Merge remote-tracking branch 'origin/topic/timw/1079-zeek-includes'

* origin/topic/timw/1079-zeek-includes:
  Move 'using namespace' declaration after other includes
  Use binpac.h as if it was an external dependency
  Fix includes of bif.h and _pac.h files to use full paths inside build directory
  Remove unnecessary include of NetVar.h from packet analysis plugins
  GH-1079: Use full paths starting with zeek/ when including files

CHANGES

@@ -1,3 +1,38 @@
+3.3.0-dev.524 | 2020-11-12 12:16:00 -0700
+
+  * Move 'using namespace' declaration after other includes (Tim Wojtulewicz, Corelight)
+
+  * Use binpac.h as if it was an external dependency (Tim Wojtulewicz, Corelight)
+
+  * Fix includes of bif.h and _pac.h files to use full paths inside build directory (Tim Wojtulewicz, Corelight)
+
+  * Remove unnecessary include of NetVar.h from packet analysis plugins (Tim Wojtulewicz, Corelight)
+
+  * GH-1079: Use full paths starting with zeek/ when including files (Tim Wojtulewicz, Corelight)
+
+  * Fix type clash fatal error with log filters that use $ext_func and $include/$exclude
+
+    The logging manager's Manager::TraverseRecord(), called when adding a
+    log filter to a stream, skipped any fields intoduced by a filter's
+    $ext_func when such fields weren't mentioned in a $include restriction
+    or mentioned in an $exclude restriction. This was inconsistent with
+    Manager::RecordToFilterVals, used when actually writing log entries,
+    which does include those values.
+
+    The result was that the record indices descent in Manager::RecordToFilterVals
+    expects to find only record values, when in fact only the record
+    provided by ext_func is present. This leads to type mismatches and
+    hard Zeek exits like this one:
+
+    1300475173.475401 fatal error in zeek/share/zeek//base/init-bare.zeek, line 4810: Val::CONVERTER (string/record) (zeek)
+
+    The fix makes ext_func's field additions decisive, meaning the
+    filter's include/exclude lists don't apply to it. If a user really
+    wants to override this, they can reset the filter's ext_func back to
+    our no-op default.
+
+    The included btest produces the above error when the fix is not present. (Christian Kreibich, Corelight)
+
 3.3.0-dev.516 | 2020-11-11 12:53:02 -0700
 
   * Support for additional DNS RR Type: LOC[29], SSHFP[44], NSEC3PARAM[51], custom BIND9 signaling[65534] (Fatema BW)

VERSION

@@ -1 +1 @@
-3.3.0-dev.516
+3.3.0-dev.524

src/Anon.cc

@@ -1,19 +1,19 @@
-#include "Anon.h"
+#include "zeek/Anon.h"
 
 #include <stdlib.h>
 #include <unistd.h>
 #include <assert.h>
 #include <sys/time.h>
 
-#include "util.h"
-#include "net_util.h"
-#include "Val.h"
-#include "NetVar.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "ID.h"
-#include "IPAddr.h"
-#include "Event.h"
+#include "zeek/util.h"
+#include "zeek/net_util.h"
+#include "zeek/Val.h"
+#include "zeek/NetVar.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/ID.h"
+#include "zeek/IPAddr.h"
+#include "zeek/Event.h"
 
 namespace zeek::detail {
 

src/Attr.cc

@@ -2,13 +2,13 @@
 
 #include "zeek-config.h"
 
-#include "Attr.h"
-#include "Expr.h"
-#include "Desc.h"
-#include "Val.h"
-#include "IntrusivePtr.h"
-#include "input/Manager.h"
-#include "threading/SerialTypes.h"
+#include "zeek/Attr.h"
+#include "zeek/Expr.h"
+#include "zeek/Desc.h"
+#include "zeek/Val.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/input/Manager.h"
+#include "zeek/threading/SerialTypes.h"
 
 namespace zeek::detail {
 

src/Attr.h

@@ -5,9 +5,9 @@
 #include <vector>
 #include <string>
 
-#include "Obj.h"
-#include "ZeekList.h"
-#include "IntrusivePtr.h"
+#include "zeek/Obj.h"
+#include "zeek/ZeekList.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
 

src/Base64.cc

@@ -1,11 +1,12 @@
 #include "zeek-config.h"
-#include "Base64.h"
-#include "ZeekString.h"
-#include "Reporter.h"
-#include "Conn.h"
 
 #include <math.h>
 
+#include "zeek/Base64.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Reporter.h"
+#include "zeek/Conn.h"
+
 namespace zeek::detail {
 
 int Base64Converter::default_base64_table[256];

src/BifReturnVal.cc

@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "BifReturnVal.h"
-#include "Val.h"
+#include "zeek/BifReturnVal.h"
+#include "zeek/Val.h"
 
 namespace zeek::detail {
 

src/BifReturnVal.h

@@ -3,7 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "IntrusivePtr.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 namespace zeek {

src/BroList.h

@@ -1,2 +1,2 @@
 #warning "BroList.h is deprecated and will be removed in v4.1. Use ZeekList.h instead."
-#include "ZeekList.h"
+#include "zeek/ZeekList.h"

src/BroString.h

@@ -1,2 +1,2 @@
 #warning "BroString.h is deprecated and will be removed in v4.1. Use ZeekString.h instead."
-#include "ZeekString.h"
+#include "zeek/ZeekString.h"

src/CCL.cc

@@ -1,12 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/CCL.h"
 
 #include <algorithm>
 
-#include "CCL.h"
-#include "RE.h"
-#include "DFA.h"
+#include "zeek/RE.h"
+#include "zeek/DFA.h"
 
 namespace zeek::detail {
 

src/CompHash.cc

@@ -1,19 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/CompHash.h"
 
 #include <cstring>
 #include <vector>
 #include <map>
 
-#include "CompHash.h"
-#include "ZeekString.h"
-#include "Dict.h"
-#include "Val.h"
-#include "RE.h"
-#include "Reporter.h"
-#include "Func.h"
-#include "IPAddr.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Dict.h"
+#include "zeek/Val.h"
+#include "zeek/RE.h"
+#include "zeek/Reporter.h"
+#include "zeek/Func.h"
+#include "zeek/IPAddr.h"
 
 namespace zeek::detail {
 

src/CompHash.h

@@ -4,8 +4,8 @@
 
 #include <memory>
 
-#include "Type.h"
-#include "IntrusivePtr.h"
+#include "zeek/Type.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(ListVal, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(HashKey, zeek::detail);

src/Conn.cc

@@ -1,25 +1,24 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "Conn.h"
+#include "zeek/Conn.h"
 
