mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
Merge remote-tracking branch 'origin/topic/timw/266-namespaces'
Merge adjustments: - Preserved original `base_type_no_ref` argument type as ::TypeTag - Removed superfluous #pragma guard around deprecated TableVal ctor - Clarify NEWS regarding MetaHook{Pre,Post} deprecations - Simplify some `::zeek::` qualifications to just `zeek::` - Prefixed FORWARD_DECLARE_NAMESPACED macro with ZEEK_ * origin/topic/timw/266-namespaces: Disable some deprecation diagnostics for GCC Rename BroType to Type Update NEWS Review cleanup Move Type types to zeek namespace Move Flare/Pipe from the bro namespace to zeek::detail Move Attr to the zeek::detail namespace Move Trigger into the zeek::detail namespace Move ID to the zeek::detail namespace Move Anon.h into zeek::detail namespace Mark all of the aliased classes in plugin/Plugin.h deprecated, and fix all of the plugins that were using them Move all of the base plugin classes into the zeek::plugin namespace Expr: move all classes into zeek::detail Stmt: move Stmt classes into zeek::detail namespace Add utility macro for creating namespaced aliases for classes
This commit is contained in:
commit
d4f3cad7d1
256 changed files with 4277 additions and 3501 deletions
|
@ -20,7 +20,7 @@ static void analyzer_del_func(void* v)
|
|||
|
||||
AnalyzerSet::AnalyzerSet(File* arg_file) : file(arg_file)
|
||||
{
|
||||
auto t = make_intrusive<TypeList>();
|
||||
auto t = make_intrusive<zeek::TypeList>();
|
||||
t->Append(file_mgr->GetTagType());
|
||||
t->Append(zeek::BifType::Record::Files::AnalyzerArgs);
|
||||
analyzer_hash = new CompositeHash(std::move(t));
|
||||
|
@ -156,7 +156,7 @@ bool AnalyzerSet::RemoveMod::Perform(AnalyzerSet* set)
|
|||
std::unique_ptr<HashKey> AnalyzerSet::GetKey(const file_analysis::Tag& t,
|
||||
IntrusivePtr<RecordVal> args) const
|
||||
{
|
||||
auto lv = make_intrusive<ListVal>(TYPE_ANY);
|
||||
auto lv = make_intrusive<ListVal>(zeek::TYPE_ANY);
|
||||
lv->Append(t.AsVal());
|
||||
lv->Append(std::move(args));
|
||||
auto key = analyzer_hash->MakeHashKey(*lv, true);
|
||||
|
|
|
@ -9,7 +9,7 @@
|
|||
using namespace file_analysis;
|
||||
|
||||
Component::Component(const std::string& name, factory_callback arg_factory, Tag::subtype_t subtype)
|
||||
: plugin::Component(plugin::component::FILE_ANALYZER, name),
|
||||
: zeek::plugin::Component(zeek::plugin::component::FILE_ANALYZER, name),
|
||||
plugin::TaggedComponent<file_analysis::Tag>(subtype)
|
||||
{
|
||||
factory = arg_factory;
|
||||
|
@ -17,7 +17,7 @@ Component::Component(const std::string& name, factory_callback arg_factory, Tag:
|
|||
}
|
||||
|
||||
Component::Component(const std::string& name, factory_function arg_factory, Tag::subtype_t subtype)
|
||||
: plugin::Component(plugin::component::FILE_ANALYZER, name),
|
||||
: zeek::plugin::Component(zeek::plugin::component::FILE_ANALYZER, name),
|
||||
plugin::TaggedComponent<file_analysis::Tag>(subtype)
|
||||
{
|
||||
factory = nullptr;
|
||||
|
|
|
@ -22,7 +22,7 @@ class Manager;
|
|||
* A plugin can provide a specific file analyzer by registering this
|
||||
* analyzer component, describing the analyzer.
|
||||
*/
|
||||
class Component : public plugin::Component,
|
||||
class Component : public zeek::plugin::Component,
|
||||
public plugin::TaggedComponent<file_analysis::Tag> {
|
||||
public:
|
||||
typedef Analyzer* (*factory_callback)(RecordVal* args, File* file);
|
||||
|
|
|
@ -23,10 +23,10 @@ using namespace file_analysis;
|
|||
|
||||
static IntrusivePtr<TableVal> empty_connection_table()
|
||||
{
|
||||
auto tbl_index = make_intrusive<TypeList>(zeek::id::conn_id);
|
||||
auto tbl_index = make_intrusive<zeek::TypeList>(zeek::id::conn_id);
|
||||
tbl_index->Append(zeek::id::conn_id);
|
||||
auto tbl_type = make_intrusive<TableType>(std::move(tbl_index),
|
||||
zeek::id::connection);
|
||||
auto tbl_type = make_intrusive<zeek::TableType>(std::move(tbl_index),
|
||||
zeek::id::connection);
|
||||
return make_intrusive<TableVal>(std::move(tbl_type));
|
||||
}
|
||||
|
||||
|
@ -170,7 +170,7 @@ double File::LookupFieldDefaultInterval(int idx) const
|
|||
return v->AsInterval();
|
||||
}
|
||||
|
||||
int File::Idx(const std::string& field, const RecordType* type)
|
||||
int File::Idx(const std::string& field, const zeek::RecordType* type)
|
||||
{
|
||||
int rval = type->FieldOffset(field.c_str());
|
||||
|
||||
|
|
|
@ -14,10 +14,11 @@
|
|||
#include "WeirdState.h"
|
||||
|
||||
class Connection;
|
||||
class RecordType;
|
||||
class RecordVal;
|
||||
class EventHandlerPtr;
|
||||
|
||||
ZEEK_FORWARD_DECLARE_NAMESPACED(RecordType, zeek);
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
class FileReassembler;
|
||||
|
@ -336,8 +337,8 @@ protected:
|
|||
* @param type the record type for which the field will be looked up.
