mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Move iosource code to zeek namespaces
This commit is contained in:
parent
45b5c6e619
commit
be92bd536f
35 changed files with 180 additions and 136 deletions
|
@ -439,7 +439,7 @@ void DNS_Mgr::InitSource()
|
||||||
|
|
||||||
if ( nb_dns )
|
if ( nb_dns )
|
||||||
{
|
{
|
||||||
if ( ! iosource_mgr->RegisterFd(nb_dns_fd(nb_dns), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(nb_dns_fd(nb_dns), this) )
|
||||||
zeek::reporter->FatalError("Failed to register nb_dns file descriptor with iosource_mgr");
|
zeek::reporter->FatalError("Failed to register nb_dns file descriptor with iosource_mgr");
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
@ -455,7 +455,7 @@ void DNS_Mgr::InitPostScript()
|
||||||
dm_rec = zeek::id::find_type<zeek::RecordType>("dns_mapping");
|
dm_rec = zeek::id::find_type<zeek::RecordType>("dns_mapping");
|
||||||
|
|
||||||
// Registering will call Init()
|
// Registering will call Init()
|
||||||
iosource_mgr->Register(this, true);
|
zeek::iosource_mgr->Register(this, true);
|
||||||
|
|
||||||
const char* cache_dir = dir ? dir : ".";
|
const char* cache_dir = dir ? dir : ".";
|
||||||
cache_name = new char[strlen(cache_dir) + 64];
|
cache_name = new char[strlen(cache_dir) + 64];
|
||||||
|
@ -1462,7 +1462,7 @@ void DNS_Mgr::GetStats(Stats* stats)
|
||||||
void DNS_Mgr::Terminate()
|
void DNS_Mgr::Terminate()
|
||||||
{
|
{
|
||||||
if ( nb_dns )
|
if ( nb_dns )
|
||||||
iosource_mgr->UnregisterFd(nb_dns_fd(nb_dns), this);
|
zeek::iosource_mgr->UnregisterFd(nb_dns_fd(nb_dns), this);
|
||||||
}
|
}
|
||||||
|
|
||||||
} // namespace zeek::detail
|
} // namespace zeek::detail
|
||||||
|
|
|
@ -47,7 +47,7 @@ enum DNS_MgrMode {
|
||||||
// Number of seconds we'll wait for a reply.
|
// Number of seconds we'll wait for a reply.
|
||||||
#define DNS_TIMEOUT 5
|
#define DNS_TIMEOUT 5
|
||||||
|
|
||||||
class DNS_Mgr final : public iosource::IOSource {
|
class DNS_Mgr final : public zeek::iosource::IOSource {
|
||||||
public:
|
public:
|
||||||
explicit DNS_Mgr(DNS_MgrMode mode);
|
explicit DNS_Mgr(DNS_MgrMode mode);
|
||||||
~DNS_Mgr() override;
|
~DNS_Mgr() override;
|
||||||
|
|
10
src/Event.cc
10
src/Event.cc
|
@ -223,7 +223,7 @@ void EventMgr::Process()
|
||||||
// If we don't have a source, or the source is closed, or we're
|
// If we don't have a source, or the source is closed, or we're
|
||||||
// reading live (which includes pseudo-realtime), advance the time
|
// reading live (which includes pseudo-realtime), advance the time
|
||||||
// here to the current time since otherwise it won't move forward.
|
// here to the current time since otherwise it won't move forward.
|
||||||
iosource::PktSrc* pkt_src = iosource_mgr->GetPktSrc();
|
zeek::iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc();
|
||||||
if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live )
|
if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live )
|
||||||
net_update_time(current_time());
|
net_update_time(current_time());
|
||||||
|
|
||||||
|
@ -233,16 +233,16 @@ void EventMgr::Process()
|
||||||
// to call Drain() as part of this method. It will get called at
|
// to call Drain() as part of this method. It will get called at
|
||||||
// the end of net_run after all of the sources have been processed
|
// the end of net_run after all of the sources have been processed
|
||||||
// and had the opportunity to spawn new events. We could use
|
// and had the opportunity to spawn new events. We could use
|
||||||
// iosource_mgr->Wakeup() instead of making EventMgr an IOSource,
|
// zeek::iosource_mgr->Wakeup() instead of making EventMgr an IOSource,
|
||||||
// but then we couldn't update the time above and nothing would
|
// but then we couldn't update the time above and nothing would
|
||||||
// drive it forward.
|
// drive it forward.
|
||||||
}
|
}
|
||||||
|
|
||||||
void EventMgr::InitPostScript()
|
void EventMgr::InitPostScript()
|
||||||
{
|
{
|
||||||
iosource_mgr->Register(this, true, false);
|
zeek::iosource_mgr->Register(this, true, false);
|
||||||
if ( ! iosource_mgr->RegisterFd(queue_flare.FD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(queue_flare.FD(), this) )
|
||||||
zeek::reporter->FatalError("Failed to register event manager FD with iosource_mgr");
|
zeek::reporter->FatalError("Failed to register event manager FD with zeek::iosource_mgr");
|
||||||
}
|
}
|
||||||
|
|
||||||
} // namespace zeek
|
} // namespace zeek
|
||||||
|
|
34
src/Net.cc
34
src/Net.cc
|
@ -42,7 +42,7 @@ extern "C" {
|
||||||
extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
|
extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
|
||||||
}
|
}
|
||||||
|
|
||||||
iosource::PktDumper* pkt_dumper = nullptr;
|
zeek::iosource::PktDumper* pkt_dumper = nullptr;
|
||||||
|
|
||||||
bool reading_live = false;
|
bool reading_live = false;
|
||||||
bool reading_traces = false;
|
bool reading_traces = false;
|
||||||
|
@ -60,8 +60,8 @@ bool is_parsing = false;
|
||||||
const zeek::Packet *current_pkt = nullptr;
|
const zeek::Packet *current_pkt = nullptr;
|
||||||
int current_dispatched = 0;
|
int current_dispatched = 0;
|
||||||
double current_timestamp = 0.0;
|
double current_timestamp = 0.0;
|
||||||
iosource::PktSrc* current_pktsrc = nullptr;
|
zeek::iosource::PktSrc* current_pktsrc = nullptr;
|
||||||
iosource::IOSource* current_iosrc = nullptr;
|
zeek::iosource::IOSource* current_iosrc = nullptr;
|
||||||
|
|
||||||
std::list<ScannedFile> files_scanned;
|
std::list<ScannedFile> files_scanned;
|
||||||
std::vector<std::string> sig_files;
|
std::vector<std::string> sig_files;
|
||||||
|
@ -110,7 +110,7 @@ RETSIGTYPE watchdog(int /* signo */)
|
||||||
// saving the packet which caused the
|
// saving the packet which caused the
|
||||||
// watchdog to trigger may be helpful,
|
// watchdog to trigger may be helpful,
|
||||||
// so we'll save that one nevertheless.
|
// so we'll save that one nevertheless.