 #include <ctype.h>
+#include <binpac.h>
 
-#include "Desc.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "Event.h"
-#include "Sessions.h"
-#include "Reporter.h"
-#include "Timer.h"
-#include "iosource/IOSource.h"
-#include "analyzer/protocol/pia/PIA.h"
-#include "binpac.h"
-#include "TunnelEncapsulation.h"
-#include "analyzer/Analyzer.h"
-#include "analyzer/Manager.h"
-#include "iosource/IOSource.h"
+#include "zeek/Desc.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/Event.h"
+#include "zeek/Sessions.h"
+#include "zeek/Reporter.h"
+#include "zeek/Timer.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/TunnelEncapsulation.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/analyzer/Manager.h"
+#include "zeek/iosource/IOSource.h"
 
 namespace zeek {
 namespace detail {

src/Conn.h

@@ -8,18 +8,18 @@
 #include <tuple>
 #include <type_traits>
 
-#include "Dict.h"
-#include "Timer.h"
-#include "Rule.h"
-#include "IPAddr.h"
-#include "UID.h"
-#include "WeirdState.h"
-#include "ZeekArgs.h"
-#include "IntrusivePtr.h"
-#include "iosource/Packet.h"
+#include "zeek/Dict.h"
+#include "zeek/Timer.h"
+#include "zeek/Rule.h"
+#include "zeek/IPAddr.h"
+#include "zeek/UID.h"
+#include "zeek/WeirdState.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/iosource/Packet.h"
 
-#include "analyzer/Tag.h"
-#include "analyzer/Analyzer.h"
+#include "zeek/analyzer/Tag.h"
+#include "zeek/analyzer/Analyzer.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Connection, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(ConnectionTimer, zeek::detail);

src/Continuation.h

@@ -8,7 +8,7 @@
 
 #pragma once
 
-#include "List.h"
+#include "zeek/List.h"
 
 class Continuation {
 public:

src/ConvertUTF.c

@@ -94,7 +94,7 @@
 ------------------------------------------------------------------------ */
 
 
-#include "ConvertUTF.h"
+#include "zeek/ConvertUTF.h"
 #ifdef CVTUTF_DEBUG
 #include <stdio.h>
 #endif

src/DFA.cc

@@ -2,10 +2,10 @@
 
 #include "zeek-config.h"
 
-#include "DFA.h"
-#include "EquivClass.h"
-#include "Desc.h"
-#include "Hash.h"
+#include "zeek/DFA.h"
+#include "zeek/EquivClass.h"
+#include "zeek/Desc.h"
+#include "zeek/Hash.h"
 
 namespace zeek::detail {
 

src/DFA.h

@@ -3,15 +3,14 @@
 
 #pragma once
 
+#include <assert.h>
+#include <sys/types.h> // for u_char
 #include <map>
 #include <string>
 
-#include <assert.h>
-#include <sys/types.h> // for u_char
-
-#include "NFA.h"
-#include "RE.h" // for typedef AcceptingSet
-#include "Obj.h"
+#include "zeek/NFA.h"
+#include "zeek/RE.h" // for typedef AcceptingSet
+#include "zeek/Obj.h"
 
 namespace zeek::detail {
 

src/DNS_Mgr.cc

@@ -1,8 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "DNS_Mgr.h"
+#include "zeek/DNS_Mgr.h"
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -31,24 +30,23 @@
 
 #include <algorithm>
 
-#include "ZeekString.h"
-#include "Expr.h"
-#include "Event.h"
-#include "RunState.h"
-#include "Val.h"
-#include "NetVar.h"
-#include "ID.h"
-#include "Reporter.h"
-#include "IntrusivePtr.h"
-#include "iosource/Manager.h"
-#include "Hash.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Expr.h"
+#include "zeek/Event.h"
+#include "zeek/RunState.h"
+#include "zeek/Val.h"
+#include "zeek/NetVar.h"
+#include "zeek/ID.h"
+#include "zeek/Reporter.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/Hash.h"
 
 extern "C" {
 extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
 
 #include <netdb.h>
-
-#include "nb_dns.h"
+#include "zeek/nb_dns.h"
 }
 
 using namespace std;

src/DNS_Mgr.h

@@ -7,11 +7,11 @@
 #include <queue>
 #include <utility>
 
-#include "List.h"
-#include "EventHandler.h"
-#include "iosource/IOSource.h"
-#include "IPAddr.h"
-#include "util.h"
+#include "zeek/List.h"
+#include "zeek/EventHandler.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/IPAddr.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(EventHandler, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(DNS_Mgr_Request, zeek::detail);

src/DbgBreakpoint.cc

@@ -2,22 +2,22 @@
 
 #include "zeek-config.h"
 
-#include "DbgBreakpoint.h"
+#include "zeek/DbgBreakpoint.h"
 
 #include <assert.h>
 
-#include "Desc.h"
-#include "ID.h"
-#include "Queue.h"
-#include "Debug.h"
-#include "Scope.h"
-#include "Frame.h"
-#include "Func.h"
-#include "Val.h"
-#include "Stmt.h"
-#include "Timer.h"
-#include "Reporter.h"
-#include "module_util.h"
+#include "zeek/Desc.h"
+#include "zeek/ID.h"
+#include "zeek/Queue.h"
+#include "zeek/Debug.h"
+#include "zeek/Scope.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/Val.h"
+#include "zeek/Stmt.h"
+#include "zeek/Timer.h"
+#include "zeek/Reporter.h"
+#include "zeek/module_util.h"
 
 namespace zeek::detail {
 

src/DbgBreakpoint.h

@@ -3,7 +3,7 @@
 #pragma once
 
 #include <string>
-#include "util.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(ParseLocationRec, zeek::detail);

src/DbgHelp.cc

@@ -2,4 +2,4 @@
 
 #include "zeek-config.h"
 
-#include "Debug.h"
+#include "zeek/Debug.h"

src/DbgWatch.cc

@@ -1,10 +1,10 @@
 // Implementation of watches
 
 #include "zeek-config.h"
+#include "zeek/DbgWatch.h"
 
-#include "Debug.h"
-#include "DbgWatch.h"
-#include "Reporter.h"
+#include "zeek/Debug.h"
+#include "zeek/Reporter.h"
 
 namespace zeek::detail {
 

src/DbgWatch.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "util.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Expr, zeek::detail);
 namespace zeek { class Obj; }

src/Debug.cc

@@ -2,7 +2,7 @@
 
 #include "zeek-config.h"
 