|
||||
* @return the field offset in #val record corresponding to \a field_name.
|
||||
*/
|
||||
static int Idx(const std::string& field_name, const RecordType* type);
|
||||
static int Idx(const std::string& field_name, const IntrusivePtr<RecordType>& type)
|
||||
static int Idx(const std::string& field_name, const zeek::RecordType* type);
|
||||
static int Idx(const std::string& field_name, const IntrusivePtr<zeek::RecordType>& type)
|
||||
{ return Idx(field_name, type.get()); }
|
||||
|
||||
/**
|
||||
|
|
|
@ -519,8 +519,8 @@ string Manager::DetectMIME(const u_char* data, uint64_t len) const
|
|||
|
||||
IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
|
||||
{
|
||||
static auto mime_matches = zeek::id::find_type<VectorType>("mime_matches");
|
||||
static auto mime_match = zeek::id::find_type<RecordType>("mime_match");
|
||||
static auto mime_matches = zeek::id::find_type<zeek::VectorType>("mime_matches");
|
||||
static auto mime_match = zeek::id::find_type<zeek::RecordType>("mime_match");
|
||||
auto rval = make_intrusive<VectorVal>(mime_matches);
|
||||
|
||||
for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin();
|
||||
|
|
|
@ -428,7 +428,7 @@ private:
|
|||
MIMEMap mime_types;/**< Mapping of MIME types to analyzers. */
|
||||
|
||||
inline static TableVal* disabled = nullptr; /**< Table of disabled analyzers. */
|
||||
inline static TableType* tag_set_type = nullptr; /**< Type for set[tag]. */
|
||||
inline static zeek::TableType* tag_set_type = nullptr; /**< Type for set[tag]. */
|
||||
|
||||
size_t cumulative_files;
|
||||
size_t max_files;
|
||||
|
|
|
@ -7,11 +7,17 @@
|
|||
|
||||
class EnumVal;
|
||||
|
||||
namespace zeek::plugin {
|
||||
template <class T> class TaggedComponent;
|
||||
template <class T, class C> class ComponentManager;
|
||||
}
|
||||
namespace plugin {
|
||||
template <class T>
|
||||
class TaggedComponent;
|
||||
template <class T, class C>
|
||||
class ComponentManager;
|
||||
template <class T>
|
||||
using TaggedComponent [[deprecated("Remove in v4.1. Use zeek::plugin::TaggedComponent instead.")]] =
|
||||
zeek::plugin::TaggedComponent<T>;
|
||||
template <class T, class C>
|
||||
using ComponentManager [[deprecated("Remove in v4.1. Use zeek::plugin::ComponentManager instead.")]] =
|
||||
zeek::plugin::ComponentManager<T, C>;
|
||||
}
|
||||
|
||||
namespace file_analysis {
|
||||
|
@ -90,8 +96,8 @@ public:
|
|||
static const Tag Error;
|
||||
|
||||
protected:
|
||||
friend class plugin::ComponentManager<Tag, Component>;
|
||||
friend class plugin::TaggedComponent<Tag>;
|
||||
friend class zeek::plugin::ComponentManager<Tag, Component>;
|
||||
friend class zeek::plugin::TaggedComponent<Tag>;
|
||||
|
||||
/**
|
||||
* Constructor.
