers/config/Config.h
View file

@ -12,14 +12,14 @@
#include "input/ReaderBackend.h"
#include "threading/formatters/Ascii.h"
namespace input { namespace reader {
namespace zeek::input::reader::detail {
/**
* Reader for Configuration files.
*/
class Config : public ReaderBackend {
class Config : public zeek::input::ReaderBackend {
public:
explicit Config(ReaderFrontend* frontend);
explicit Config(zeek::input::ReaderFrontend* frontend);
~Config() override;
// prohibit copying and moving
@ -28,7 +28,7 @@ public:
Config& operator=(const Config&) = delete;
Config& operator=(Config&&) = delete;
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Config(frontend); }
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Config(frontend); }
protected:
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
@ -54,6 +54,8 @@ private:
std::unordered_map<std::string, std::string> option_values;
};
} // namespace zeek::input::reader::detail
}
namespace input::reader {
using Config [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Config.")]] = zeek::input::reader::detail::Config;
}

6
src/input/readers/config/Plugin.cc
View file

@ -4,14 +4,13 @@
#include "Config.h"
namespace plugin {
namespace Zeek_ConfigReader {
namespace zeek::plugin::Zeek_ConfigReader {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure() override
{
AddComponent(new ::input::Component("Config", ::input::reader::Config::Instantiate));
AddComponent(new zeek::input::Component("Config", zeek::input::reader::detail::Config::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::ConfigReader";
@ -21,4 +20,3 @@ public:
} plugin;
}
}

8
src/input/readers/raw/Plugin.cc
View file

@ -2,9 +2,9 @@
#include "Plugin.h"
namespace plugin { namespace Zeek_RawReader { Plugin plugin; } }
namespace zeek::plugin::Zeek_RawReader {
using namespace plugin::Zeek_RawReader;
Plugin plugin;
Plugin::Plugin()
{
@ -12,7 +12,7 @@ Plugin::Plugin()
zeek::plugin::Configuration Plugin::Configure()
{
AddComponent(new ::input::Component("Raw", ::input::reader::Raw::Instantiate));
AddComponent(new zeek::input::Component("Raw", zeek::input::reader::detail::Raw::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::RawReader";
@ -32,3 +32,5 @@ std::unique_lock<std::mutex> Plugin::ForkMutex()
{
return std::unique_lock<std::mutex>(fork_mutex, std::defer_lock);
}
} // namespace zeek::plugin::Zeek_RawReader

6
src/input/readers/raw/Plugin.h
View file

@ -8,8 +8,7 @@
#include "Raw.h"
namespace plugin {
namespace Zeek_RawReader {
namespace zeek::plugin::Zeek_RawReader {
class Plugin : public zeek::plugin::Plugin {
public:
@ -29,5 +28,4 @@ private:
extern Plugin plugin;
}
}
} // namespace zeek::plugin::Zeek_RawReader

36
src/input/readers/raw/Raw.cc
View file

@ -20,13 +20,14 @@ extern "C" {
#include "setsignal.h"
}
using namespace input::reader;
using threading::Value;
using threading::Field;
namespace zeek::input::reader::detail {
const int Raw::block_size = 4096; // how big do we expect our chunks of data to be.
Raw::Raw(ReaderFrontend *frontend) : ReaderBackend(frontend), file(nullptr, fclose), stderrfile(nullptr, fclose)
Raw::Raw(zeek::input::ReaderFrontend *frontend) : zeek::input::ReaderBackend(frontend), file(nullptr, fclose), stderrfile(nullptr, fclose)
{
execute = false;
firstrun = true;
@ -207,7 +208,7 @@ bool Raw::Execute()
ClosePipeEnd(stdout_out);
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
{
if ( ! SetFDFlags(pipes[stdout_in], F_SETFL, O_NONBLOCK) )
return false;
@ -377,14 +378,15 @@ bool Raw::DoInit(const ReaderInfo& info, int num_fields, const Field* const* fie
}
it = info.config.find("offset"); // we want to seek to a given offset inside the file
if ( it != info.config.end() && ! execute && (Info().mode == MODE_STREAM || Info().mode == MODE_MANUAL) )
if ( it != info.config.end() && ! execute && (Info().mode == zeek::input::MODE_STREAM ||
Info().mode == zeek::input::MODE_MANUAL) )
{
std::string offset_s = it->second;
offset = strtoll(offset_s.c_str(), 0, 10);
}
else if ( it != info.config.end() )
{
Error("Offset only is supported for MODE_STREAM and MODE_MANUAL; it is also not supported when executing a command");
Error("Offset only is supported for zeek::input::MODE_STREAM and zeek::input::MODE_MANUAL; it is also not supported when executing a command");
return false;
}
@ -407,7 +409,7 @@ bool Raw::DoInit(const ReaderInfo& info, int num_fields, const Field* const* fie
return false;
}
if ( execute && Info().mode == MODE_REREAD )
if ( execute && Info().mode == zeek::input::MODE_REREAD )
{
// for execs this makes no sense - would have to execute each heartbeat?
Error("Rereading only supported for files, not for executables.");
@ -528,7 +530,7 @@ void Raw::WriteToStdin()
if ( stdin_towrite == 0 ) // send EOF when we are done.
ClosePipeEnd(stdin_out);
if ( Info().mode == MODE_MANUAL && stdin_towrite != 0 )
if ( Info().mode == zeek::input::MODE_MANUAL && stdin_towrite != 0 )
{
Error(Fmt("Could not write whole string to stdin of child process in one go. Please use STREAM mode to pass more data to child."));
}
@ -544,7 +546,7 @@ bool Raw::DoUpdate()
else
{
switch ( Info().mode ) {
case MODE_REREAD:
case zeek::input::MODE_REREAD:
{
assert(childpid == -1); // mode may not be used to execute child programs
// check if the file has changed
@ -566,9 +568,9 @@ bool Raw::DoUpdate()
// fallthrough
}
case MODE_MANUAL:
case MODE_STREAM:
if ( Info().mode == MODE_STREAM && file )
case zeek::input::MODE_MANUAL:
case zeek::input::MODE_STREAM:
if ( Info().mode == zeek::input::MODE_STREAM && file )
{
clearerr(file.get()); // remove end of file evil bits
break;
@ -645,7 +647,7 @@ bool Raw::DoUpdate()
}
}
if ( ( Info().mode == MODE_MANUAL ) || ( Info().mode == MODE_REREAD ) )
if ( ( Info().mode == zeek::input::MODE_MANUAL ) || ( Info().mode == zeek::input::MODE_REREAD ) )
// done with the current data source
EndCurrentSend();
@ -687,7 +689,7 @@ bool Raw::DoUpdate()
vals[3]->val.int_val = signal;
// and in this case we can signal end_of_data even for the streaming reader
if ( Info().mode == MODE_STREAM )
if ( Info().mode == zeek::input::MODE_STREAM )
EndCurrentSend();
SendEvent("InputRaw::process_finished", 4, vals);
@ -706,12 +708,12 @@ bool Raw::DoUpdate()
bool Raw::DoHeartbeat(double network_time, double current_time)
{
switch ( Info().mode ) {
case MODE_MANUAL:
case zeek::input::MODE_MANUAL:
// yay, we do nothing :)
break;
case MODE_REREAD:
case MODE_STREAM:
case zeek::input::MODE_REREAD:
case zeek::input::MODE_STREAM:
#ifdef DEBUG
Debug(zeek::DBG_INPUT, "Starting Heartbeat update");
#endif
@ -727,3 +729,5 @@ bool Raw::DoHeartbeat(double network_time, double current_time)
return true;
}
} // namespace zeek::input::reader::detail

13
src/input/readers/raw/Raw.h
View file

@ -9,15 +9,15 @@
#include "input/ReaderBackend.h"
namespace input { namespace reader {
namespace zeek::input::reader::detail {
/**
* A reader that returns a file (or the output of a command) as a single
* blob.
*/
class Raw : public ReaderBackend {
class Raw : public zeek::input::ReaderBackend {
public:
explicit Raw(ReaderFrontend* frontend);
explicit Raw(zeek::input::ReaderFrontend* frontend);
~Raw() override;
// prohibit copying and moving
@ -26,7 +26,7 @@ public:
Raw& operator=(const Raw&) = delete;
Raw& operator=(Raw&&) = delete;
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Raw(frontend); }
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new Raw(frontend); }
protected:
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
@ -89,5 +89,8 @@ private:
static const int block_size;
};
}
} // namespace zeek::input::reader::detail
namespace input::reader {
using Raw [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::Raw.")]] = zeek::input::reader::detail::Raw;
}

6
src/input/readers/sqlite/Plugin.cc
View file

@ -4,14 +4,13 @@
#include "SQLite.h"
namespace plugin {
namespace Zeek_SQLiteReader {
namespace zeek::plugin::Zeek_SQLiteReader {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure() override
{
AddComponent(new ::input::Component("SQLite", ::input::reader::SQLite::Instantiate));
AddComponent(new zeek::input::Component("SQLite", zeek::input::reader::detail::SQLite::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::SQLiteReader";
@ -21,4 +20,3 @@ public:
} plugin;
}
}

14
src/input/readers/sqlite/SQLite.cc
View file

@ -15,12 +15,13 @@
#include "threading/SerialTypes.h"
using namespace input::reader;
using threading::Value;
using threading::Field;
SQLite::SQLite(ReaderFrontend *frontend)
: ReaderBackend(frontend),
namespace zeek::input::reader::detail {
SQLite::SQLite(zeek::input::ReaderFrontend *frontend)
: zeek::input::ReaderBackend(frontend),
fields(), num_fields(), mode(), started(), query(), db(), st()
{
set_separator.assign(
@ -38,7 +39,8 @@ SQLite::SQLite(ReaderFrontend *frontend)
zeek::BifConst::InputSQLite::empty_field->Len()
);
io = new threading::formatter::Ascii(this, threading::formatter::Ascii::SeparatorInfo(std::string(), set_separator, unset_field, empty_field));
io = new threading::formatter::Ascii(this, threading::formatter::Ascii::SeparatorInfo(std::string(),
set_separator, unset_field, empty_field));
}
SQLite::~SQLite()
@ -82,7 +84,7 @@ bool SQLite::DoInit(const ReaderInfo& info, int arg_num_fields, const threading:
// allows simultaneous writes to one file.
sqlite3_enable_shared_cache(1);
if ( Info().mode != MODE_MANUAL )
if ( Info().mode != zeek::input::MODE_MANUAL )
{
Error("SQLite only supports manual reading mode.");
return false;
@ -341,3 +343,5 @@ bool SQLite::DoUpdate()
return true;
}
} // namespace zeek::input::reader::detail

12
src/input/readers/sqlite/SQLite.h
View file

@ -11,14 +11,14 @@
#include "threading/formatters/Ascii.h"
#include "3rdparty/sqlite3.h"
namespace input { namespace reader {
namespace zeek::input::reader::detail {
class SQLite : public ReaderBackend {
class SQLite : public zeek::input::ReaderBackend {
public:
explicit SQLite(ReaderFrontend* frontend);
explicit SQLite(zeek::input::ReaderFrontend* frontend);
~SQLite() override;
static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new SQLite(frontend); }
static zeek::input::ReaderBackend* Instantiate(zeek::input::ReaderFrontend* frontend) { return new SQLite(frontend); }
protected:
bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* arg_fields) override;
@ -45,6 +45,8 @@ private:
std::string empty_field;
};
} // namespace zeek::input::reader
}
namespace input::reader {
using SQLite [[deprecated("Remove in v4.1. Use zeek::input::reader::detail::SQLite.")]] = zeek::input::reader::detail::SQLite;
}

7
src/zeek-setup.cc
View file

@ -104,7 +104,8 @@ zeek::detail::TimerMgr*& timer_mgr = zeek::detail::timer_mgr;
logging::Manager* log_mgr = nullptr;
threading::Manager* thread_mgr = nullptr;
input::Manager* input_mgr = nullptr;
zeek::input::Manager* zeek::input_mgr = nullptr;
zeek::input::Manager*& input_mgr = zeek::input_mgr;
zeek::file_analysis::Manager* zeek::file_mgr = nullptr;
zeek::file_analysis::Manager*& file_mgr = zeek::file_mgr;
zeekygen::Manager* zeekygen_mgr = nullptr;
@ -305,7 +306,7 @@ void terminate_bro()
notifier::registry.Terminate();
log_mgr->Terminate();
input_mgr->Terminate();
zeek::input_mgr->Terminate();
thread_mgr->Terminate();
broker_mgr->Terminate();
zeek::detail::dns_mgr->Terminate();
@ -581,7 +582,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
event_registry = new EventRegistry();
zeek::analyzer_mgr = new analyzer::Manager();
log_mgr = new logging::Manager();
input_mgr = new input::Manager();
zeek::input_mgr = new input::Manager();
zeek::file_mgr = new file_analysis::Manager();
auto broker_real_time = ! options.pcap_file && ! options.deterministic_mode;
broker_mgr = new bro_broker::Manager(broker_real_time);