-#include "Debug.h"
+#include "zeek/Debug.h"
 
 #include <stdio.h>
 #include <stdarg.h>
@@ -10,31 +10,32 @@
 #include <ctype.h>
 
 #include <string>
-using namespace std;
-
-#include "util.h"
-#include "DebugCmds.h"
-#include "DbgBreakpoint.h"
-#include "ID.h"
-#include "IntrusivePtr.h"
-#include "Expr.h"
-#include "Stmt.h"
-#include "Frame.h"
-#include "Func.h"
-#include "IntrusivePtr.h"
-#include "Scope.h"
-#include "PolicyFile.h"
-#include "Desc.h"
-#include "Reporter.h"
-#include "Val.h"
-#include "module_util.h"
-#include "input.h"
 
 #ifdef HAVE_READLINE
 #include <readline/readline.h>
 #include <readline/history.h>
 #endif
 
+#include "zeek/util.h"
+#include "zeek/DebugCmds.h"
+#include "zeek/DbgBreakpoint.h"
+#include "zeek/ID.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Expr.h"
+#include "zeek/Stmt.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Scope.h"
+#include "zeek/PolicyFile.h"
+#include "zeek/Desc.h"
+#include "zeek/Reporter.h"
+#include "zeek/Val.h"
+#include "zeek/module_util.h"
+#include "zeek/input.h"
+
+using namespace std;
+
 bool zeek::detail::g_policy_debug = false;
 bool& g_policy_debug = zeek::detail::g_policy_debug;
 

src/Debug.h

@@ -2,15 +2,15 @@
 
 #pragma once
 
-#include "Obj.h"
-#include "Queue.h"
-#include "StmtEnums.h"
-#include "util.h"
-
 #include <vector>
 #include <map>
 #include <string>
 
+#include "zeek/Obj.h"
+#include "zeek/Queue.h"
+#include "zeek/StmtEnums.h"
+#include "zeek/util.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Stmt, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);

src/DebugCmdInfoConstants.cc

@@ -4,7 +4,7 @@
 // DO NOT EDIT.
 //
 
-#include "util.h"
+#include "zeek/util.h"
 namespace zeek::detail {
 
 void init_global_dbg_constants () {

src/DebugCmds.cc

@@ -2,7 +2,7 @@
 // implementation of most commands.
 
 #include "zeek-config.h"
-#include "DebugCmds.h"
+#include "zeek/DebugCmds.h"
 
 #include <sys/types.h>
 
@@ -10,19 +10,19 @@
 #include <string.h>
 #include <assert.h>
 
-#include "DebugCmdInfoConstants.cc"
-#include "Debug.h"
-#include "Desc.h"
-#include "DbgBreakpoint.h"
-#include "ID.h"
-#include "Frame.h"
-#include "Func.h"
-#include "Stmt.h"
-#include "Scope.h"
-#include "Reporter.h"
-#include "PolicyFile.h"
-#include "Val.h"
-#include "util.h"
+#include "zeek/DebugCmdInfoConstants.cc"
+#include "zeek/Debug.h"
+#include "zeek/Desc.h"
+#include "zeek/DbgBreakpoint.h"
+#include "zeek/ID.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/Stmt.h"
+#include "zeek/Scope.h"
+#include "zeek/Reporter.h"
+#include "zeek/PolicyFile.h"
+#include "zeek/Val.h"
+#include "zeek/util.h"
 
 using namespace std;
 

src/DebugCmds.h

@@ -7,7 +7,9 @@
 #include <string>
 #include <vector>
 
-#include "Queue.h"
+#include "zeek/Queue.h"
+
+// This file is generated during the build.
 #include "DebugCmdConstants.h"
 
 namespace zeek::detail {

src/DebugLogger.cc

@@ -1,11 +1,12 @@
 #ifdef DEBUG
 
+#include "zeek/DebugLogger.h"
+
 #include <stdlib.h>
 #include <unistd.h>
 
-#include "DebugLogger.h"
-#include "RunState.h"
-#include "plugin/Plugin.h"
+#include "zeek/RunState.h"
+#include "zeek/plugin/Plugin.h"
 
 zeek::detail::DebugLogger zeek::detail::debug_logger;
 zeek::detail::DebugLogger& debug_logger = zeek::detail::debug_logger;

src/Desc.cc

@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Desc.h"
+#include "zeek/Desc.h"
 
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <math.h>
 
-#include "File.h"
-#include "Reporter.h"
-#include "ConvertUTF.h"
-#include "IPAddr.h"
+#include "zeek/File.h"
+#include "zeek/Reporter.h"
+#include "zeek/ConvertUTF.h"
+#include "zeek/IPAddr.h"
 
 #define DEFAULT_SIZE 128
 #define SLOP 10

src/Desc.h

@@ -2,14 +2,14 @@
 
 #pragma once
 
-#include "ZeekString.h" // for byte_vec
-#include "util.h" // for bro_int_t
+#include <sys/types.h> // for u_char
 
 #include <set>
 #include <utility>
 #include <string>
 
-#include <sys/types.h> // for u_char
+#include "zeek/ZeekString.h" // for byte_vec
+#include "zeek/util.h" // for bro_int_t
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPPrefix, zeek);

src/Dict.cc

@@ -1,8 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Dict.h"
-
 #include "zeek-config.h"
+#include "zeek/Dict.h"
 
 #ifdef HAVE_MEMORY_H
 #include <memory.h>
@@ -12,10 +11,10 @@
 #include <climits>
 #include <fstream>
 
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/3rdparty/doctest.h"
 
-#include "3rdparty/doctest.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
 #if defined(DEBUG) && defined(ZEEK_DICT_DEBUG)
 #define ASSERT_VALID(o)	o->AssertValid()

src/Dict.h

@@ -5,7 +5,7 @@
 #include <cstdint>
 #include <vector>
 
-#include "Hash.h"
+#include "zeek/Hash.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IterCookie, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(DictEntry, zeek::detail);

src/Discard.cc

@@ -2,17 +2,17 @@
 
 #include "zeek-config.h"
 
-#include "Discard.h"
+#include "zeek/Discard.h"
 