|
||||||
pkt_dumper = iosource_mgr->OpenPktDumper("watchdog-pkt.pcap", false);
|
pkt_dumper = zeek::iosource_mgr->OpenPktDumper("watchdog-pkt.pcap", false);
|
||||||
if ( ! pkt_dumper || pkt_dumper->IsError() )
|
if ( ! pkt_dumper || pkt_dumper->IsError() )
|
||||||
{
|
{
|
||||||
zeek::reporter->Error("watchdog: can't open watchdog-pkt.pcap for writing");
|
zeek::reporter->Error("watchdog: can't open watchdog-pkt.pcap for writing");
|
||||||
|
@ -155,7 +155,7 @@ void net_init(const std::optional<std::string>& interface,
|
||||||
reading_live = pseudo_realtime > 0.0;
|
reading_live = pseudo_realtime > 0.0;
|
||||||
reading_traces = true;
|
reading_traces = true;
|
||||||
|
|
||||||
iosource::PktSrc* ps = iosource_mgr->OpenPktSrc(*pcap_input_file, false);
|
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->OpenPktSrc(*pcap_input_file, false);
|
||||||
assert(ps);
|
assert(ps);
|
||||||
|
|
||||||
if ( ! ps->IsOpen() )
|
if ( ! ps->IsOpen() )
|
||||||
|
@ -167,7 +167,7 @@ void net_init(const std::optional<std::string>& interface,
|
||||||
reading_live = true;
|
reading_live = true;
|
||||||
reading_traces = false;
|
reading_traces = false;
|
||||||
|
|
||||||
iosource::PktSrc* ps = iosource_mgr->OpenPktSrc(*interface, true);
|
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->OpenPktSrc(*interface, true);
|
||||||
assert(ps);
|
assert(ps);
|
||||||
|
|
||||||
if ( ! ps->IsOpen() )
|
if ( ! ps->IsOpen() )
|
||||||
|
@ -185,7 +185,7 @@ void net_init(const std::optional<std::string>& interface,
|
||||||
if ( pcap_output_file )
|
if ( pcap_output_file )
|
||||||
{
|
{
|
||||||
const char* writefile = pcap_output_file->data();
|
const char* writefile = pcap_output_file->data();
|
||||||
pkt_dumper = iosource_mgr->OpenPktDumper(writefile, false);
|
pkt_dumper = zeek::iosource_mgr->OpenPktDumper(writefile, false);
|
||||||
assert(pkt_dumper);
|
assert(pkt_dumper);
|
||||||
|
|
||||||
if ( ! pkt_dumper->IsOpen() )
|
if ( ! pkt_dumper->IsOpen() )
|
||||||
|
@ -210,7 +210,7 @@ void net_init(const std::optional<std::string>& interface,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void expire_timers(iosource::PktSrc* src_ps)
|
void expire_timers(zeek::iosource::PktSrc* src_ps)
|
||||||
{
|
{
|
||||||
zeek::detail::SegmentProfiler prof(zeek::detail::segment_logger, "expiring-timers");
|
zeek::detail::SegmentProfiler prof(zeek::detail::segment_logger, "expiring-timers");
|
||||||
|
|
||||||
|
@ -219,7 +219,7 @@ void expire_timers(iosource::PktSrc* src_ps)
|
||||||
max_timer_expires - current_dispatched);
|
max_timer_expires - current_dispatched);
|
||||||
}
|
}
|
||||||
|
|
||||||
void net_packet_dispatch(double t, const zeek::Packet* pkt, iosource::PktSrc* src_ps)
|
void net_packet_dispatch(double t, const zeek::Packet* pkt, zeek::iosource::PktSrc* src_ps)
|
||||||
{
|
{
|
||||||
if ( ! bro_start_network_time )
|
if ( ! bro_start_network_time )
|
||||||
{
|
{
|
||||||
|
@ -278,13 +278,13 @@ void net_run()
|
||||||
{
|
{
|
||||||
set_processing_status("RUNNING", "net_run");
|
set_processing_status("RUNNING", "net_run");
|
||||||
|
|
||||||
std::vector<iosource::IOSource*> ready;
|
std::vector<zeek::iosource::IOSource*> ready;
|
||||||
ready.reserve(iosource_mgr->TotalSize());
|
ready.reserve(zeek::iosource_mgr->TotalSize());
|
||||||
|
|
||||||
while ( iosource_mgr->Size() ||
|
while ( zeek::iosource_mgr->Size() ||
|
||||||
(zeek::BifConst::exit_only_after_terminate && ! terminating) )
|
(zeek::BifConst::exit_only_after_terminate && ! terminating) )
|
||||||
{
|
{
|
||||||
iosource_mgr->FindReadySources(&ready);
|
zeek::iosource_mgr->FindReadySources(&ready);
|
||||||
|
|
||||||
#ifdef DEBUG
|
#ifdef DEBUG
|
||||||
static int loop_counter = 0;
|
static int loop_counter = 0;
|
||||||
|
@ -347,7 +347,7 @@ void net_run()
|
||||||
{
|
{
|
||||||
auto have_active_packet_source = false;
|
auto have_active_packet_source = false;
|
||||||
|
|
||||||
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
|
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
|
||||||
if ( ps && ps->IsOpen() )
|
if ( ps && ps->IsOpen() )
|
||||||
have_active_packet_source = true;
|
have_active_packet_source = true;
|
||||||
|
|
||||||
|
@ -366,10 +366,10 @@ void net_run()
|
||||||
|
|
||||||
void net_get_final_stats()
|
void net_get_final_stats()
|
||||||
{
|
{
|
||||||
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
|
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
|
||||||
if ( ps && ps->IsLive() )
|
if ( ps && ps->IsLive() )
|
||||||
{
|
{
|
||||||
iosource::PktSrc::Stats s;
|
zeek::iosource::PktSrc::Stats s;
|
||||||
ps->Statistics(&s);
|
ps->Statistics(&s);
|
||||||
double dropped_pct = s.dropped > 0.0 ? ((double)s.dropped / ((double)s.received + (double)s.dropped)) * 100.0 : 0.0;
|
double dropped_pct = s.dropped > 0.0 ? ((double)s.dropped / ((double)s.received + (double)s.dropped)) * 100.0 : 0.0;
|
||||||
zeek::reporter->Info("%" PRIu64 " packets received on interface %s, %" PRIu64 " (%.2f%%) dropped",
|
zeek::reporter->Info("%" PRIu64 " packets received on interface %s, %" PRIu64 " (%.2f%%) dropped",
|
||||||
|
@ -427,7 +427,7 @@ void net_continue_processing()
|
||||||
if ( _processing_suspended == 1 )
|
if ( _processing_suspended == 1 )
|
||||||
{
|
{
|
||||||
zeek::reporter->Info("processing continued");
|
zeek::reporter->Info("processing continued");
|
||||||
if ( iosource::PktSrc* ps = iosource_mgr->GetPktSrc() )
|
if ( zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc() )
|
||||||
ps->ContinueAfterSuspend();
|
ps->ContinueAfterSuspend();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
19
src/Net.h
19
src/Net.h
|
@ -11,12 +11,9 @@
|
||||||
#include <string>
|
#include <string>
|
||||||
#include <optional>
|
#include <optional>
|
||||||
|
|
||||||
namespace iosource {
|
ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
|
||||||
class IOSource;
|
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
|
||||||
class PktSrc;
|
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
|
||||||
class PktDumper;
|
|
||||||
}
|
|
||||||
|
|
||||||
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
|
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
|
||||||
|
|
||||||
extern void net_init(const std::optional<std::string>& interfaces,
|
extern void net_init(const std::optional<std::string>& interfaces,
|
||||||
|
@ -29,8 +26,8 @@ extern void net_finish(int drain_events);
|
||||||
extern void net_delete(); // Reclaim all memory, etc.
|
extern void net_delete(); // Reclaim all memory, etc.
|
||||||
extern void net_update_time(double new_network_time);
|
extern void net_update_time(double new_network_time);
|
||||||
extern void net_packet_dispatch(double t, const zeek::Packet* pkt,
|
extern void net_packet_dispatch(double t, const zeek::Packet* pkt,
|
||||||
iosource::PktSrc* src_ps);
|
zeek::iosource::PktSrc* src_ps);
|
||||||
extern void expire_timers(iosource::PktSrc* src_ps = nullptr);
|
extern void expire_timers(zeek::iosource::PktSrc* src_ps = nullptr);
|
||||||
extern void zeek_terminate_loop(const char* reason);
|
extern void zeek_terminate_loop(const char* reason);
|
||||||
|
|
||||||
// Functions to temporarily suspend processing of live input (network packets
|
// Functions to temporarily suspend processing of live input (network packets
|
||||||
|
@ -82,10 +79,10 @@ extern bool is_parsing;
|
||||||
extern const zeek::Packet* current_pkt;
|
extern const zeek::Packet* current_pkt;
|
||||||
extern int current_dispatched;
|
extern int current_dispatched;
|
||||||
extern double current_timestamp;
|
extern double current_timestamp;
|
||||||
extern iosource::PktSrc* current_pktsrc;
|
extern zeek::iosource::PktSrc* current_pktsrc;
|
||||||
extern iosource::IOSource* current_iosrc;
|
extern zeek::iosource::IOSource* current_iosrc;
|
||||||
|
|
||||||
extern iosource::PktDumper* pkt_dumper; // where to save packets
|
extern zeek::iosource::PktDumper* pkt_dumper; // where to save packets
|
||||||
|
|
||||||
// Script file we have already scanned (or are in the process of scanning).
