Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Remove other using statements from headers

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-04-07 13:14:17 -07:00
parent eb010290eb
commit a525f9532e
22 changed files with 123 additions and 171 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/EventRegistry.h
View file

@ -7,9 +7,6 @@
#include <string> #include <string>
#include <vector> #include <vector>
using std::string;
using std::vector;
class EventHandler; class EventHandler;
class EventHandlerPtr; class EventHandlerPtr;
class RE_Matcher; class RE_Matcher;
@ -23,17 +20,17 @@ public:
void Register(EventHandlerPtr handler); void Register(EventHandlerPtr handler);
// Return nil if unknown. // Return nil if unknown.
EventHandler* Lookup(const string& name); EventHandler* Lookup(const std::string& name);
// Returns a list of all local handlers that match the given pattern. // Returns a list of all local handlers that match the given pattern.
// Passes ownership of list. // Passes ownership of list.
typedef vector<string> string_list; using string_list = std::vector<std::string>;
string_list Match(RE_Matcher* pattern); string_list Match(RE_Matcher* pattern);
// Marks a handler as handling errors. Error handler will not be called // Marks a handler as handling errors. Error handler will not be called
// recursively to avoid infinite loops in case they trigger an error // recursively to avoid infinite loops in case they trigger an error
// themselves. // themselves.
void SetErrorHandler(const string& name); void SetErrorHandler(const std::string& name);
string_list UnusedHandlers(); string_list UnusedHandlers();
string_list UsedHandlers(); string_list UsedHandlers();

18
src/Expr.h
View file

@ -2,6 +2,12 @@
#pragma once #pragma once
#include <memory>
#include <string>
#include <vector>
#include <utility>
#include <optional>
#include "BroList.h" #include "BroList.h"
#include "IntrusivePtr.h" #include "IntrusivePtr.h"
#include "Timer.h" #include "Timer.h"
@ -11,14 +17,6 @@
#include "Val.h" #include "Val.h"
#include "ZeekArgs.h" #include "ZeekArgs.h"
#include <memory>
#include <string>
#include <vector>
#include <utility>
#include <optional>
using std::string;
enum BroExprTag : int { enum BroExprTag : int {
EXPR_ANY = -1, EXPR_ANY = -1,
EXPR_NAME, EXPR_CONST, EXPR_NAME, EXPR_CONST,
@ -683,7 +681,7 @@ public:
protected: protected:
void ExprDescribe(ODesc* d) const override; void ExprDescribe(ODesc* d) const override;
string field_name; std::string field_name;
}; };
class ArithCoerceExpr : public UnaryExpr { class ArithCoerceExpr : public UnaryExpr {
@ -843,7 +841,7 @@ public:
protected: protected:
void ExprDescribe(ODesc* d) const override; void ExprDescribe(ODesc* d) const override;
string name; std::string name;
EventHandlerPtr handler; EventHandlerPtr handler;
IntrusivePtr<ListExpr> args; IntrusivePtr<ListExpr> args;
}; };

25
src/Func.h
View file

@ -2,13 +2,6 @@
#pragma once #pragma once
#include "BroList.h"
#include "Obj.h"
#include "IntrusivePtr.h"
#include "Type.h" /* for function_flavor */
#include "TraverseTypes.h"
#include "ZeekArgs.h"
#include <utility> #include <utility>
#include <memory> #include <memory>
#include <string> #include <string>
@ -19,8 +12,12 @@
#include <broker/data.hh> #include <broker/data.hh>
#include <broker/expected.hh> #include <broker/expected.hh>
using std::string; #include "BroList.h"
using std::vector; #include "Obj.h"
#include "IntrusivePtr.h"
#include "Type.h" /* for function_flavor */
#include "TraverseTypes.h"
#include "ZeekArgs.h"
class Val; class Val;
class ListExpr; class ListExpr;
@ -49,7 +46,7 @@ public:
{ return priority > other.priority; } // reverse sort { return priority > other.priority; } // reverse sort
}; };
const vector<Body>& GetBodies() const { return bodies; } const std::vector<Body>& GetBodies() const { return bodies; }
bool HasBodies() const { return bodies.size(); } bool HasBodies() const { return bodies.size(); }
[[deprecated("Remove in v4.1. Use zeek::Args overload instead.")]] [[deprecated("Remove in v4.1. Use zeek::Args overload instead.")]]
@ -108,13 +105,13 @@ protected:
// Helper function for handling result of plugin hook. // Helper function for handling result of plugin hook.
std::pair<bool, Val*> HandlePluginResult(std::pair<bool, Val*> plugin_result, function_flavor flavor) const; std::pair<bool, Val*> HandlePluginResult(std::pair<bool, Val*> plugin_result, function_flavor flavor) const;
vector<Body> bodies; std::vector<Body> bodies;
IntrusivePtr<Scope> scope; IntrusivePtr<Scope> scope;
Kind kind; Kind kind;
IntrusivePtr<BroType> type; IntrusivePtr<BroType> type;
string name; std::string name;
uint32_t unique_id; uint32_t unique_id;
static vector<Func*> unique_ids; static std::vector<Func*> unique_ids;
}; };
@ -244,7 +241,7 @@ struct function_ingredients {
IntrusivePtr<Scope> scope; IntrusivePtr<Scope> scope;
}; };
extern vector<CallInfo> call_stack; extern std::vector<CallInfo> call_stack;
extern std::string render_call_stack(); extern std::string render_call_stack();

6
src/IP.h
View file

@ -4,8 +4,6 @@
#include "zeek-config.h" #include "zeek-config.h"
#include <vector>
#include <sys/types.h> // for u_char #include <sys/types.h> // for u_char
#include <netinet/in.h> #include <netinet/in.h>
#include <netinet/ip.h> #include <netinet/ip.h>
@ -14,7 +12,7 @@
#include <netinet/ip6.h> #include <netinet/ip6.h>
#endif #endif
using std::vector; #include <vector>
class IPAddr; class IPAddr;
class RecordVal; class RecordVal;
@ -263,7 +261,7 @@ protected:
void ProcessDstOpts(const struct ip6_dest* d, uint16_t len); void ProcessDstOpts(const struct ip6_dest* d, uint16_t len);
#endif #endif
vector<IPv6_Hdr*> chain; std::vector<IPv6_Hdr*> chain;
/** /**
* The summation of all header lengths in the chain in bytes. * The summation of all header lengths in the chain in bytes.

7
src/IPAddr.h
View file

@ -2,14 +2,13 @@
#pragma once #pragma once
#include "threading/SerialTypes.h"
#include <netinet/in.h> #include <netinet/in.h>
#include <arpa/inet.h> #include <arpa/inet.h>
#include <string.h> #include <string.h>
#include <string> #include <string>
using std::string; #include "threading/SerialTypes.h"
struct ConnID; struct ConnID;
class BroString; class BroString;
class HashKey; class HashKey;
@ -317,7 +316,7 @@ public:
if ( GetFamily() == IPv4 ) if ( GetFamily() == IPv4 )
return AsString(); return AsString();
return string("[") + AsString() + "]"; return std::string("[") + AsString() + "]";
} }
/** /**

12
src/Net.h
View file

@ -2,15 +2,13 @@
#pragma once #pragma once
#include <sys/stat.h> // for ino_t
#include <list> #include <list>
#include <vector> #include <vector>
#include <string> #include <string>
#include <optional> #include <optional>
#include <sys/stat.h> // for ino_t
using std::string;
namespace iosource { namespace iosource {
class IOSource; class IOSource;
class PktSrc; class PktSrc;
@ -93,12 +91,12 @@ struct ScannedFile {
dev_t dev; dev_t dev;
ino_t inode; ino_t inode;
int include_level; int include_level;
string name; std::string name;
bool skipped; // This ScannedFile was @unload'd. bool skipped; // This ScannedFile was @unload'd.
bool prefixes_checked; // If loading prefixes for this file has been tried. bool prefixes_checked; // If loading prefixes for this file has been tried.
ScannedFile(dev_t arg_dev, ino_t arg_inode, int arg_include_level, ScannedFile(dev_t arg_dev, ino_t arg_inode, int arg_include_level,
const string& arg_name, bool arg_skipped = false, const std::string& arg_name, bool arg_skipped = false,
bool arg_prefixes_checked = false) bool arg_prefixes_checked = false)
: dev(arg_dev), inode(arg_inode), : dev(arg_dev), inode(arg_inode),
include_level(arg_include_level), include_level(arg_include_level),
@ -108,4 +106,4 @@ struct ScannedFile {
}; };
extern std::list<ScannedFile> files_scanned; extern std::list<ScannedFile> files_scanned;
extern std::vector<string> sig_files; extern std::vector<std::string> sig_files;

2
src/OpaqueVal.h
View file

@ -306,7 +306,7 @@ public:
size_t Count(const Val* val) const; size_t Count(const Val* val) const;
void Clear(); void Clear();
bool Empty() const; bool Empty() const;
string InternalState() const; std::string InternalState() const;
static IntrusivePtr<BloomFilterVal> Merge(const BloomFilterVal* x, static IntrusivePtr<BloomFilterVal> Merge(const BloomFilterVal* x,
const BloomFilterVal* y); const BloomFilterVal* y);

9
src/PrefixTable.h
View file

@ -1,15 +1,12 @@
#pragma once #pragma once
#include "IPAddr.h"
extern "C" { extern "C" {
#include "patricia.h" #include "patricia.h"
} }
#include <list> #include <list>
using std::list; #include "IPAddr.h"
using std::tuple;
class Val; class Val;
class SubNetVal; class SubNetVal;
@ -42,8 +39,8 @@ public:
void* Lookup(const Val* value, bool exact = false) const; void* Lookup(const Val* value, bool exact = false) const;
// Returns list of all found matches or empty list otherwise. // Returns list of all found matches or empty list otherwise.
list<tuple<IPPrefix,void*>> FindAll(const IPAddr& addr, int width) const; std::list<std::tuple<IPPrefix,void*>> FindAll(const IPAddr& addr, int width) const;
list<tuple<IPPrefix,void*>> FindAll(const SubNetVal* value) const; std::list<std::tuple<IPPrefix,void*>> FindAll(const SubNetVal* value) const;
// Returns pointer to data or nil if not found. // Returns pointer to data or nil if not found.
void* Remove(const IPAddr& addr, int width); void* Remove(const IPAddr& addr, int width);