 #include <algorithm>
 
-#include "ZeekString.h"
-#include "RunState.h"
-#include "Func.h"
-#include "Var.h"
-#include "Val.h"
-#include "IP.h"
-#include "Reporter.h" // for InterpreterException
+#include "zeek/ZeekString.h"
+#include "zeek/RunState.h"
+#include "zeek/Func.h"
+#include "zeek/Var.h"
+#include "zeek/Val.h"
+#include "zeek/IP.h"
+#include "zeek/Reporter.h" // for InterpreterException
 
 namespace zeek::detail {
 

src/Discard.h

@@ -5,7 +5,7 @@
 #include <sys/types.h> // for u_char
 #include <memory>
 
-#include "IntrusivePtr.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);

src/EquivClass.cc

@@ -2,9 +2,9 @@
 
 #include "zeek-config.h"
 
-#include "EquivClass.h"
-#include "CCL.h"
-#include "util.h"
+#include "zeek/EquivClass.h"
+#include "zeek/CCL.h"
+#include "zeek/util.h"
 
 namespace zeek::detail {
 

src/Event.cc

@@ -2,16 +2,16 @@
 
 #include "zeek-config.h"
 
-#include "Event.h"
-#include "Desc.h"
-#include "Func.h"
-#include "NetVar.h"
-#include "Trigger.h"
-#include "Val.h"
-#include "plugin/Manager.h"
-#include "iosource/Manager.h"
-#include "iosource/PktSrc.h"
-#include "RunState.h"
+#include "zeek/Event.h"
+#include "zeek/Desc.h"
+#include "zeek/Func.h"
+#include "zeek/NetVar.h"
+#include "zeek/Trigger.h"
+#include "zeek/Val.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/iosource/Manager.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/RunState.h"
 
 zeek::EventMgr zeek::event_mgr;
 zeek::EventMgr& mgr = zeek::event_mgr;

src/Event.h

@@ -2,16 +2,16 @@
 
 #pragma once
 
-#include "ZeekList.h"
-#include "analyzer/Analyzer.h"
-#include "iosource/IOSource.h"
-#include "Flare.h"
-#include "ZeekArgs.h"
-#include "IntrusivePtr.h"
-
 #include <tuple>
 #include <type_traits>
 
+#include "zeek/ZeekList.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/iosource/IOSource.h"
+#include "zeek/Flare.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/IntrusivePtr.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(EventMgr, zeek);
 
 namespace zeek {

src/EventHandler.cc

@@ -1,14 +1,15 @@
-#include "EventHandler.h"
-#include "Event.h"
-#include "Desc.h"
-#include "Func.h"
-#include "Scope.h"
-#include "NetVar.h"
-#include "ID.h"
-#include "Var.h"
+#include "zeek/EventHandler.h"
 
-#include "broker/Manager.h"
-#include "broker/Data.h"
+#include "zeek/Event.h"
+#include "zeek/Desc.h"
+#include "zeek/Func.h"
+#include "zeek/Scope.h"
+#include "zeek/NetVar.h"
+#include "zeek/ID.h"
+#include "zeek/Var.h"
+
+#include "zeek/broker/Manager.h"
+#include "zeek/broker/Data.h"
 
 namespace zeek {
 

src/EventHandler.h

@@ -2,13 +2,13 @@
 
 #pragma once
 
-#include "ZeekList.h"
-#include "ZeekArgs.h"
-#include "Type.h"
-
 #include <unordered_set>
 #include <string>
 
+#include "zeek/ZeekList.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/Type.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
 
 namespace zeek {

src/EventLauncher.cc

@@ -1,9 +1,9 @@
-#include "Val.h"
-#include "analyzer/Analyzer.h"
-#include "EventLauncher.h"
-#include "Event.h"
-#include "NetVar.h"
-#include "Conn.h"
-#include "File.h"
+#include "zeek/Val.h"
+#include "zeek/analyzer/Analyzer.h"
+#include "zeek/EventLauncher.h"
+#include "zeek/Event.h"
+#include "zeek/NetVar.h"
+#include "zeek/Conn.h"
+#include "zeek/File.h"
 
 #include "event.bif.func_def"

src/EventRegistry.cc

@@ -1,8 +1,8 @@
-#include "EventRegistry.h"
-#include "EventHandler.h"
-#include "Func.h"
-#include "RE.h"
-#include "Reporter.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/EventHandler.h"
+#include "zeek/Func.h"
+#include "zeek/RE.h"
+#include "zeek/Reporter.h"
 
 namespace zeek {
 

src/Expr.cc

@@ -2,25 +2,25 @@
 
 #include "zeek-config.h"
 
-#include "Expr.h"
-#include "Event.h"
-#include "Desc.h"
-#include "Frame.h"
-#include "Func.h"
-#include "RE.h"
-#include "Scope.h"
-#include "Stmt.h"
-#include "EventRegistry.h"
-#include "RunState.h"
-#include "Traverse.h"
-#include "Trigger.h"
-#include "IPAddr.h"
-#include "digest.h"
-#include "module_util.h"
-#include "DebugLogger.h"
-#include "Hash.h"
+#include "zeek/Expr.h"
+#include "zeek/Event.h"
+#include "zeek/Desc.h"
+#include "zeek/Frame.h"
+#include "zeek/Func.h"
+#include "zeek/RE.h"
+#include "zeek/Scope.h"
+#include "zeek/Stmt.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/RunState.h"
+#include "zeek/Traverse.h"
+#include "zeek/Trigger.h"
+#include "zeek/IPAddr.h"
+#include "zeek/digest.h"
+#include "zeek/module_util.h"
+#include "zeek/DebugLogger.h"
+#include "zeek/Hash.h"
 
-#include "broker/Data.h"
+#include "zeek/broker/Data.h"
 
 namespace zeek::detail {
 

src/Expr.h

@@ -8,14 +8,14 @@
 #include <utility>
 #include <optional>
 
-#include "ZeekList.h"
-#include "IntrusivePtr.h"
-#include "Timer.h"
-#include "Type.h"
-#include "EventHandler.h"
-#include "TraverseTypes.h"
-#include "Val.h"
-#include "ZeekArgs.h"
+#include "zeek/ZeekList.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Timer.h"
+#include "zeek/Type.h"
+#include "zeek/EventHandler.h"
+#include "zeek/TraverseTypes.h"
+#include "zeek/Val.h"
+#include "zeek/ZeekArgs.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);

src/File.cc

@@ -1,7 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "File.h"
+#include "zeek/File.h"
 
 #include <sys/types.h>
 #ifdef TIME_WITH_SYS_TIME
@@ -21,15 +21,15 @@
 
 #include <algorithm>
 
-#include "Attr.h"
-#include "Type.h"
-#include "Expr.h"
-#include "NetVar.h"
-#include "RunState.h"
-#include "Event.h"
-#include "Reporter.h"
-#include "Desc.h"
-#include "Var.h"
+#include "zeek/Attr.h"
+#include "zeek/Type.h"
+#include "zeek/Expr.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/Event.h"
+#include "zeek/Reporter.h"
+#include "zeek/Desc.h"
+#include "zeek/Var.h"
 
 namespace zeek {
 

src/File.h

@@ -2,19 +2,19 @@
 
 #pragma once
 
+#include <fcntl.h>
+
 #include <list>
 #include <string>
 #include <utility>
 
-#include <fcntl.h>
-
 #ifdef NEED_KRB5_H
 #include <krb5.h>
 #endif // NEED_KRB5_H
 
-#include "Obj.h"
-#include "IntrusivePtr.h"
-#include "util.h"
+#include "zeek/Obj.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(PrintStmt, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Attributes, zeek::detail);

src/Flare.cc

@@ -1,11 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Flare.h"
-#include "Reporter.h"
+#include "zeek/Flare.h"
+
 #include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
 
+#include "zeek/Reporter.h"
+
 namespace zeek::detail {
 
 Flare::Flare()

src/Flare.h

@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "Pipe.h"
+#include "zeek/Pipe.h"
 
 namespace zeek::detail {
 

src/Frag.cc

@@ -2,13 +2,13 @@
 
 #include "zeek-config.h"
 
-#include "Frag.h"
-#include "Hash.h"
-#include "IP.h"
-#include "NetVar.h"
-#include "Sessions.h"
-#include "Reporter.h"
-#include "RunState.h"
+#include "zeek/Frag.h"
+#include "zeek/Hash.h"
+#include "zeek/IP.h"
+#include "zeek/NetVar.h"
+#include "zeek/Sessions.h"
+#include "zeek/Reporter.h"
+#include "zeek/RunState.h"
 
 constexpr uint32_t MIN_ACCEPTABLE_FRAG_SIZE = 64;
 constexpr uint32_t MAX_ACCEPTABLE_FRAG_SIZE = 64000;

src/Frag.h

@@ -2,14 +2,13 @@
 
 #pragma once
 
-#include "util.h" // for bro_uint_t
-#include "IPAddr.h"
-#include "Reassem.h"
-#include "Timer.h"
-
+#include <sys/types.h> // for u_char
 #include <tuple>
 
-#include <sys/types.h> // for u_char
+#include "zeek/util.h" // for bro_uint_t
+#include "zeek/IPAddr.h"
+#include "zeek/Reassem.h"
+#include "zeek/Timer.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);

src/Frame.cc

@@ -1,15 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Frame.h"
+#include "zeek/Frame.h"
 
 #include <broker/error.hh>
-#include "broker/Data.h"
 
-#include "Func.h"
-#include "Desc.h"
-#include "Trigger.h"
-#include "Val.h"
-#include "ID.h"
+#include "zeek/broker/Data.h"
+#include "zeek/Func.h"
+#include "zeek/Desc.h"
+#include "zeek/Trigger.h"
+#include "zeek/Val.h"
+#include "zeek/ID.h"
 
 std::vector<zeek::detail::Frame*> g_frame_stack;
 

src/Frame.h

@@ -2,11 +2,6 @@
 
 #pragma once
 
-#include "ZeekList.h" // for typedef val_list
-#include "Obj.h"
-#include "IntrusivePtr.h"
-#include "ZeekArgs.h"
-
 #include <unordered_map>
 #include <string>
 #include <utility>
@@ -16,6 +11,11 @@
 #include <broker/data.hh>
 #include <broker/expected.hh>
 
+#include "zeek/ZeekList.h" // for typedef val_list
+#include "zeek/Obj.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/ZeekArgs.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(CallExpr, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Trigger, zeek::detail::trigger);
 

src/Func.cc

@@ -2,7 +2,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Func.h"
+#include "zeek/Func.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -33,27 +33,27 @@
 
 #include <broker/error.hh>
 
-#include "Base64.h"
-#include "Debug.h"
-#include "Desc.h"
-#include "Expr.h"
-#include "Stmt.h"
-#include "Scope.h"
-#include "RunState.h"
-#include "NetVar.h"
-#include "File.h"
-#include "Frame.h"
-#include "Var.h"
-#include "analyzer/protocol/login/Login.h"
-#include "Sessions.h"
-#include "RE.h"
-#include "Event.h"
-#include "Traverse.h"
-#include "Reporter.h"
-#include "plugin/Manager.h"
-#include "module_util.h"
-#include "iosource/PktSrc.h"
-#include "iosource/PktDumper.h"
+#include "zeek/Base64.h"
+#include "zeek/Debug.h"
+#include "zeek/Desc.h"
+#include "zeek/Expr.h"
+#include "zeek/Stmt.h"
+#include "zeek/Scope.h"
+#include "zeek/RunState.h"
+#include "zeek/NetVar.h"
+#include "zeek/File.h"
+#include "zeek/Frame.h"
+#include "zeek/Var.h"
+#include "zeek/analyzer/protocol/login/Login.h"
+#include "zeek/Sessions.h"
+#include "zeek/RE.h"
+#include "zeek/Event.h"
+#include "zeek/Traverse.h"
+#include "zeek/Reporter.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/module_util.h"
+#include "zeek/iosource/PktSrc.h"
+#include "zeek/iosource/PktDumper.h"
 
 #include "zeek.bif.func_h"
 #include "stats.bif.func_h"

src/Func.h

@@ -9,13 +9,13 @@
 #include <tuple>
 #include <type_traits>
 
-#include "ZeekList.h"
-#include "Obj.h"
-#include "IntrusivePtr.h"
-#include "Type.h" /* for function_flavor */
-#include "TraverseTypes.h"
-#include "ZeekArgs.h"
-#include "BifReturnVal.h"
+#include "zeek/ZeekList.h"
+#include "zeek/Obj.h"
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Type.h" /* for function_flavor */
+#include "zeek/TraverseTypes.h"
+#include "zeek/ZeekArgs.h"
+#include "zeek/BifReturnVal.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Scope, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);

src/Hash.cc

@@ -1,18 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/Hash.h"
+
+#include <highwayhash/sip_hash.h>
+#include <highwayhash/highwayhash_target.h>
+#include <highwayhash/instruction_sets.h>
+
+#include "zeek/digest.h"
+#include "zeek/Reporter.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Val.h" // needed for const.bif
 
-#include "Hash.h"
-#include "digest.h"
-#include "Reporter.h"
-#include "ZeekString.h"
-#include "Val.h" // needed for const.bif
 #include "const.bif.netvar_h"
 
