Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Move iosource code to zeek namespaces

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-08-01 10:48:21 -07:00
parent 45b5c6e619
commit be92bd536f
35 changed files with 180 additions and 136 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/DNS_Mgr.cc
View file

@ -439,7 +439,7 @@ void DNS_Mgr::InitSource()
if ( nb_dns )
{
if ( ! iosource_mgr->RegisterFd(nb_dns_fd(nb_dns), this) )
if ( ! zeek::iosource_mgr->RegisterFd(nb_dns_fd(nb_dns), this) )
zeek::reporter->FatalError("Failed to register nb_dns file descriptor with iosource_mgr");
}
else
@ -455,7 +455,7 @@ void DNS_Mgr::InitPostScript()
dm_rec = zeek::id::find_type<zeek::RecordType>("dns_mapping");
// Registering will call Init()
iosource_mgr->Register(this, true);
zeek::iosource_mgr->Register(this, true);
const char* cache_dir = dir ? dir : ".";
cache_name = new char[strlen(cache_dir) + 64];
@ -1462,7 +1462,7 @@ void DNS_Mgr::GetStats(Stats* stats)
void DNS_Mgr::Terminate()
{
if ( nb_dns )
iosource_mgr->UnregisterFd(nb_dns_fd(nb_dns), this);
zeek::iosource_mgr->UnregisterFd(nb_dns_fd(nb_dns), this);
}
} // namespace zeek::detail

2
src/DNS_Mgr.h
View file

@ -47,7 +47,7 @@ enum DNS_MgrMode {
// Number of seconds we'll wait for a reply.
#define DNS_TIMEOUT 5
class DNS_Mgr final : public iosource::IOSource {
class DNS_Mgr final : public zeek::iosource::IOSource {
public:
explicit DNS_Mgr(DNS_MgrMode mode);
~DNS_Mgr() override;

10
src/Event.cc
View file

@ -223,7 +223,7 @@ void EventMgr::Process()
// If we don't have a source, or the source is closed, or we're
// reading live (which includes pseudo-realtime), advance the time
// here to the current time since otherwise it won't move forward.
iosource::PktSrc* pkt_src = iosource_mgr->GetPktSrc();
zeek::iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc();
if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live )
net_update_time(current_time());
@ -233,16 +233,16 @@ void EventMgr::Process()
// to call Drain() as part of this method. It will get called at
// the end of net_run after all of the sources have been processed
// and had the opportunity to spawn new events. We could use
// iosource_mgr->Wakeup() instead of making EventMgr an IOSource,
// zeek::iosource_mgr->Wakeup() instead of making EventMgr an IOSource,
// but then we couldn't update the time above and nothing would
// drive it forward.
}
void EventMgr::InitPostScript()
{
iosource_mgr->Register(this, true, false);
if ( ! iosource_mgr->RegisterFd(queue_flare.FD(), this) )
zeek::reporter->FatalError("Failed to register event manager FD with iosource_mgr");
zeek::iosource_mgr->Register(this, true, false);
if ( ! zeek::iosource_mgr->RegisterFd(queue_flare.FD(), this) )
zeek::reporter->FatalError("Failed to register event manager FD with zeek::iosource_mgr");
}
} // namespace zeek

