diff --git a/CHANGES b/CHANGES index e6463829e5..a4972bb8ea 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,9 @@ +2.5-743 | 2018-07-17 14:20:19 -0500 + + * Port broker::data variant usages to use CAF API directly + (Jon Siwek, Corelight) + 2.5-741 | 2018-07-16 16:06:02 -0500 * Improve Specific_RE_Matcher::CompileSet() error condition cleanup diff --git a/VERSION b/VERSION index 86f56afeeb..fd335625ba 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.5-741 +2.5-743 diff --git a/aux/broker b/aux/broker index 1d90b931cc..467024ab09 160000 --- a/aux/broker +++ b/aux/broker @@ -1 +1 @@ -Subproject commit 1d90b931cc888e31b0d4774dbae54f5758841ab3 +Subproject commit 467024ab09e3443798126e69054fb8862c69562f diff --git a/src/broker/Data.cc b/src/broker/Data.cc index 99c6e3ebef..b836b66002 100644 --- a/src/broker/Data.cc +++ b/src/broker/Data.cc @@ -215,7 +215,7 @@ struct val_converter { { auto expected_index_types = tt->Indices()->Types(); broker::vector composite_key; - auto indices = broker::get_if(item); + auto indices = caf::get_if(&item); if ( indices ) { @@ -283,7 +283,7 @@ struct val_converter { { auto expected_index_types = tt->Indices()->Types(); broker::vector composite_key; - auto indices = broker::get_if(item.first); + auto indices = caf::get_if(&item.first); if ( indices ) { @@ -384,7 +384,7 @@ struct val_converter { return nullptr; } - if ( broker::get_if(a[idx]) != nullptr ) + if ( caf::get_if(&a[idx]) != nullptr ) { rval->Assign(i, nullptr); ++idx; @@ -411,8 +411,8 @@ struct val_converter { if ( a.size() != 2 ) return nullptr; - auto exact_text = broker::get_if(a[0]); - auto anywhere_text = broker::get_if(a[1]); + auto exact_text = caf::get_if(&a[0]); + auto anywhere_text = caf::get_if(&a[1]); if ( ! exact_text || ! anywhere_text ) return nullptr; @@ -582,7 +582,7 @@ struct type_checker { for ( const auto& item : a ) { auto expected_index_types = tt->Indices()->Types(); - auto indices = broker::get_if(item); + auto indices = caf::get_if(&item); vector indices_to_check; if ( indices ) @@ -624,7 +624,7 @@ struct type_checker { auto expect = (*expected_index_types)[i]; auto& index_to_check = *(indices_to_check)[i]; - if ( ! broker::visit(type_checker{expect}, index_to_check) ) + if ( ! caf::visit(type_checker{expect}, index_to_check) ) return false; } } @@ -642,7 +642,7 @@ struct type_checker { for ( auto& item : a ) { auto expected_index_types = tt->Indices()->Types(); - auto indices = broker::get_if(item.first); + auto indices = caf::get_if(&item.first); vector indices_to_check; if ( indices ) @@ -689,11 +689,11 @@ struct type_checker { auto expect = (*expected_index_types)[i]; auto& index_to_check = *(indices_to_check)[i]; - if ( ! broker::visit(type_checker{expect}, index_to_check) ) + if ( ! caf::visit(type_checker{expect}, index_to_check) ) return false; } - if ( ! broker::visit(type_checker{tt->YieldType()}, + if ( ! caf::visit(type_checker{tt->YieldType()}, item.second) ) return false; } @@ -709,7 +709,7 @@ struct type_checker { for ( auto& item : a ) { - if ( ! broker::visit(type_checker{vt->YieldType()}, item) ) + if ( ! caf::visit(type_checker{vt->YieldType()}, item) ) return false; } @@ -725,13 +725,13 @@ struct type_checker { if ( idx >= a.size() ) return false; - if ( broker::get_if(a[idx]) != nullptr ) + if ( caf::get_if(&a[idx]) != nullptr ) { ++idx; continue; } - if ( ! broker::visit(type_checker{rt->FieldType(i)}, + if ( ! caf::visit(type_checker{rt->FieldType(i)}, a[idx]) ) return false; @@ -745,8 +745,8 @@ struct type_checker { if ( a.size() != 2 ) return false; - auto exact_text = broker::get_if(a[0]); - auto anywhere_text = broker::get_if(a[1]); + auto exact_text = caf::get_if(&a[0]); + auto anywhere_text = caf::get_if(&a[1]); if ( ! exact_text || ! anywhere_text ) return false; @@ -775,7 +775,7 @@ Val* bro_broker::data_to_val(broker::data d, BroType* type) if ( type->Tag() == TYPE_ANY ) return bro_broker::make_data_val(move(d)); - return broker::visit(val_converter{type}, std::move(d)); + return caf::visit(val_converter{type}, std::move(d)); } broker::expected bro_broker::val_to_data(Val* v) @@ -900,7 +900,7 @@ broker::expected bro_broker::val_to_data(Val* v) key = move(composite_key); if ( is_set ) - broker::get(rval).emplace(move(key)); + caf::get(rval).emplace(move(key)); else { auto val = val_to_data(entry->Value()); @@ -908,7 +908,7 @@ broker::expected bro_broker::val_to_data(Val* v) if ( ! val ) return broker::ec::invalid_data; - broker::get(rval).emplace(move(key), move(*val)); + caf::get(rval).emplace(move(key), move(*val)); } } @@ -1115,7 +1115,7 @@ struct data_type_getter { EnumVal* bro_broker::get_data_type(RecordVal* v, Frame* frame) { - return broker::visit(data_type_getter{}, opaque_field_to_data(v, frame)); + return caf::visit(data_type_getter{}, opaque_field_to_data(v, frame)); } broker::data& bro_broker::opaque_field_to_data(RecordVal* v, Frame* f) @@ -1131,7 +1131,7 @@ broker::data& bro_broker::opaque_field_to_data(RecordVal* v, Frame* f) bool bro_broker::DataVal::canCastTo(BroType* t) const { - return broker::visit(type_checker{t}, data); + return caf::visit(type_checker{t}, data); } Val* bro_broker::DataVal::castTo(BroType* t) @@ -1192,24 +1192,24 @@ broker::data bro_broker::threading_field_to_data(const threading::Field* f) threading::Field* bro_broker::data_to_threading_field(broker::data d) { - if ( ! broker::is(d) ) + if ( ! caf::holds_alternative(d) ) return nullptr; - auto& v = broker::get(d); - auto name = broker::get_if(v[0]); + auto& v = caf::get(d); + auto name = caf::get_if(&v[0]); auto secondary = v[1]; - auto type = broker::get_if(v[2]); - auto subtype = broker::get_if(v[3]); - auto optional = broker::get_if(v[4]); + auto type = caf::get_if(&v[2]); + auto subtype = caf::get_if(&v[3]); + auto optional = caf::get_if(&v[4]); if ( ! (name && type && subtype && optional) ) return nullptr; - if ( secondary != broker::nil && ! broker::is(secondary) ) + if ( secondary != broker::nil && ! caf::holds_alternative(secondary) ) return nullptr; return new threading::Field(name->c_str(), - secondary != broker::nil ? broker::get(secondary).c_str() : nullptr, + secondary != broker::nil ? caf::get(secondary).c_str() : nullptr, static_cast(*type), static_cast(*subtype), *optional); diff --git a/src/broker/Data.h b/src/broker/Data.h index 525faba5f6..e2a5968a82 100644 --- a/src/broker/Data.h +++ b/src/broker/Data.h @@ -210,11 +210,11 @@ broker::data& opaque_field_to_data(RecordVal* v, Frame* f); template T& require_data_type(broker::data& d, TypeTag tag, Frame* f) { - auto ptr = broker::get_if(d); + auto ptr = caf::get_if(&d); if ( ! ptr ) reporter->RuntimeError(f->GetCall()->GetLocationInfo(), "data is of type '%s' not of type '%s'", - broker::visit(type_name_getter{tag}, d), + caf::visit(type_name_getter{tag}, d), type_name(tag)); return *ptr; diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index 5def875ce7..a78ba2bea8 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -942,13 +942,13 @@ void Manager::Process() { had_input = true; - if ( auto stat = broker::get_if(status_msg) ) + if ( auto stat = caf::get_if(&status_msg) ) { ProcessStatus(std::move(*stat)); continue; } - if ( auto err = broker::get_if(status_msg) ) + if ( auto err = caf::get_if(&status_msg) ) { ProcessError(std::move(*err)); continue; @@ -1048,7 +1048,7 @@ void Manager::ProcessRelayEvent(broker::bro::RelayEvent ev) ++statistics.num_events_incoming; for ( auto& t : ev.topics() ) - PublishEvent(std::move(broker::get(t)), + PublishEvent(std::move(caf::get(t)), std::move(ev.name()), std::move(ev.args())); } @@ -1060,7 +1060,7 @@ void Manager::ProcessHandleAndRelayEvent(broker::bro::HandleAndRelayEvent ev) ProcessEvent(ev.name(), ev.args()); for ( auto& t : ev.topics() ) - PublishEvent(std::move(broker::get(t)), + PublishEvent(std::move(caf::get(t)), std::move(ev.name()), std::move(ev.args())); } @@ -1095,40 +1095,38 @@ bool bro_broker::Manager::ProcessLogCreate(broker::bro::LogCreate lc) } // Get log fields. + auto fields_data = caf::get_if(&lc.fields_data()); - try - { - auto fields_data = std::move(broker::get(lc.fields_data())); - auto num_fields = fields_data.size(); - auto fields = new threading::Field* [num_fields]; - - for ( auto i = 0u; i < num_fields; ++i ) - { - if ( auto field = data_to_threading_field(std::move(fields_data[i])) ) - fields[i] = field; - else - { - reporter->Warning("failed to convert remote log field # %d", i); - return false; - } - } - - if ( ! log_mgr->CreateWriterForRemoteLog(stream_id->AsEnumVal(), writer_id->AsEnumVal(), writer_info.get(), num_fields, fields) ) - { - ODesc d; - stream_id->Describe(&d); - reporter->Warning("failed to create remote log stream for %s locally", d.Description()); - } - - writer_info.release(); // log_mgr took ownership. - return true; - } - - catch (const broker::bad_variant_access& e) + if ( ! fields_data ) { reporter->Warning("failed to unpack remote log fields"); return false; } + + auto num_fields = fields_data->size(); + auto fields = new threading::Field* [num_fields]; + + for ( auto i = 0u; i < num_fields; ++i ) + { + if ( auto field = data_to_threading_field(std::move((*fields_data)[i])) ) + fields[i] = field; + else + { + reporter->Warning("failed to convert remote log field # %d", i); + delete [] fields; + return false; + } + } + + if ( ! log_mgr->CreateWriterForRemoteLog(stream_id->AsEnumVal(), writer_id->AsEnumVal(), writer_info.get(), num_fields, fields) ) + { + ODesc d; + stream_id->Describe(&d); + reporter->Warning("failed to create remote log stream for %s locally", d.Description()); + } + + writer_info.release(); // log_mgr took ownership. + return true; } bool bro_broker::Manager::ProcessLogWrite(broker::bro::LogWrite lw) @@ -1159,52 +1157,56 @@ bool bro_broker::Manager::ProcessLogWrite(broker::bro::LogWrite lw) } unref_guard writer_id_unreffer{writer_id}; + auto path = caf::get_if(&lw.path()); - try + if ( ! path ) { - auto& path = broker::get(lw.path()); - auto& serial_data = broker::get(lw.serial_data()); - - BinarySerializationFormat fmt; - fmt.StartRead(serial_data.data(), serial_data.size()); - - int num_fields; - bool success = fmt.Read(&num_fields, "num_fields"); - - if ( ! success ) - { - reporter->Warning("failed to unserialize remote log num fields for stream: %s", stream_id_name.data()); - return false; - } - - auto vals = new threading::Value* [num_fields]; - - for ( int i = 0; i < num_fields; ++i ) - { - vals[i] = new threading::Value; - - if ( ! vals[i]->Read(&fmt) ) - { - for ( int j = 0; j <=i; ++j ) - delete vals[j]; - - delete [] vals; - reporter->Warning("failed to unserialize remote log field %d for stream: %s", i, stream_id_name.data()); - - return false; - } - } - - log_mgr->WriteFromRemote(stream_id->AsEnumVal(), writer_id->AsEnumVal(), std::move(path), num_fields, vals); - fmt.EndRead(); - return true; - } - - catch ( const broker::bad_variant_access& e) - { - reporter->Warning("failed to unpack remote log values (bad variant) for stream: %s", stream_id_name.data()); + reporter->Warning("failed to unpack remote log values (bad path variant) for stream: %s", stream_id_name.data()); return false; } + + auto serial_data = caf::get_if(&lw.serial_data()); + + if ( ! serial_data ) + { + reporter->Warning("failed to unpack remote log values (bad serial_data variant) for stream: %s", stream_id_name.data()); + return false; + } + + BinarySerializationFormat fmt; + fmt.StartRead(serial_data->data(), serial_data->size()); + + int num_fields; + bool success = fmt.Read(&num_fields, "num_fields"); + + if ( ! success ) + { + reporter->Warning("failed to unserialize remote log num fields for stream: %s", stream_id_name.data()); + return false; + } + + auto vals = new threading::Value* [num_fields]; + + for ( int i = 0; i < num_fields; ++i ) + { + vals[i] = new threading::Value; + + if ( ! vals[i]->Read(&fmt) ) + { + for ( int j = 0; j <=i; ++j ) + delete vals[j]; + + delete [] vals; + reporter->Warning("failed to unserialize remote log field %d for stream: %s", i, stream_id_name.data()); + + return false; + } + } + + log_mgr->WriteFromRemote(stream_id->AsEnumVal(), writer_id->AsEnumVal(), + std::move(*path), num_fields, vals); + fmt.EndRead(); + return true; } bool Manager::ProcessIdentifierUpdate(broker::bro::IdentifierUpdate iu) diff --git a/src/broker/data.bif b/src/broker/data.bif index 658145089c..e874076434 100644 --- a/src/broker/data.bif +++ b/src/broker/data.bif @@ -457,7 +457,7 @@ function Broker::__record_lookup%(r: Broker::Data, idx: count%): Broker::Data auto& v = bro_broker::require_data_type(r->AsRecordVal(), TYPE_RECORD, frame); - if ( idx >= v.size() || broker::get_if(v[idx]) ) + if ( idx >= v.size() || caf::get_if(&v[idx]) ) return new RecordVal(BifType::Record::Broker::Data); return bro_broker::make_data_val(v[idx]); @@ -496,7 +496,7 @@ function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%) return rval; } - if ( broker::get_if(*ri->it) ) + if ( caf::get_if(&(*ri->it)) ) return rval; // field isn't set rval->Assign(0, new bro_broker::DataVal(*ri->it)); diff --git a/src/logging/WriterBackend.cc b/src/logging/WriterBackend.cc index 69327e815d..4416e41d17 100644 --- a/src/logging/WriterBackend.cc +++ b/src/logging/WriterBackend.cc @@ -137,15 +137,15 @@ broker::data WriterBackend::WriterInfo::ToBroker() const bool WriterBackend::WriterInfo::FromBroker(broker::data d) { - if ( ! broker::is(d) ) + if ( ! caf::holds_alternative(d) ) return false; - auto v = broker::get(d); - auto bpath = broker::get_if(v[0]); - auto brotation_base = broker::get_if(v[1]); - auto brotation_interval = broker::get_if(v[2]); - auto bnetwork_time = broker::get_if(v[3]); - auto bconfig = broker::get_if(v[4]); + auto v = caf::get(d); + auto bpath = caf::get_if(&v[0]); + auto brotation_base = caf::get_if(&v[1]); + auto brotation_interval = caf::get_if(&v[2]); + auto bnetwork_time = caf::get_if(&v[3]); + auto bconfig = caf::get_if(&v[4]); if ( ! (bpath && brotation_base && brotation_interval && bnetwork_time && bconfig) ) return false; @@ -157,8 +157,8 @@ bool WriterBackend::WriterInfo::FromBroker(broker::data d) for ( auto i : *bconfig ) { - auto k = broker::get_if(i.first); - auto v = broker::get_if(i.second); + auto k = caf::get_if(&i.first); + auto v = caf::get_if(&i.second); if ( ! (k && v) ) return false;