-#include "highwayhash/sip_hash.h"
-#include "highwayhash/highwayhash_target.h"
-#include "highwayhash/instruction_sets.h"
-
 namespace zeek::detail {
 
 alignas(32) uint64_t KeyedHash::shared_highwayhash_key[4];

src/Hash.h

@@ -19,12 +19,12 @@
 
 #pragma once
 
-#include "util.h" // for bro_int_t
-
 #include <stdlib.h>
 
+#include "zeek/util.h" // for bro_int_t
+
 // to allow bro_md5_hmac access to the hmac seed
-#include "ZeekArgs.h"
+#include "zeek/ZeekArgs.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Frame, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(BifReturnVal, zeek::detail);

src/ID.cc

@@ -2,23 +2,23 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/ID.h"
 
-#include "ID.h"
-#include "Attr.h"
-#include "Desc.h"
-#include "Expr.h"
-#include "Dict.h"
-#include "EventRegistry.h"
-#include "Func.h"
-#include "Scope.h"
-#include "Type.h"
-#include "File.h"
-#include "Traverse.h"
-#include "Val.h"
-#include "zeekygen/Manager.h"
-#include "zeekygen/IdentifierInfo.h"
-#include "zeekygen/ScriptInfo.h"
-#include "module_util.h"
+#include "zeek/Attr.h"
+#include "zeek/Desc.h"
+#include "zeek/Expr.h"
+#include "zeek/Dict.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/Func.h"
+#include "zeek/Scope.h"
+#include "zeek/Type.h"
+#include "zeek/File.h"
+#include "zeek/Traverse.h"
+#include "zeek/Val.h"
+#include "zeek/zeekygen/Manager.h"
+#include "zeek/zeekygen/IdentifierInfo.h"
+#include "zeek/zeekygen/ScriptInfo.h"
+#include "zeek/module_util.h"
 
 namespace zeek {
 

src/ID.h

@@ -2,17 +2,17 @@
 
 #pragma once
 
-#include "IntrusivePtr.h"
-#include "Obj.h"
-#include "Attr.h"
-#include "Notifier.h"
-#include "TraverseTypes.h"
-
 #include <map>
 #include <string>
 #include <string_view>
 #include <vector>
 
+#include "zeek/IntrusivePtr.h"
+#include "zeek/Obj.h"
+#include "zeek/Attr.h"
+#include "zeek/Notifier.h"
+#include "zeek/TraverseTypes.h"
+
 ZEEK_FORWARD_DECLARE_NAMESPACED(Func, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek);

src/IP.cc

@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "IP.h"
+#include "zeek/IP.h"
 
 #include <sys/types.h>
 #include <netinet/in.h>
 #include <netinet/icmp6.h>
 
-#include "IPAddr.h"
-#include "Type.h"
-#include "Val.h"
-#include "Var.h"
-#include "ZeekString.h"
-#include "Reporter.h"
+#include "zeek/IPAddr.h"
+#include "zeek/Type.h"
+#include "zeek/Val.h"
+#include "zeek/Var.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Reporter.h"
 
 namespace zeek {
 

src/IP.h

@@ -14,7 +14,7 @@
 
 #include <vector>
 
-#include "IntrusivePtr.h"
+#include "zeek/IntrusivePtr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IPAddr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);

src/IPAddr.cc

@@ -3,14 +3,14 @@
 #include <cstdlib>
 #include <string>
 #include <vector>
-#include "IPAddr.h"
-#include "Reporter.h"
-#include "ZeekString.h"
-#include "Conn.h"
-#include "Hash.h"
-#include "bro_inet_ntop.h"
 
-#include "analyzer/Manager.h"
+#include "zeek/IPAddr.h"
+#include "zeek/Reporter.h"
+#include "zeek/ZeekString.h"
+#include "zeek/Conn.h"
+#include "zeek/Hash.h"
+#include "zeek/bro_inet_ntop.h"
+#include "zeek/analyzer/Manager.h"
 
 namespace zeek {
 

src/IPAddr.h

@@ -8,7 +8,7 @@
 #include <string>
 #include <memory>
 
-#include "threading/SerialTypes.h"
+#include "zeek/threading/SerialTypes.h"
 
 namespace zeek { class String; }
 using BroString [[deprecated("Remove in v4.1. Use zeek::String instead.")]] = zeek::String;

src/IntSet.cc

@@ -1,12 +1,11 @@
 #include "zeek-config.h"
+#include "zeek/IntSet.h"
 
 #ifdef HAVE_MEMORY_H
 #include <memory.h>
 #endif
 #include <stdlib.h>
 
-#include "IntSet.h"
-
 namespace zeek::detail {
 
 void IntSet::Expand(unsigned int i)

src/List.cc

@@ -1,5 +1,5 @@
-#include <List.h>
-#include <3rdparty/doctest.h>
+#include "zeek/List.h"
+#include "zeek/3rdparty/doctest.h"
 
 TEST_CASE("list construction")
 	{

src/List.h

@@ -24,7 +24,7 @@
 #include <iterator>
 #include <utility>
 #include <cassert>
-#include "util.h"
+#include "zeek/util.h"
 
 namespace zeek {
 

src/NFA.cc

@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-
-#include "NFA.h"
-#include "Desc.h"
-#include "EquivClass.h"
-#include "IntSet.h"
+#include "zeek/NFA.h"
 
 #include <algorithm>
 
+#include "zeek/Desc.h"
+#include "zeek/EquivClass.h"
+#include "zeek/IntSet.h"
+
 namespace zeek::detail {
 
 static int nfa_state_id = 0;

src/NFA.h

@@ -2,8 +2,8 @@
 
 #pragma once
 
-#include "Obj.h"
-#include "List.h"
+#include "zeek/Obj.h"
+#include "zeek/List.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(CCL, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(EquivClass, zeek::detail);

src/Net.h

@@ -1,4 +1,4 @@
 #warning "Net.h is deprecated and will be removed in v4.1. Use RunState.h and/or ScannedFile.h instead."
 