34
src/Net.cc
View file

@ -42,7 +42,7 @@ extern "C" {
extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
}
iosource::PktDumper* pkt_dumper = nullptr;
zeek::iosource::PktDumper* pkt_dumper = nullptr;
bool reading_live = false;
bool reading_traces = false;
@ -60,8 +60,8 @@ bool is_parsing = false;
const zeek::Packet *current_pkt = nullptr;
int current_dispatched = 0;
double current_timestamp = 0.0;
iosource::PktSrc* current_pktsrc = nullptr;
iosource::IOSource* current_iosrc = nullptr;
zeek::iosource::PktSrc* current_pktsrc = nullptr;
zeek::iosource::IOSource* current_iosrc = nullptr;
std::list<ScannedFile> files_scanned;
std::vector<std::string> sig_files;
@ -110,7 +110,7 @@ RETSIGTYPE watchdog(int /* signo */)
// saving the packet which caused the
// watchdog to trigger may be helpful,
// so we'll save that one nevertheless.
pkt_dumper = iosource_mgr->OpenPktDumper("watchdog-pkt.pcap", false);
pkt_dumper = zeek::iosource_mgr->OpenPktDumper("watchdog-pkt.pcap", false);
if ( ! pkt_dumper || pkt_dumper->IsError() )
{
zeek::reporter->Error("watchdog: can't open watchdog-pkt.pcap for writing");
@ -155,7 +155,7 @@ void net_init(const std::optional<std::string>& interface,
reading_live = pseudo_realtime > 0.0;
reading_traces = true;
iosource::PktSrc* ps = iosource_mgr->OpenPktSrc(*pcap_input_file, false);
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->OpenPktSrc(*pcap_input_file, false);
assert(ps);
if ( ! ps->IsOpen() )
@ -167,7 +167,7 @@ void net_init(const std::optional<std::string>& interface,
reading_live = true;
reading_traces = false;
iosource::PktSrc* ps = iosource_mgr->OpenPktSrc(*interface, true);
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->OpenPktSrc(*interface, true);
assert(ps);
if ( ! ps->IsOpen() )
@ -185,7 +185,7 @@ void net_init(const std::optional<std::string>& interface,
if ( pcap_output_file )
{
const char* writefile = pcap_output_file->data();
pkt_dumper = iosource_mgr->OpenPktDumper(writefile, false);
pkt_dumper = zeek::iosource_mgr->OpenPktDumper(writefile, false);
assert(pkt_dumper);
if ( ! pkt_dumper->IsOpen() )
@ -210,7 +210,7 @@ void net_init(const std::optional<std::string>& interface,
}
}
void expire_timers(iosource::PktSrc* src_ps)
void expire_timers(zeek::iosource::PktSrc* src_ps)
{
zeek::detail::SegmentProfiler prof(zeek::detail::segment_logger, "expiring-timers");
@ -219,7 +219,7 @@ void expire_timers(iosource::PktSrc* src_ps)
max_timer_expires - current_dispatched);
}
void net_packet_dispatch(double t, const zeek::Packet* pkt, iosource::PktSrc* src_ps)
void net_packet_dispatch(double t, const zeek::Packet* pkt, zeek::iosource::PktSrc* src_ps)
{
if ( ! bro_start_network_time )
{
@ -278,13 +278,13 @@ void net_run()
{
set_processing_status("RUNNING", "net_run");
std::vector<iosource::IOSource*> ready;
ready.reserve(iosource_mgr->TotalSize());
std::vector<zeek::iosource::IOSource*> ready;
ready.reserve(zeek::iosource_mgr->TotalSize());
while ( iosource_mgr->Size() ||
while ( zeek::iosource_mgr->Size() ||
(zeek::BifConst::exit_only_after_terminate && ! terminating) )
{
iosource_mgr->FindReadySources(&ready);
zeek::iosource_mgr->FindReadySources(&ready);
#ifdef DEBUG
static int loop_counter = 0;
@ -347,7 +347,7 @@ void net_run()
{
auto have_active_packet_source = false;
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
if ( ps && ps->IsOpen() )
have_active_packet_source = true;
@ -366,10 +366,10 @@ void net_run()
void net_get_final_stats()
{
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
if ( ps && ps->IsLive() )
{
iosource::PktSrc::Stats s;
zeek::iosource::PktSrc::Stats s;
ps->Statistics(&s);
double dropped_pct = s.dropped > 0.0 ? ((double)s.dropped / ((double)s.received + (double)s.dropped)) * 100.0 : 0.0;
zeek::reporter->Info("%" PRIu64 " packets received on interface %s, %" PRIu64 " (%.2f%%) dropped",
@ -427,7 +427,7 @@ void net_continue_processing()
if ( _processing_suspended == 1 )
{
zeek::reporter->Info("processing continued");
if ( iosource::PktSrc* ps = iosource_mgr->GetPktSrc() )
if ( zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc() )
ps->ContinueAfterSuspend();
}

19
src/Net.h
View file

@ -11,12 +11,9 @@
#include <string>
#include <optional>
namespace iosource {
class IOSource;
class PktSrc;
class PktDumper;
}
ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
extern void net_init(const std::optional<std::string>& interfaces,
@ -29,8 +26,8 @@ extern void net_finish(int drain_events);
extern void net_delete(); // Reclaim all memory, etc.
extern void net_update_time(double new_network_time);
extern void net_packet_dispatch(double t, const zeek::Packet* pkt,
iosource::PktSrc* src_ps);
extern void expire_timers(iosource::PktSrc* src_ps = nullptr);
zeek::iosource::PktSrc* src_ps);
extern void expire_timers(zeek::iosource::PktSrc* src_ps = nullptr);
extern void zeek_terminate_loop(const char* reason);
// Functions to temporarily suspend processing of live input (network packets
@ -82,10 +79,10 @@ extern bool is_parsing;
extern const zeek::Packet* current_pkt;
extern int current_dispatched;
extern double current_timestamp;
extern iosource::PktSrc* current_pktsrc;
extern iosource::IOSource* current_iosrc;
extern zeek::iosource::PktSrc* current_pktsrc;
extern zeek::iosource::IOSource* current_iosrc;
extern iosource::PktDumper* pkt_dumper; // where to save packets
extern zeek::iosource::PktDumper* pkt_dumper; // where to save packets
// Script file we have already scanned (or are in the process of scanning).
// They are identified by normalized realpath.