|
// Script file we have already scanned (or are in the process of scanning).
|
||||||
// They are identified by normalized realpath.
|
// They are identified by normalized realpath.
|
||||||
|
|
10
src/Timer.cc
10
src/Timer.cc
|
@ -69,8 +69,8 @@ TimerMgr::TimerMgr()
|
||||||
num_expired = 0;
|
num_expired = 0;
|
||||||
last_advance = last_timestamp = 0;
|
last_advance = last_timestamp = 0;
|
||||||
|
|
||||||
if ( iosource_mgr )
|
if ( zeek::iosource_mgr )
|
||||||
iosource_mgr->Register(this, true);
|
zeek::iosource_mgr->Register(this, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
TimerMgr::~TimerMgr()
|
TimerMgr::~TimerMgr()
|
||||||
|
@ -95,7 +95,7 @@ void TimerMgr::Process()
|
||||||
// If we don't have a source, or the source is closed, or we're reading live (which includes
|
// If we don't have a source, or the source is closed, or we're reading live (which includes
|
||||||
// pseudo-realtime), advance the timer here to the current time since otherwise it won't
|
// pseudo-realtime), advance the timer here to the current time since otherwise it won't
|
||||||
// move forward and the timers won't fire correctly.
|
// move forward and the timers won't fire correctly.
|
||||||
iosource::PktSrc* pkt_src = iosource_mgr->GetPktSrc();
|
iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc();
|
||||||
if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live || net_is_processing_suspended() )
|
if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live || net_is_processing_suspended() )
|
||||||
net_update_time(current_time());
|
net_update_time(current_time());
|
||||||
|
|
||||||
|
@ -106,8 +106,8 @@ void TimerMgr::Process()
|
||||||
|
|
||||||
void TimerMgr::InitPostScript()
|
void TimerMgr::InitPostScript()
|
||||||
{
|
{
|
||||||
if ( iosource_mgr )
|
if ( zeek::iosource_mgr )
|
||||||
iosource_mgr->Register(this, true);
|
zeek::iosource_mgr->Register(this, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
PQ_TimerMgr::PQ_TimerMgr() : TimerMgr()
|
PQ_TimerMgr::PQ_TimerMgr() : TimerMgr()
|
||||||
|
|
|
@ -492,10 +492,10 @@ const char* Trigger::Name() const
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Manager::Manager() : IOSource()
|
Manager::Manager() : zeek::iosource::IOSource()
|
||||||
{
|
{
|
||||||
pending = new TriggerList();
|
pending = new TriggerList();
|
||||||
iosource_mgr->Register(this, true);
|
zeek::iosource_mgr->Register(this, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
Manager::~Manager()
|
Manager::~Manager()
|
||||||
|
@ -540,7 +540,7 @@ void Manager::Queue(Trigger* trigger)
|
||||||
Ref(trigger);
|
Ref(trigger);
|
||||||
pending->push_back(trigger);
|
pending->push_back(trigger);
|
||||||
total_triggers++;
|
total_triggers++;
|
||||||
iosource_mgr->Wakeup(Tag());
|
zeek::iosource_mgr->Wakeup(Tag());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -117,7 +117,7 @@ private:
|
||||||
|
|
||||||
using TriggerPtr = zeek::IntrusivePtr<Trigger>;
|
using TriggerPtr = zeek::IntrusivePtr<Trigger>;
|
||||||
|
|
||||||
class Manager final : public iosource::IOSource {
|
class Manager final : public zeek::iosource::IOSource {
|
||||||
public:
|
public:
|
||||||
|
|
||||||
Manager();
|
Manager();
|
||||||
|
@ -143,7 +143,7 @@ private:
|
||||||
unsigned long total_triggers = 0;
|
unsigned long total_triggers = 0;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::detail::trigger
|
||||||
|
|
||||||
namespace trigger {
|
namespace trigger {
|
||||||
using Trigger [[deprecated("Remove in v4.1. Use zeek::detail::trigger::Trigger instead")]] = zeek::detail::trigger::Trigger;
|
using Trigger [[deprecated("Remove in v4.1. Use zeek::detail::trigger::Trigger instead")]] = zeek::detail::trigger::Trigger;
|
||||||
|
|
|
@ -163,7 +163,7 @@ void Manager::InitPostScript()
|
||||||
vector_of_data_type = zeek::make_intrusive<zeek::VectorType>(zeek::id::find_type("Broker::Data"));
|
vector_of_data_type = zeek::make_intrusive<zeek::VectorType>(zeek::id::find_type("Broker::Data"));
|
||||||
|
|
||||||
// Register as a "dont-count" source first, we may change that later.
|
// Register as a "dont-count" source first, we may change that later.
|
||||||
iosource_mgr->Register(this, true);
|
zeek::iosource_mgr->Register(this, true);
|
||||||
|
|
||||||
broker::broker_options options;
|
broker::broker_options options;
|
||||||
options.disable_ssl = get_option("Broker::disable_ssl")->AsBool();
|
options.disable_ssl = get_option("Broker::disable_ssl")->AsBool();
|
||||||
|
@ -210,9 +210,9 @@ void Manager::InitPostScript()
|
||||||
auto cqs = get_option("Broker::congestion_queue_size")->AsCount();
|
auto cqs = get_option("Broker::congestion_queue_size")->AsCount();
|
||||||
bstate = std::make_shared<BrokerState>(std::move(config), cqs);
|
bstate = std::make_shared<BrokerState>(std::move(config), cqs);
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(bstate->subscriber.fd(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(bstate->subscriber.fd(), this) )
|
||||||
zeek::reporter->FatalError("Failed to register broker subscriber with iosource_mgr");
|
zeek::reporter->FatalError("Failed to register broker subscriber with iosource_mgr");
|
||||||
if ( ! iosource_mgr->RegisterFd(bstate->status_subscriber.fd(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(bstate->status_subscriber.fd(), this) )
|
||||||
zeek::reporter->FatalError("Failed to register broker status subscriber with iosource_mgr");
|
zeek::reporter->FatalError("Failed to register broker status subscriber with iosource_mgr");
|
||||||
|
|
||||||
bstate->subscriber.add_topic(broker::topics::store_events, true);
|
bstate->subscriber.add_topic(broker::topics::store_events, true);
|
||||||
|
@ -268,8 +268,8 @@ void Manager::Terminate()
|
||||||
{
|
{
|
||||||
FlushLogBuffers();
|
FlushLogBuffers();
|
||||||
|
|
||||||
iosource_mgr->UnregisterFd(bstate->subscriber.fd(), this);
|
zeek::iosource_mgr->UnregisterFd(bstate->subscriber.fd(), this);
|
||||||
iosource_mgr->UnregisterFd(bstate->status_subscriber.fd(), this);
|
zeek::iosource_mgr->UnregisterFd(bstate->status_subscriber.fd(), this);
|
||||||
|
|
||||||
vector<string> stores_to_close;
|
vector<string> stores_to_close;
|
||||||
|
|
||||||
|
@ -353,7 +353,7 @@ uint16_t Manager::Listen(const string& addr, uint16_t port)
|
||||||
addr.empty() ? "INADDR_ANY" : addr.c_str(), port);
|
addr.empty() ? "INADDR_ANY" : addr.c_str(), port);
|
||||||
|
|
||||||
// Register as a "does-count" source now.
|
// Register as a "does-count" source now.