-#include "RunState.h"
-#include "ScannedFile.h"
+#include "zeek/RunState.h"
+#include "zeek/ScannedFile.h"

src/NetVar.cc

@@ -2,11 +2,11 @@
 
 #include "zeek-config.h"
 
-#include "NetVar.h"
-#include "Var.h"
-#include "EventHandler.h"
-#include "Val.h"
-#include "ID.h"
+#include "zeek/NetVar.h"
+#include "zeek/Var.h"
+#include "zeek/EventHandler.h"
+#include "zeek/Val.h"
+#include "zeek/ID.h"
 
 zeek::RecordType* conn_id;
 zeek::RecordType* endpoint;

src/NetVar.h

@@ -2,9 +2,9 @@
 
 #pragma once
 
-#include "Val.h"
-#include "EventRegistry.h"
-#include "Stats.h"
+#include "zeek/Val.h"
+#include "zeek/EventRegistry.h"
+#include "zeek/Stats.h"
 
 namespace zeek::detail {
 

src/Notifier.cc

@@ -1,10 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Notifier.h"
-#include "DebugLogger.h"
-
 #include <set>
 
+#include "zeek/Notifier.h"
+#include "zeek/DebugLogger.h"
+
 zeek::notifier::detail::Registry zeek::notifier::detail::registry;
 zeek::notifier::detail::Registry& notifier::registry = zeek::notifier::detail::registry;
 

src/Obj.cc

@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Obj.h"
+#include "zeek/Obj.h"
 
 #include <stdlib.h>
 
-#include "Desc.h"
-#include "Func.h"
-#include "File.h"
-#include "plugin/Manager.h"
+#include "zeek/Desc.h"
+#include "zeek/Func.h"
+#include "zeek/File.h"
+#include "zeek/plugin/Manager.h"
 
 namespace zeek {
 namespace detail {

src/OpaqueVal.cc

@@ -1,20 +1,21 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek/OpaqueVal.h"
+
 #include <memory>
 
-#include "OpaqueVal.h"
-#include "CompHash.h"
-#include "NetVar.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "Desc.h"
-#include "Var.h"
-#include "probabilistic/BloomFilter.h"
-#include "probabilistic/CardinalityCounter.h"
-
 #include <broker/data.hh>
 #include <broker/error.hh>
 
+#include "zeek/CompHash.h"
+#include "zeek/NetVar.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/Desc.h"
+#include "zeek/Var.h"
+#include "zeek/probabilistic/BloomFilter.h"
+#include "zeek/probabilistic/CardinalityCounter.h"
+
 namespace zeek {
 
 // Helper to retrieve a broker value out of a broker::vector at a specified

src/OpaqueVal.h

@@ -2,15 +2,14 @@
 
 #pragma once
 
-#include "IntrusivePtr.h"
-#include "RandTest.h"
-#include "Val.h"
-#include "digest.h"
-#include "paraglob/paraglob.h"
-
-#include <broker/expected.hh>
-
 #include <sys/types.h> // for u_char
+#include <broker/expected.hh>
+#include <paraglob/paraglob.h>
+
+#include "zeek/IntrusivePtr.h"
+#include "zeek/RandTest.h"
+#include "zeek/Val.h"
+#include "zeek/digest.h"
 
 namespace broker { class data; }
 

src/Options.cc

@@ -2,10 +2,7 @@
 
 #include "zeek-config.h"
 
-#include "Options.h"
-
-#include <algorithm>
-#include <sstream>
+#include "zeek/Options.h"
 
 #include <unistd.h>
 
@@ -13,8 +10,11 @@
 #include <getopt.h>
 #endif
 
-#include "bsd-getopt-long.h"
-#include "logging/writers/ascii/Ascii.h"
+#include <algorithm>
+#include <sstream>
+
+#include "zeek/bsd-getopt-long.h"
+#include "zeek/logging/writers/ascii/Ascii.h"
 
 namespace zeek {
 

src/Options.h

@@ -6,7 +6,7 @@
 #include <string>
 #include <vector>
 
-#include "DNS_Mgr.h"
+#include "zeek/DNS_Mgr.h"
 
 namespace zeek {
 

src/PacketDumper.cc

@@ -1,10 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "PacketDumper.h"
-#include "Reporter.h"
-#include "util.h"
-#include "iosource/PktDumper.h"
+#include "zeek/PacketDumper.h"
+
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
+#include "zeek/iosource/PktDumper.h"
 
 namespace zeek::detail {
 

src/PacketDumper.h

@@ -4,9 +4,8 @@
 
 #pragma once
 
-#include <pcap.h>
-
 #include <sys/types.h> // for u_char
+#include <pcap.h>
 
 namespace zeek::detail {
 

src/PacketFilter.cc

@@ -1,5 +1,5 @@
-#include "PacketFilter.h"
-#include "IP.h"
+#include "zeek/PacketFilter.h"
+#include "zeek/IP.h"
 
 namespace zeek::detail {
 

src/PacketFilter.h

@@ -3,8 +3,9 @@
 #pragma once
 
 #include <memory>
-#include "IPAddr.h"
-#include "PrefixTable.h"
+
+#include "zeek/IPAddr.h"
+#include "zeek/PrefixTable.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);

src/Pipe.cc

@@ -1,12 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Pipe.h"
-#include "Reporter.h"
+#include "zeek/Pipe.h"
+
 #include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
 #include <cstdio>
 
+#include "zeek/Reporter.h"
+
 namespace zeek::detail {
 
 static void pipe_fail(int eno)

src/PolicyFile.cc

@@ -1,19 +1,19 @@
 #include "zeek-config.h"
+#include "zeek/PolicyFile.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <assert.h>
-
-#include <map>
 #include <stdio.h>
 #include <errno.h>
+
 #include <string>
 #include <vector>
+#include <map>
 
-#include "Debug.h"
-#include "util.h"
-#include "PolicyFile.h"
-#include "Reporter.h"
+#include "zeek/Debug.h"
+#include "zeek/util.h"
+#include "zeek/Reporter.h"
 
 using namespace std;
 

src/PrefixTable.cc

@@ -1,6 +1,6 @@
-#include "PrefixTable.h"
-#include "Reporter.h"
-#include "Val.h"
+#include "zeek/PrefixTable.h"
+#include "zeek/Reporter.h"
+#include "zeek/Val.h"
 
 namespace zeek::detail {
 

src/PrefixTable.h

@@ -1,12 +1,12 @@
 #pragma once
 
 extern "C" {
-	#include "patricia.h"
+	#include "zeek/patricia.h"
 }
 
 #include <list>
 
-#include "IPAddr.h"
+#include "zeek/IPAddr.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
 ZEEK_FORWARD_DECLARE_NAMESPACED(SubNetVal, zeek);

src/PriorityQueue.cc

@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "zeek/PriorityQueue.h"
 
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "PriorityQueue.h"
-#include "Reporter.h"
-#include "util.h"
+#include "zeek/Reporter.h"
+#include "zeek/util.h"
 
 namespace zeek::detail {
 

src/RE.cc

@@ -1,16 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "RE.h"
+#include "zeek/RE.h"
 
 #include <stdlib.h>
 #include <utility>
 
-#include "DFA.h"
-#include "CCL.h"
-#include "EquivClass.h"
-#include "Reporter.h"
-#include "ZeekString.h"
+#include "zeek/DFA.h"
+#include "zeek/CCL.h"
+#include "zeek/EquivClass.h"
+#include "zeek/Reporter.h"
+#include "zeek/ZeekString.h"
 
 zeek::detail::CCL* zeek::detail::curr_ccl = nullptr;
 zeek::detail::CCL*& curr_ccl = zeek::detail::curr_ccl;

src/RE.h

@@ -2,16 +2,16 @@
 
 #pragma once
 
-#include "List.h"
-#include "CCL.h"
-#include "EquivClass.h"
-
+#include <sys/types.h> // for u_char
+#include <ctype.h>
 #include <set>
 #include <map>
 #include <string>
 
-#include <sys/types.h> // for u_char
-#include <ctype.h>
+#include "zeek/List.h"
+#include "zeek/CCL.h"
+#include "zeek/EquivClass.h"
+
 typedef int (*cce_func)(int);
 
 namespace zeek { class String; }

src/RandTest.cc

@@ -12,7 +12,7 @@
 	Modified for Bro by Seth Hall - July 2010
 */
 
-#include "RandTest.h"
+#include "zeek/RandTest.h"
 
 #include <math.h>
 

src/Reassem.cc

@@ -1,11 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
-#include "Reassem.h"
+#include "zeek/Reassem.h"
 
 #include <algorithm>
 
-#include "Desc.h"
+#include "zeek/Desc.h"
 
 using std::min;
 

src/Reassem.h

@@ -2,14 +2,13 @@
 
 #pragma once
 
-#include <map>
-
-#include "Obj.h"
-
 #include <assert.h>
 #include <string.h>
 #include <sys/types.h> // for u_char
 #include <cstdint>
+#include <map>
+
+#include "zeek/Obj.h"
 
 namespace zeek {
 

src/Reporter.cc

@@ -3,24 +3,24 @@
 //
 
 #include "zeek-config.h"
-#include "Reporter.h"
+#include "zeek/Reporter.h"
 
 #include <unistd.h>
 #include <syslog.h>
 
-#include "Desc.h"
-#include "Event.h"
-#include "Expr.h"
-#include "NetVar.h"
-#include "RunState.h"
-#include "Conn.h"
-#include "Timer.h"
-#include "ID.h"
-#include "EventHandler.h"
-#include "plugin/Plugin.h"
-#include "plugin/Manager.h"
-#include "input.h"
-#include "file_analysis/File.h"
+#include "zeek/Desc.h"
+#include "zeek/Event.h"
+#include "zeek/Expr.h"
+#include "zeek/NetVar.h"
+#include "zeek/RunState.h"
+#include "zeek/Conn.h"
+#include "zeek/Timer.h"
+#include "zeek/ID.h"
+#include "zeek/EventHandler.h"
+#include "zeek/plugin/Plugin.h"
+#include "zeek/plugin/Manager.h"
+#include "zeek/input.h"
+#include "zeek/file_analysis/File.h"
 
 #ifdef SYSLOG_INT
 extern "C" {

src/Reporter.h

@@ -12,8 +12,8 @@
 #include <unordered_set>
 #include <unordered_map>
 
-#include "ZeekList.h"
-#include "net_util.h"
+#include "zeek/ZeekList.h"
+#include "zeek/net_util.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Analyzer, zeek, analyzer);
 ZEEK_FORWARD_DECLARE_NAMESPACED(File, zeek, file_analysis);

src/Rule.cc

@@ -1,9 +1,9 @@
 #include "zeek-config.h"
 
-#include "Rule.h"
-#include "RuleAction.h"
-#include "RuleCondition.h"
-#include "RuleMatcher.h"
+#include "zeek/Rule.h"
+#include "zeek/RuleAction.h"
+#include "zeek/RuleCondition.h"
+#include "zeek/RuleMatcher.h"
 
 namespace zeek::detail {
 

src/Rule.h

@@ -1,13 +1,12 @@
 #pragma once
 
-#include "List.h"
-#include "Obj.h"
-
-#include <map>
-#include <string>
-
 #include <limits.h>
 #include <stdint.h>
+#include <map>
+#include <string>
+
+#include "zeek/List.h"
+#include "zeek/Obj.h"
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleCondition, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleAction, zeek::detail);

src/RuleAction.cc

@@ -1,16 +1,16 @@
-#include <string>
-using std::string;
-
 #include "zeek-config.h"
+#include "zeek/RuleAction.h"
 
-#include "RuleAction.h"
-#include "RuleMatcher.h"
-#include "Conn.h"
-#include "Event.h"
-#include "NetVar.h"
-#include "analyzer/protocol/pia/PIA.h"
+#include <string>
 
-#include "analyzer/Manager.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/Conn.h"
+#include "zeek/Event.h"
+#include "zeek/NetVar.h"
+#include "zeek/analyzer/protocol/pia/PIA.h"
+#include "zeek/analyzer/Manager.h"
+
+using std::string;
 
 namespace zeek::detail {
 

src/RuleAction.h

@@ -1,10 +1,9 @@
 #pragma once
 
-#include "analyzer/Tag.h"
-
-#include <string>
+#include "zeek/analyzer/Tag.h"
 
 #include <sys/types.h> // for u_char
+#include <string>
 
 ZEEK_FORWARD_DECLARE_NAMESPACED(Rule, zeek::detail);
 ZEEK_FORWARD_DECLARE_NAMESPACED(RuleEndpointState, zeek::detail);

src/RuleCondition.cc

@@ -1,13 +1,13 @@
 #include "zeek-config.h"
 
-#include "RuleCondition.h"
-#include "RuleMatcher.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "Reporter.h"
-#include "Scope.h"
-#include "Func.h"
-#include "ID.h"
-#include "Val.h"
+#include "zeek/RuleCondition.h"
+#include "zeek/RuleMatcher.h"
+#include "zeek/analyzer/protocol/tcp/TCP.h"
+#include "zeek/Reporter.h"
+#include "zeek/Scope.h"
+#include "zeek/Func.h"
+#include "zeek/ID.h"
+#include "zeek/Val.h"
 
 static inline bool is_established(const zeek::analyzer::tcp::TCP_Endpoint* e)
 	{