4
src/RuleAction.h
View file

@ -6,8 +6,6 @@
#include <sys/types.h> // for u_char #include <sys/types.h> // for u_char
using std::string;
class Rule; class Rule;
class RuleEndpointState; class RuleEndpointState;
@ -50,7 +48,7 @@ public:
void PrintDebug() override; void PrintDebug() override;
string GetMIME() const std::string GetMIME() const
{ return mime; } { return mime; }
int GetStrength() const int GetStrength() const

23
src/RuleMatcher.h
View file

@ -1,8 +1,7 @@
#pragma once #pragma once
#include "Rule.h" #include <sys/types.h> // for u_char
#include "RE.h" #include <limits.h>
#include "CCL.h"
#include <vector> #include <vector>
#include <map> #include <map>
@ -10,8 +9,9 @@
#include <set> #include <set>
#include <string> #include <string>
#include <sys/types.h> // for u_char #include "Rule.h"
#include <limits.h> #include "RE.h"
#include "CCL.h"
//#define MATCHER_PRINT_STATS //#define MATCHER_PRINT_STATS
@ -27,11 +27,6 @@ extern FILE* rules_in;
extern int rules_line_number; extern int rules_line_number;
extern const char* current_rule_file; extern const char* current_rule_file;
using std::vector;
using std::map;
using std::set;
using std::string;
class Val; class Val;
class BroFile; class BroFile;
class IntSet; class IntSet;
@ -67,7 +62,7 @@ typedef PList<BroString> bstr_list;
// Get values from Bro's script-level variables. // Get values from Bro's script-level variables.
extern void id_to_maskedvallist(const char* id, maskedvalue_list* append_to, extern void id_to_maskedvallist(const char* id, maskedvalue_list* append_to,
vector<IPPrefix>* prefix_vector = 0); std::vector<IPPrefix>* prefix_vector = 0);
extern char* id_to_str(const char* id); extern char* id_to_str(const char* id);
extern uint32_t id_to_uint(const char* id); extern uint32_t id_to_uint(const char* id);
@ -79,7 +74,7 @@ public:
RuleHdrTest(Prot arg_prot, uint32_t arg_offset, uint32_t arg_size, RuleHdrTest(Prot arg_prot, uint32_t arg_offset, uint32_t arg_size,
Comp arg_comp, maskedvalue_list* arg_vals); Comp arg_comp, maskedvalue_list* arg_vals);
RuleHdrTest(Prot arg_prot, Comp arg_comp, vector<IPPrefix> arg_v); RuleHdrTest(Prot arg_prot, Comp arg_comp, std::vector<IPPrefix> arg_v);
~RuleHdrTest(); ~RuleHdrTest();
void PrintDebug(); void PrintDebug();
@ -96,7 +91,7 @@ private:
Prot prot; Prot prot;
Comp comp; Comp comp;
maskedvalue_list* vals; maskedvalue_list* vals;
vector<IPPrefix> prefix_vals; // for use with IPSrc/IPDst comparisons std::vector<IPPrefix> prefix_vals; // for use with IPSrc/IPDst comparisons
uint32_t offset; uint32_t offset;
uint32_t size; uint32_t size;
@ -241,7 +236,7 @@ public:
* Ordered from greatest to least strength. Matches of the same strength * Ordered from greatest to least strength. Matches of the same strength
* will be in the set in lexicographic order of the MIME type string. * will be in the set in lexicographic order of the MIME type string.
*/ */
typedef map<int, set<string>, std::greater<int> > MIME_Matches; using MIME_Matches = std::map<int, std::set<std::string>, std::greater<int>>;
/** /**
* Matches a chunk of data against file magic signatures. * Matches a chunk of data against file magic signatures.

4
src/Trigger.h
View file

@ -20,8 +20,6 @@ namespace trigger {
// Triggers are the heart of "when" statements: expressions that when // Triggers are the heart of "when" statements: expressions that when
// they become true execute a body of statements. // they become true execute a body of statements.
using std::map;
class TriggerTimer; class TriggerTimer;
class TriggerTraversalCallback; class TriggerTraversalCallback;
@ -110,7 +108,7 @@ private:
std::vector<std::pair<BroObj *, notifier::Modifiable*>> objs; std::vector<std::pair<BroObj *, notifier::Modifiable*>> objs;
using ValCache = map<const CallExpr*, Val*>; using ValCache = std::map<const CallExpr*, Val*>;
ValCache cache; ValCache cache;
}; };

9
src/TunnelEncapsulation.h
View file

@ -10,7 +10,6 @@
#include <vector> #include <vector>
using std::vector;
class Connection; class Connection;
/** /**
@ -135,7 +134,7 @@ public:
EncapsulationStack(const EncapsulationStack& other) EncapsulationStack(const EncapsulationStack& other)
{ {
if ( other.conns ) if ( other.conns )
conns = new vector<EncapsulatingConn>(*(other.conns)); conns = new std::vector<EncapsulatingConn>(*(other.conns));
else else
conns = 0; conns = 0;
} }
@ -148,7 +147,7 @@ public:
delete conns; delete conns;
if ( other.conns ) if ( other.conns )
conns = new vector<EncapsulatingConn>(*(other.conns)); conns = new std::vector<EncapsulatingConn>(*(other.conns));
else else
conns = 0; conns = 0;
@ -165,7 +164,7 @@ public:
void Add(const EncapsulatingConn& c) void Add(const EncapsulatingConn& c)
{ {
if ( ! conns ) if ( ! conns )
conns = new vector<EncapsulatingConn>(); conns = new std::vector<EncapsulatingConn>();
conns->push_back(c); conns->push_back(c);
} }
@ -215,5 +214,5 @@ public:
} }
protected: protected:
vector<EncapsulatingConn>* conns; std::vector<EncapsulatingConn>* conns;
}; };

15
src/Val.h
View file

@ -15,9 +15,6 @@
#include <sys/types.h> // for u_char #include <sys/types.h> // for u_char
using std::vector;
using std::string;
// We have four different port name spaces: TCP, UDP, ICMP, and UNKNOWN. // We have four different port name spaces: TCP, UDP, ICMP, and UNKNOWN.
// We distinguish between them based on the bits specified in the *_PORT_MASK // We distinguish between them based on the bits specified in the *_PORT_MASK
// entries specified below. // entries specified below.
@ -85,7 +82,7 @@ union BroValUnion {
PDict<TableEntryVal>* table_val; PDict<TableEntryVal>* table_val;
val_list* val_list_val; val_list* val_list_val;
vector<Val*>* vector_val; std::vector<Val*>* vector_val;
BroValUnion() = default; BroValUnion() = default;
@ -122,7 +119,7 @@ union BroValUnion {
constexpr BroValUnion(val_list* value) noexcept constexpr BroValUnion(val_list* value) noexcept
: val_list_val(value) {} : val_list_val(value) {}
constexpr BroValUnion(vector<Val*> *value) noexcept constexpr BroValUnion(std::vector<Val*> *value) noexcept
: vector_val(value) {} : vector_val(value) {}
}; };
@ -214,7 +211,7 @@ public:
CONST_ACCESSOR(TYPE_RECORD, val_list*, val_list_val, AsRecord) CONST_ACCESSOR(TYPE_RECORD, val_list*, val_list_val, AsRecord)
CONST_ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile) CONST_ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile)
CONST_ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern) CONST_ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
CONST_ACCESSOR(TYPE_VECTOR, vector<Val*>*, vector_val, AsVector) CONST_ACCESSOR(TYPE_VECTOR, std::vector<Val*>*, vector_val, AsVector)
const IPPrefix& AsSubNet() const const IPPrefix& AsSubNet() const
{ {
@ -248,7 +245,7 @@ public:
ACCESSOR(TYPE_FUNC, Func*, func_val, AsFunc) ACCESSOR(TYPE_FUNC, Func*, func_val, AsFunc)
ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile) ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile)
ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern) ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
ACCESSOR(TYPE_VECTOR, vector<Val*>*, vector_val, AsVector) ACCESSOR(TYPE_VECTOR, std::vector<Val*>*, vector_val, AsVector)
const IPPrefix& AsSubNet() const IPPrefix& AsSubNet()
{ {
@ -475,7 +472,7 @@ public:
// Returns the port number in host order (not including the mask). // Returns the port number in host order (not including the mask).
uint32_t Port() const; uint32_t Port() const;
string Protocol() const; std::string Protocol() const;
// Tests for protocol types. // Tests for protocol types.
bool IsTCP() const; bool IsTCP() const;
@ -553,7 +550,7 @@ class StringVal : public Val {
public: public:
explicit StringVal(BroString* s); explicit StringVal(BroString* s);
explicit StringVal(const char* s); explicit StringVal(const char* s);
explicit StringVal(const string& s); explicit StringVal(const std::string& s);
StringVal(int length, const char* s); StringVal(int length, const char* s);
IntrusivePtr<Val> SizeVal() const override; IntrusivePtr<Val> SizeVal() const override;

23
src/analyzer/Analyzer.h
View file

@ -2,6 +2,13 @@
#pragma once #pragma once
#include <sys/types.h> // for u_char
#include <list>
#include <vector>
#include <tuple>
#include <type_traits>
#include "Tag.h" #include "Tag.h"
#include "../Obj.h" #include "../Obj.h"
@ -9,16 +16,6 @@
#include "../Timer.h" #include "../Timer.h"
#include "../IntrusivePtr.h" #include "../IntrusivePtr.h"
#include <list>
#include <vector>
#include <tuple>
#include <type_traits>
#include <sys/types.h> // for u_char
using std::list;
using std::string;
class BroFile; class BroFile;
class Rule; class Rule;
class Connection; class Connection;
@ -34,7 +31,7 @@ class AnalyzerTimer;
class SupportAnalyzer; class SupportAnalyzer;
class OutputHandler; class OutputHandler;
typedef list<Analyzer*> analyzer_list; using analyzer_list = std::list<Analyzer*>;
typedef uint32_t ID; typedef uint32_t ID;
typedef void (Analyzer::*analyzer_timer_func)(double t); typedef void (Analyzer::*analyzer_timer_func)(double t);
@ -624,8 +621,8 @@ protected:
* Return a string represantation of an analyzer, containing its name * Return a string represantation of an analyzer, containing its name
* and ID. * and ID.
*/ */
static string fmt_analyzer(const Analyzer* a) static std::string fmt_analyzer(const Analyzer* a)
{ return string(a->GetAnalyzerName()) + fmt("[%d]", a->GetID()); } { return std::string(a->GetAnalyzerName()) + fmt("[%d]", a->GetID()); }
/** /**
* Associates a connection with this analyzer. Must be called if * Associates a connection with this analyzer. Must be called if

11
src/analyzer/protocol/mime/MIME.h
View file

@ -5,7 +5,6 @@
#include <stdio.h> #include <stdio.h>
#include <vector> #include <vector>
#include <queue> #include <queue>
using namespace std;
#include "BroString.h" #include "BroString.h"
#include "Reporter.h" #include "Reporter.h"
@ -61,7 +60,7 @@ public:
BroString* get_concatenated_line(); BroString* get_concatenated_line();
protected: protected:
vector<const BroString*> buffer; std::vector<const BroString*> buffer;
BroString* line; BroString* line;
}; };
@ -86,7 +85,7 @@ protected:
}; };
typedef vector<MIME_Header*> MIME_HeaderList; using MIME_HeaderList = std::vector<MIME_Header*>;
class MIME_Entity { class MIME_Entity {
public: public:
@ -255,13 +254,13 @@ protected:
int compute_content_hash; int compute_content_hash;
int content_hash_length; int content_hash_length;
EVP_MD_CTX* md5_hash; EVP_MD_CTX* md5_hash;
vector<const BroString*> entity_content; std::vector<const BroString*> entity_content;
vector<const BroString*> all_content; std::vector<const BroString*> all_content;
BroString* data_buffer; BroString* data_buffer;
uint64_t cur_entity_len; uint64_t cur_entity_len;
string cur_entity_id; std::string cur_entity_id;
}; };

1
src/analyzer/protocol/smtp/SMTP.h
View file

@ -3,7 +3,6 @@
#pragma once #pragma once
#include <list> #include <list>
using namespace std;
#include "analyzer/protocol/tcp/TCP.h" #include "analyzer/protocol/tcp/TCP.h"
#include "analyzer/protocol/tcp/ContentLine.h" #include "analyzer/protocol/tcp/ContentLine.h"

4
src/file_analysis/AnalyzerSet.h
View file

@ -7,8 +7,6 @@
#include "Dict.h" #include "Dict.h"
#include "Tag.h" #include "Tag.h"
using std::queue;
class CompositeHash; class CompositeHash;
class RecordVal; class RecordVal;
@ -204,7 +202,7 @@ private:
HashKey* key; HashKey* key;
}; };
typedef queue<Modification*> ModQueue; using ModQueue = std::queue<Modification*>;
ModQueue mod_queue; /**< A queue of analyzer additions/removals requests. */ ModQueue mod_queue; /**< A queue of analyzer additions/removals requests. */
}; };

16
src/file_analysis/File.h
View file

@ -13,8 +13,6 @@
#include "ZeekArgs.h" #include "ZeekArgs.h"
#include "WeirdState.h" #include "WeirdState.h"
using std::string;
class Connection; class Connection;
class RecordType; class RecordType;
class RecordVal; class RecordVal;
@ -46,13 +44,13 @@ public:
* @return the value of the "source" field from #val record or an empty * @return the value of the "source" field from #val record or an empty
* string if it's not initialized. * string if it's not initialized.
*/ */
string GetSource() const; std::string GetSource() const;
/** /**
* Set the "source" field from #val record to \a source. * Set the "source" field from #val record to \a source.
* @param source the new value of the "source" field. * @param source the new value of the "source" field.
*/ */
void SetSource(const string& source); void SetSource(const std::string& source);
/** /**
* @return value (seconds) of the "timeout_interval" field from #val record. * @return value (seconds) of the "timeout_interval" field from #val record.
@ -76,7 +74,7 @@ public:
/** /**
* @return value of the "id" field from #val record. * @return value of the "id" field from #val record.
*/ */
string GetID() const { return id; } std::string GetID() const { return id; }
/** /**
* @return value of "last_active" field in #val record; * @return value of "last_active" field in #val record;
@ -212,7 +210,7 @@ public:
* @return true if the mime type was set. False if it could not be set because * @return true if the mime type was set. False if it could not be set because
* a mime type was already set or inferred. * a mime type was already set or inferred.
*/ */
bool SetMime(const string& mime_type); bool SetMime(const std::string& mime_type);
/** /**
* Whether to permit a weird to carry on through the full reporter/weird * Whether to permit a weird to carry on through the full reporter/weird
@ -236,7 +234,7 @@ protected:
* of the connection to the responder. False indicates the other * of the connection to the responder. False indicates the other
* direction. * direction.
*/ */
File(const string& file_id, const string& source_name, Connection* conn = 0, File(const std::string& file_id, const std::string& source_name, Connection* conn = 0,
analyzer::Tag tag = analyzer::Tag::Error, bool is_orig = false); analyzer::Tag tag = analyzer::Tag::Error, bool is_orig = false);
/** /**
@ -324,7 +322,7 @@ protected:
* @param type the record type for which the field will be looked up. * @param type the record type for which the field will be looked up.
* @return the field offset in #val record corresponding to \a field_name. * @return the field offset in #val record corresponding to \a field_name.
*/ */
static int Idx(const string& field_name, const RecordType* type); static int Idx(const std::string& field_name, const RecordType* type);
/** /**
* Initializes static member. * Initializes static member.
@ -332,7 +330,7 @@ protected:
static void StaticInit(); static void StaticInit();
protected: protected:
string id; /**< A pretty hash that likely identifies file */ std::string id; /**< A pretty hash that likely identifies file */
RecordVal* val; /**< \c fa_file from script layer. */ RecordVal* val; /**< \c fa_file from script layer. */
FileReassembler* file_reassembler; /**< A reassembler for the file if it's needed. */ FileReassembler* file_reassembler; /**< A reassembler for the file if it's needed. */
uint64_t stream_offset; /**< The offset of the file which has been forwarded. */ uint64_t stream_offset; /**< The offset of the file which has been forwarded. */

9
src/file_analysis/FileTimer.h
View file

@ -2,11 +2,8 @@
#pragma once #pragma once
#include "Timer.h"
#include <string> #include <string>
#include "Timer.h"
using std::string;
namespace file_analysis { namespace file_analysis {
@ -22,7 +19,7 @@ public:
* @param id the file identifier which will be checked for inactivity. * @param id the file identifier which will be checked for inactivity.
* @param interval amount of time after \a t to check for inactivity. * @param interval amount of time after \a t to check for inactivity.
*/ */
FileTimer(double t, const string& id, double interval); FileTimer(double t, const std::string& id, double interval);
/** /**
* Check inactivity of file_analysis::File corresponding to #file_id, * Check inactivity of file_analysis::File corresponding to #file_id,
@ -33,7 +30,7 @@ public:
void Dispatch(double t, bool is_expire) override; void Dispatch(double t, bool is_expire) override;
private: private:
string file_id; std::string file_id;
}; };
} // namespace file_analysis } // namespace file_analysis

53
src/file_analysis/Manager.h
View file

@ -14,9 +14,6 @@
#include "analyzer/Tag.h" #include "analyzer/Tag.h"
using std::map;
using std::set;
class TableVal; class TableVal;
class VectorVal; class VectorVal;
@ -75,7 +72,7 @@ public:
* a single file. * a single file.
* @return a prettified MD5 hash of \a handle, truncated to *bits_per_uid* bits. * @return a prettified MD5 hash of \a handle, truncated to *bits_per_uid* bits.
*/ */
string HashHandle(const string& handle) const; std::string HashHandle(const std::string& handle) const;
/** /**
* Take in a unique file handle string to identify next piece of * Take in a unique file handle string to identify next piece of
@ -83,7 +80,7 @@ public:
* @param handle a unique string (may contain NULs) which identifies * @param handle a unique string (may contain NULs) which identifies
* a single file. * a single file.
*/ */
void SetHandle(const string& handle); void SetHandle(const std::string& handle);
/** /**
* Pass in non-sequential file data. * Pass in non-sequential file data.
@ -150,8 +147,8 @@ public:
* in human-readable form where the file input is coming from (e.g. * in human-readable form where the file input is coming from (e.g.
* a local file path). * a local file path).
*/ */
void DataIn(const u_char* data, uint64_t len, const string& file_id, void DataIn(const u_char* data, uint64_t len, const std::string& file_id,
const string& source); const std::string& source);
/** /**
* Signal the end of file data regardless of which direction it is being * Signal the end of file data regardless of which direction it is being
@ -173,7 +170,7 @@ public:
* Signal the end of file data being transferred using the file identifier. * Signal the end of file data being transferred using the file identifier.
* @param file_id the file identifier/hash. * @param file_id the file identifier/hash.
*/ */
void EndOfFile(const string& file_id); void EndOfFile(const std::string& file_id);
/** /**
* Signal a gap in the file data stream. * Signal a gap in the file data stream.
@ -219,7 +216,7 @@ public:
* @param file_id the file identifier/hash. * @param file_id the file identifier/hash.
* @return false if file identifier did not map to anything, else true. * @return false if file identifier did not map to anything, else true.
*/ */
bool IgnoreFile(const string& file_id); bool IgnoreFile(const std::string& file_id);
/** /**
* Set's an inactivity threshold for the file. * Set's an inactivity threshold for the file.
@ -229,22 +226,22 @@ public:
* to be considered stale, timed out, and then resource reclaimed. * to be considered stale, timed out, and then resource reclaimed.
* @return false if file identifier did not map to anything, else true. * @return false if file identifier did not map to anything, else true.
*/ */
bool SetTimeoutInterval(const string& file_id, double interval) const; bool SetTimeoutInterval(const std::string& file_id, double interval) const;
/** /**
* Enable the reassembler for a file. * Enable the reassembler for a file.
*/ */
bool EnableReassembly(const string& file_id); bool EnableReassembly(const std::string& file_id);
/** /**
* Disable the reassembler for a file. * Disable the reassembler for a file.
*/ */
bool DisableReassembly(const string& file_id); bool DisableReassembly(const std::string& file_id);
/** /**
* Set the reassembly for a file in bytes. * Set the reassembly for a file in bytes.
*/ */
bool SetReassemblyBuffer(const string& file_id, uint64_t max); bool SetReassemblyBuffer(const std::string& file_id, uint64_t max);
/** /**
* Sets a limit on the maximum size allowed for extracting the file * Sets a limit on the maximum size allowed for extracting the file
@ -256,7 +253,7 @@ public:
* @return false if file identifier and analyzer did not map to anything, * @return false if file identifier and analyzer did not map to anything,
* else true. * else true.
*/ */
bool SetExtractionLimit(const string& file_id, RecordVal* args, bool SetExtractionLimit(const std::string& file_id, RecordVal* args,
uint64_t n) const; uint64_t n) const;
/** /**
@ -265,7 +262,7 @@ public:
* @return the File object mapped to \a file_id, or a null pointer if no * @return the File object mapped to \a file_id, or a null pointer if no
* mapping exists. * mapping exists.
*/ */
File* LookupFile(const string& file_id) const; File* LookupFile(const std::string& file_id) const;
/** /**
* Queue attachment of an analzer to the file identifier. Multiple * Queue attachment of an analzer to the file identifier. Multiple
@ -276,7 +273,7 @@ public:
* @param args a \c AnalyzerArgs value which describes a file analyzer. * @param args a \c AnalyzerArgs value which describes a file analyzer.
* @return false if the analyzer failed to be instantiated, else true. * @return false if the analyzer failed to be instantiated, else true.
*/ */
bool AddAnalyzer(const string& file_id, const file_analysis::Tag& tag, bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
RecordVal* args) const; RecordVal* args) const;
/** /**
@ -286,7 +283,7 @@ public:
* @param args a \c AnalyzerArgs value which describes a file analyzer. * @param args a \c AnalyzerArgs value which describes a file analyzer.
* @return true if the analyzer is active at the time of call, else false. * @return true if the analyzer is active at the time of call, else false.
*/ */
bool RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag, bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
RecordVal* args) const; RecordVal* args) const;
/** /**
@ -294,7 +291,7 @@ public:
* @param file_id the file identifier/hash. * @param file_id the file identifier/hash.
* @return whether the file mapped to \a file_id is being ignored. * @return whether the file mapped to \a file_id is being ignored.
*/ */
bool IsIgnored(const string& file_id); bool IsIgnored(const std::string& file_id);
/** /**
* Instantiates a new file analyzer instance for the file. * Instantiates a new file analyzer instance for the file.
@ -358,7 +355,7 @@ protected:
* exist, the activity time is refreshed along with any * exist, the activity time is refreshed along with any
* connection-related fields. * connection-related fields.
*/ */
File* GetFile(const string& file_id, Connection* conn = 0, File* GetFile(const std::string& file_id, Connection* conn = 0,
const analyzer::Tag& tag = analyzer::Tag::Error, const analyzer::Tag& tag = analyzer::Tag::Error,
bool is_orig = false, bool update_conn = true, bool is_orig = false, bool update_conn = true,
const char* source_name = 0); const char* source_name = 0);
@ -370,14 +367,14 @@ protected:
* @param is_termination whether the Manager (and probably Bro) is in a * @param is_termination whether the Manager (and probably Bro) is in a
* terminating state. If true, then the timeout cannot be postponed. * terminating state. If true, then the timeout cannot be postponed.
*/ */
void Timeout(const string& file_id, bool is_terminating = ::terminating); void Timeout(const std::string& file_id, bool is_terminating = ::terminating);
/** /**
* Immediately remove file_analysis::File object associated with \a file_id. * Immediately remove file_analysis::File object associated with \a file_id.
* @param file_id the file identifier/hash. * @param file_id the file identifier/hash.
* @return false if file id string did not map to anything, else true. * @return false if file id string did not map to anything, else true.
*/ */
bool RemoveFile(const string& file_id); bool RemoveFile(const std::string& file_id);
/** /**
* Sets #current_file_id to a hash of a unique file handle string based on * Sets #current_file_id to a hash of a unique file handle string based on
@ -403,20 +400,20 @@ protected:
static bool IsDisabled(const analyzer::Tag& tag); static bool IsDisabled(const analyzer::Tag& tag);
private: private:
typedef set<Tag> TagSet; typedef std::set<Tag> TagSet;
typedef map<string, TagSet*> MIMEMap; typedef std::map<std::string, TagSet*> MIMEMap;
TagSet* LookupMIMEType(const string& mtype, bool add_if_not_found); TagSet* LookupMIMEType(const std::string& mtype, bool add_if_not_found);
std::map<string, File*> id_map; /**< Map file ID to file_analysis::File records. */ std::map<std::string, File*> id_map; /**< Map file ID to file_analysis::File records. */
std::set<string> ignored; /**< Ignored files. Will be finally removed on EOF. */ std::set<std::string> ignored; /**< Ignored files. Will be finally removed on EOF. */
string current_file_id; /**< Hash of what get_file_handle event sets. */ std::string current_file_id; /**< Hash of what get_file_handle event sets. */
RuleFileMagicState* magic_state; /**< File magic signature match state. */ RuleFileMagicState* magic_state; /**< File magic signature match state. */
MIMEMap mime_types;/**< Mapping of MIME types to analyzers. */ MIMEMap mime_types;/**< Mapping of MIME types to analyzers. */
static TableVal* disabled; /**< Table of disabled analyzers. */ static TableVal* disabled; /**< Table of disabled analyzers. */
static TableType* tag_set_type; /**< Type for set[tag]. */ static TableType* tag_set_type; /**< Type for set[tag]. */
static string salt; /**< A salt added to file handles before hashing. */ static std::string salt; /**< A salt added to file handles before hashing. */
size_t cumulative_files; size_t cumulative_files;
size_t max_files; size_t max_files;

6
src/threading/BasicThread.h
View file

@ -1,12 +1,10 @@
#pragma once #pragma once
#include <iosfwd>
#include <thread>
#include <stdint.h> #include <stdint.h>
using namespace std; #include <iosfwd>
#include <thread>
namespace threading { namespace threading {

22
src/threading/Formatter.h
View file

@ -2,12 +2,10 @@
#pragma once #pragma once
#include "Type.h"
#include "SerialTypes.h"
#include <string> #include <string>
using std::string; #include "Type.h"
#include "SerialTypes.h"
namespace threading { namespace threading {
@ -69,7 +67,7 @@ public:
* @return Returns true on success, false on error. Errors are also * @return Returns true on success, false on error. Errors are also
* flagged via the thread. * flagged via the thread.
*/ */
virtual bool Describe(ODesc* desc, threading::Value* val, const string& name = "") const = 0; virtual bool Describe(ODesc* desc, threading::Value* val, const std::string& name = "") const = 0;
/** /**
* Convert an implementation-specific textual representation of a * Convert an implementation-specific textual representation of a
@ -83,7 +81,7 @@ public:
* @return The new value, or null on error. Errors must also be * @return The new value, or null on error. Errors must also be
* flagged via the thread. * flagged via the thread.
*/ */
virtual threading::Value* ParseValue(const string& s, const string& name, TypeTag type, TypeTag subtype = TYPE_ERROR) const = 0; virtual threading::Value* ParseValue(const std::string& s, const std::string& name, TypeTag type, TypeTag subtype = TYPE_ERROR) const = 0;
/** /**
* Convert an IP address into a string. * Convert an IP address into a string.
@ -94,7 +92,7 @@ public:
* *
* @return An ASCII representation of the address. * @return An ASCII representation of the address.
*/ */
static string Render(const threading::Value::addr_t& addr); static std::string Render(const threading::Value::addr_t& addr);
/** /**
* Convert an subnet value into a string. * Convert an subnet value into a string.
@ -105,7 +103,7 @@ public:
* *
* @return An ASCII representation of the subnet. * @return An ASCII representation of the subnet.
*/ */
static string Render(const threading::Value::subnet_t& subnet); static std::string Render(const threading::Value::subnet_t& subnet);
/** /**
* Convert a double into a string. This renders the double with Bro's * Convert a double into a string. This renders the double with Bro's
@ -117,7 +115,7 @@ public:
* *
* @return An ASCII representation of the double. * @return An ASCII representation of the double.
*/ */
static string Render(double d); static std::string Render(double d);
/** /**
* Convert a transport protocol into a string. * Convert a transport protocol into a string.
@ -128,7 +126,7 @@ public:
* *
* @return An ASCII representation of the protocol. * @return An ASCII representation of the protocol.
*/ */
static string Render(TransportProto proto); static std::string Render(TransportProto proto);
/** /**
* Convert a string into a TransportProto. The string must be one of * Convert a string into a TransportProto. The string must be one of
@ -141,7 +139,7 @@ public:
* @return The transport protocol, which will be \c TRANSPORT_UNKNOWN * @return The transport protocol, which will be \c TRANSPORT_UNKNOWN
* on error. Errors are also flagged via the thread. * on error. Errors are also flagged via the thread.
*/ */
TransportProto ParseProto(const string &proto) const; TransportProto ParseProto(const std::string &proto) const;
/** /**
* Convert a string into a Value::addr_t. * Convert a string into a Value::addr_t.
@ -153,7 +151,7 @@ public:
* @return The address, which will be all-zero on error. Errors are * @return The address, which will be all-zero on error. Errors are
* also flagged via the thread. * also flagged via the thread.
*/ */
threading::Value::addr_t ParseAddr(const string &addr) const; threading::Value::addr_t ParseAddr(const std::string &addr) const;
protected: protected:
/** /**