10
src/Timer.cc
View file

@ -69,8 +69,8 @@ TimerMgr::TimerMgr()
num_expired = 0;
last_advance = last_timestamp = 0;
if ( iosource_mgr )
iosource_mgr->Register(this, true);
if ( zeek::iosource_mgr )
zeek::iosource_mgr->Register(this, true);
}
TimerMgr::~TimerMgr()
@ -95,7 +95,7 @@ void TimerMgr::Process()
// If we don't have a source, or the source is closed, or we're reading live (which includes
// pseudo-realtime), advance the timer here to the current time since otherwise it won't
// move forward and the timers won't fire correctly.
iosource::PktSrc* pkt_src = iosource_mgr->GetPktSrc();
iosource::PktSrc* pkt_src = zeek::iosource_mgr->GetPktSrc();
if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live || net_is_processing_suspended() )
net_update_time(current_time());
@ -106,8 +106,8 @@ void TimerMgr::Process()
void TimerMgr::InitPostScript()
{
if ( iosource_mgr )
iosource_mgr->Register(this, true);
if ( zeek::iosource_mgr )
zeek::iosource_mgr->Register(this, true);
}
PQ_TimerMgr::PQ_TimerMgr() : TimerMgr()

6
src/Trigger.cc
View file

@ -492,10 +492,10 @@ const char* Trigger::Name() const
Manager::Manager() : IOSource()
Manager::Manager() : zeek::iosource::IOSource()
{
pending = new TriggerList();
iosource_mgr->Register(this, true);
zeek::iosource_mgr->Register(this, true);
}
Manager::~Manager()
@ -540,7 +540,7 @@ void Manager::Queue(Trigger* trigger)
Ref(trigger);
pending->push_back(trigger);
total_triggers++;
iosource_mgr->Wakeup(Tag());
zeek::iosource_mgr->Wakeup(Tag());
}
}

4
src/Trigger.h
View file

@ -117,7 +117,7 @@ private:
using TriggerPtr = zeek::IntrusivePtr<Trigger>;
class Manager final : public iosource::IOSource {
class Manager final : public zeek::iosource::IOSource {
public:
Manager();
@ -143,7 +143,7 @@ private:
unsigned long total_triggers = 0;
};
}
} // namespace zeek::detail::trigger
namespace trigger {
using Trigger [[deprecated("Remove in v4.1. Use zeek::detail::trigger::Trigger instead")]] = zeek::detail::trigger::Trigger;

20
src/broker/Manager.cc
View file

@ -163,7 +163,7 @@ void Manager::InitPostScript()
vector_of_data_type = zeek::make_intrusive<zeek::VectorType>(zeek::id::find_type("Broker::Data"));
// Register as a "dont-count" source first, we may change that later.
iosource_mgr->Register(this, true);
zeek::iosource_mgr->Register(this, true);
broker::broker_options options;
options.disable_ssl = get_option("Broker::disable_ssl")->AsBool();
@ -210,9 +210,9 @@ void Manager::InitPostScript()
auto cqs = get_option("Broker::congestion_queue_size")->AsCount();
bstate = std::make_shared<BrokerState>(std::move(config), cqs);
if ( ! iosource_mgr->RegisterFd(bstate->subscriber.fd(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(bstate->subscriber.fd(), this) )
zeek::reporter->FatalError("Failed to register broker subscriber with iosource_mgr");
if ( ! iosource_mgr->RegisterFd(bstate->status_subscriber.fd(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(bstate->status_subscriber.fd(), this) )
zeek::reporter->FatalError("Failed to register broker status subscriber with iosource_mgr");
bstate->subscriber.add_topic(broker::topics::store_events, true);
@ -268,8 +268,8 @@ void Manager::Terminate()
{
FlushLogBuffers();
iosource_mgr->UnregisterFd(bstate->subscriber.fd(), this);
iosource_mgr->UnregisterFd(bstate->status_subscriber.fd(), this);
zeek::iosource_mgr->UnregisterFd(bstate->subscriber.fd(), this);
zeek::iosource_mgr->UnregisterFd(bstate->status_subscriber.fd(), this);
vector<string> stores_to_close;
@ -353,7 +353,7 @@ uint16_t Manager::Listen(const string& addr, uint16_t port)
addr.empty() ? "INADDR_ANY" : addr.c_str(), port);
// Register as a "does-count" source now.
iosource_mgr->Register(this, false);
zeek::iosource_mgr->Register(this, false);
DBG_LOG(zeek::DBG_BROKER, "Listening on %s:%" PRIu16,
addr.empty() ? "INADDR_ANY" : addr.c_str(), port);
@ -385,7 +385,7 @@ void Manager::Peer(const string& addr, uint16_t port, double retry)
if ( counts_as_iosource )
// Register as a "does-count" source now.
iosource_mgr->Register(this, false);
zeek::iosource_mgr->Register(this, false);
}
void Manager::Unpeer(const string& addr, uint16_t port)
@ -1598,7 +1598,7 @@ StoreHandleVal* Manager::MakeMaster(const string& name, broker::backend type,
Ref(handle);
data_stores.emplace(name, handle);
iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
zeek::iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
PrepareForwarding(name);
if ( ! bstate->endpoint.use_real_time() )
@ -1695,7 +1695,7 @@ StoreHandleVal* Manager::MakeClone(const string& name, double resync_interval,
Ref(handle);
data_stores.emplace(name, handle);
iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
zeek::iosource_mgr->RegisterFd(handle->proxy.mailbox().descriptor(), this);
PrepareForwarding(name);
return handle;
}
@ -1714,7 +1714,7 @@ bool Manager::CloseStore(const string& name)
if ( s == data_stores.end() )
return false;
iosource_mgr->UnregisterFd(s->second->proxy.mailbox().descriptor(), this);
zeek::iosource_mgr->UnregisterFd(s->second->proxy.mailbox().descriptor(), this);
for ( auto i = pending_queries.begin(); i != pending_queries.end(); )
if ( i->second->Store().name() == name )

2
src/broker/Manager.h
View file

@ -66,7 +66,7 @@ struct Stats {
* Manages various forms of communication between peer Bro processes
* or other external applications via use of the Broker messaging library.
*/
class Manager : public iosource::IOSource {
class Manager : public zeek::iosource::IOSource {
public:
static const broker::endpoint_info NoPeer;

4
src/iosource/BPF_Program.cc
View file

@ -59,7 +59,7 @@ int pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
}
#endif
namespace zeek::detail {
namespace zeek::iosource::detail {
// Simple heuristic to identify filters that always match, so that we can
// skip the filtering in that case. "ip or not ip" is Bro's default filter.
@ -161,4 +161,4 @@ void BPF_Program::FreeCode()
}
}
} // namespace zeek::detail
} // namespace zeek::iosource::detail

6
src/iosource/BPF_Program.h
View file

@ -8,7 +8,7 @@ extern "C" {
#include <stdint.h>
namespace zeek::detail {
namespace zeek::iosource::detail {
// BPF_Programs are an abstraction around struct bpf_program,
// to create a clean facility for creating, compiling, and
@ -56,6 +56,6 @@ protected:
struct bpf_program m_program;
};
} // namespace zeek::detail
} // namespace zeek::iosource::detail
using BPF_Program [[deprecated("Remove in v4.1. Use zeek::detail::BPF_Program.")]] = zeek::detail::BPF_Program;
using BPF_Program [[deprecated("Remove in v4.1. Use zeek::iosource::detail::BPF_Program.")]] = zeek::iosource::detail::BPF_Program;

4
src/iosource/Component.cc
View file

@ -5,7 +5,7 @@
#include "Desc.h"
#include "Reporter.h"
using namespace iosource;
namespace zeek::iosource {
Component::Component(const std::string& name)
: zeek::plugin::Component(zeek::plugin::component::IOSOURCE, name)
@ -163,3 +163,5 @@ void PktDumperComponent::DoDescribe(zeek::ODesc* d) const
d->Add(": ");
d->Add(prefs);
}
} // namespace zeek::iosource

24
src/iosource/Component.h
View file

@ -2,16 +2,16 @@
#pragma once
#include "plugin/Component.h"
#include <string>
#include <vector>
namespace iosource {
#include "plugin/Component.h"
class IOSource;
class PktSrc;
class PktDumper;
ZEEK_FORWARD_DECLARE_NAMESPACED(IOSource, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
namespace zeek::iosource {
/**
* Component description for plugins providing IOSources.
@ -49,7 +49,7 @@ protected:
/**
* Component description for plugins providing a PktSrc for packet input.
*/
class PktSrcComponent : public iosource::Component {
class PktSrcComponent : public zeek::iosource::Component {
public:
/**
* Type of input a packet source supports.
@ -167,4 +167,12 @@ private:
factory_callback factory;
};
}
} // namespace zeek::iosource
namespace iosource {
using Component [[deprecated("Remove in v4.1. Use zeek::iosource::Component.")]] = zeek::iosource::Component;
using PktSrcComponent [[deprecated("Remove in v4.1. Use zeek::iosource::PktSrcComponent.")]] = zeek::iosource::PktSrcComponent;
using PktDumperComponent [[deprecated("Remove in v4.1. Use zeek::iosource::PktDumperComponent.")]] = zeek::iosource::PktDumperComponent;
} // namespace iosource

6
src/iosource/IOSource.h
View file

@ -2,7 +2,7 @@
#pragma once
namespace iosource {
namespace zeek::iosource {
/**
* Interface class for components providing/consuming data inside Bro's main
@ -86,4 +86,8 @@ private:
bool closed;
};
} // namespace zeek::iosource
namespace iosource {
using IOSource [[deprecated("Remove in v4.1. Use zeek::iosource::IOSource.")]] = zeek::iosource::IOSource;
}

4
src/iosource/Manager.cc
View file

@ -20,7 +20,7 @@
#define DEFAULT_PREFIX "pcap"
using namespace iosource;
namespace zeek::iosource {
Manager::WakeupHandler::WakeupHandler()
{
@ -417,3 +417,5 @@ PktDumper* Manager::OpenPktDumper(const std::string& path, bool append)
return pd;
}
} // namespace zeek::iosource

17
src/iosource/Manager.h
View file

@ -14,10 +14,11 @@
struct timespec;
struct kevent;
namespace iosource {
ZEEK_FORWARD_DECLARE_NAMESPACED(PktSrc, zeek, iosource);
ZEEK_FORWARD_DECLARE_NAMESPACED(PktDumper, zeek, iosource);
class PktSrc;
class PktDumper;
namespace zeek {
namespace iosource {
/**
* Manager class for IO sources. This handles all of the polling of sources
@ -209,6 +210,14 @@ private:
std::vector<struct kevent> events;
};
}
} // namespace iosource
extern iosource::Manager* iosource_mgr;
} // namespace zeek
extern zeek::iosource::Manager*& iosource_mgr [[deprecated("Remove in v4.1. Use zeek::iosource_mgr.")]];
namespace iosource {
using Manager [[deprecated("Remove in v4.1. Use zeek::iosource::Manager.")]] = zeek::iosource::Manager;
}

4
src/iosource/PktDumper.cc
View file

@ -6,7 +6,7 @@
#include "PktDumper.h"
#include "DebugLogger.h"
using namespace iosource;
namespace zeek::iosource {
PktDumper::PktDumper()
{
@ -80,3 +80,5 @@ void PktDumper::Error(const std::string& msg)
IsOpen() ? props.path.c_str() : "<not open>",
msg.c_str());
}
} // namespace zeek::iosource

6
src/iosource/PktDumper.h
View file

@ -7,7 +7,7 @@
ZEEK_FORWARD_DECLARE_NAMESPACED(Packet, zeek);
namespace iosource {
namespace zeek::iosource {
/**
* Base class for packet dumpers.
@ -139,4 +139,8 @@ private:
std::string errmsg;
};
} // namespace zeek::iosource
namespace iosource {
using PktDumper [[deprecated("Remove in v4.1. Use zeek::iosource::PktDumper.")]] = zeek::iosource::PktDumper;
}

10
src/iosource/PktSrc.cc
View file

@ -15,7 +15,7 @@
#include "pcap/pcap.bif.h"
using namespace iosource;
namespace zeek::iosource {
PktSrc::Properties::Properties()
{
@ -269,7 +269,7 @@ bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
char errbuf[PCAP_ERRBUF_SIZE];
// Compile filter.
auto* code = new zeek::detail::BPF_Program();
auto* code = new zeek::iosource::detail::BPF_Program();
if ( ! code->Compile(zeek::BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf, sizeof(errbuf)) )
{
@ -296,7 +296,7 @@ bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
return true;
}
zeek::detail::BPF_Program* PktSrc::GetBPFFilter(int index)
zeek::iosource::detail::BPF_Program* PktSrc::GetBPFFilter(int index)
{
if ( index < 0 )
return nullptr;
@ -306,7 +306,7 @@ zeek::detail::BPF_Program* PktSrc::GetBPFFilter(int index)
bool PktSrc::ApplyBPFFilter(int index, const struct pcap_pkthdr *hdr, const u_char *pkt)
{
zeek::detail::BPF_Program* code = GetBPFFilter(index);
zeek::iosource::detail::BPF_Program* code = GetBPFFilter(index);
if ( ! code )
{
@ -356,3 +356,5 @@ double PktSrc::GetNextTimeout()
double ct = (current_time(true) - first_wallclock) * pseudo_realtime;
return std::max(0.0, pseudo_time - ct);
}
} // namespace zeek::iosource

12
src/iosource/PktSrc.h
View file

@ -10,9 +10,9 @@
#include <sys/types.h> // for u_char
struct pcap_pkthdr;
ZEEK_FORWARD_DECLARE_NAMESPACED(BPF_Program, zeek::detail);
ZEEK_FORWARD_DECLARE_NAMESPACED(BPF_Program, zeek::iosource::detail);
namespace iosource {
namespace zeek::iosource {
/**
* Base class for packet sources.
@ -136,7 +136,7 @@ public:
* @return The BPF filter associated, or null if none has been
* (successfully) compiled.
*/
zeek::detail::BPF_Program* GetBPFFilter(int index);
zeek::iosource::detail::BPF_Program* GetBPFFilter(int index);
/**
* Applies a precompiled BPF filter to a packet. This will close the
@ -368,7 +368,7 @@ private:
zeek::Packet current_packet;
// For BPF filtering support.
std::vector<zeek::detail::BPF_Program *> filters;
std::vector<zeek::iosource::detail::BPF_Program *> filters;
// Only set in pseudo-realtime mode.
double first_timestamp;
@ -380,4 +380,8 @@ private:
std::string errbuf;
};
} // namespace zeek::iosource
namespace iosource {
using PktSrc [[deprecated("Remove in v4.1. Use zeek::iosource::PktSrc.")]] = zeek::iosource::PktSrc;
}

4
src/iosource/pcap/Dumper.cc
View file

@ -9,7 +9,7 @@
#include "pcap.bif.h"
using namespace iosource::pcap;
namespace zeek::iosource::pcap {
PcapDumper::PcapDumper(const std::string& path, bool arg_append)
{
@ -117,3 +117,5 @@ iosource::PktDumper* PcapDumper::Instantiate(const std::string& path, bool appen
{
return new PcapDumper(path, append);
}
} // namespace zeek::iosource::pcap

8
src/iosource/pcap/Dumper.h
View file

@ -8,8 +8,7 @@ extern "C" {
#include "../PktDumper.h"
namespace iosource {
namespace pcap {
namespace zeek::iosource::pcap {
class PcapDumper : public PktDumper {
public:
@ -32,5 +31,8 @@ private:
pcap_t* pd;
};
}
} // namespace zeek::iosource::pcap
namespace iosource::pcap {
using PcapDumper [[deprecated("Remove in v4.1. Use zeek::iosource::pcap::PcapDumper.")]] = zeek::iosource::pcap::PcapDumper;
}

13
src/iosource/pcap/Plugin.cc
View file

@ -5,15 +5,17 @@
#include "plugin/Plugin.h"
#include "iosource/Component.h"
namespace plugin {
namespace Zeek_Pcap {
namespace zeek::plugin::Zeek_Pcap {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure() override
{
AddComponent(new ::iosource::PktSrcComponent("PcapReader", "pcap", ::iosource::PktSrcComponent::BOTH, ::iosource::pcap::PcapSource::Instantiate));
AddComponent(new ::iosource::PktDumperComponent("PcapWriter", "pcap", ::iosource::pcap::PcapDumper::Instantiate));
AddComponent(new zeek::iosource::PktSrcComponent(
"PcapReader", "pcap", zeek::iosource::PktSrcComponent::BOTH,
zeek::iosource::pcap::PcapSource::Instantiate));
AddComponent(new zeek::iosource::PktDumperComponent(
"PcapWriter", "pcap", zeek::iosource::pcap::PcapDumper::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::Pcap";
@ -22,5 +24,4 @@ public:
}
} plugin;
}
}
} // namespace zeek::plugin::Zeek_Pcap

6
src/iosource/pcap/Source.cc
View file

@ -14,7 +14,7 @@
#include <pcap-int.h>
#endif
using namespace iosource::pcap;
namespace zeek::iosource::pcap {
PcapSource::~PcapSource()
{
@ -258,7 +258,7 @@ bool PcapSource::SetFilter(int index)
char errbuf[PCAP_ERRBUF_SIZE];
zeek::detail::BPF_Program* code = GetBPFFilter(index);
zeek::iosource::detail::BPF_Program* code = GetBPFFilter(index);
if ( ! code )
{
@ -342,3 +342,5 @@ iosource::PktSrc* PcapSource::Instantiate(const std::string& path, bool is_live)
{
return new PcapSource(path, is_live);
}
} // namespace zeek::iosource::pcap

10
src/iosource/pcap/Source.h
View file

@ -10,10 +10,9 @@ extern "C" {
#include <sys/types.h> // for u_char
namespace iosource {
namespace pcap {
namespace zeek::iosource::pcap {
class PcapSource : public iosource::PktSrc {
class PcapSource : public zeek::iosource::PktSrc {
public:
PcapSource(const std::string& path, bool is_live);
~PcapSource() override;
@ -41,5 +40,8 @@ private:
pcap_t *pd;
};
}
} // namespace zeek::iosource::pcap
namespace iosource::pcap {
using PcapSource [[deprecated("Remove in v4.1. Use zeek::iosource::pcap::PcapSource.")]] = zeek::iosource::pcap::PcapSource;
}

6
src/iosource/pcap/pcap.bif
View file

@ -39,7 +39,7 @@ function precompile_pcap_filter%(id: PcapFilterID, s: string%): bool
bool success = true;
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
if ( ps && ! ps->PrecompileFilter(id->ForceAsInt(), s->CheckString()) )
success = false;
@ -68,7 +68,7 @@ function Pcap::install_pcap_filter%(id: PcapFilterID%): bool
%{
bool success = true;
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
if ( ps && ! ps->SetFilter(id->ForceAsInt()) )
success = false;
@ -91,7 +91,7 @@ function Pcap::install_pcap_filter%(id: PcapFilterID%): bool
## uninstall_dst_net_filter
function error%(%): string
%{
iosource::PktSrc* ps = iosource_mgr->GetPktSrc();
zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc();
if ( ps )
{
const char* err = ps->ErrorMsg();

2
src/main.cc
View file

@ -16,7 +16,7 @@ int main(int argc, char** argv)
return setup_result.code;
auto& options = setup_result.options;
auto do_net_run = iosource_mgr->Size() > 0 ||
auto do_net_run = zeek::iosource_mgr->Size() > 0 ||
have_pending_timers ||
zeek::BifConst::exit_only_after_terminate;

4
src/stats.bif
View file

@ -44,9 +44,9 @@ function get_net_stats%(%): NetStats
uint64_t link = 0;
uint64_t bytes_recv = 0;
if ( iosource::PktSrc* ps = iosource_mgr->GetPktSrc() )
if ( zeek::iosource::PktSrc* ps = zeek::iosource_mgr->GetPktSrc() )
{
struct iosource::PktSrc::Stats stat;
struct zeek::iosource::PktSrc::Stats stat;
ps->Statistics(&stat);
recv += stat.received;
drop += stat.dropped;

22
src/supervisor/Supervisor.cc
View file

@ -255,8 +255,8 @@ Supervisor::~Supervisor()
return;
}
iosource_mgr->UnregisterFd(signal_flare.FD(), this);
iosource_mgr->UnregisterFd(stem_pipe->InFD(), this);
zeek::iosource_mgr->UnregisterFd(signal_flare.FD(), this);
zeek::iosource_mgr->UnregisterFd(stem_pipe->InFD(), this);
DBG_LOG(zeek::DBG_SUPERVISOR, "shutdown, killing stem process %d", stem_pid);
@ -449,11 +449,11 @@ void Supervisor::HandleChildSignal()
}
else
{
if ( ! iosource_mgr->UnregisterFd(stem_stdout.pipe->ReadFD(), this) )
if ( ! zeek::iosource_mgr->UnregisterFd(stem_stdout.pipe->ReadFD(), this) )
reporter->FatalError("Revived supervisor stem failed to unregister "
"redirected stdout pipe");
if ( ! iosource_mgr->UnregisterFd(stem_stderr.pipe->ReadFD(), this) )
if ( ! zeek::iosource_mgr->UnregisterFd(stem_stderr.pipe->ReadFD(), this) )
reporter->FatalError("Revived supervisor stem failed to unregister "
"redirected stderr pipe");
@ -462,11 +462,11 @@ void Supervisor::HandleChildSignal()
stem_stdout.pipe = std::move(fork_res.stdout_pipe);
stem_stderr.pipe = std::move(fork_res.stderr_pipe);
if ( ! iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
reporter->FatalError("Revived supervisor stem failed to register "
"redirected stdout pipe");
if ( ! iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
reporter->FatalError("Revived supervisor stem failed to register "
"redirected stderr pipe");
}
@ -494,18 +494,18 @@ void Supervisor::InitPostScript()
stem_stdout.hook = id::find_func("Supervisor::stdout_hook");
stem_stderr.hook = id::find_func("Supervisor::stderr_hook");
iosource_mgr->Register(this);
zeek::iosource_mgr->Register(this);
if ( ! iosource_mgr->RegisterFd(signal_flare.FD(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(signal_flare.FD(), this) )
reporter->FatalError("Supervisor stem failed to register signal_flare");
if ( ! iosource_mgr->RegisterFd(stem_pipe->InFD(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(stem_pipe->InFD(), this) )
reporter->FatalError("Supervisor stem failed to register stem_pipe");
if ( ! iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(stem_stdout.pipe->ReadFD(), this) )
reporter->FatalError("Supervisor stem failed to register stdout pipe");
if ( ! iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(stem_stderr.pipe->ReadFD(), this) )
reporter->FatalError("Supervisor stem failed to register stderr pipe");
}

4
src/threading/MsgThread.cc
View file

@ -206,7 +206,7 @@ MsgThread::MsgThread() : BasicThread(), queue_in(this, nullptr), queue_out(nullp
failed = false;
thread_mgr->AddMsgThread(this);
if ( ! iosource_mgr->RegisterFd(flare.FD(), this) )
if ( ! zeek::iosource_mgr->RegisterFd(flare.FD(), this) )
zeek::reporter->FatalError("Failed to register MsgThread fd with iosource_mgr");
SetClosed(false);
@ -216,7 +216,7 @@ MsgThread::~MsgThread()
{
// Unregister this thread from the iosource manager so it doesn't wake
// up the main poll anymore.
iosource_mgr->UnregisterFd(flare.FD(), this);
zeek::iosource_mgr->UnregisterFd(flare.FD(), this);
}
// Set by Bro's main signal handler.

2
src/threading/MsgThread.h
View file

@ -27,7 +27,7 @@ struct Field;
* that happens, the thread stops accepting any new messages, finishes
* processes all remaining ones still in the queue, and then exits.
*/
class MsgThread : public BasicThread, public iosource::IOSource
class MsgThread : public BasicThread, public zeek::iosource::IOSource
{
public:
/**

4
src/util.cc
View file

@ -2025,11 +2025,11 @@ double current_time(bool real)
double t = double(tv.tv_sec) + double(tv.tv_usec) / 1e6;
if ( ! pseudo_realtime || real || ! iosource_mgr || ! iosource_mgr->GetPktSrc() )
if ( ! pseudo_realtime || real || ! zeek::iosource_mgr || ! zeek::iosource_mgr->GetPktSrc() )
return t;
// This obviously only works for a single source ...
iosource::PktSrc* src = iosource_mgr->GetPktSrc();
zeek::iosource::PktSrc* src = zeek::iosource_mgr->GetPktSrc();
if ( net_is_processing_suspended() )
return src->CurrentPacketTimestamp();

13
src/zeek-setup.cc
View file

@ -110,7 +110,8 @@ zeek::input::Manager*& input_mgr = zeek::input_mgr;
zeek::file_analysis::Manager* zeek::file_mgr = nullptr;
zeek::file_analysis::Manager*& file_mgr = zeek::file_mgr;
zeekygen::Manager* zeekygen_mgr = nullptr;
iosource::Manager* iosource_mgr = nullptr;
zeek::iosource::Manager* zeek::iosource_mgr = nullptr;
zeek::iosource::Manager*& iosource_mgr = zeek::iosource_mgr;
bro_broker::Manager* broker_mgr = nullptr;
zeek::Supervisor* zeek::supervisor_mgr = nullptr;
zeek::detail::trigger::Manager* trigger_mgr = nullptr;
@ -279,7 +280,7 @@ void terminate_bro()
terminating = true;
iosource_mgr->Wakeup("terminate_bro");
zeek::iosource_mgr->Wakeup("terminate_bro");
// File analysis termination may produce events, so do it early on in
// the termination process.
@ -320,7 +321,7 @@ void terminate_bro()
delete zeek::analyzer_mgr;
delete zeek::file_mgr;
// broker_mgr, timer_mgr, and supervisor are deleted via iosource_mgr
delete iosource_mgr;
delete zeek::iosource_mgr;
delete zeek::event_registry;
delete zeek::log_mgr;
delete zeek::reporter;
@ -359,7 +360,7 @@ RETSIGTYPE sig_handler(int signo)
signal_val = signo;
if ( ! terminating )
iosource_mgr->Wakeup("sig_handler");
zeek::iosource_mgr->Wakeup("sig_handler");
return RETSIGVAL;
}
@ -579,7 +580,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
// policy, but we can't parse policy without DNS resolution.
zeek::detail::dns_mgr->SetDir(".state");
iosource_mgr = new iosource::Manager();
zeek::iosource_mgr = new iosource::Manager();
event_registry = new EventRegistry();
zeek::analyzer_mgr = new analyzer::Manager();
zeek::log_mgr = new logging::Manager();
@ -659,7 +660,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
if ( zeek::reporter->Errors() > 0 )
exit(1);
iosource_mgr->InitPostScript();
zeek::iosource_mgr->InitPostScript();
zeek::log_mgr->InitPostScript();
zeek::plugin_mgr->InitPostScript();
zeekygen_mgr->InitPostScript();

8
src/zeek.bif
View file

@ -33,7 +33,7 @@ using namespace std;
zeek::TableType* var_sizes;
static iosource::PktDumper* addl_pkt_dumper = 0;
static zeek::iosource::PktDumper* addl_pkt_dumper = nullptr;
bro_int_t parse_int(const char*& fmt)
{
@ -1891,7 +1891,7 @@ function reading_traces%(%): bool
function packet_source%(%): PacketSource
%{
static auto ps_type = zeek::id::find_type<zeek::RecordType>("PacketSource");
auto ps = iosource_mgr->GetPktSrc();
auto ps = zeek::iosource_mgr->GetPktSrc();
auto r = zeek::make_intrusive<zeek::RecordVal>(ps_type);
if ( ps )
@ -3407,7 +3407,7 @@ function dump_current_packet%(file_name: string%) : bool
}
if ( ! addl_pkt_dumper )
addl_pkt_dumper = iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
addl_pkt_dumper = zeek::iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
if ( addl_pkt_dumper )
{
@ -3490,7 +3490,7 @@ function dump_packet%(pkt: pcap_packet, file_name: string%) : bool
}
if ( ! addl_pkt_dumper )
addl_pkt_dumper = iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
addl_pkt_dumper = zeek::iosource_mgr->OpenPktDumper(file_name->CheckString(), true);
if ( ! addl_pkt_dumper->IsError() )
{