|
||||
|
|
|
@ -7,13 +7,13 @@
|
|||
namespace plugin {
|
||||
namespace Zeek_FileDataEvent {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure() override
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new ::file_analysis::Component("DATA_EVENT", ::file_analysis::DataEvent::Instantiate));
|
||||
|
||||
plugin::Configuration config;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::FileDataEvent";
|
||||
config.description = "Delivers file content";
|
||||
return config;
|
||||
|
|
|
@ -62,7 +62,7 @@ void Entropy::Finalize()
|
|||
montepi = scc = ent = mean = chisq = 0.0;
|
||||
entropy->Get(&ent, &chisq, &mean, &montepi, &scc);
|
||||
|
||||
static auto entropy_test_result = zeek::id::find_type<RecordType>("entropy_test_result");
|
||||
static auto entropy_test_result = zeek::id::find_type<zeek::RecordType>("entropy_test_result");
|
||||
auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
|
||||
ent_result->Assign<DoubleVal>(0, ent);
|
||||
ent_result->Assign<DoubleVal>(1, chisq);
|
||||
|
|
|
@ -7,13 +7,13 @@
|
|||
namespace plugin {
|
||||
namespace Zeek_FileEntropy {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure() override
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new ::file_analysis::Component("ENTROPY", ::file_analysis::Entropy::Instantiate));
|
||||
|
||||
plugin::Configuration config;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::FileEntropy";
|
||||
config.description = "Entropy test file content";
|
||||
return config;
|
||||
|
|
|
@ -7,13 +7,13 @@
|
|||
namespace plugin {
|
||||
namespace Zeek_FileExtract {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure() override
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new ::file_analysis::Component("EXTRACT", ::file_analysis::Extract::Instantiate));
|
||||
|
||||
plugin::Configuration config;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::FileExtract";
|
||||
config.description = "Extract file content";
|
||||
return config;
|
||||
|
|
|
@ -7,15 +7,15 @@
|
|||
namespace plugin {
|
||||
namespace Zeek_FileHash {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure() override
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new ::file_analysis::Component("MD5", ::file_analysis::MD5::Instantiate));
|
||||
AddComponent(new ::file_analysis::Component("SHA1", ::file_analysis::SHA1::Instantiate));
|
||||
AddComponent(new ::file_analysis::Component("SHA256", ::file_analysis::SHA256::Instantiate));
|
||||
|
||||
plugin::Configuration config;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::FileHash";
|
||||
config.description = "Hash file content";
|
||||
return config;
|
||||
|
|
|
@ -7,13 +7,13 @@
|
|||
namespace plugin {
|
||||
namespace Zeek_PE {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure() override
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new ::file_analysis::Component("PE", ::file_analysis::PE::Instantiate));
|
||||
|
||||
plugin::Configuration config;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::PE";
|
||||
config.description = "Portable Executable analyzer";
|
||||
return config;
|
||||
|
|
|
@ -9,13 +9,13 @@
|
|||
namespace plugin {
|
||||
namespace Zeek_Unified2 {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure() override
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new ::file_analysis::Component("UNIFIED2", ::file_analysis::Unified2::Instantiate));
|
||||
|
||||
plugin::Configuration config;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::Unified2";
|
||||
config.description = "Analyze Unified2 alert files.";
|
||||
return config;
|
||||
|
|
|
@ -620,7 +620,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
|
|||
//ocsp_resp_record->Assign(7, make_intrusive<StringVal>(len, buf));
|
||||
//BIO_reset(bio);
|
||||
|
||||
certs_vector = new VectorVal(zeek::id::find_type<VectorType>("x509_opaque_vector"));
|
||||
certs_vector = new VectorVal(zeek::id::find_type<zeek::VectorType>("x509_opaque_vector"));
|
||||
vl.emplace_back(AdoptRef{}, certs_vector);
|
||||
|
||||
#if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
|
||||
|
@ -675,4 +675,3 @@ void file_analysis::OCSP::ParseExtensionsSpecific(X509_EXTENSION* ex, bool globa
|
|||
#endif
|
||||
ParseSignedCertificateTimestamps(ex);
|
||||
}
|
||||
|
||||
|
|
|
@ -8,15 +8,15 @@
|
|||
namespace plugin {
|
||||
namespace Zeek_X509 {
|
||||
|
||||
class Plugin : public plugin::Plugin {
|
||||
class Plugin : public zeek::plugin::Plugin {
|
||||
public:
|
||||
plugin::Configuration Configure() override
|
||||
zeek::plugin::Configuration Configure() override
|
||||
{
|
||||
AddComponent(new ::file_analysis::Component("X509", ::file_analysis::X509::Instantiate));
|
||||
AddComponent(new ::file_analysis::Component("OCSP_REQUEST", ::file_analysis::OCSP::InstantiateRequest));
|
||||
AddComponent(new ::file_analysis::Component("OCSP_REPLY", ::file_analysis::OCSP::InstantiateReply));
|
||||
|
||||
plugin::Configuration config;
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::X509";
|
||||
config.description = "X509 and OCSP analyzer";
|
||||
return config;
|
||||
|
@ -24,7 +24,7 @@ public:
|
|||
|
||||
void Done() override
|
||||
{
|
||||
plugin::Plugin::Done();
|
||||
zeek::plugin::Plugin::Done();
|
||||
::file_analysis::X509::FreeRootStore();
|
||||
}
|
||||
} plugin;
|
||||
|
|
|
@ -395,7 +395,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
|
|||
else if ( gen->type == GEN_IPADD )
|
||||
{
|
||||
if ( ips == nullptr )
|
||||
ips = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("addr_vec"));
|
||||
ips = make_intrusive<VectorVal>(zeek::id::find_type<zeek::VectorType>("addr_vec"));
|
||||
|
||||
uint32_t* addr = (uint32_t*) gen->d.ip->data;
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue