Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Deprecate global type pointers in NetVar.h

Browse source 
There's analogous IntrusivePtrs in zeek::vars
This commit is contained in:
Jon Siwek 2020-05-11 19:22:49 -07:00
parent 4351a26710
commit c0986f0739
51 changed files with 451 additions and 224 deletions
Download patch file Download diff file Expand all files Collapse all files

58
src/file_analysis/File.cc
View file

@ -23,16 +23,16 @@ using namespace file_analysis;
static Val* empty_connection_table()
{
auto tbl_index = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, conn_id});
tbl_index->Append({NewRef{}, conn_id});
auto tbl_index = make_intrusive<TypeList>(zeek::vars::conn_id);
tbl_index->Append(zeek::vars::conn_id);
auto tbl_type = make_intrusive<TableType>(std::move(tbl_index),
IntrusivePtr{NewRef{}, connection_type});
zeek::vars::connection_type);
return new TableVal(std::move(tbl_type));
}
static RecordVal* get_conn_id_val(const Connection* conn)
static IntrusivePtr<RecordVal> get_conn_id_val(const Connection* conn)
{
RecordVal* v = new RecordVal(conn_id);
auto v = make_intrusive<RecordVal>(zeek::vars::conn_id);
v->Assign(0, make_intrusive<AddrVal>(conn->OrigAddr()));
v->Assign(1, val_mgr->Port(ntohs(conn->OrigPort()), conn->ConnTransport()));
v->Assign(2, make_intrusive<AddrVal>(conn->RespAddr()));
@ -62,22 +62,22 @@ void File::StaticInit()
if ( id_idx != -1 )
return;
id_idx = Idx("id", fa_file_type);
parent_id_idx = Idx("parent_id", fa_file_type);
source_idx = Idx("source", fa_file_type);
is_orig_idx = Idx("is_orig", fa_file_type);
conns_idx = Idx("conns", fa_file_type);
last_active_idx = Idx("last_active", fa_file_type);
seen_bytes_idx = Idx("seen_bytes", fa_file_type);
total_bytes_idx = Idx("total_bytes", fa_file_type);
missing_bytes_idx = Idx("missing_bytes", fa_file_type);
overflow_bytes_idx = Idx("overflow_bytes", fa_file_type);
timeout_interval_idx = Idx("timeout_interval", fa_file_type);
bof_buffer_size_idx = Idx("bof_buffer_size", fa_file_type);
bof_buffer_idx = Idx("bof_buffer", fa_file_type);
meta_mime_type_idx = Idx("mime_type", fa_metadata_type);
meta_mime_types_idx = Idx("mime_types", fa_metadata_type);
meta_inferred_idx = Idx("inferred", fa_metadata_type);
id_idx = Idx("id", zeek::vars::fa_file_type);
parent_id_idx = Idx("parent_id", zeek::vars::fa_file_type);
source_idx = Idx("source", zeek::vars::fa_file_type);
is_orig_idx = Idx("is_orig", zeek::vars::fa_file_type);
conns_idx = Idx("conns", zeek::vars::fa_file_type);
last_active_idx = Idx("last_active", zeek::vars::fa_file_type);
seen_bytes_idx = Idx("seen_bytes", zeek::vars::fa_file_type);
total_bytes_idx = Idx("total_bytes", zeek::vars::fa_file_type);
missing_bytes_idx = Idx("missing_bytes", zeek::vars::fa_file_type);
overflow_bytes_idx = Idx("overflow_bytes", zeek::vars::fa_file_type);
timeout_interval_idx = Idx("timeout_interval", zeek::vars::fa_file_type);
bof_buffer_size_idx = Idx("bof_buffer_size", zeek::vars::fa_file_type);
bof_buffer_idx = Idx("bof_buffer", zeek::vars::fa_file_type);
meta_mime_type_idx = Idx("mime_type", zeek::vars::fa_metadata_type);
meta_mime_types_idx = Idx("mime_types", zeek::vars::fa_metadata_type);
meta_inferred_idx = Idx("inferred", zeek::vars::fa_metadata_type);
}
File::File(const std::string& file_id, const std::string& source_name, Connection* conn,
@ -91,7 +91,7 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio
DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Creating new File object", file_id.c_str());
val = new RecordVal(fa_file_type);
val = new RecordVal(zeek::vars::fa_file_type);
val->Assign(id_idx, make_intrusive<StringVal>(file_id.c_str()));
SetSource(source_name);
@ -137,16 +137,12 @@ bool File::UpdateConnectionFields(Connection* conn, bool is_orig)
val->Assign(conns_idx, conns);
}
Val* idx = get_conn_id_val(conn);
auto idx = get_conn_id_val(conn);
if ( conns->AsTableVal()->Lookup(idx) )
{
Unref(idx);
if ( conns->AsTableVal()->Lookup(idx.get()) )
return false;
}
conns->AsTableVal()->Assign(idx, conn->ConnVal());
Unref(idx);
conns->AsTableVal()->Assign(idx.get(), conn->ConnVal());
return true;
}
@ -299,7 +295,7 @@ bool File::SetMime(const std::string& mime_type)
if ( ! FileEventAvailable(file_sniff) )
return false;
auto meta = make_intrusive<RecordVal>(fa_metadata_type);
auto meta = make_intrusive<RecordVal>(zeek::vars::fa_metadata_type);
meta->Assign(meta_mime_type_idx, make_intrusive<StringVal>(mime_type));
meta->Assign(meta_inferred_idx, val_mgr->False());
@ -332,7 +328,7 @@ void File::InferMetadata()
len = std::min(len, LookupFieldDefaultCount(bof_buffer_size_idx));
file_mgr->DetectMIME(data, len, &matches);
auto meta = make_intrusive<RecordVal>(fa_metadata_type);
auto meta = make_intrusive<RecordVal>(zeek::vars::fa_metadata_type);
if ( ! matches.empty() )
{

2
src/file_analysis/File.h
View file

@ -323,6 +323,8 @@ protected:
* @return the field offset in #val record corresponding to \a field_name.
*/
static int Idx(const std::string& field_name, const RecordType* type);
static int Idx(const std::string& field_name, const IntrusivePtr<RecordType>& type)
{ return Idx(field_name, type.get()); }
/**
* Initializes static member.

4
src/file_analysis/Manager.cc
View file

@ -499,12 +499,12 @@ string Manager::DetectMIME(const u_char* data, uint64_t len) const
IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
{
auto rval = make_intrusive<VectorVal>(IntrusivePtr{NewRef{}, mime_matches});
auto rval = make_intrusive<VectorVal>(zeek::vars::mime_matches);
for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin();
it != m.end(); ++it )
{
auto element = make_intrusive<RecordVal>(mime_match);
auto element = make_intrusive<RecordVal>(zeek::vars::mime_match);
for ( set<string>::const_iterator it2 = it->second.begin();
it2 != it->second.end(); ++it2 )

2
src/file_analysis/analyzer/entropy/Entropy.cc
View file

@ -60,7 +60,7 @@ void Entropy::Finalize()
montepi = scc = ent = mean = chisq = 0.0;
entropy->Get(&ent, &chisq, &mean, &montepi, &scc);
auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
auto ent_result = make_intrusive<RecordVal>(zeek::vars::entropy_test_result);
ent_result->Assign(0, make_intrusive<Val>(ent, TYPE_DOUBLE));
ent_result->Assign(1, make_intrusive<Val>(chisq, TYPE_DOUBLE));
ent_result->Assign(2, make_intrusive<Val>(mean, TYPE_DOUBLE));

4
src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

@ -11,7 +11,7 @@ VectorVal* process_rvas(const RVAS* rvas);
%code{
VectorVal* process_rvas(const RVAS* rva_table)
{
auto rvas = make_intrusive<VectorVal>(zeek::lookup_type<VectorType>("index_vec"));
auto rvas = make_intrusive<VectorVal>(zeek::vars::index_vec);
for ( uint16 i=0; i < rva_table->rvas()->size(); ++i )
rvas->Assign(i, val_mgr->Count((*rva_table->rvas())[i]->size()));
@ -26,7 +26,7 @@ refine flow File += {
function characteristics_to_bro(c: uint32, len: uint8): TableVal
%{
uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF;
TableVal* char_set = new TableVal(zeek::lookup_type<TableType>("count_set"));
TableVal* char_set = new TableVal(zeek::vars::count_set);
for ( uint16 i=0; i < len; ++i )
{
if ( ((c >> i) & 0x1) == 1 )

6
src/file_analysis/analyzer/x509/X509.cc
View file

@ -367,21 +367,21 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
{
case GEN_DNS:
if ( names == nullptr )
names = new VectorVal(zeek::lookup_type<VectorType>("string_vec"));
names = new VectorVal(zeek::vars::string_vec);
names->Assign(names->Size(), bs);
break;
case GEN_URI:
if ( uris == nullptr )
uris = new VectorVal(zeek::lookup_type<VectorType>("string_vec"));
uris = new VectorVal(zeek::vars::string_vec);
uris->Assign(uris->Size(), bs);
break;
case GEN_EMAIL:
if ( emails == nullptr )
emails = new VectorVal(zeek::lookup_type<VectorType>("string_vec"));
emails = new VectorVal(zeek::vars::string_vec);
emails->Assign(emails->Size(), bs);
break;