|
||||||
iosource_mgr->Register(this, false);
|
zeek::iosource_mgr->Register(this, false);
|
||||||
|
|
||||||
DBG_LOG(zeek::DBG_BROKER, "Listening on %s:%" PRIu16,
|
DBG_LOG(zeek::DBG_BROKER, "Listening on %s:%" PRIu16,
|
||||||
addr.empty() ? "INADDR_ANY" : addr.c_str(), port);
|
addr.empty() ? "INADDR_ANY" : addr.c_str(), port);
|
||||||
|
@ -385,7 +385,7 @@ void Manager::Peer(const string& addr, uint16_t port, double retry)
|
||||||
|
|
||||||
if ( counts_as_iosource )
|
if ( counts_as_iosource )
|
||||||
// Register as a "does-count" source now.
|
// Register as a "does-count" source now.
|
||||||
iosource_mgr->Register(this, false);
|
zeek::iosource_mgr->Register(this, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
void Manager::Unpeer(const string& addr, uint16_t port)
|
void Manager::Unpeer(const string& addr, uint16_t port)
|
||||||
|
@ -1598,7 +1598,7 @@ StoreHandleVal* Manager::MakeMaster(const string& name, broker::backend type,
|
||||||
Ref(handle);
|
Ref(handle);
|
||||||
|
|
||||||
data_stores.emplace(name, handle);
|
data_stores.emplace(name, handle);
|
||||||
iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
|
zeek::iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
|
||||||
PrepareForwarding(name);
|
PrepareForwarding(name);
|
||||||
|
|
||||||
if ( ! bstate->endpoint.use_real_time() )
|
if ( ! bstate->endpoint.use_real_time() )
|
||||||
|
@ -1695,7 +1695,7 @@ StoreHandleVal* Manager::MakeClone(const string& name, double resync_interval,
|
||||||
Ref(handle);
|
Ref(handle);
|
||||||
|
|
||||||
data_stores.emplace(name, handle);
|
data_stores.emplace(name, handle);
|
||||||
iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
|
zeek::iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
|
||||||
PrepareForwarding(name);
|
PrepareForwarding(name);
|
||||||
return handle;
|
return handle;
|
||||||
}
|
}
|
||||||
|
@ -1714,7 +1714,7 @@ bool Manager::CloseStore(const string& name)
|
||||||
if ( s == data_stores.end() )
|
if ( s == data_stores.end() )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
iosource_mgr->UnregisterFd(s->second->proxy.mailbox().descriptor(), this);
|
zeek::iosource_mgr->UnregisterFd(s->second->proxy.mailbox().descriptor(), this);
|
||||||
|
|
||||||
for ( auto i = pending_queries.begin(); i != pending_queries.end(); )
|
for ( auto i = pending_queries.begin(); i != pending_queries.end(); )
|
||||||
if ( i->second->Store().name() == name )
|
if ( i->second->Store().name() == name )
|
||||||
|
|
|
@ -66,7 +66,7 @@ struct Stats {
|
||||||
* Manages various forms of communication between peer Bro processes
|
* Manages various forms of communication between peer Bro processes
|
||||||
* or other external applications via use of the Broker messaging library.
|
* or other external applications via use of the Broker messaging library.
|
||||||
*/
|
*/
|
||||||
class Manager : public iosource::IOSource {
|
class Manager : public zeek::iosource::IOSource {
|
||||||
public:
|
public:
|
||||||
static const broker::endpoint_info NoPeer;
|
static const broker::endpoint_info NoPeer;
|
||||||
|
|
||||||
|
|
|
@ -59,7 +59,7 @@ int pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
namespace zeek::detail {
|
namespace zeek::iosource::detail {
|
||||||
|
|
||||||
// Simple heuristic to identify filters that always match, so that we can
|
// Simple heuristic to identify filters that always match, so that we can
|
||||||
// skip the filtering in that case. "ip or not ip" is Bro's default filter.
|
// skip the filtering in that case. "ip or not ip" is Bro's default filter.
|
||||||
|
@ -161,4 +161,4 @@ void BPF_Program::FreeCode()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
} // namespace zeek::detail
|
} // namespace zeek::iosource::detail
|
||||||
|
|
|
@ -8,7 +8,7 @@ extern "C" {
|
||||||
|
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
|
|
||||||
namespace zeek::detail {
|
namespace zeek::iosource::detail {
|
||||||
|
|
||||||
// BPF_Programs are an abstraction around struct bpf_program,
|
// BPF_Programs are an abstraction around struct bpf_program,
|
||||||
// to create a clean facility for creating, compiling, and
|
// to create a clean facility for creating, compiling, and
|
||||||
|
@ -56,6 +56,6 @@ protected:
|
||||||
struct bpf_program m_program;
|
struct bpf_program m_program;
|
||||||
};
|
};
|
||||||
|
|
||||||
} // namespace zeek::detail
|
} // namespace zeek::iosource::detail
|
||||||
|
|
||||||
using BPF_Program [[deprecated("Remove in v4.1. Use zeek::detail::BPF_Program.")]] = zeek::detail::BPF_Program;
|
using BPF_Program [[deprecated("Remove in v4.1. Use zeek::iosource::detail::BPF_Program.")]] = zeek::iosource::detail::BPF_Program;
|
||||||
|
|
|
@ -5,7 +5,7 @@
|
||||||
#include "Desc.h"
|
#include "Desc.h"
|
||||||
#include "Reporter.h"
|
#include "Reporter.h"
|
||||||
|
|
||||||
using namespace iosource;
|
namespace zeek::iosource {
|
||||||
|
|
||||||
Component::Component(const std::string& name)
|
Component::Component(const std::string& name)
|
||||||
: zeek::plugin::Component(zeek::plugin::component::IOSOURCE, name)
|
: zeek::plugin::Component(zeek::plugin::component::IOSOURCE, name)
|
||||||
|
@ -163,3 +163,5 @@ void PktDumperComponent::DoDescribe(zeek::ODesc* d) const
|
||||||
d->Add(": ");
|
d->Add(": ");
|
||||||
d->Add(prefs);
|
d->Add(prefs);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::iosource
|
||||||
|
|
|
@ -2,16 +2,16 @@
|
||||||
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include "plugin/Component.h"
|
|
||||||
|
|
||||||
#include <string>
|
#include <string>
|
||||||
#include <vector>
|
#include <vector>
|
||||||
|
|
||||||
namespace iosource {
|
#include "plugin/Component.h"
|
||||||
|
|
||||||
class IOSource;
|
ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
|
||||||
class PktSrc;
|
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
|
||||||
class PktDumper;
|
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
|
||||||
|
|
||||||
|
namespace zeek::iosource {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Component description for plugins providing IOSources.
|
* Component description for plugins providing IOSources.
|
||||||
|
@ -49,7 +49,7 @@ protected:
|
||||||
/**
|
/**
|
||||||
* Component description for plugins providing a PktSrc for packet input.
|
* Component description for plugins providing a PktSrc for packet input.
|
||||||
*/
|
*/
|
||||||
class PktSrcComponent : public iosource::Component {
|
class PktSrcComponent : public zeek::iosource::Component {
|
||||||
public:
|
public:
|
||||||
/**
|
/**
|
||||||
* Type of input a packet source supports.
|
* Type of input a packet source supports.
|
||||||
|
@ -167,4 +167,12 @@ private:
|
||||||
factory_callback factory;
|
factory_callback factory;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::iosource
|
||||||
|
|
||||||
|
namespace iosource {
|
||||||
|
|
||||||
|
using Component [[deprecated("Remove in v4.1. Use zeek::iosource::Component.")]] = zeek::iosource::Component;
|
||||||
|
using PktSrcComponent [[deprecated("Remove in v4.1. Use zeek::iosource::PktSrcComponent.")]] = zeek::iosource::PktSrcComponent;
|
||||||
|
using PktDumperComponent [[deprecated("Remove in v4.1. Use zeek::iosource::PktDumperComponent.")]] = zeek::iosource::PktDumperComponent;
|
||||||
|
|
||||||
|
} // namespace iosource
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
namespace iosource {
|
namespace zeek::iosource {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Interface class for components providing/consuming data inside Bro's main
|
* Interface class for components providing/consuming data inside Bro's main
|
||||||
|
@ -86,4 +86,8 @@ private:
|
||||||
bool closed;
|
bool closed;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::iosource
|
||||||
|
|
||||||
|
namespace iosource {
|
||||||
|
using IOSource [[deprecated("Remove in v4.1. Use zeek::iosource::IOSource.")]] = zeek::iosource::IOSource;
|
||||||
}
|
}
|
||||||
|
|
|
@ -20,7 +20,7 @@
|
||||||
|
|
||||||
#define DEFAULT_PREFIX "pcap"
|
#define DEFAULT_PREFIX "pcap"
|
||||||
|
|
||||||
using namespace iosource;
|
namespace zeek::iosource {
|
||||||
|
|
||||||
Manager::WakeupHandler::WakeupHandler()
|
Manager::WakeupHandler::WakeupHandler()
|
||||||
{
|
{
|
||||||
|
@ -417,3 +417,5 @@ PktDumper* Manager::OpenPktDumper(const std::string& path, bool append)
|
||||||
|
|
||||||
return pd;
|
return pd;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::iosource
|
||||||
|
|
|
@ -14,10 +14,11 @@
|
||||||
struct timespec;
|
struct timespec;
|
||||||
struct kevent;
|
struct kevent;
|
||||||
|
|
||||||
namespace iosource {
|
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
|
||||||
|
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
|
||||||
|
|
||||||
class PktSrc;
|
namespace zeek {
|
||||||
class PktDumper;
|
namespace iosource {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Manager class for IO sources. This handles all of the polling of sources
|
* Manager class for IO sources. This handles all of the polling of sources
|
||||||
|
@ -209,6 +210,14 @@ private:
|
||||||
std::vector<struct kevent> events;
|
std::vector<struct kevent> events;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace iosource
|
||||||
|
|
||||||
extern iosource::Manager* iosource_mgr;
|
extern iosource::Manager* iosource_mgr;
|
||||||
|
|
||||||
|
} // namespace zeek
|
||||||
|
|
||||||
|
extern zeek::iosource::Manager*& iosource_mgr [[deprecated("Remove in v4.1. Use zeek::iosource_mgr.")]];
|
||||||
|
|
||||||
|
namespace iosource {
|
||||||
|
using Manager [[deprecated("Remove in v4.1. Use zeek::iosource::Manager.")]] = zeek::iosource::Manager;
|
||||||
|
}
|
||||||
|
|
|
@ -6,7 +6,7 @@
|
||||||
#include "PktDumper.h"
|
#include "PktDumper.h"
|
||||||
#include "DebugLogger.h"
|
#include "DebugLogger.h"
|
||||||
|
|
||||||
using namespace iosource;
|
namespace zeek::iosource {
|
||||||
|
|
||||||
PktDumper::PktDumper()
|
PktDumper::PktDumper()
|
||||||
{
|
{
|
||||||
|
@ -80,3 +80,5 @@ void PktDumper::Error(const std::string& msg)
|
||||||
IsOpen() ? props.path.c_str() : "<not open>",
|
IsOpen() ? props.path.c_str() : "<not open>",
|
||||||
msg.c_str());
|
msg.c_str());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::iosource
|
||||||
|
|
|
@ -7,7 +7,7 @@
|
||||||
|
|
||||||
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
|
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
|
||||||
|
|
||||||
namespace iosource {
|
namespace zeek::iosource {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Base class for packet dumpers.
|
* Base class for packet dumpers.
|
||||||
|
@ -139,4 +139,8 @@ private:
|
||||||
std::string errmsg;
|
std::string errmsg;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::iosource
|
||||||
|
|
||||||
|
namespace iosource {
|
||||||
|
using PktDumper [[deprecated("Remove in v4.1. Use zeek::iosource::PktDumper.")]] = zeek::iosource::PktDumper;
|
||||||
}
|
}
|
||||||
|
|
|
@ -15,7 +15,7 @@
|
||||||
|
|
||||||
#include "pcap/pcap.bif.h"
|
#include "pcap/pcap.bif.h"
|
||||||
|
|
||||||
using namespace iosource;
|
namespace zeek::iosource {
|
||||||
|
|
||||||
PktSrc::Properties::Properties()
|
PktSrc::Properties::Properties()
|
||||||
{
|
{
|
||||||
|
@ -269,7 +269,7 @@ bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
|
||||||
char errbuf[PCAP_ERRBUF_SIZE];
|
char errbuf[PCAP_ERRBUF_SIZE];
|
||||||
|
|
||||||
// Compile filter.
|
// Compile filter.
|
||||||
auto* code = new zeek::detail::BPF_Program();
|
auto* code = new zeek::iosource::detail::BPF_Program();
|
||||||
|
|
||||||
if ( ! code->Compile(zeek::BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf, sizeof(errbuf)) )
|
if ( ! code->Compile(zeek::BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf, sizeof(errbuf)) )
|
||||||
{
|
{
|
||||||
|
@ -296,7 +296,7 @@ bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
zeek::detail::BPF_Program* PktSrc::GetBPFFilter(int index)
|
zeek::iosource::detail::BPF_Program* PktSrc::GetBPFFilter(int index)
|
||||||
{
|
{
|
||||||
if ( index < 0 )
|
if ( index < 0 )
|
||||||
return nullptr;
|
return nullptr;
|
||||||
|
@ -306,7 +306,7 @@ zeek::detail::BPF_Program* PktSrc::GetBPFFilter(int index)
|
||||||
|
|
||||||
bool PktSrc::ApplyBPFFilter(int index, const struct pcap_pkthdr *hdr, const u_char *pkt)
|
bool PktSrc::ApplyBPFFilter(int index, const struct pcap_pkthdr *hdr, const u_char *pkt)
|
||||||
{
|
{
|
||||||
zeek::detail::BPF_Program* code = GetBPFFilter(index);
|
zeek::iosource::detail::BPF_Program* code = GetBPFFilter(index);
|
||||||
|
|
||||||
if ( ! code )
|
if ( ! code )
|
||||||
{
|
{
|
||||||
|
@ -356,3 +356,5 @@ double PktSrc::GetNextTimeout()
|
||||||
double ct = (current_time(true) - first_wallclock) * pseudo_realtime;
|
double ct = (current_time(true) - first_wallclock) * pseudo_realtime;
|
||||||
return std::max(0.0, pseudo_time - ct);
|
return std::max(0.0, pseudo_time - ct);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::iosource
|
||||||
|
|
|
@ -10,9 +10,9 @@
|
||||||
#include <sys/types.h> // for u_char
|
#include <sys/types.h> // for u_char
|
||||||
|
|
||||||
struct pcap_pkthdr;
|
struct pcap_pkthdr;
|
||||||
ZEEK_FORWARD_DECLARE_NAMESPACED(BPF_Program, zeek::detail);
|
ZEEK_FORWARD_DECLARE_NAMESPACED(BPF_Program, zeek::iosource::detail);
|
||||||
|
|
||||||
namespace iosource {
|
namespace zeek::iosource {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Base class for packet sources.
|
* Base class for packet sources.
|
||||||
|
@ -136,7 +136,7 @@ public:
|
||||||
* @return The BPF filter associated, or null if none has been
|
* @return The BPF filter associated, or null if none has been
|
||||||
* (successfully) compiled.
|
* (successfully) compiled.
|
||||||
*/
|
*/
|
||||||
zeek::detail::BPF_Program* GetBPFFilter(int index);
|
zeek::iosource::detail::BPF_Program* GetBPFFilter(int index);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Applies a precompiled BPF filter to a packet. This will close the
|
* Applies a precompiled BPF filter to a packet. This will close the
|
||||||
|
@ -368,7 +368,7 @@ private:
|
||||||
zeek::Packet current_packet;
|
zeek::Packet current_packet;
|
||||||
|
|
||||||
// For BPF filtering support.
|
// For BPF filtering support.
|
||||||
std::vector<zeek::detail::BPF_Program *> filters;
|
std::vector<zeek::iosource::detail::BPF_Program *> filters;
|
||||||
|
|
||||||
// Only set in pseudo-realtime mode.
|
// Only set in pseudo-realtime mode.
|
||||||
double first_timestamp;
|
double first_timestamp;
|
||||||
|
@ -380,4 +380,8 @@ private:
|
||||||
std::string errbuf;
|
std::string errbuf;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
} // namespace zeek::iosource
|
||||||
|
|
||||||
|
namespace iosource {
|
||||||
|
using PktSrc [[deprecated("Remove in v4.1. Use zeek::iosource::PktSrc.")]] = zeek::iosource::PktSrc;
|
||||||
}
|
}
|
||||||
|
|
|
@ -9,7 +9,7 @@
|
||||||
|
|
||||||
#include "pcap.bif.h"
|
#include "pcap.bif.h"
|
||||||
|
|
||||||
using namespace iosource::pcap;
|
namespace zeek::iosource::pcap {
|
||||||
|
|
||||||
PcapDumper::PcapDumper(const std::string& path, bool arg_append)
|
PcapDumper::PcapDumper(const std::string& path, bool arg_append)
|
||||||
{
|
{
|
||||||
|
@ -117,3 +117,5 @@ iosource::PktDumper* PcapDumper::Instantiate(const std::string& path, bool appen
|
||||||
{
|
{
|
||||||
return new PcapDumper(path, append);
|
return new PcapDumper(path, append);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::iosource::pcap
|
||||||
|
|
|
@ -8,8 +8,7 @@ extern "C" {
|
||||||
|
|
||||||
#include "../PktDumper.h"
|
#include "../PktDumper.h"
|
||||||
|
|
||||||
namespace iosource {
|
namespace zeek::iosource::pcap {
|
||||||
namespace pcap {
|
|
||||||
|
|
||||||
class PcapDumper : public PktDumper {
|
class PcapDumper : public PktDumper {
|
||||||
public:
|
public:
|
||||||
|
@ -32,5 +31,8 @@ private:
|
||||||
pcap_t* pd;
|
pcap_t* pd;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::iosource::pcap
|
||||||
|
|
||||||
|
namespace iosource::pcap {
|
||||||
|
using PcapDumper [[deprecated("Remove in v4.1. Use zeek::iosource::pcap::PcapDumper.")]] = zeek::iosource::pcap::PcapDumper;
|
||||||
}
|
}
|
||||||
|
|
|
@ -5,15 +5,17 @@
|
||||||
#include "plugin/Plugin.h"
|
#include "plugin/Plugin.h"
|
||||||
#include "iosource/Component.h"
|
#include "iosource/Component.h"
|
||||||
|
|
||||||
namespace plugin {
|
namespace zeek::plugin::Zeek_Pcap {
|
||||||
namespace Zeek_Pcap {
|
|
||||||
|
|
||||||
class Plugin : public zeek::plugin::Plugin {
|
class Plugin : public zeek::plugin::Plugin {
|
||||||
public:
|
public:
|
||||||
zeek::plugin::Configuration Configure() override
|
zeek::plugin::Configuration Configure() override
|
||||||
{
|
{
|
||||||
AddComponent(new ::iosource::PktSrcComponent("PcapReader", "pcap", ::iosource::PktSrcComponent::BOTH, ::iosource::pcap::PcapSource::Instantiate));
|
AddComponent(new zeek::iosource::PktSrcComponent(
|
||||||
AddComponent(new ::iosource::PktDumperComponent("PcapWriter", "pcap", ::iosource::pcap::PcapDumper::Instantiate));
|
"PcapReader", "pcap", zeek::iosource::PktSrcComponent::BOTH,
|
||||||
|
zeek::iosource::pcap::PcapSource::Instantiate));
|
||||||
|
AddComponent(new zeek::iosource::PktDumperComponent(
|
||||||
|
"PcapWriter", "pcap", zeek::iosource::pcap::PcapDumper::Instantiate));
|
||||||
|
|
||||||
zeek::plugin::Configuration config;
|
zeek::plugin::Configuration config;
|
||||||
config.name = "Zeek::Pcap";
|
config.name = "Zeek::Pcap";
|
||||||
|
@ -22,5 +24,4 @@ public:
|
||||||
}
|
}
|
||||||
} plugin;
|
} plugin;
|
||||||
|
|
||||||
}
|
} // namespace zeek::plugin::Zeek_Pcap
|
||||||
}
|
|
||||||
|
|
|
@ -14,7 +14,7 @@
|
||||||
#include <pcap-int.h>
|
#include <pcap-int.h>
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
using namespace iosource::pcap;
|
namespace zeek::iosource::pcap {
|
||||||
|
|
||||||
PcapSource::~PcapSource()
|
PcapSource::~PcapSource()
|
||||||
{
|
{
|
||||||
|
@ -258,7 +258,7 @@ bool PcapSource::SetFilter(int index)
|
||||||
|
|
||||||
char errbuf[PCAP_ERRBUF_SIZE];
|
char errbuf[PCAP_ERRBUF_SIZE];
|
||||||
|
|
||||||
zeek::detail::BPF_Program* code = GetBPFFilter(index);
|
zeek::iosource::detail::BPF_Program* code = GetBPFFilter(index);
|
||||||
|
|
||||||
if ( ! code )
|
if ( ! code )
|
||||||
{
|
{
|
||||||
|
@ -342,3 +342,5 @@ iosource::PktSrc* PcapSource::Instantiate(const std::string& path, bool is_live)
|
||||||
{
|
{
|
||||||
return new PcapSource(path, is_live);
|
return new PcapSource(path, is_live);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
} // namespace zeek::iosource::pcap
|
||||||
|
|
|
@ -10,10 +10,9 @@ extern "C" {
|
||||||
|
|
||||||
#include <sys/types.h> // for u_char
|
#include <sys/types.h> // for u_char
|
||||||
|
|
||||||
namespace iosource {
|
namespace zeek::iosource::pcap {
|
||||||
namespace pcap {
|
|
||||||
|
|
||||||
class PcapSource : public iosource::PktSrc {
|
class PcapSource : public zeek::iosource::PktSrc {
|
||||||
public:
|
public:
|
||||||
PcapSource(const std::string& path, bool is_live);
|
PcapSource(const std::string& path, bool is_live);
|
||||||
~PcapSource() override;
|
~PcapSource() override;
|
||||||
|
@ -41,5 +40,8 @@ private:
|
||||||
pcap_t *pd;
|
pcap_t *pd;
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
} // namespace zeek::iosource::pcap
|
||||||
|
|
||||||
|
namespace iosource::pcap {
|
||||||
|
using PcapSource [[deprecated("Remove in v4.1. Use zeek::iosource::pcap::PcapSource.")]] = zeek::iosource::pcap::PcapSource;
|
||||||
}
|
}
|
||||||
|
|
|
@ -39,7 +39,7 @@ function precompile_pcap_filter%(id: PcapFilterID, s: string%): bool
|
||||||
|
|
||||||
bool success = true;
|
bool success = true;
|
||||||
|
|
||||||
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
|
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
|
||||||
if ( ps && ! ps->PrecompileFilter(id->ForceAsInt(), s->CheckString()) )
|
if ( ps && ! ps->PrecompileFilter(id->ForceAsInt(), s->CheckString()) )
|
||||||
success = false;
|
success = false;
|
||||||
|
|
||||||
|
@ -68,7 +68,7 @@ function Pcap::install_pcap_filter%(id: PcapFilterID%): bool
|
||||||
%{
|
%{
|
||||||
bool success = true;
|
bool success = true;
|
||||||
|
|
||||||
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
|
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
|
||||||
if ( ps && ! ps->SetFilter(id->ForceAsInt()) )
|
if ( ps && ! ps->SetFilter(id->ForceAsInt()) )
|
||||||
success = false;
|
success = false;
|
||||||
|
|
||||||
|
@ -91,7 +91,7 @@ function Pcap::install_pcap_filter%(id: PcapFilterID%): bool
|
||||||
## uninstall_dst_net_filter
|
## uninstall_dst_net_filter
|
||||||
function error%(%): string
|
function error%(%): string
|
||||||
%{
|
%{
|
||||||
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
|
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
|
||||||
if ( ps )
|
if ( ps )
|
||||||
{
|
{
|
||||||
const char* err = ps->ErrorMsg();
|
const char* err = ps->ErrorMsg();
|
||||||
|
|
|
@ -16,7 +16,7 @@ int main(int argc, char** argv)
|
||||||
return setup_result.code;
|
return setup_result.code;
|
||||||
|
|
||||||
auto& options = setup_result.options;
|
auto& options = setup_result.options;
|
||||||
auto do_net_run = iosource_mgr->Size() > 0 ||
|
auto do_net_run = zeek::iosource_mgr->Size() > 0 ||
|
||||||
have_pending_timers ||
|
have_pending_timers ||
|
||||||
zeek::BifConst::exit_only_after_terminate;
|
zeek::BifConst::exit_only_after_terminate;
|
||||||
|
|
||||||
|
|
|
@ -44,9 +44,9 @@ function get_net_stats%(%): NetStats
|
||||||
uint64_t link = 0;
|
uint64_t link = 0;
|
||||||
uint64_t bytes_recv = 0;
|
uint64_t bytes_recv = 0;
|
||||||
|
|
||||||
if ( iosource::PktSrc* ps = iosource_mgr->GetPktSrc() )
|
if ( zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc() )
|
||||||
{
|
{
|
||||||
struct iosource::PktSrc::Stats stat;
|
struct zeek::iosource::PktSrc::Stats stat;
|
||||||
ps->Statistics(&stat);
|
ps->Statistics(&stat);
|
||||||
recv += stat.received;
|
recv += stat.received;
|
||||||
drop += stat.dropped;
|
drop += stat.dropped;
|
||||||
|
|
|
@ -255,8 +255,8 @@ Supervisor::~Supervisor()
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
iosource_mgr->UnregisterFd(signal_flare.FD(), this);
|
zeek::iosource_mgr->UnregisterFd(signal_flare.FD(), this);
|
||||||
iosource_mgr->UnregisterFd(stem_pipe->InFD(), this);
|
zeek::iosource_mgr->UnregisterFd(stem_pipe->InFD(), this);
|
||||||
|
|
||||||
DBG_LOG(zeek::DBG_SUPERVISOR, "shutdown, killing stem process %d", stem_pid);
|
DBG_LOG(zeek::DBG_SUPERVISOR, "shutdown, killing stem process %d", stem_pid);
|
||||||
|
|
||||||
|
@ -449,11 +449,11 @@ void Supervisor::HandleChildSignal()
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
if ( ! iosource_mgr->UnregisterFd(stem_stdout.pipe->ReadFD(), this) )
|
if ( ! zeek::iosource_mgr->UnregisterFd(stem_stdout.pipe->ReadFD(), this) )
|
||||||
reporter->FatalError("Revived supervisor stem failed to unregister "
|
reporter->FatalError("Revived supervisor stem failed to unregister "
|
||||||
"redirected stdout pipe");
|
"redirected stdout pipe");
|
||||||
|
|
||||||
if ( ! iosource_mgr->UnregisterFd(stem_stderr.pipe->ReadFD(), this) )
|
if ( ! zeek::iosource_mgr->UnregisterFd(stem_stderr.pipe->ReadFD(), this) )
|
||||||
reporter->FatalError("Revived supervisor stem failed to unregister "
|
reporter->FatalError("Revived supervisor stem failed to unregister "
|
||||||
"redirected stderr pipe");
|
"redirected stderr pipe");
|
||||||
|
|
||||||
|
@ -462,11 +462,11 @@ void Supervisor::HandleChildSignal()
|
||||||
stem_stdout.pipe = std::move(fork_res.stdout_pipe);
|
stem_stdout.pipe = std::move(fork_res.stdout_pipe);
|
||||||
stem_stderr.pipe = std::move(fork_res.stderr_pipe);
|
stem_stderr.pipe = std::move(fork_res.stderr_pipe);
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
|
||||||
reporter->FatalError("Revived supervisor stem failed to register "
|
reporter->FatalError("Revived supervisor stem failed to register "
|
||||||
"redirected stdout pipe");
|
"redirected stdout pipe");
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
|
||||||
reporter->FatalError("Revived supervisor stem failed to register "
|
reporter->FatalError("Revived supervisor stem failed to register "
|
||||||
"redirected stderr pipe");
|
"redirected stderr pipe");
|
||||||
}
|
}
|
||||||
|
@ -494,18 +494,18 @@ void Supervisor::InitPostScript()
|
||||||
stem_stdout.hook = id::find_func("Supervisor::stdout_hook");
|
stem_stdout.hook = id::find_func("Supervisor::stdout_hook");
|
||||||
stem_stderr.hook = id::find_func("Supervisor::stderr_hook");
|
stem_stderr.hook = id::find_func("Supervisor::stderr_hook");
|
||||||
|
|
||||||
iosource_mgr->Register(this);
|
zeek::iosource_mgr->Register(this);
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(signal_flare.FD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(signal_flare.FD(), this) )
|
||||||
reporter->FatalError("Supervisor stem failed to register signal_flare");
|
reporter->FatalError("Supervisor stem failed to register signal_flare");
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(stem_pipe->InFD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(stem_pipe->InFD(), this) )
|
||||||
reporter->FatalError("Supervisor stem failed to register stem_pipe");
|
reporter->FatalError("Supervisor stem failed to register stem_pipe");
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
|
||||||
reporter->FatalError("Supervisor stem failed to register stdout pipe");
|
reporter->FatalError("Supervisor stem failed to register stdout pipe");
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
|
||||||
reporter->FatalError("Supervisor stem failed to register stderr pipe");
|
reporter->FatalError("Supervisor stem failed to register stderr pipe");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -206,7 +206,7 @@ MsgThread::MsgThread() : BasicThread(), queue_in(this, nullptr), queue_out(nullp
|
||||||
failed = false;
|
failed = false;
|
||||||
thread_mgr->AddMsgThread(this);
|
thread_mgr->AddMsgThread(this);
|
||||||
|
|
||||||
if ( ! iosource_mgr->RegisterFd(flare.FD(), this) )
|
if ( ! zeek::iosource_mgr->RegisterFd(flare.FD(), this) )
|
||||||
zeek::reporter->FatalError("Failed to register MsgThread fd with iosource_mgr");
|
zeek::reporter->FatalError("Failed to register MsgThread fd with iosource_mgr");
|
||||||
|
|
||||||
SetClosed(false);
|
SetClosed(false);
|
||||||
|
@ -216,7 +216,7 @@ MsgThread::~MsgThread()
|
||||||
{
|
{
|
||||||
// Unregister this thread from the iosource manager so it doesn't wake
|
// Unregister this thread from the iosource manager so it doesn't wake
|
||||||
// up the main poll anymore.
|
// up the main poll anymore.
|
||||||
iosource_mgr->UnregisterFd(flare.FD(), this);
|
zeek::iosource_mgr->UnregisterFd(flare.FD(), this);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Set by Bro's main signal handler.
|
// Set by Bro's main signal handler.
|
||||||
|
|
|
@ -27,7 +27,7 @@ struct Field;
|
||||||
* that happens, the thread stops accepting any new messages, finishes
|
* that happens, the thread stops accepting any new messages, finishes
|
||||||
* processes all remaining ones still in the queue, and then exits.
|
* processes all remaining ones still in the queue, and then exits.
|
||||||
*/
|
*/
|
||||||
class MsgThread : public BasicThread, public iosource::IOSource
|
class MsgThread : public BasicThread, public zeek::iosource::IOSource
|
||||||
{
|
{
|
||||||
public:
|
public:
|
||||||
/**
|
/**
|
||||||
|
|
|
@ -2025,11 +2025,11 @@ double current_time(bool real)
|
||||||
|
|
||||||
double t = double(tv.tv_sec) + double(tv.tv_usec) / 1e6;
|
double t = double(tv.tv_sec) + double(tv.tv_usec) / 1e6;
|
||||||
|
|
||||||
if ( ! pseudo_realtime || real || ! iosource_mgr || ! iosource_mgr->GetPktSrc() )
|
if ( ! pseudo_realtime || real || ! zeek::iosource_mgr || ! zeek::iosource_mgr->GetPktSrc() )
|
||||||
return t;
|
return t;
|
||||||
|
|
||||||
// This obviously only works for a single source ...
|
// This obviously only works for a single source ...
|
||||||
iosource::PktSrc* src = iosource_mgr->GetPktSrc();
|
zeek::iosource::PktSrc* src = zeek::iosource_mgr->GetPktSrc();
|
||||||
|
|
||||||
if ( net_is_processing_suspended() )
|
if ( net_is_processing_suspended() )
|
||||||
return src->CurrentPacketTimestamp();
|
return src->CurrentPacketTimestamp();
|
||||||
|
|
|
@ -110,7 +110,8 @@ zeek::input::Manager*& input_mgr = zeek::input_mgr;
|
||||||
zeek::file_analysis::Manager* zeek::file_mgr = nullptr;
|
zeek::file_analysis::Manager* zeek::file_mgr = nullptr;
|
||||||
zeek::file_analysis::Manager*& file_mgr = zeek::file_mgr;
|
zeek::file_analysis::Manager*& file_mgr = zeek::file_mgr;
|
||||||
zeekygen::Manager* zeekygen_mgr = nullptr;
|
zeekygen::Manager* zeekygen_mgr = nullptr;
|
||||||
iosource::Manager* iosource_mgr = nullptr;
|
zeek::iosource::Manager* zeek::iosource_mgr = nullptr;
|
||||||
|
zeek::iosource::Manager*& iosource_mgr = zeek::iosource_mgr;
|
||||||
bro_broker::Manager* broker_mgr = nullptr;
|
bro_broker::Manager* broker_mgr = nullptr;
|
||||||
zeek::Supervisor* zeek::supervisor_mgr = nullptr;
|
zeek::Supervisor* zeek::supervisor_mgr = nullptr;
|
||||||
zeek::detail::trigger::Manager* trigger_mgr = nullptr;
|
zeek::detail::trigger::Manager* trigger_mgr = nullptr;
|
||||||
|
@ -279,7 +280,7 @@ void terminate_bro()
|
||||||
|
|
||||||
terminating = true;
|
terminating = true;
|
||||||
|
|
||||||
iosource_mgr->Wakeup("terminate_bro");
|
zeek::iosource_mgr->Wakeup("terminate_bro");
|
||||||
|
|
||||||
// File analysis termination may produce events, so do it early on in
|
// File analysis termination may produce events, so do it early on in
|
||||||
// the termination process.
|
// the termination process.
|
||||||
|
@ -320,7 +321,7 @@ void terminate_bro()
|
||||||
delete zeek::analyzer_mgr;
|
delete zeek::analyzer_mgr;
|
||||||
delete zeek::file_mgr;
|
delete zeek::file_mgr;
|
||||||
// broker_mgr, timer_mgr, and supervisor are deleted via iosource_mgr
|
// broker_mgr, timer_mgr, and supervisor are deleted via iosource_mgr
|
||||||
delete iosource_mgr;
|
delete zeek::iosource_mgr;
|
||||||
delete zeek::event_registry;
|
delete zeek::event_registry;
|
||||||
delete zeek::log_mgr;
|
delete zeek::log_mgr;
|
||||||
delete zeek::reporter;
|
delete zeek::reporter;
|
||||||
|
@ -359,7 +360,7 @@ RETSIGTYPE sig_handler(int signo)
|
||||||
signal_val = signo;
|
signal_val = signo;
|
||||||
|
|
||||||
if ( ! terminating )
|
if ( ! terminating )
|
||||||
iosource_mgr->Wakeup("sig_handler");
|
zeek::iosource_mgr->Wakeup("sig_handler");
|
||||||
|
|
||||||
return RETSIGVAL;
|
return RETSIGVAL;
|
||||||
}
|
}
|
||||||
|
@ -579,7 +580,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
|
||||||
// policy, but we can't parse policy without DNS resolution.
|
// policy, but we can't parse policy without DNS resolution.
|
||||||
zeek::detail::dns_mgr->SetDir(".state");
|
zeek::detail::dns_mgr->SetDir(".state");
|
||||||
|
|
||||||
iosource_mgr = new iosource::Manager();
|
zeek::iosource_mgr = new iosource::Manager();
|
||||||
event_registry = new EventRegistry();
|
event_registry = new EventRegistry();
|
||||||
zeek::analyzer_mgr = new analyzer::Manager();
|
zeek::analyzer_mgr = new analyzer::Manager();
|
||||||
zeek::log_mgr = new logging::Manager();
|
zeek::log_mgr = new logging::Manager();
|
||||||
|
@ -659,7 +660,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
|
||||||
if ( zeek::reporter->Errors() > 0 )
|
if ( zeek::reporter->Errors() > 0 )
|
||||||
exit(1);
|
exit(1);
|
||||||
|
|
||||||
iosource_mgr->InitPostScript();
|
zeek::iosource_mgr->InitPostScript();
|
||||||
zeek::log_mgr->InitPostScript();
|
zeek::log_mgr->InitPostScript();
|
||||||
zeek::plugin_mgr->InitPostScript();
|
zeek::plugin_mgr->InitPostScript();
|
||||||
zeekygen_mgr->InitPostScript();
|
zeekygen_mgr->InitPostScript();
|
||||||
|
|
|
@ -33,7 +33,7 @@ using namespace std;
|
||||||
|
|
||||||
zeek::TableType* var_sizes;
|
zeek::TableType* var_sizes;
|
||||||
|
|
||||||
static iosource::PktDumper* addl_pkt_dumper = 0;
|
static zeek::iosource::PktDumper* addl_pkt_dumper = nullptr;
|
||||||
|
|
||||||
bro_int_t parse_int(const char*& fmt)
|
bro_int_t parse_int(const char*& fmt)
|
||||||
{
|
{
|
||||||
|
@ -1891,7 +1891,7 @@ function reading_traces%(%): bool
|
||||||
function packet_source%(%): PacketSource
|
function packet_source%(%): PacketSource
|
||||||
%{
|
%{
|
||||||
static auto ps_type = zeek::id::find_type<zeek::RecordType>("PacketSource");
|
static auto ps_type = zeek::id::find_type<zeek::RecordType>("PacketSource");
|
||||||
auto ps = iosource_mgr->GetPktSrc();
|
auto ps = zeek::iosource_mgr->GetPktSrc();
|
||||||
auto r = zeek::make_intrusive<zeek::RecordVal>(ps_type);
|
auto r = zeek::make_intrusive<zeek::RecordVal>(ps_type);
|
||||||
|
|
||||||
if ( ps )
|
if ( ps )
|
||||||
|
@ -3407,7 +3407,7 @@ function dump_current_packet%(file_name: string%) : bool
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ! addl_pkt_dumper )
|
if ( ! addl_pkt_dumper )
|
||||||
addl_pkt_dumper = iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
|
addl_pkt_dumper = zeek::iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
|
||||||
|
|
||||||
if ( addl_pkt_dumper )
|
if ( addl_pkt_dumper )
|
||||||
{
|
{
|
||||||
|
@ -3490,7 +3490,7 @@ function dump_packet%(pkt: pcap_packet, file_name: string%) : bool
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ! addl_pkt_dumper )
|
if ( ! addl_pkt_dumper )
|
||||||
addl_pkt_dumper = iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
|
addl_pkt_dumper = zeek::iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
|
||||||
|
|
||||||
if ( ! addl_pkt_dumper->IsError() )
|
if ( ! addl_pkt_dumper->IsError() )
|
||||||
{
|
{
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue