From d9edd855da1b7a076d263ca7e116bc57bc1fa393 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Tue, 7 Apr 2020 21:32:55 -0700 Subject: [PATCH] Update deprecated ValManager::GetBool usages --- src/CompHash.cc | 2 +- src/Conn.cc | 6 +- src/DNS_Mgr.cc | 2 +- src/Expr.cc | 30 ++++---- src/IP.cc | 12 ++-- src/RuleMatcher.cc | 2 +- src/SmithWaterman.cc | 2 +- src/Stats.cc | 2 +- src/Type.cc | 2 +- src/analyzer/analyzer.bif | 6 +- src/analyzer/protocol/asn1/asn1.pac | 2 +- .../protocol/bittorrent/BitTorrent.cc | 2 +- .../protocol/bittorrent/BitTorrentTracker.cc | 2 +- src/analyzer/protocol/conn-size/ConnSize.cc | 4 +- src/analyzer/protocol/dhcp/dhcp-options.pac | 4 +- src/analyzer/protocol/dns/DNS.cc | 12 ++-- src/analyzer/protocol/finger/Finger.cc | 2 +- src/analyzer/protocol/ftp/FTP.cc | 2 +- src/analyzer/protocol/ftp/functions.bif | 4 +- src/analyzer/protocol/gnutella/Gnutella.cc | 10 +-- .../protocol/gtpv1/gtpv1-analyzer.pac | 18 ++--- src/analyzer/protocol/http/HTTP.cc | 16 ++--- src/analyzer/protocol/icmp/ICMP.cc | 34 ++++----- src/analyzer/protocol/irc/IRC.cc | 72 +++++++++---------- src/analyzer/protocol/krb/krb-analyzer.pac | 30 ++++---- .../protocol/modbus/modbus-analyzer.pac | 2 +- .../protocol/mqtt/commands/connack.pac | 2 +- .../protocol/mqtt/commands/connect.pac | 4 +- .../protocol/mqtt/commands/publish.pac | 4 +- src/analyzer/protocol/netbios/NetbiosSSN.cc | 4 +- src/analyzer/protocol/ntlm/ntlm-analyzer.pac | 46 ++++++------ src/analyzer/protocol/ntp/ntp-analyzer.pac | 8 +-- src/analyzer/protocol/pop3/POP3.cc | 2 +- src/analyzer/protocol/rdp/rdp-analyzer.pac | 46 ++++++------ src/analyzer/protocol/rpc/NFS.cc | 6 +- src/analyzer/protocol/rpc/Portmap.cc | 6 +- .../protocol/smb/smb1-com-negotiate.pac | 52 +++++++------- .../smb/smb1-com-session-setup-andx.pac | 28 ++++---- .../protocol/smb/smb2-com-session-setup.pac | 6 +- src/analyzer/protocol/smb/smb2-protocol.pac | 30 ++++---- src/analyzer/protocol/smtp/SMTP.cc | 10 +-- src/analyzer/protocol/snmp/snmp-analyzer.pac | 6 +- src/analyzer/protocol/ssh/ssh-analyzer.pac | 2 +- .../protocol/stepping-stone/SteppingStone.cc | 2 +- src/analyzer/protocol/tcp/TCP.cc | 16 ++--- src/analyzer/protocol/tcp/TCP_Endpoint.cc | 2 +- src/analyzer/protocol/tcp/TCP_Reassembler.cc | 8 +-- src/analyzer/protocol/udp/UDP.cc | 2 +- src/broker/Data.cc | 2 +- src/broker/data.bif | 24 +++---- src/broker/messaging.bif | 18 ++--- src/broker/store.bif | 4 +- src/file_analysis/File.cc | 4 +- src/file_analysis/Manager.cc | 2 +- .../analyzer/extract/functions.bif | 2 +- src/file_analysis/analyzer/x509/X509.cc | 4 +- src/file_analysis/analyzer/x509/X509Common.cc | 4 +- src/file_analysis/analyzer/x509/functions.bif | 2 +- src/file_analysis/file_analysis.bif | 14 ++-- src/input/Manager.cc | 4 +- src/input/input.bif | 10 +-- src/iosource/pcap/pcap.bif | 4 +- src/logging/Manager.cc | 2 +- src/logging/logging.bif | 18 ++--- src/option.bif | 6 +- src/supervisor/Supervisor.cc | 2 +- src/supervisor/supervisor.bif | 16 ++--- src/zeek.bif | 24 +++---- 68 files changed, 370 insertions(+), 370 deletions(-) diff --git a/src/CompHash.cc b/src/CompHash.cc index be576228fd..aab4c0c6b6 100644 --- a/src/CompHash.cc +++ b/src/CompHash.cc @@ -768,7 +768,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0, if ( tag == TYPE_ENUM ) *pval = t->AsEnumType()->GetVal(*kp); else if ( tag == TYPE_BOOL ) - *pval = {AdoptRef{}, val_mgr->GetBool(*kp)}; + *pval = val_mgr->Bool(*kp); else if ( tag == TYPE_INT ) *pval = {AdoptRef{}, val_mgr->GetInt(*kp)}; else diff --git a/src/Conn.cc b/src/Conn.cc index 95ee5af8f2..8cddcad7cd 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -261,7 +261,7 @@ void Connection::HistoryThresholdEvent(EventHandlerPtr e, bool is_orig, EnqueueEvent(e, nullptr, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)} ); } @@ -391,7 +391,7 @@ RecordVal* Connection::BuildConnVal() conn_val->Assign(3, make_intrusive(start_time, TYPE_TIME)); // ### conn_val->Assign(4, make_intrusive(last_time - start_time, TYPE_INTERVAL)); conn_val->Assign(6, make_intrusive(history.c_str())); - conn_val->Assign(11, val_mgr->GetBool(is_successful)); + conn_val->Assign(11, val_mgr->Bool(is_successful)); conn_val->SetOrigin(this); @@ -698,7 +698,7 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label) { EnqueueEvent(connection_flow_label_changed, nullptr, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(my_flow_label)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flow_label)} ); diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc index d627a09c73..7b27feb27c 100644 --- a/src/DNS_Mgr.cc +++ b/src/DNS_Mgr.cc @@ -738,7 +738,7 @@ IntrusivePtr DNS_Mgr::BuildMappingVal(DNS_Mapping* dm) r->Assign(0, make_intrusive(dm->CreationTime(), TYPE_TIME)); r->Assign(1, make_intrusive(dm->ReqHost() ? dm->ReqHost() : "")); r->Assign(2, make_intrusive(dm->ReqAddr())); - r->Assign(3, val_mgr->GetBool(dm->Valid())); + r->Assign(3, val_mgr->Bool(dm->Valid())); auto h = dm->Host(); r->Assign(4, h ? h.release() : new StringVal("")); diff --git a/src/Expr.cc b/src/Expr.cc index 7301422a76..cda8bc2ece 100644 --- a/src/Expr.cc +++ b/src/Expr.cc @@ -684,7 +684,7 @@ IntrusivePtr BinaryExpr::Fold(Val* v1, Val* v2) const else if ( ret_type->InternalType() == TYPE_INTERNAL_UNSIGNED ) return {AdoptRef{}, val_mgr->GetCount(u3)}; else if ( ret_type->Tag() == TYPE_BOOL ) - return {AdoptRef{}, val_mgr->GetBool(i3)}; + return val_mgr->Bool(i3); else return {AdoptRef{}, val_mgr->GetInt(i3)}; } @@ -720,7 +720,7 @@ IntrusivePtr BinaryExpr::StringFold(Val* v1, Val* v2) const BadTag("BinaryExpr::StringFold", expr_name(tag)); } - return {AdoptRef{}, val_mgr->GetBool(result)}; + return val_mgr->Bool(result); } @@ -796,7 +796,7 @@ IntrusivePtr BinaryExpr::SetFold(Val* v1, Val* v2) const return nullptr; } - return {AdoptRef{}, val_mgr->GetBool(res)}; + return val_mgr->Bool(res); } IntrusivePtr BinaryExpr::AddrFold(Val* v1, Val* v2) const @@ -830,7 +830,7 @@ IntrusivePtr BinaryExpr::AddrFold(Val* v1, Val* v2) const BadTag("BinaryExpr::AddrFold", expr_name(tag)); } - return {AdoptRef{}, val_mgr->GetBool(result)}; + return val_mgr->Bool(result); } IntrusivePtr BinaryExpr::SubNetFold(Val* v1, Val* v2) const @@ -843,7 +843,7 @@ IntrusivePtr BinaryExpr::SubNetFold(Val* v1, Val* v2) const if ( tag == EXPR_NE ) result = ! result; - return {AdoptRef{}, val_mgr->GetBool(result)}; + return val_mgr->Bool(result); } void BinaryExpr::SwapOps() @@ -1037,7 +1037,7 @@ NotExpr::NotExpr(IntrusivePtr arg_op) IntrusivePtr NotExpr::Fold(Val* v) const { - return {AdoptRef{}, val_mgr->GetBool(! v->InternalInt())}; + return val_mgr->Bool(! v->InternalInt()); } PosExpr::PosExpr(IntrusivePtr arg_op) @@ -1620,7 +1620,7 @@ IntrusivePtr BoolExpr::Eval(Frame* f) const (! op1->IsZero() && ! op2->IsZero()) : (! op1->IsZero() || ! op2->IsZero()); - result->Assign(i, val_mgr->GetBool(local_result)); + result->Assign(i, val_mgr->Bool(local_result)); } else result->Assign(i, nullptr); @@ -1775,9 +1775,9 @@ IntrusivePtr EqExpr::Fold(Val* v1, Val* v2) const RE_Matcher* re = v1->AsPattern(); const BroString* s = v2->AsString(); if ( tag == EXPR_EQ ) - return {AdoptRef{}, val_mgr->GetBool(re->MatchExactly(s))}; + return val_mgr->Bool(re->MatchExactly(s)); else - return {AdoptRef{}, val_mgr->GetBool(! re->MatchExactly(s))}; + return val_mgr->Bool(! re->MatchExactly(s)); } else @@ -2972,7 +2972,7 @@ HasFieldExpr::~HasFieldExpr() IntrusivePtr HasFieldExpr::Fold(Val* v) const { auto rv = v->AsRecordVal(); - return {AdoptRef{}, val_mgr->GetBool(rv->Lookup(field))}; + return val_mgr->Bool(rv->Lookup(field)); } void HasFieldExpr::ExprDescribe(ODesc* d) const @@ -4024,7 +4024,7 @@ IntrusivePtr InExpr::Fold(Val* v1, Val* v2) const { RE_Matcher* re = v1->AsPattern(); const BroString* s = v2->AsString(); - return {AdoptRef{}, val_mgr->GetBool(re->MatchAnywhere(s) != 0)}; + return val_mgr->Bool(re->MatchAnywhere(s) != 0); } if ( v2->Type()->Tag() == TYPE_STRING ) @@ -4035,12 +4035,12 @@ IntrusivePtr InExpr::Fold(Val* v1, Val* v2) const // Could do better here e.g. Boyer-Moore if done repeatedly. auto s = reinterpret_cast(s1->CheckString()); auto res = strstr_n(s2->Len(), s2->Bytes(), s1->Len(), s) != -1; - return {AdoptRef{}, val_mgr->GetBool(res)}; + return val_mgr->Bool(res); } if ( v1->Type()->Tag() == TYPE_ADDR && v2->Type()->Tag() == TYPE_SUBNET ) - return {AdoptRef{}, val_mgr->GetBool(v2->AsSubNetVal()->Contains(v1->AsAddr()))}; + return val_mgr->Bool(v2->AsSubNetVal()->Contains(v1->AsAddr())); bool res; @@ -4049,7 +4049,7 @@ IntrusivePtr InExpr::Fold(Val* v1, Val* v2) const else res = (bool)v2->AsTableVal()->Lookup(v1, false); - return {AdoptRef{}, val_mgr->GetBool(res)}; + return val_mgr->Bool(res); } CallExpr::CallExpr(IntrusivePtr arg_func, @@ -4906,7 +4906,7 @@ IntrusivePtr IsExpr::Fold(Val* v) const if ( IsError() ) return nullptr; - return {AdoptRef{}, val_mgr->GetBool(can_cast_value_to_type(v, t.get()))}; + return val_mgr->Bool(can_cast_value_to_type(v, t.get())); } void IsExpr::ExprDescribe(ODesc* d) const diff --git a/src/IP.cc b/src/IP.cc index 019bec0790..81cd17b4ef 100644 --- a/src/IP.cc +++ b/src/IP.cc @@ -144,7 +144,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const rv->Assign(1, val_mgr->GetCount(frag->ip6f_reserved)); rv->Assign(2, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0xfff8)>>3)); rv->Assign(3, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0x0006)>>1)); - rv->Assign(4, val_mgr->GetBool(ntohs(frag->ip6f_offlg) & 0x0001)); + rv->Assign(4, val_mgr->Bool(ntohs(frag->ip6f_offlg) & 0x0001)); rv->Assign(5, val_mgr->GetCount(ntohl(frag->ip6f_ident))); } break; @@ -255,10 +255,10 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const { RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_bu")); m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data)))); - m->Assign(1, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000)); - m->Assign(2, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000)); - m->Assign(3, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000)); - m->Assign(4, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000)); + m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000)); + m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000)); + m->Assign(3, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000)); + m->Assign(4, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000)); m->Assign(5, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t)))))); off += 3 * sizeof(uint16_t); m->Assign(6, BuildOptionsVal(data + off, Length() - off)); @@ -270,7 +270,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const { RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_back")); m->Assign(0, val_mgr->GetCount(*((uint8_t*)msg_data))); - m->Assign(1, val_mgr->GetBool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80)); + m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80)); m->Assign(2, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))))); m->Assign(3, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t)))))); off += 3 * sizeof(uint16_t); diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc index 79a778eb34..1c4da88be4 100644 --- a/src/RuleMatcher.cc +++ b/src/RuleMatcher.cc @@ -82,7 +82,7 @@ Val* RuleMatcher::BuildRuleStateValue(const Rule* rule, RecordVal* val = new RecordVal(signature_state); val->Assign(0, make_intrusive(rule->ID())); val->Assign(1, state->GetAnalyzer()->BuildConnVal()); - val->Assign(2, val_mgr->GetBool(state->is_orig)); + val->Assign(2, val_mgr->Bool(state->is_orig)); val->Assign(3, val_mgr->GetCount(state->payload_size)); return val; } diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc index 695d087848..25ee01c719 100644 --- a/src/SmithWaterman.cc +++ b/src/SmithWaterman.cc @@ -101,7 +101,7 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec) } st_val->Assign(1, std::move(aligns)); - st_val->Assign(2, val_mgr->GetBool(bst->IsNewAlignment())); + st_val->Assign(2, val_mgr->Bool(bst->IsNewAlignment())); result->Assign(i + 1, std::move(st_val)); } } diff --git a/src/Stats.cc b/src/Stats.cc index 1181f8dc9e..fc18a850e7 100644 --- a/src/Stats.cc +++ b/src/Stats.cc @@ -314,7 +314,7 @@ void ProfileLogger::Log() Ref(file); mgr.Dispatch(new Event(profiling_update, { make_intrusive(file), - {AdoptRef{}, val_mgr->GetBool(expensive)}, + val_mgr->Bool(expensive), })); } } diff --git a/src/Type.cc b/src/Type.cc index 2683356722..2ca7a96077 100644 --- a/src/Type.cc +++ b/src/Type.cc @@ -840,7 +840,7 @@ IntrusivePtr RecordType::GetRecordFieldsVal(const RecordVal* rv) const string s = container_type_name(ft); nr->Assign(0, make_intrusive(s)); - nr->Assign(1, val_mgr->GetBool(logged)); + nr->Assign(1, val_mgr->Bool(logged)); nr->Assign(2, fv); nr->Assign(3, FieldDefault(i)); Val* field_name = new StringVal(FieldName(i)); diff --git a/src/analyzer/analyzer.bif b/src/analyzer/analyzer.bif index 83e0602db5..dac146a172 100644 --- a/src/analyzer/analyzer.bif +++ b/src/analyzer/analyzer.bif @@ -11,13 +11,13 @@ module Analyzer; function Analyzer::__enable_analyzer%(id: Analyzer::Tag%) : bool %{ bool result = analyzer_mgr->EnableAnalyzer(id->AsEnumVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Analyzer::__disable_analyzer%(id: Analyzer::Tag%) : bool %{ bool result = analyzer_mgr->DisableAnalyzer(id->AsEnumVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Analyzer::__disable_all_analyzers%(%) : any @@ -29,7 +29,7 @@ function Analyzer::__disable_all_analyzers%(%) : any function Analyzer::__register_for_port%(id: Analyzer::Tag, p: port%) : bool %{ bool result = analyzer_mgr->RegisterAnalyzerForPort(id->AsEnumVal(), p); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Analyzer::__schedule_analyzer%(orig: addr, resp: addr, resp_p: port, diff --git a/src/analyzer/protocol/asn1/asn1.pac b/src/analyzer/protocol/asn1/asn1.pac index abf766d2f3..91a2cf5f1d 100644 --- a/src/analyzer/protocol/asn1/asn1.pac +++ b/src/analyzer/protocol/asn1/asn1.pac @@ -113,7 +113,7 @@ Val* asn1_integer_to_val(const ASN1Encoding* i, TypeTag t) switch ( t ) { case TYPE_BOOL: - return val_mgr->GetBool(v); + return val_mgr->Bool(v)->Ref(); case TYPE_INT: return val_mgr->GetInt(v); case TYPE_COUNT: diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.cc b/src/analyzer/protocol/bittorrent/BitTorrent.cc index 5a85b01660..c1341ef2c0 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrent.cc +++ b/src/analyzer/protocol/bittorrent/BitTorrent.cc @@ -121,7 +121,7 @@ void BitTorrent_Analyzer::DeliverWeird(const char* msg, bool orig) if ( bittorrent_peer_weird ) EnqueueConnEvent(bittorrent_peer_weird, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(msg) ); } diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc index d60bfcbfc4..ed0b6fbe88 100644 --- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc +++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc @@ -248,7 +248,7 @@ void BitTorrentTracker_Analyzer::DeliverWeird(const char* msg, bool orig) if ( bt_tracker_weird ) EnqueueConnEvent(bt_tracker_weird, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(msg) ); } diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc index 81350f9708..130287afe4 100644 --- a/src/analyzer/protocol/conn-size/ConnSize.cc +++ b/src/analyzer/protocol/conn-size/ConnSize.cc @@ -53,7 +53,7 @@ void ConnSize_Analyzer::ThresholdEvent(EventHandlerPtr f, uint64_t threshold, bo EnqueueConnEvent(f, IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + val_mgr->Bool(is_orig) ); } @@ -95,7 +95,7 @@ void ConnSize_Analyzer::CheckThresholds(bool is_orig) EnqueueConnEvent(conn_duration_threshold_crossed, IntrusivePtr{AdoptRef{}, BuildConnVal()}, make_intrusive(duration_thresh, TYPE_INTERVAL), - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + val_mgr->Bool(is_orig) ); duration_thresh = 0; } diff --git a/src/analyzer/protocol/dhcp/dhcp-options.pac b/src/analyzer/protocol/dhcp/dhcp-options.pac index ac36c2b304..3fb593b6fe 100644 --- a/src/analyzer/protocol/dhcp/dhcp-options.pac +++ b/src/analyzer/protocol/dhcp/dhcp-options.pac @@ -250,7 +250,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_forwarding_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(6, val_mgr->GetBool(${v.forwarding} == 0 ? false : true)); + ${context.flow}->options->Assign(6, val_mgr->Bool(${v.forwarding} == 0 ? false : true)); return true; %} @@ -781,7 +781,7 @@ refine casetype OptionValue += { refine flow DHCP_Flow += { function process_auto_config_option(v: OptionValue): bool %{ - ${context.flow}->options->Assign(23, val_mgr->GetBool(${v.auto_config} == 0 ? false : true)); + ${context.flow}->options->Assign(23, val_mgr->Bool(${v.auto_config} == 0 ? false : true)); return true; %} diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc index 5c041a09d8..77fb934b64 100644 --- a/src/analyzer/protocol/dns/DNS.cc +++ b/src/analyzer/protocol/dns/DNS.cc @@ -50,7 +50,7 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query) if ( dns_message ) analyzer->EnqueueConnEvent(dns_message, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_query)}, + val_mgr->Bool(is_query), IntrusivePtr{AdoptRef{}, msg.BuildHdrVal()}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} ); @@ -1449,11 +1449,11 @@ Val* DNS_MsgInfo::BuildHdrVal() r->Assign(0, val_mgr->GetCount(id)); r->Assign(1, val_mgr->GetCount(opcode)); r->Assign(2, val_mgr->GetCount(rcode)); - r->Assign(3, val_mgr->GetBool(QR)); - r->Assign(4, val_mgr->GetBool(AA)); - r->Assign(5, val_mgr->GetBool(TC)); - r->Assign(6, val_mgr->GetBool(RD)); - r->Assign(7, val_mgr->GetBool(RA)); + r->Assign(3, val_mgr->Bool(QR)); + r->Assign(4, val_mgr->Bool(AA)); + r->Assign(5, val_mgr->Bool(TC)); + r->Assign(6, val_mgr->Bool(RD)); + r->Assign(7, val_mgr->Bool(RA)); r->Assign(8, val_mgr->GetCount(Z)); r->Assign(9, val_mgr->GetCount(qdcount)); r->Assign(10, val_mgr->GetCount(ancount)); diff --git a/src/analyzer/protocol/finger/Finger.cc b/src/analyzer/protocol/finger/Finger.cc index 6fa54964a3..54f4ff02d3 100644 --- a/src/analyzer/protocol/finger/Finger.cc +++ b/src/analyzer/protocol/finger/Finger.cc @@ -69,7 +69,7 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig if ( finger_request ) EnqueueConnEvent(finger_request, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(long_cnt)}, + val_mgr->Bool(long_cnt), make_intrusive(at - line, line), make_intrusive(end_of_line - host, host) ); diff --git a/src/analyzer/protocol/ftp/FTP.cc b/src/analyzer/protocol/ftp/FTP.cc index 310c7e896a..9fdfc578a2 100644 --- a/src/analyzer/protocol/ftp/FTP.cc +++ b/src/analyzer/protocol/ftp/FTP.cc @@ -179,7 +179,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig) IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, make_intrusive(end_of_line - line, line), - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(cont_resp)} + val_mgr->Bool(cont_resp) }; f = ftp_reply; diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif index 46a53d146c..672996565f 100644 --- a/src/analyzer/protocol/ftp/functions.bif +++ b/src/analyzer/protocol/ftp/functions.bif @@ -35,7 +35,7 @@ static Val* parse_port(const char* line) r->Assign(0, make_intrusive(htonl(addr))); r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP)); - r->Assign(2, val_mgr->GetBool(good)); + r->Assign(2, val_mgr->Bool(good)); } else { @@ -111,7 +111,7 @@ static Val* parse_eftp(const char* line) r->Assign(0, make_intrusive(addr)); r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP)); - r->Assign(2, val_mgr->GetBool(good)); + r->Assign(2, val_mgr->Bool(good)); return r; } diff --git a/src/analyzer/protocol/gnutella/Gnutella.cc b/src/analyzer/protocol/gnutella/Gnutella.cc index 5f162d2b68..61cb7a19e3 100644 --- a/src/analyzer/protocol/gnutella/Gnutella.cc +++ b/src/analyzer/protocol/gnutella/Gnutella.cc @@ -74,7 +74,7 @@ void Gnutella_Analyzer::Done() EnqueueConnEvent(gnutella_partial_binary_msg, IntrusivePtr{AdoptRef{}, BuildConnVal()}, make_intrusive(p->msg), - IntrusivePtr{AdoptRef{}, val_mgr->GetBool((i == 0))}, + val_mgr->Bool((i == 0)), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_pos)} ); @@ -178,7 +178,7 @@ void Gnutella_Analyzer::DeliverLines(int len, const u_char* data, bool orig) if ( gnutella_text_msg ) EnqueueConnEvent(gnutella_text_msg, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(ms->headers.data()) ); @@ -216,15 +216,15 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig) if ( gnutella_binary_msg ) EnqueueConnEvent(gnutella_binary_msg, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_type)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_ttl)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_hops)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_len)}, make_intrusive(p->payload), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->payload_len)}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD)))}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_left == 0))} + val_mgr->Bool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))), + val_mgr->Bool((p->payload_left == 0)) ); } diff --git a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac index 9c7c369132..fd30368524 100644 --- a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac +++ b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac @@ -9,11 +9,11 @@ RecordVal* BuildGTPv1Hdr(const GTPv1_Header* pdu) RecordVal* rv = new RecordVal(BifType::Record::gtpv1_hdr); rv->Assign(0, val_mgr->GetCount(pdu->version())); - rv->Assign(1, val_mgr->GetBool(pdu->pt_flag())); - rv->Assign(2, val_mgr->GetBool(pdu->rsv())); - rv->Assign(3, val_mgr->GetBool(pdu->e_flag())); - rv->Assign(4, val_mgr->GetBool(pdu->s_flag())); - rv->Assign(5, val_mgr->GetBool(pdu->pn_flag())); + rv->Assign(1, val_mgr->Bool(pdu->pt_flag())); + rv->Assign(2, val_mgr->Bool(pdu->rsv())); + rv->Assign(3, val_mgr->Bool(pdu->e_flag())); + rv->Assign(4, val_mgr->Bool(pdu->s_flag())); + rv->Assign(5, val_mgr->Bool(pdu->pn_flag())); rv->Assign(6, val_mgr->GetCount(pdu->msg_type())); rv->Assign(7, val_mgr->GetCount(pdu->length())); rv->Assign(8, val_mgr->GetCount(pdu->teid())); @@ -206,9 +206,9 @@ Val* BuildCause(const InformationElement* ie) return val_mgr->GetCount(ie->cause()->value()); } -Val* BuildReorderReq(const InformationElement* ie) +static IntrusivePtr BuildReorderReq(const InformationElement* ie) { - return val_mgr->GetBool(ie->reorder_req()->req()); + return val_mgr->Bool(ie->reorder_req()->req()); } Val* BuildChargingID(const InformationElement* ie) @@ -228,9 +228,9 @@ Val* BuildChargingGatewayAddr(const InformationElement* ie) return 0; } -Val* BuildTeardownInd(const InformationElement* ie) +static IntrusivePtr BuildTeardownInd(const InformationElement* ie) { - return val_mgr->GetBool(ie->teardown_ind()->ind()); + return val_mgr->Bool(ie->teardown_ind()->ind()); } void CreatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu) diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index 8b1cf4c415..5b56320cbd 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -618,7 +618,7 @@ Val* HTTP_Message::BuildMessageStat(bool interrupted, const char* msg) RecordVal* stat = new RecordVal(http_message_stat); int field = 0; stat->Assign(field++, make_intrusive(start_time, TYPE_TIME)); - stat->Assign(field++, val_mgr->GetBool(interrupted)); + stat->Assign(field++, val_mgr->Bool(interrupted)); stat->Assign(field++, make_intrusive(msg)); stat->Assign(field++, val_mgr->GetCount(body_length)); stat->Assign(field++, val_mgr->GetCount(content_gap_length)); @@ -651,7 +651,7 @@ void HTTP_Message::Done(bool interrupted, const char* detail) if ( http_message_done ) GetAnalyzer()->EnqueueConnEvent(http_message_done, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, BuildMessageStat(interrupted, detail)} ); @@ -682,7 +682,7 @@ void HTTP_Message::BeginEntity(mime::MIME_Entity* entity) if ( http_begin_entity ) analyzer->EnqueueConnEvent(http_begin_entity, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + val_mgr->Bool(is_orig) ); } @@ -697,7 +697,7 @@ void HTTP_Message::EndEntity(mime::MIME_Entity* entity) if ( http_end_entity ) analyzer->EnqueueConnEvent(http_end_entity, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + val_mgr->Bool(is_orig) ); current_entity = (HTTP_Entity*) entity->Parent(); @@ -736,7 +736,7 @@ void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist) if ( http_all_headers ) analyzer->EnqueueConnEvent(http_all_headers, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, BuildHeaderTable(hlist)} ); @@ -747,7 +747,7 @@ void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist) analyzer->EnqueueConnEvent(http_content_type, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{NewRef{}, ty}, IntrusivePtr{NewRef{}, subty} ); @@ -1671,7 +1671,7 @@ void HTTP_Analyzer::HTTP_Header(bool is_orig, mime::MIME_Header* h) EnqueueConnEvent(http_header, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())->ToUpper()}, IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_value())} ); @@ -1683,7 +1683,7 @@ void HTTP_Analyzer::HTTP_EntityData(bool is_orig, BroString* entity_data) if ( http_entity_data ) EnqueueConnEvent(http_entity_data, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(entity_data->Len())}, make_intrusive(entity_data) ); diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc index 96bc7d9ef9..0e6915a91a 100644 --- a/src/analyzer/protocol/icmp/ICMP.cc +++ b/src/analyzer/protocol/icmp/ICMP.cc @@ -232,7 +232,7 @@ RecordVal* ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len, icmp_conn_val->Assign(3, val_mgr->GetCount(icmpp->icmp_code)); icmp_conn_val->Assign(4, val_mgr->GetCount(len)); icmp_conn_val->Assign(5, val_mgr->GetCount(ip_hdr->TTL())); - icmp_conn_val->Assign(6, val_mgr->GetBool(icmpv6)); + icmp_conn_val->Assign(6, val_mgr->Bool(icmpv6)); } Ref(icmp_conn_val); @@ -363,10 +363,10 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data) iprec->Assign(1, val_mgr->GetCount(ip_len)); iprec->Assign(2, val_mgr->GetCount(proto)); iprec->Assign(3, val_mgr->GetCount(frag_offset)); - iprec->Assign(4, val_mgr->GetBool(bad_hdr_len)); - iprec->Assign(5, val_mgr->GetBool(bad_checksum)); - iprec->Assign(6, val_mgr->GetBool(MF)); - iprec->Assign(7, val_mgr->GetBool(DF)); + iprec->Assign(4, val_mgr->Bool(bad_hdr_len)); + iprec->Assign(5, val_mgr->Bool(bad_checksum)); + iprec->Assign(6, val_mgr->Bool(MF)); + iprec->Assign(7, val_mgr->Bool(DF)); return iprec; } @@ -422,11 +422,11 @@ RecordVal* ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data) iprec->Assign(1, val_mgr->GetCount(ip_len)); iprec->Assign(2, val_mgr->GetCount(proto)); iprec->Assign(3, val_mgr->GetCount(frag_offset)); - iprec->Assign(4, val_mgr->GetBool(bad_hdr_len)); + iprec->Assign(4, val_mgr->Bool(bad_hdr_len)); // bad_checksum is always false since IPv6 layer doesn't have a checksum. iprec->Assign(5, val_mgr->False()); - iprec->Assign(6, val_mgr->GetBool(MF)); - iprec->Assign(7, val_mgr->GetBool(DF)); + iprec->Assign(6, val_mgr->Bool(MF)); + iprec->Assign(7, val_mgr->Bool(DF)); return iprec; } @@ -546,11 +546,11 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len, IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_num_addrs)}, // Cur Hop Limit - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x80)}, // Managed - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x40)}, // Other - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x20)}, // Home Agent + val_mgr->Bool(icmpp->icmp_wpa & 0x80), // Managed + val_mgr->Bool(icmpp->icmp_wpa & 0x40), // Other + val_mgr->Bool(icmpp->icmp_wpa & 0x20), // Home Agent IntrusivePtr{AdoptRef{}, val_mgr->GetCount((icmpp->icmp_wpa & 0x18)>>3)}, // Pref - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x04)}, // Proxy + val_mgr->Bool(icmpp->icmp_wpa & 0x04), // Proxy IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_wpa & 0x02)}, // Reserved make_intrusive((double)ntohs(icmpp->icmp_lifetime), Seconds), make_intrusive((double)ntohl(reachable), Milliseconds), @@ -578,9 +578,9 @@ void ICMP_Analyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len, EnqueueConnEvent(f, IntrusivePtr{AdoptRef{}, BuildConnVal()}, IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x80)}, // Router - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x40)}, // Solicited - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x20)}, // Override + val_mgr->Bool(icmpp->icmp_num_addrs & 0x80), // Router + val_mgr->Bool(icmpp->icmp_num_addrs & 0x40), // Solicited + val_mgr->Bool(icmpp->icmp_num_addrs & 0x20), // Override make_intrusive(tgtaddr), IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)} ); @@ -793,8 +793,8 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data) uint32_t prefer_life = *((const uint32_t*)(data + 6)); in6_addr prefix = *((const in6_addr*)(data + 14)); info->Assign(0, val_mgr->GetCount(prefix_len)); - info->Assign(1, val_mgr->GetBool(L_flag)); - info->Assign(2, val_mgr->GetBool(A_flag)); + info->Assign(1, val_mgr->Bool(L_flag)); + info->Assign(2, val_mgr->Bool(A_flag)); info->Assign(3, make_intrusive((double)ntohl(valid_life), Seconds)); info->Assign(4, make_intrusive((double)ntohl(prefer_life), Seconds)); info->Assign(5, make_intrusive(IPAddr(prefix))); diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc index 834ac3a824..374230e5f2 100644 --- a/src/analyzer/protocol/irc/IRC.cc +++ b/src/analyzer/protocol/irc/IRC.cc @@ -236,7 +236,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_network_info, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)}, IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)}, IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)} @@ -283,7 +283,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_names_info, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(type.c_str()), make_intrusive(channel.c_str()), std::move(set) @@ -317,7 +317,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_server_info, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)}, IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)}, IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)} @@ -339,7 +339,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_channel_info, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), IntrusivePtr{AdoptRef{}, val_mgr->GetInt(channels)} ); } @@ -371,7 +371,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_global_users, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(eop - prefix, prefix), make_intrusive(++msg) ); @@ -397,7 +397,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) zeek::Args vl; vl.reserve(6); vl.emplace_back(AdoptRef{}, BuildConnVal()); - vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig)); + vl.emplace_back(val_mgr->Bool(orig)); vl.emplace_back(make_intrusive(parts[0].c_str())); vl.emplace_back(make_intrusive(parts[1].c_str())); vl.emplace_back(make_intrusive(parts[2].c_str())); @@ -436,7 +436,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_whois_operator_line, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(parts[0].c_str()) ); } @@ -474,7 +474,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_whois_channel_line, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(nick.c_str()), std::move(set) ); @@ -505,7 +505,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_channel_topic, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(parts[1].c_str()), make_intrusive(t) ); @@ -539,7 +539,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_who_line, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(parts[0].c_str()), make_intrusive(parts[1].c_str()), make_intrusive(parts[2].c_str()), @@ -561,7 +561,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_invalid_nick ) EnqueueConnEvent(irc_invalid_nick, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)} + val_mgr->Bool(orig) ); break; @@ -571,8 +571,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_oper_response ) EnqueueConnEvent(irc_oper_response, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(code == 381)} + val_mgr->Bool(orig), + val_mgr->Bool(code == 381) ); break; @@ -586,7 +586,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_reply ) EnqueueConnEvent(irc_reply, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(code)}, make_intrusive(params.c_str()) @@ -657,7 +657,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_dcc_message ) EnqueueConnEvent(irc_dcc_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(target.c_str()), make_intrusive(parts[1].c_str()), @@ -675,7 +675,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( irc_privmsg_message ) EnqueueConnEvent(irc_privmsg_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(target.c_str()), make_intrusive(message.c_str()) @@ -700,7 +700,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_notice_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(target.c_str()), make_intrusive(message.c_str()) @@ -724,7 +724,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_squery_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(target.c_str()), make_intrusive(message.c_str()) @@ -738,7 +738,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) zeek::Args vl; vl.reserve(6); vl.emplace_back(AdoptRef{}, BuildConnVal()); - vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig)); + vl.emplace_back(val_mgr->Bool(orig)); if ( parts.size() > 0 ) vl.emplace_back(make_intrusive(parts[0].c_str())); @@ -773,7 +773,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( parts.size() == 2 ) EnqueueConnEvent(irc_oper_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(parts[0].c_str()), make_intrusive(parts[1].c_str()) ); @@ -795,7 +795,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) zeek::Args vl; vl.reserve(6); vl.emplace_back(AdoptRef{}, BuildConnVal()); - vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig)); + vl.emplace_back(val_mgr->Bool(orig)); vl.emplace_back(make_intrusive(prefix.c_str())); vl.emplace_back(make_intrusive(parts[0].c_str())); vl.emplace_back(make_intrusive(parts[1].c_str())); @@ -864,7 +864,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_join_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), std::move(list) ); } @@ -924,7 +924,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_join_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), std::move(list) ); } @@ -963,7 +963,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_part_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(nick.c_str()), std::move(set), make_intrusive(message.c_str()) @@ -986,7 +986,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_quit_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(nickname.c_str()), make_intrusive(message.c_str()) ); @@ -1000,7 +1000,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_nick_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(nick.c_str()) ); @@ -1025,11 +1025,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_who_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), parts.size() > 0 ? make_intrusive(parts[0].c_str()) : IntrusivePtr{AdoptRef{}, val_mgr->GetEmptyString()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(oper)} + val_mgr->Bool(oper) ); } @@ -1055,7 +1055,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_whois_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(server.c_str()), make_intrusive(users.c_str()) ); @@ -1068,7 +1068,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_error_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(params.c_str()) ); @@ -1084,7 +1084,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_invite_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(parts[0].c_str()), make_intrusive(parts[1].c_str()) @@ -1099,7 +1099,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) if ( params.size() > 0 ) EnqueueConnEvent(irc_mode_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(params.c_str()) ); @@ -1112,7 +1112,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) { EnqueueConnEvent(irc_password_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(params.c_str()) ); } @@ -1134,7 +1134,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) EnqueueConnEvent(irc_squit_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(server.c_str()), make_intrusive(message.c_str()) @@ -1148,7 +1148,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) { EnqueueConnEvent(irc_request, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(command.c_str()), make_intrusive(params.c_str()) @@ -1162,7 +1162,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig) { EnqueueConnEvent(irc_message, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(prefix.c_str()), make_intrusive(command.c_str()), make_intrusive(params.c_str()) diff --git a/src/analyzer/protocol/krb/krb-analyzer.pac b/src/analyzer/protocol/krb/krb-analyzer.pac index e13c93fdde..f24964300d 100644 --- a/src/analyzer/protocol/krb/krb-analyzer.pac +++ b/src/analyzer/protocol/krb/krb-analyzer.pac @@ -10,19 +10,19 @@ RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts) { RecordVal* rv = new RecordVal(BifType::Record::KRB::KDC_Options); - rv->Assign(0, val_mgr->GetBool(opts->forwardable())); - rv->Assign(1, val_mgr->GetBool(opts->forwarded())); - rv->Assign(2, val_mgr->GetBool(opts->proxiable())); - rv->Assign(3, val_mgr->GetBool(opts->proxy())); - rv->Assign(4, val_mgr->GetBool(opts->allow_postdate())); - rv->Assign(5, val_mgr->GetBool(opts->postdated())); - rv->Assign(6, val_mgr->GetBool(opts->renewable())); - rv->Assign(7, val_mgr->GetBool(opts->opt_hardware_auth())); - rv->Assign(8, val_mgr->GetBool(opts->disable_transited_check())); - rv->Assign(9, val_mgr->GetBool(opts->renewable_ok())); - rv->Assign(10, val_mgr->GetBool(opts->enc_tkt_in_skey())); - rv->Assign(11, val_mgr->GetBool(opts->renew())); - rv->Assign(12, val_mgr->GetBool(opts->validate())); + rv->Assign(0, val_mgr->Bool(opts->forwardable())); + rv->Assign(1, val_mgr->Bool(opts->forwarded())); + rv->Assign(2, val_mgr->Bool(opts->proxiable())); + rv->Assign(3, val_mgr->Bool(opts->proxy())); + rv->Assign(4, val_mgr->Bool(opts->allow_postdate())); + rv->Assign(5, val_mgr->Bool(opts->postdated())); + rv->Assign(6, val_mgr->Bool(opts->renewable())); + rv->Assign(7, val_mgr->Bool(opts->opt_hardware_auth())); + rv->Assign(8, val_mgr->Bool(opts->disable_transited_check())); + rv->Assign(9, val_mgr->Bool(opts->renewable_ok())); + rv->Assign(10, val_mgr->Bool(opts->enc_tkt_in_skey())); + rv->Assign(11, val_mgr->Bool(opts->renew())); + rv->Assign(12, val_mgr->Bool(opts->validate())); return rv; } @@ -259,8 +259,8 @@ refine connection KRB_Conn += { if ( krb_ap_request ) { RecordVal* rv = new RecordVal(BifType::Record::KRB::AP_Options); - rv->Assign(0, val_mgr->GetBool(${msg.ap_options.use_session_key})); - rv->Assign(1, val_mgr->GetBool(${msg.ap_options.mutual_required})); + rv->Assign(0, val_mgr->Bool(${msg.ap_options.use_session_key})); + rv->Assign(1, val_mgr->Bool(${msg.ap_options.mutual_required})); RecordVal* rvticket = proc_ticket(${msg.ticket}); StringVal* authenticationinfo = bro_analyzer()->GetAuthenticationInfo(rvticket->Lookup(2)->AsString(), rvticket->Lookup(4)->AsString(), rvticket->Lookup(3)->AsCount()); diff --git a/src/analyzer/protocol/modbus/modbus-analyzer.pac b/src/analyzer/protocol/modbus/modbus-analyzer.pac index e30b5e3867..846b3aa6f8 100644 --- a/src/analyzer/protocol/modbus/modbus-analyzer.pac +++ b/src/analyzer/protocol/modbus/modbus-analyzer.pac @@ -20,7 +20,7 @@ for ( uint i = 0; i < quantity; i++ ) { char currentCoil = (coils[i/8] >> (i % 8)) % 2; - modbus_coils->Assign(i, val_mgr->GetBool(currentCoil)); + modbus_coils->Assign(i, val_mgr->Bool(currentCoil)); } return modbus_coils; diff --git a/src/analyzer/protocol/mqtt/commands/connack.pac b/src/analyzer/protocol/mqtt/commands/connack.pac index ad641b8468..cf85f76be4 100644 --- a/src/analyzer/protocol/mqtt/commands/connack.pac +++ b/src/analyzer/protocol/mqtt/commands/connack.pac @@ -17,7 +17,7 @@ refine flow MQTT_Flow += { { auto m = new RecordVal(BifType::Record::MQTT::ConnectAckMsg); m->Assign(0, val_mgr->GetCount(${msg.return_code})); - m->Assign(1, val_mgr->GetBool(${msg.session_present})); + m->Assign(1, val_mgr->Bool(${msg.session_present})); BifEvent::generate_mqtt_connack(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), m); diff --git a/src/analyzer/protocol/mqtt/commands/connect.pac b/src/analyzer/protocol/mqtt/commands/connect.pac index c8050ba6f8..b4e774a250 100644 --- a/src/analyzer/protocol/mqtt/commands/connect.pac +++ b/src/analyzer/protocol/mqtt/commands/connect.pac @@ -52,8 +52,8 @@ refine flow MQTT_Flow += { reinterpret_cast(${msg.client_id.str}.begin()))); m->Assign(3, make_intrusive(double(${msg.keep_alive}), Seconds)); - m->Assign(4, val_mgr->GetBool(${msg.clean_session})); - m->Assign(5, val_mgr->GetBool(${msg.will_retain})); + m->Assign(4, val_mgr->Bool(${msg.clean_session})); + m->Assign(5, val_mgr->Bool(${msg.will_retain})); m->Assign(6, val_mgr->GetCount(${msg.will_qos})); if ( ${msg.will_flag} ) diff --git a/src/analyzer/protocol/mqtt/commands/publish.pac b/src/analyzer/protocol/mqtt/commands/publish.pac index a7514d60d8..475c183a45 100644 --- a/src/analyzer/protocol/mqtt/commands/publish.pac +++ b/src/analyzer/protocol/mqtt/commands/publish.pac @@ -24,9 +24,9 @@ refine flow MQTT_Flow += { if ( mqtt_publish ) { auto m = new RecordVal(BifType::Record::MQTT::PublishMsg); - m->Assign(0, val_mgr->GetBool(${msg.dup})); + m->Assign(0, val_mgr->Bool(${msg.dup})); m->Assign(1, val_mgr->GetCount(${msg.qos})); - m->Assign(2, val_mgr->GetBool(${msg.retain})); + m->Assign(2, val_mgr->Bool(${msg.retain})); m->Assign(3, new StringVal(${msg.topic.str}.length(), reinterpret_cast(${msg.topic.str}.begin()))); diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc index 3af2569738..68b2c03bc4 100644 --- a/src/analyzer/protocol/netbios/NetbiosSSN.cc +++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc @@ -61,7 +61,7 @@ void NetbiosSSN_Interpreter::ParseMessage(unsigned int type, unsigned int flags, if ( netbios_session_message ) analyzer->EnqueueConnEvent(netbios_session_message, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_query)}, + val_mgr->Bool(is_query), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(type)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} ); @@ -323,7 +323,7 @@ void NetbiosSSN_Interpreter::Event(EventHandlerPtr event, const u_char* data, if ( is_orig >= 0 ) analyzer->EnqueueConnEvent(event, IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), make_intrusive(new BroString(data, len, false)) ); else diff --git a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac index 3d2008808b..cde82b05c0 100644 --- a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac +++ b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac @@ -60,7 +60,7 @@ refine connection NTLM_Conn += { result->Assign(4, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_tree_name.data})); break; case 6: - result->Assign(5, val_mgr->GetBool(${val.pairs[i].constrained_auth})); + result->Assign(5, val_mgr->Bool(${val.pairs[i].constrained_auth})); break; case 7: result->Assign(6, filetime2brotime(${val.pairs[i].timestamp})); @@ -79,28 +79,28 @@ refine connection NTLM_Conn += { function build_negotiate_flag_record(val: NTLM_Negotiate_Flags): BroVal %{ RecordVal* flags = new RecordVal(BifType::Record::NTLM::NegotiateFlags); - flags->Assign(0, val_mgr->GetBool(${val.negotiate_56})); - flags->Assign(1, val_mgr->GetBool(${val.negotiate_key_exch})); - flags->Assign(2, val_mgr->GetBool(${val.negotiate_128})); - flags->Assign(3, val_mgr->GetBool(${val.negotiate_version})); - flags->Assign(4, val_mgr->GetBool(${val.negotiate_target_info})); - flags->Assign(5, val_mgr->GetBool(${val.request_non_nt_session_key})); - flags->Assign(6, val_mgr->GetBool(${val.negotiate_identify})); - flags->Assign(7, val_mgr->GetBool(${val.negotiate_extended_sessionsecurity})); - flags->Assign(8, val_mgr->GetBool(${val.target_type_server})); - flags->Assign(9, val_mgr->GetBool(${val.target_type_domain})); - flags->Assign(10, val_mgr->GetBool(${val.negotiate_always_sign})); - flags->Assign(11, val_mgr->GetBool(${val.negotiate_oem_workstation_supplied})); - flags->Assign(12, val_mgr->GetBool(${val.negotiate_oem_domain_supplied})); - flags->Assign(13, val_mgr->GetBool(${val.negotiate_anonymous_connection})); - flags->Assign(14, val_mgr->GetBool(${val.negotiate_ntlm})); - flags->Assign(15, val_mgr->GetBool(${val.negotiate_lm_key})); - flags->Assign(16, val_mgr->GetBool(${val.negotiate_datagram})); - flags->Assign(17, val_mgr->GetBool(${val.negotiate_seal})); - flags->Assign(18, val_mgr->GetBool(${val.negotiate_sign})); - flags->Assign(19, val_mgr->GetBool(${val.request_target})); - flags->Assign(20, val_mgr->GetBool(${val.negotiate_oem})); - flags->Assign(21, val_mgr->GetBool(${val.negotiate_unicode})); + flags->Assign(0, val_mgr->Bool(${val.negotiate_56})); + flags->Assign(1, val_mgr->Bool(${val.negotiate_key_exch})); + flags->Assign(2, val_mgr->Bool(${val.negotiate_128})); + flags->Assign(3, val_mgr->Bool(${val.negotiate_version})); + flags->Assign(4, val_mgr->Bool(${val.negotiate_target_info})); + flags->Assign(5, val_mgr->Bool(${val.request_non_nt_session_key})); + flags->Assign(6, val_mgr->Bool(${val.negotiate_identify})); + flags->Assign(7, val_mgr->Bool(${val.negotiate_extended_sessionsecurity})); + flags->Assign(8, val_mgr->Bool(${val.target_type_server})); + flags->Assign(9, val_mgr->Bool(${val.target_type_domain})); + flags->Assign(10, val_mgr->Bool(${val.negotiate_always_sign})); + flags->Assign(11, val_mgr->Bool(${val.negotiate_oem_workstation_supplied})); + flags->Assign(12, val_mgr->Bool(${val.negotiate_oem_domain_supplied})); + flags->Assign(13, val_mgr->Bool(${val.negotiate_anonymous_connection})); + flags->Assign(14, val_mgr->Bool(${val.negotiate_ntlm})); + flags->Assign(15, val_mgr->Bool(${val.negotiate_lm_key})); + flags->Assign(16, val_mgr->Bool(${val.negotiate_datagram})); + flags->Assign(17, val_mgr->Bool(${val.negotiate_seal})); + flags->Assign(18, val_mgr->Bool(${val.negotiate_sign})); + flags->Assign(19, val_mgr->Bool(${val.request_target})); + flags->Assign(20, val_mgr->Bool(${val.negotiate_oem})); + flags->Assign(21, val_mgr->Bool(${val.negotiate_unicode})); return flags; %} diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac index fe3bed6b0f..7c0b834a94 100644 --- a/src/analyzer/protocol/ntp/ntp-analyzer.pac +++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac @@ -91,9 +91,9 @@ refine flow NTP_Flow += { RecordVal* rv = new RecordVal(BifType::Record::NTP::ControlMessage); rv->Assign(0, val_mgr->GetCount(${ncm.OpCode})); - rv->Assign(1, val_mgr->GetBool(${ncm.R})); - rv->Assign(2, val_mgr->GetBool(${ncm.E})); - rv->Assign(3, val_mgr->GetBool(${ncm.M})); + rv->Assign(1, val_mgr->Bool(${ncm.R})); + rv->Assign(2, val_mgr->Bool(${ncm.E})); + rv->Assign(3, val_mgr->Bool(${ncm.M})); rv->Assign(4, val_mgr->GetCount(${ncm.sequence})); rv->Assign(5, val_mgr->GetCount(${ncm.status})); rv->Assign(6, val_mgr->GetCount(${ncm.association_id})); @@ -116,7 +116,7 @@ refine flow NTP_Flow += { RecordVal* rv = new RecordVal(BifType::Record::NTP::Mode7Message); rv->Assign(0, val_mgr->GetCount(${m7.request_code})); - rv->Assign(1, val_mgr->GetBool(${m7.auth_bit})); + rv->Assign(1, val_mgr->Bool(${m7.auth_bit})); rv->Assign(2, val_mgr->GetCount(${m7.sequence})); rv->Assign(3, val_mgr->GetCount(${m7.implementation})); rv->Assign(4, val_mgr->GetCount(${m7.error_code})); diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc index c6753c01da..e39b725374 100644 --- a/src/analyzer/protocol/pop3/POP3.cc +++ b/src/analyzer/protocol/pop3/POP3.cc @@ -920,7 +920,7 @@ void POP3_Analyzer::POP3Event(EventHandlerPtr event, bool is_orig, vl.reserve(2 + (bool)arg1 + (bool)arg2); vl.emplace_back(AdoptRef{}, BuildConnVal()); - vl.emplace_back(AdoptRef{}, val_mgr->GetBool(is_orig)); + vl.emplace_back(val_mgr->Bool(is_orig)); if ( arg1 ) vl.emplace_back(make_intrusive(arg1)); diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac index 73f68f29d2..5368099312 100644 --- a/src/analyzer/protocol/rdp/rdp-analyzer.pac +++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac @@ -62,15 +62,15 @@ refine flow RDP_Flow += { if ( rdp_client_core_data ) { RecordVal* ec_flags = new RecordVal(BifType::Record::RDP::EarlyCapabilityFlags); - ec_flags->Assign(0, val_mgr->GetBool(${ccore.SUPPORT_ERRINFO_PDU})); - ec_flags->Assign(1, val_mgr->GetBool(${ccore.WANT_32BPP_SESSION})); - ec_flags->Assign(2, val_mgr->GetBool(${ccore.SUPPORT_STATUSINFO_PDU})); - ec_flags->Assign(3, val_mgr->GetBool(${ccore.STRONG_ASYMMETRIC_KEYS})); - ec_flags->Assign(4, val_mgr->GetBool(${ccore.SUPPORT_MONITOR_LAYOUT_PDU})); - ec_flags->Assign(5, val_mgr->GetBool(${ccore.SUPPORT_NETCHAR_AUTODETECT})); - ec_flags->Assign(6, val_mgr->GetBool(${ccore.SUPPORT_DYNVC_GFX_PROTOCOL})); - ec_flags->Assign(7, val_mgr->GetBool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE})); - ec_flags->Assign(8, val_mgr->GetBool(${ccore.SUPPORT_HEARTBEAT_PDU})); + ec_flags->Assign(0, val_mgr->Bool(${ccore.SUPPORT_ERRINFO_PDU})); + ec_flags->Assign(1, val_mgr->Bool(${ccore.WANT_32BPP_SESSION})); + ec_flags->Assign(2, val_mgr->Bool(${ccore.SUPPORT_STATUSINFO_PDU})); + ec_flags->Assign(3, val_mgr->Bool(${ccore.STRONG_ASYMMETRIC_KEYS})); + ec_flags->Assign(4, val_mgr->Bool(${ccore.SUPPORT_MONITOR_LAYOUT_PDU})); + ec_flags->Assign(5, val_mgr->Bool(${ccore.SUPPORT_NETCHAR_AUTODETECT})); + ec_flags->Assign(6, val_mgr->Bool(${ccore.SUPPORT_DYNVC_GFX_PROTOCOL})); + ec_flags->Assign(7, val_mgr->Bool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE})); + ec_flags->Assign(8, val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU})); RecordVal* ccd = new RecordVal(BifType::Record::RDP::ClientCoreData); ccd->Assign(0, val_mgr->GetCount(${ccore.version_major})); @@ -133,17 +133,17 @@ refine flow RDP_Flow += { channel_def->Assign(0, bytestring_to_val(${cnetwork.channel_def_array[i].name})); channel_def->Assign(1, val_mgr->GetCount(${cnetwork.channel_def_array[i].options})); - channel_def->Assign(2, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED})); - channel_def->Assign(3, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP})); - channel_def->Assign(4, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_SC})); - channel_def->Assign(5, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_CS})); - channel_def->Assign(6, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_HIGH})); - channel_def->Assign(7, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_MED})); - channel_def->Assign(8, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_LOW})); - channel_def->Assign(9, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS_RDP})); - channel_def->Assign(10, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS})); - channel_def->Assign(11, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_SHOW_PROTOCOL})); - channel_def->Assign(12, val_mgr->GetBool(${cnetwork.channel_def_array[i].REMOTE_CONTROL_PERSISTENT})); + channel_def->Assign(2, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED})); + channel_def->Assign(3, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP})); + channel_def->Assign(4, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_SC})); + channel_def->Assign(5, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_CS})); + channel_def->Assign(6, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_HIGH})); + channel_def->Assign(7, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_MED})); + channel_def->Assign(8, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_LOW})); + channel_def->Assign(9, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS_RDP})); + channel_def->Assign(10, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS})); + channel_def->Assign(11, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_SHOW_PROTOCOL})); + channel_def->Assign(12, val_mgr->Bool(${cnetwork.channel_def_array[i].REMOTE_CONTROL_PERSISTENT})); channels->Assign(channels->Size(), channel_def); } @@ -164,10 +164,10 @@ refine flow RDP_Flow += { RecordVal* ccld = new RecordVal(BifType::Record::RDP::ClientClusterData); ccld->Assign(0, val_mgr->GetCount(${ccluster.flags})); ccld->Assign(1, val_mgr->GetCount(${ccluster.redir_session_id})); - ccld->Assign(2, val_mgr->GetBool(${ccluster.REDIRECTION_SUPPORTED})); + ccld->Assign(2, val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED})); ccld->Assign(3, val_mgr->GetCount(${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK})); - ccld->Assign(4, val_mgr->GetBool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID})); - ccld->Assign(5, val_mgr->GetBool(${ccluster.REDIRECTED_SMARTCARD})); + ccld->Assign(4, val_mgr->Bool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID})); + ccld->Assign(5, val_mgr->Bool(${ccluster.REDIRECTED_SMARTCARD})); BifEvent::generate_rdp_client_cluster_data(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc index b3bebcbfee..86ec19716c 100644 --- a/src/analyzer/protocol/rpc/NFS.cc +++ b/src/analyzer/protocol/rpc/NFS.cc @@ -747,7 +747,7 @@ RecordVal* NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n) { RecordVal *args = new RecordVal(BifType::Record::NFS3::readdirargs_t); - args->Assign(0, val_mgr->GetBool(isplus)); + args->Assign(0, val_mgr->Bool(isplus)); args->Assign(1, nfs3_fh(buf, n)); args->Assign(2, ExtractUint64(buf,n)); // cookie args->Assign(3, ExtractUint64(buf,n)); // cookieverf @@ -764,7 +764,7 @@ RecordVal* NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf, { RecordVal *rep = new RecordVal(BifType::Record::NFS3::readdir_reply_t); - rep->Assign(0, val_mgr->GetBool(isplus)); + rep->Assign(0, val_mgr->Bool(isplus)); if ( status == BifEnum::NFS3::NFS3ERR_OK ) { @@ -826,7 +826,7 @@ Val* NFS_Interp::ExtractInterval(const u_char*& buf, int& n) Val* NFS_Interp::ExtractBool(const u_char*& buf, int& n) { - return val_mgr->GetBool(extract_XDR_uint32(buf, n)); + return val_mgr->Bool(extract_XDR_uint32(buf, n))->Ref(); } diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc index ad9fa37f02..ddb5451ecc 100644 --- a/src/analyzer/protocol/rpc/Portmap.cc +++ b/src/analyzer/protocol/rpc/Portmap.cc @@ -94,7 +94,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu if ( ! buf ) return false; - reply = val_mgr->GetBool(status); + reply = val_mgr->Bool(status)->Ref(); event = pm_request_set; } else @@ -109,7 +109,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu if ( ! buf ) return false; - reply = val_mgr->GetBool(status); + reply = val_mgr->Bool(status)->Ref(); event = pm_request_unset; } else @@ -222,7 +222,7 @@ Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) pr->Assign(1, val_mgr->GetCount(extract_XDR_uint32(buf, len))); bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP; - pr->Assign(2, val_mgr->GetBool(is_tcp)); + pr->Assign(2, val_mgr->Bool(is_tcp)); (void) extract_XDR_uint32(buf, len); // consume the bogus port if ( ! buf ) diff --git a/src/analyzer/protocol/smb/smb1-com-negotiate.pac b/src/analyzer/protocol/smb/smb1-com-negotiate.pac index 1b4aab7d71..a6876b46ce 100644 --- a/src/analyzer/protocol/smb/smb1-com-negotiate.pac +++ b/src/analyzer/protocol/smb/smb1-com-negotiate.pac @@ -53,12 +53,12 @@ refine connection SMB_Conn += { case 0x0d: security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity); - security->Assign(0, val_mgr->GetBool(${val.lanman.security_user_level})); - security->Assign(1, val_mgr->GetBool(${val.lanman.security_challenge_response})); + security->Assign(0, val_mgr->Bool(${val.lanman.security_user_level})); + security->Assign(1, val_mgr->Bool(${val.lanman.security_challenge_response})); raw = new RecordVal(BifType::Record::SMB1::NegotiateRawMode); - raw->Assign(0, val_mgr->GetBool(${val.lanman.raw_read_supported})); - raw->Assign(1, val_mgr->GetBool(${val.lanman.raw_write_supported})); + raw->Assign(0, val_mgr->Bool(${val.lanman.raw_read_supported})); + raw->Assign(1, val_mgr->Bool(${val.lanman.raw_write_supported})); lanman = new RecordVal(BifType::Record::SMB1::NegotiateResponseLANMAN); lanman->Assign(0, val_mgr->GetCount(${val.word_count})); @@ -80,33 +80,33 @@ refine connection SMB_Conn += { case 0x11: security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity); - security->Assign(0, val_mgr->GetBool(${val.ntlm.security_user_level})); - security->Assign(1, val_mgr->GetBool(${val.ntlm.security_challenge_response})); - security->Assign(2, val_mgr->GetBool(${val.ntlm.security_signatures_enabled})); - security->Assign(3, val_mgr->GetBool(${val.ntlm.security_signatures_required})); + security->Assign(0, val_mgr->Bool(${val.ntlm.security_user_level})); + security->Assign(1, val_mgr->Bool(${val.ntlm.security_challenge_response})); + security->Assign(2, val_mgr->Bool(${val.ntlm.security_signatures_enabled})); + security->Assign(3, val_mgr->Bool(${val.ntlm.security_signatures_required})); capabilities = new RecordVal(BifType::Record::SMB1::NegotiateCapabilities); - capabilities->Assign(0, val_mgr->GetBool(${val.ntlm.capabilities_raw_mode})); - capabilities->Assign(1, val_mgr->GetBool(${val.ntlm.capabilities_mpx_mode})); - capabilities->Assign(2, val_mgr->GetBool(${val.ntlm.capabilities_unicode})); - capabilities->Assign(3, val_mgr->GetBool(${val.ntlm.capabilities_large_files})); - capabilities->Assign(4, val_mgr->GetBool(${val.ntlm.capabilities_nt_smbs})); + capabilities->Assign(0, val_mgr->Bool(${val.ntlm.capabilities_raw_mode})); + capabilities->Assign(1, val_mgr->Bool(${val.ntlm.capabilities_mpx_mode})); + capabilities->Assign(2, val_mgr->Bool(${val.ntlm.capabilities_unicode})); + capabilities->Assign(3, val_mgr->Bool(${val.ntlm.capabilities_large_files})); + capabilities->Assign(4, val_mgr->Bool(${val.ntlm.capabilities_nt_smbs})); - capabilities->Assign(5, val_mgr->GetBool(${val.ntlm.capabilities_rpc_remote_apis})); - capabilities->Assign(6, val_mgr->GetBool(${val.ntlm.capabilities_status32})); - capabilities->Assign(7, val_mgr->GetBool(${val.ntlm.capabilities_level_2_oplocks})); - capabilities->Assign(8, val_mgr->GetBool(${val.ntlm.capabilities_lock_and_read})); - capabilities->Assign(9, val_mgr->GetBool(${val.ntlm.capabilities_nt_find})); + capabilities->Assign(5, val_mgr->Bool(${val.ntlm.capabilities_rpc_remote_apis})); + capabilities->Assign(6, val_mgr->Bool(${val.ntlm.capabilities_status32})); + capabilities->Assign(7, val_mgr->Bool(${val.ntlm.capabilities_level_2_oplocks})); + capabilities->Assign(8, val_mgr->Bool(${val.ntlm.capabilities_lock_and_read})); + capabilities->Assign(9, val_mgr->Bool(${val.ntlm.capabilities_nt_find})); - capabilities->Assign(10, val_mgr->GetBool(${val.ntlm.capabilities_dfs})); - capabilities->Assign(11, val_mgr->GetBool(${val.ntlm.capabilities_infolevel_passthru})); - capabilities->Assign(12, val_mgr->GetBool(${val.ntlm.capabilities_large_readx})); - capabilities->Assign(13, val_mgr->GetBool(${val.ntlm.capabilities_large_writex})); - capabilities->Assign(14, val_mgr->GetBool(${val.ntlm.capabilities_unix})); + capabilities->Assign(10, val_mgr->Bool(${val.ntlm.capabilities_dfs})); + capabilities->Assign(11, val_mgr->Bool(${val.ntlm.capabilities_infolevel_passthru})); + capabilities->Assign(12, val_mgr->Bool(${val.ntlm.capabilities_large_readx})); + capabilities->Assign(13, val_mgr->Bool(${val.ntlm.capabilities_large_writex})); + capabilities->Assign(14, val_mgr->Bool(${val.ntlm.capabilities_unix})); - capabilities->Assign(15, val_mgr->GetBool(${val.ntlm.capabilities_bulk_transfer})); - capabilities->Assign(16, val_mgr->GetBool(${val.ntlm.capabilities_compressed_data})); - capabilities->Assign(17, val_mgr->GetBool(${val.ntlm.capabilities_extended_security})); + capabilities->Assign(15, val_mgr->Bool(${val.ntlm.capabilities_bulk_transfer})); + capabilities->Assign(16, val_mgr->Bool(${val.ntlm.capabilities_compressed_data})); + capabilities->Assign(17, val_mgr->Bool(${val.ntlm.capabilities_extended_security})); ntlm = new RecordVal(BifType::Record::SMB1::NegotiateResponseNTLM); ntlm->Assign(0, val_mgr->GetCount(${val.word_count})); diff --git a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac index 7ba49ff6bd..51a5050d3e 100644 --- a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac +++ b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac @@ -32,12 +32,12 @@ refine connection SMB_Conn += { break; case 12: // NT LM 0.12 with extended security capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities); - capabilities->Assign(0, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.unicode})); - capabilities->Assign(1, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.large_files})); - capabilities->Assign(2, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.nt_smbs})); - capabilities->Assign(3, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.status32})); - capabilities->Assign(4, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.level_2_oplocks})); - capabilities->Assign(5, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.nt_find})); + capabilities->Assign(0, val_mgr->Bool(${val.ntlm_extended_security.capabilities.unicode})); + capabilities->Assign(1, val_mgr->Bool(${val.ntlm_extended_security.capabilities.large_files})); + capabilities->Assign(2, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_smbs})); + capabilities->Assign(3, val_mgr->Bool(${val.ntlm_extended_security.capabilities.status32})); + capabilities->Assign(4, val_mgr->Bool(${val.ntlm_extended_security.capabilities.level_2_oplocks})); + capabilities->Assign(5, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_find})); request->Assign(1, val_mgr->GetCount(${val.ntlm_extended_security.max_buffer_size})); request->Assign(2, val_mgr->GetCount(${val.ntlm_extended_security.max_mpx_count})); @@ -52,12 +52,12 @@ refine connection SMB_Conn += { case 13: // NT LM 0.12 without extended security capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities); - capabilities->Assign(0, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.unicode})); - capabilities->Assign(1, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.large_files})); - capabilities->Assign(2, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.nt_smbs})); - capabilities->Assign(3, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.status32})); - capabilities->Assign(4, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks})); - capabilities->Assign(5, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.nt_find})); + capabilities->Assign(0, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.unicode})); + capabilities->Assign(1, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.large_files})); + capabilities->Assign(2, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_smbs})); + capabilities->Assign(3, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.status32})); + capabilities->Assign(4, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks})); + capabilities->Assign(5, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_find})); request->Assign(1, val_mgr->GetCount(${val.ntlm_nonextended_security.max_buffer_size})); request->Assign(2, val_mgr->GetCount(${val.ntlm_nonextended_security.max_mpx_count})); @@ -90,13 +90,13 @@ refine connection SMB_Conn += { switch ( ${val.word_count} ) { case 3: // pre NT LM 0.12 - response->Assign(1, val_mgr->GetBool(${val.lanman.is_guest})); + response->Assign(1, val_mgr->Bool(${val.lanman.is_guest})); response->Assign(2, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.native_os[0]})); response->Assign(3, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.native_lanman[0]})); response->Assign(4, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.primary_domain[0]})); break; case 4: // NT LM 0.12 - response->Assign(1, val_mgr->GetBool(${val.ntlm.is_guest})); + response->Assign(1, val_mgr->Bool(${val.ntlm.is_guest})); response->Assign(2, smb_string2stringval(${val.ntlm.native_os})); response->Assign(3, smb_string2stringval(${val.ntlm.native_lanman})); //response->Assign(4, smb_string2stringval(${val.ntlm.primary_domain})); diff --git a/src/analyzer/protocol/smb/smb2-com-session-setup.pac b/src/analyzer/protocol/smb/smb2-com-session-setup.pac index 8dd1c62778..77ff901f65 100644 --- a/src/analyzer/protocol/smb/smb2-com-session-setup.pac +++ b/src/analyzer/protocol/smb/smb2-com-session-setup.pac @@ -21,9 +21,9 @@ refine connection SMB_Conn += { if ( smb2_session_setup_response ) { RecordVal* flags = new RecordVal(BifType::Record::SMB2::SessionSetupFlags); - flags->Assign(0, val_mgr->GetBool(${val.flag_guest})); - flags->Assign(1, val_mgr->GetBool(${val.flag_anonymous})); - flags->Assign(2, val_mgr->GetBool(${val.flag_encrypt})); + flags->Assign(0, val_mgr->Bool(${val.flag_guest})); + flags->Assign(1, val_mgr->Bool(${val.flag_anonymous})); + flags->Assign(2, val_mgr->Bool(${val.flag_encrypt})); RecordVal* resp = new RecordVal(BifType::Record::SMB2::SessionSetupResponse); resp->Assign(0, flags); diff --git a/src/analyzer/protocol/smb/smb2-protocol.pac b/src/analyzer/protocol/smb/smb2-protocol.pac index 6424e86d53..d09f620f9c 100644 --- a/src/analyzer/protocol/smb/smb2-protocol.pac +++ b/src/analyzer/protocol/smb/smb2-protocol.pac @@ -238,21 +238,21 @@ function smb2_file_attrs_to_bro(val: SMB2_file_attributes): BroVal %{ RecordVal* r = new RecordVal(BifType::Record::SMB2::FileAttrs); - r->Assign(0, val_mgr->GetBool(${val.read_only})); - r->Assign(1, val_mgr->GetBool(${val.hidden})); - r->Assign(2, val_mgr->GetBool(${val.system})); - r->Assign(3, val_mgr->GetBool(${val.directory})); - r->Assign(4, val_mgr->GetBool(${val.archive})); - r->Assign(5, val_mgr->GetBool(${val.normal})); - r->Assign(6, val_mgr->GetBool(${val.temporary})); - r->Assign(7, val_mgr->GetBool(${val.sparse_file})); - r->Assign(8, val_mgr->GetBool(${val.reparse_point})); - r->Assign(9, val_mgr->GetBool(${val.compressed})); - r->Assign(10, val_mgr->GetBool(${val.offline})); - r->Assign(11, val_mgr->GetBool(${val.not_content_indexed})); - r->Assign(12, val_mgr->GetBool(${val.encrypted})); - r->Assign(13, val_mgr->GetBool(${val.integrity_stream})); - r->Assign(14, val_mgr->GetBool(${val.no_scrub_data})); + r->Assign(0, val_mgr->Bool(${val.read_only})); + r->Assign(1, val_mgr->Bool(${val.hidden})); + r->Assign(2, val_mgr->Bool(${val.system})); + r->Assign(3, val_mgr->Bool(${val.directory})); + r->Assign(4, val_mgr->Bool(${val.archive})); + r->Assign(5, val_mgr->Bool(${val.normal})); + r->Assign(6, val_mgr->Bool(${val.temporary})); + r->Assign(7, val_mgr->Bool(${val.sparse_file})); + r->Assign(8, val_mgr->Bool(${val.reparse_point})); + r->Assign(9, val_mgr->Bool(${val.compressed})); + r->Assign(10, val_mgr->Bool(${val.offline})); + r->Assign(11, val_mgr->Bool(${val.not_content_indexed})); + r->Assign(12, val_mgr->Bool(${val.encrypted})); + r->Assign(13, val_mgr->Bool(${val.integrity_stream})); + r->Assign(14, val_mgr->Bool(${val.no_scrub_data})); return r; %} diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc index 0494bee0c0..c0dea9f4b8 100644 --- a/src/analyzer/protocol/smtp/SMTP.cc +++ b/src/analyzer/protocol/smtp/SMTP.cc @@ -221,7 +221,7 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig) { EnqueueConnEvent(smtp_data, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), make_intrusive(data_len, line) ); } @@ -351,11 +351,11 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig) EnqueueConnEvent(smtp_reply, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}, + val_mgr->Bool(orig), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)}, make_intrusive(cmd), make_intrusive(end_of_line - line, line), - IntrusivePtr{AdoptRef{}, val_mgr->GetBool((pending_reply > 0))} + val_mgr->Bool((pending_reply > 0)) ); } } @@ -860,7 +860,7 @@ void SMTP_Analyzer::RequestEvent(int cmd_len, const char* cmd, EnqueueConnEvent(smtp_request, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig_is_sender)}, + val_mgr->Bool(orig_is_sender), std::move(cmd_arg), make_intrusive(arg_len, arg) ); @@ -881,7 +881,7 @@ void SMTP_Analyzer::Unexpected(bool is_sender, const char* msg, EnqueueConnEvent(smtp_unexpected, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), make_intrusive(msg), make_intrusive(detail_len, detail) ); diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac index da48d6cf78..0913504db4 100644 --- a/src/analyzer/protocol/snmp/snmp-analyzer.pac +++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac @@ -134,9 +134,9 @@ RecordVal* build_hdrV3(const Header* header) v3->Assign(1, asn1_integer_to_val(global_data->max_size(), TYPE_COUNT)); v3->Assign(2, val_mgr->GetCount(flags_byte)); - v3->Assign(3, val_mgr->GetBool(flags_byte & 0x01)); - v3->Assign(4, val_mgr->GetBool(flags_byte & 0x02)); - v3->Assign(5, val_mgr->GetBool(flags_byte & 0x04)); + v3->Assign(3, val_mgr->Bool(flags_byte & 0x01)); + v3->Assign(4, val_mgr->Bool(flags_byte & 0x02)); + v3->Assign(5, val_mgr->Bool(flags_byte & 0x04)); v3->Assign(6, asn1_integer_to_val(global_data->security_model(), TYPE_COUNT)); v3->Assign(7, asn1_octet_string_to_val(v3hdr->security_parameters())); diff --git a/src/analyzer/protocol/ssh/ssh-analyzer.pac b/src/analyzer/protocol/ssh/ssh-analyzer.pac index 38e450f69a..9734311535 100644 --- a/src/analyzer/protocol/ssh/ssh-analyzer.pac +++ b/src/analyzer/protocol/ssh/ssh-analyzer.pac @@ -101,7 +101,7 @@ refine flow SSH_Flow += { } - result->Assign(6, val_mgr->GetBool(!${msg.is_orig})); + result->Assign(6, val_mgr->Bool(!${msg.is_orig})); BifEvent::generate_ssh_capabilities(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), bytestring_to_val(${msg.cookie}), diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.cc b/src/analyzer/protocol/stepping-stone/SteppingStone.cc index 42332a59c5..baf4cba126 100644 --- a/src/analyzer/protocol/stepping-stone/SteppingStone.cc +++ b/src/analyzer/protocol/stepping-stone/SteppingStone.cc @@ -149,7 +149,7 @@ void SteppingStoneEndpoint::CreateEndpEvent(bool is_orig) endp->TCP()->EnqueueConnEvent(stp_create_endp, IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()}, IntrusivePtr{AdoptRef{}, val_mgr->GetInt(stp_id)}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + val_mgr->Bool(is_orig) ); } diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc index f9ce7d59b5..6998af68ea 100644 --- a/src/analyzer/protocol/tcp/TCP.cc +++ b/src/analyzer/protocol/tcp/TCP.cc @@ -109,14 +109,14 @@ static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip, RecordVal* v = new RecordVal(SYN_packet); - v->Assign(0, val_mgr->GetBool(is_orig)); - v->Assign(1, val_mgr->GetBool(int(ip->DF()))); + v->Assign(0, val_mgr->Bool(is_orig)); + v->Assign(1, val_mgr->Bool(int(ip->DF()))); v->Assign(2, val_mgr->GetCount((ip->TTL()))); v->Assign(3, val_mgr->GetCount((ip->TotalLen()))); v->Assign(4, val_mgr->GetCount(ntohs(tcp->th_win))); v->Assign(5, val_mgr->GetInt(winscale)); v->Assign(6, val_mgr->GetCount(MSS)); - v->Assign(7, val_mgr->GetBool(SACK)); + v->Assign(7, val_mgr->Bool(SACK)); return v; } @@ -787,7 +787,7 @@ void TCP_Analyzer::GeneratePacketEvent( { EnqueueConnEvent(tcp_packet, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), make_intrusive(flags.AsString()), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(rel_seq)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flags.ACK() ? rel_ack : 0)}, @@ -1347,7 +1347,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) auto length = kind < 2 ? 1 : o[1]; EnqueueConnEvent(tcp_option, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(kind)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(length)} ); @@ -1460,7 +1460,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig) EnqueueConnEvent(tcp_options, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), std::move(option_list) ); } @@ -1782,7 +1782,7 @@ void TCP_Analyzer::EndpointEOF(TCP_Reassembler* endp) if ( connection_EOF ) EnqueueConnEvent(connection_EOF, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(endp->IsOrig())} + val_mgr->Bool(endp->IsOrig()) ); const analyzer_list& children(GetChildren()); @@ -2062,7 +2062,7 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl if ( tcp_rexmit ) endp->TCP()->EnqueueConnEvent(tcp_rexmit, IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(endp->IsOrig())}, + val_mgr->Bool(endp->IsOrig()), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(data_in_flight)}, diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc index f0fb129d6d..d0626ac37c 100644 --- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc +++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc @@ -239,7 +239,7 @@ bool TCP_Endpoint::DataSent(double t, uint64_t seq, int len, int caplen, if ( contents_file_write_failure ) tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, IntrusivePtr{AdoptRef{}, Conn()->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + val_mgr->Bool(IsOrig()), make_intrusive(buf) ); } diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc index 697e8d7325..72428107a9 100644 --- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc +++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc @@ -153,7 +153,7 @@ void TCP_Reassembler::Gap(uint64_t seq, uint64_t len) if ( report_gap(endp, endp->peer) ) dst_analyzer->EnqueueConnEvent(content_gap, IntrusivePtr{AdoptRef{}, dst_analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + val_mgr->Bool(IsOrig()), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)} ); @@ -363,7 +363,7 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, BroFile* f) if ( contents_file_write_failure ) tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + val_mgr->Bool(IsOrig()), make_intrusive("TCP reassembler content write failure") ); } @@ -378,7 +378,7 @@ void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile* if ( contents_file_write_failure ) tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + val_mgr->Bool(IsOrig()), make_intrusive("TCP reassembler gap write failure") ); } @@ -614,7 +614,7 @@ void TCP_Reassembler::DeliverBlock(uint64_t seq, int len, const u_char* data) if ( deliver_tcp_contents ) tcp_analyzer->EnqueueConnEvent(tcp_contents, IntrusivePtr{AdoptRef{}, tcp_analyzer->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())}, + val_mgr->Bool(IsOrig()), IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)}, make_intrusive(len, (const char*) data) ); diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc index b585f4b227..6e62f17c83 100644 --- a/src/analyzer/protocol/udp/UDP.cc +++ b/src/analyzer/protocol/udp/UDP.cc @@ -166,7 +166,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, if ( do_udp_contents ) EnqueueConnEvent(udp_contents, IntrusivePtr{AdoptRef{}, BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), make_intrusive(len, (const char*) data) ); } diff --git a/src/broker/Data.cc b/src/broker/Data.cc index 7459c8f3ac..6616973485 100644 --- a/src/broker/Data.cc +++ b/src/broker/Data.cc @@ -90,7 +90,7 @@ struct val_converter { result_type operator()(bool a) { if ( type->Tag() == TYPE_BOOL ) - return val_mgr->GetBool(a); + return val_mgr->Bool(a)->Ref(); return nullptr; } diff --git a/src/broker/data.bif b/src/broker/data.bif index 79d87bb76d..9c4014b3af 100644 --- a/src/broker/data.bif +++ b/src/broker/data.bif @@ -87,7 +87,7 @@ function Broker::__set_contains%(s: Broker::Data, key: any%): bool return val_mgr->False(); } - return val_mgr->GetBool(v.find(*k) != v.end()); + return val_mgr->Bool(v.find(*k) != v.end()); %} function Broker::__set_insert%(s: Broker::Data, key: any%): bool @@ -103,7 +103,7 @@ function Broker::__set_insert%(s: Broker::Data, key: any%): bool return val_mgr->False(); } - return val_mgr->GetBool(v.insert(std::move(*k)).second); + return val_mgr->Bool(v.insert(std::move(*k)).second); %} function Broker::__set_remove%(s: Broker::Data, key: any%): bool @@ -118,7 +118,7 @@ function Broker::__set_remove%(s: Broker::Data, key: any%): bool return val_mgr->False(); } - return val_mgr->GetBool(v.erase(*k) > 0); + return val_mgr->Bool(v.erase(*k) > 0); %} function Broker::__set_iterator%(s: Broker::Data%): opaque of Broker::SetIterator @@ -129,7 +129,7 @@ function Broker::__set_iterator%(s: Broker::Data%): opaque of Broker::SetIterato function Broker::__set_iterator_last%(it: opaque of Broker::SetIterator%): bool %{ auto set_it = static_cast(it); - return val_mgr->GetBool(set_it->it == set_it->dat.end()); + return val_mgr->Bool(set_it->it == set_it->dat.end()); %} function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool @@ -140,7 +140,7 @@ function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool return val_mgr->False(); ++set_it->it; - return val_mgr->GetBool(set_it->it != set_it->dat.end()); + return val_mgr->Bool(set_it->it != set_it->dat.end()); %} function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Broker::Data @@ -191,7 +191,7 @@ function Broker::__table_contains%(t: Broker::Data, key: any%): bool return val_mgr->False(); } - return val_mgr->GetBool(v.find(*k) != v.end()); + return val_mgr->Bool(v.find(*k) != v.end()); %} function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::Data @@ -283,7 +283,7 @@ function Broker::__table_iterator%(t: Broker::Data%): opaque of Broker::TableIte function Broker::__table_iterator_last%(it: opaque of Broker::TableIterator%): bool %{ auto ti = static_cast(it); - return val_mgr->GetBool(ti->it == ti->dat.end()); + return val_mgr->Bool(ti->it == ti->dat.end()); %} function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): bool @@ -294,7 +294,7 @@ function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): b return val_mgr->False(); ++ti->it; - return val_mgr->GetBool(ti->it != ti->dat.end()); + return val_mgr->Bool(ti->it != ti->dat.end()); %} function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%): Broker::TableItem @@ -406,7 +406,7 @@ function Broker::__vector_iterator%(v: Broker::Data%): opaque of Broker::VectorI function Broker::__vector_iterator_last%(it: opaque of Broker::VectorIterator%): bool %{ auto vi = static_cast(it); - return val_mgr->GetBool(vi->it == vi->dat.end()); + return val_mgr->Bool(vi->it == vi->dat.end()); %} function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%): bool @@ -417,7 +417,7 @@ function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%): return val_mgr->False(); ++vi->it; - return val_mgr->GetBool(vi->it != vi->dat.end()); + return val_mgr->Bool(vi->it != vi->dat.end()); %} function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%): Broker::Data @@ -485,7 +485,7 @@ function Broker::__record_iterator%(r: Broker::Data%): opaque of Broker::RecordI function Broker::__record_iterator_last%(it: opaque of Broker::RecordIterator%): bool %{ auto ri = static_cast(it); - return val_mgr->GetBool(ri->it == ri->dat.end()); + return val_mgr->Bool(ri->it == ri->dat.end()); %} function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%): bool @@ -496,7 +496,7 @@ function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%): return val_mgr->False(); ++ri->it; - return val_mgr->GetBool(ri->it != ri->dat.end()); + return val_mgr->Bool(ri->it != ri->dat.end()); %} function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%): Broker::Data diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif index 97cf4ea321..94ccf72103 100644 --- a/src/broker/messaging.bif +++ b/src/broker/messaging.bif @@ -111,7 +111,7 @@ function Broker::publish%(topic: string, ...%): bool args.push_back((*bif_args)[i].get()); auto rval = publish_event_args(args, topic->AsString(), frame); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Broker::__flush_logs%(%): count @@ -125,42 +125,42 @@ function Broker::__publish_id%(topic: string, id: string%): bool bro_broker::Manager::ScriptScopeGuard ssg; auto rval = broker_mgr->PublishIdentifier(topic->CheckString(), id->CheckString()); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Broker::__auto_publish%(topic: string, ev: any%): bool %{ bro_broker::Manager::ScriptScopeGuard ssg; auto rval = broker_mgr->AutoPublishEvent(topic->CheckString(), ev); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Broker::__auto_unpublish%(topic: string, ev: any%): bool %{ bro_broker::Manager::ScriptScopeGuard ssg; auto rval = broker_mgr->AutoUnpublishEvent(topic->CheckString(), ev); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Broker::__subscribe%(topic_prefix: string%): bool %{ bro_broker::Manager::ScriptScopeGuard ssg; auto rval = broker_mgr->Subscribe(topic_prefix->CheckString()); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Broker::__forward%(topic_prefix: string%): bool %{ bro_broker::Manager::ScriptScopeGuard ssg; auto rval = broker_mgr->Forward(topic_prefix->CheckString()); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Broker::__unsubscribe%(topic_prefix: string%): bool %{ bro_broker::Manager::ScriptScopeGuard ssg; auto rval = broker_mgr->Unsubscribe(topic_prefix->CheckString()); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} module Cluster; @@ -201,7 +201,7 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool args.push_back((*bif_args)[i].get()); auto rval = publish_event_args(args, topic->AsString(), frame); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} @@ -238,5 +238,5 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool args.push_back((*bif_args)[i].get()); auto rval = publish_event_args(args, topic->AsString(), frame); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} diff --git a/src/broker/store.bif b/src/broker/store.bif index 514dcff4be..26c6fa72cd 100644 --- a/src/broker/store.bif +++ b/src/broker/store.bif @@ -98,7 +98,7 @@ function Broker::__is_closed%(h: opaque of Broker::Store%): bool } auto handle = static_cast(h); - return val_mgr->GetBool(broker_mgr->LookupStore(handle->store.name())); + return val_mgr->Bool(broker_mgr->LookupStore(handle->store.name())); %} function Broker::__close%(h: opaque of Broker::Store%): bool @@ -112,7 +112,7 @@ function Broker::__close%(h: opaque of Broker::Store%): bool } auto handle = static_cast(h); - return val_mgr->GetBool(broker_mgr->CloseStore(handle->store.name())); + return val_mgr->Bool(broker_mgr->CloseStore(handle->store.name())); %} function Broker::__store_name%(h: opaque of Broker::Store%): string diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index e0c8f02d8d..24734eba99 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -97,7 +97,7 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio if ( conn ) { - val->Assign(is_orig_idx, val_mgr->GetBool(is_orig)); + val->Assign(is_orig_idx, val_mgr->Bool(is_orig)); UpdateConnectionFields(conn, is_orig); } @@ -157,7 +157,7 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig) FileEvent(file_over_new_connection, { IntrusivePtr{NewRef{}, val}, IntrusivePtr{AdoptRef{}, conn->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}, + val_mgr->Bool(is_orig), }); } } diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc index c5406ae132..6aed55df34 100644 --- a/src/file_analysis/Manager.cc +++ b/src/file_analysis/Manager.cc @@ -437,7 +437,7 @@ string Manager::GetFileID(const analyzer::Tag& tag, Connection* c, bool is_orig) mgr.Enqueue(get_file_handle, IntrusivePtr{NewRef{}, tagval}, IntrusivePtr{AdoptRef{}, c->BuildConnVal()}, - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)} + val_mgr->Bool(is_orig) ); mgr.Drain(); // need file handle immediately so we don't have to buffer data return current_file_id; diff --git a/src/file_analysis/analyzer/extract/functions.bif b/src/file_analysis/analyzer/extract/functions.bif index ddf342fee7..9b80700755 100644 --- a/src/file_analysis/analyzer/extract/functions.bif +++ b/src/file_analysis/analyzer/extract/functions.bif @@ -13,7 +13,7 @@ function FileExtract::__set_limit%(file_id: string, args: any, n: count%): bool using BifType::Record::Files::AnalyzerArgs; auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs); bool result = file_mgr->SetExtractionLimit(file_id->CheckString(), rv.get(), n); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} module GLOBAL; diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc index b990d0511c..0c063986b2 100644 --- a/src/file_analysis/analyzer/x509/X509.cc +++ b/src/file_analysis/analyzer/x509/X509.cc @@ -290,7 +290,7 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex) if ( x509_ext_basic_constraints ) { auto pBasicConstraint = make_intrusive(BifType::Record::X509::BasicConstraints); - pBasicConstraint->Assign(0, val_mgr->GetBool(constr->ca)); + pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca)); if ( constr->pathlen ) pBasicConstraint->Assign(1, val_mgr->GetCount((int32_t) ASN1_INTEGER_get(constr->pathlen))); @@ -434,7 +434,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext) if ( ips != nullptr ) sanExt->Assign(3, ips); - sanExt->Assign(4, val_mgr->GetBool(otherfields)); + sanExt->Assign(4, val_mgr->Bool(otherfields)); mgr.Enqueue(x509_ext_subject_alternative_name, IntrusivePtr{NewRef{}, GetFile()->GetVal()}, diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc index c560e2afdb..1b26a86663 100644 --- a/src/file_analysis/analyzer/x509/X509Common.cc +++ b/src/file_analysis/analyzer/x509/X509Common.cc @@ -276,7 +276,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa pX509Ext->Assign(1, make_intrusive(short_name)); pX509Ext->Assign(2, make_intrusive(oid)); - pX509Ext->Assign(3, val_mgr->GetBool(critical)); + pX509Ext->Assign(3, val_mgr->Bool(critical)); pX509Ext->Assign(4, ext_val); // send off generic extension event @@ -289,7 +289,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa if ( h == ocsp_extension ) mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()}, std::move(pX509Ext), - IntrusivePtr{AdoptRef{}, val_mgr->GetBool(global)}); + val_mgr->Bool(global)); else mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()}, std::move(pX509Ext)); diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif index aa621fe5ea..59697e59ee 100644 --- a/src/file_analysis/analyzer/x509/functions.bif +++ b/src/file_analysis/analyzer/x509/functions.bif @@ -742,7 +742,7 @@ function sct_verify%(cert: opaque of x509, logid: string, log_key: string, signa EVP_MD_CTX_destroy(mdctx); EVP_PKEY_free(key); - return val_mgr->GetBool(success); + return val_mgr->Bool(success); sct_verify_err: if (mdctx) diff --git a/src/file_analysis/file_analysis.bif b/src/file_analysis/file_analysis.bif index f7f27cca08..c9bbdc47f4 100644 --- a/src/file_analysis/file_analysis.bif +++ b/src/file_analysis/file_analysis.bif @@ -14,28 +14,28 @@ type AnalyzerArgs: record; function Files::__set_timeout_interval%(file_id: string, t: interval%): bool %{ bool result = file_mgr->SetTimeoutInterval(file_id->CheckString(), t); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} ## :zeek:see:`Files::enable_reassembly`. function Files::__enable_reassembly%(file_id: string%): bool %{ bool result = file_mgr->EnableReassembly(file_id->CheckString()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} ## :zeek:see:`Files::disable_reassembly`. function Files::__disable_reassembly%(file_id: string%): bool %{ bool result = file_mgr->DisableReassembly(file_id->CheckString()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} ## :zeek:see:`Files::set_reassembly_buffer_size`. function Files::__set_reassembly_buffer%(file_id: string, max: count%): bool %{ bool result = file_mgr->SetReassemblyBuffer(file_id->CheckString(), max); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} ## :zeek:see:`Files::add_analyzer`. @@ -45,7 +45,7 @@ function Files::__add_analyzer%(file_id: string, tag: Files::Tag, args: any%): b auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs); bool result = file_mgr->AddAnalyzer(file_id->CheckString(), file_mgr->GetComponentTag(tag), rv.get()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} ## :zeek:see:`Files::remove_analyzer`. @@ -55,14 +55,14 @@ function Files::__remove_analyzer%(file_id: string, tag: Files::Tag, args: any%) auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs); bool result = file_mgr->RemoveAnalyzer(file_id->CheckString(), file_mgr->GetComponentTag(tag) , rv.get()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} ## :zeek:see:`Files::stop`. function Files::__stop%(file_id: string%): bool %{ bool result = file_mgr->IgnoreFile(file_id->CheckString()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} ## :zeek:see:`Files::analyzer_name`. diff --git a/src/input/Manager.cc b/src/input/Manager.cc index 4d6702e5f6..c8a2b72f63 100644 --- a/src/input/Manager.cc +++ b/src/input/Manager.cc @@ -2259,7 +2259,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ switch ( val->type ) { case TYPE_BOOL: - return val_mgr->GetBool(val->val.int_val); + return val_mgr->Bool(val->val.int_val)->Ref(); case TYPE_INT: return val_mgr->GetInt(val->val.int_val); @@ -2407,7 +2407,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co switch ( val->type ) { case TYPE_BOOL: - return val_mgr->GetBool(val->val.int_val); + return val_mgr->Bool(val->val.int_val)->Ref(); case TYPE_INT: return val_mgr->GetInt(val->val.int_val); diff --git a/src/input/input.bif b/src/input/input.bif index a143799a52..a90564acdc 100644 --- a/src/input/input.bif +++ b/src/input/input.bif @@ -19,31 +19,31 @@ type AnalysisDescription: record; function Input::__create_table_stream%(description: Input::TableDescription%) : bool %{ bool res = input_mgr->CreateTableStream(description->AsRecordVal()); - return val_mgr->GetBool(res); + return val_mgr->Bool(res); %} function Input::__create_event_stream%(description: Input::EventDescription%) : bool %{ bool res = input_mgr->CreateEventStream(description->AsRecordVal()); - return val_mgr->GetBool(res); + return val_mgr->Bool(res); %} function Input::__create_analysis_stream%(description: Input::AnalysisDescription%) : bool %{ bool res = input_mgr->CreateAnalysisStream(description->AsRecordVal()); - return val_mgr->GetBool(res); + return val_mgr->Bool(res); %} function Input::__remove_stream%(id: string%) : bool %{ bool res = input_mgr->RemoveStream(id->AsString()->CheckString()); - return val_mgr->GetBool(res); + return val_mgr->Bool(res); %} function Input::__force_update%(id: string%) : bool %{ bool res = input_mgr->ForceUpdate(id->AsString()->CheckString()); - return val_mgr->GetBool(res); + return val_mgr->Bool(res); %} # Options for the input framework diff --git a/src/iosource/pcap/pcap.bif b/src/iosource/pcap/pcap.bif index 3094b4cc07..790e09dd9d 100644 --- a/src/iosource/pcap/pcap.bif +++ b/src/iosource/pcap/pcap.bif @@ -43,7 +43,7 @@ function precompile_pcap_filter%(id: PcapFilterID, s: string%): bool if ( ps && ! ps->PrecompileFilter(id->ForceAsInt(), s->CheckString()) ) success = false; - return val_mgr->GetBool(success); + return val_mgr->Bool(success); %} ## Installs a PCAP filter that has been precompiled with @@ -72,7 +72,7 @@ function Pcap::install_pcap_filter%(id: PcapFilterID%): bool if ( ps && ! ps->SetFilter(id->ForceAsInt()) ) success = false; - return val_mgr->GetBool(success); + return val_mgr->Bool(success); %} ## Returns a string representation of the last PCAP error. diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc index 22a6829201..e9c305634a 100644 --- a/src/logging/Manager.cc +++ b/src/logging/Manager.cc @@ -1521,7 +1521,7 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con info->Assign(2, make_intrusive(winfo->writer->Info().path)); info->Assign(3, make_intrusive(open, TYPE_TIME)); info->Assign(4, make_intrusive(close, TYPE_TIME)); - info->Assign(5, val_mgr->GetBool(terminating)); + info->Assign(5, val_mgr->Bool(terminating)); Func* func = winfo->postprocessor; if ( ! func ) diff --git a/src/logging/logging.bif b/src/logging/logging.bif index fda6d36c5c..efe08b26d9 100644 --- a/src/logging/logging.bif +++ b/src/logging/logging.bif @@ -19,53 +19,53 @@ enum PrintLogType %{ function Log::__create_stream%(id: Log::ID, stream: Log::Stream%) : bool %{ bool result = log_mgr->CreateStream(id->AsEnumVal(), stream->AsRecordVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__remove_stream%(id: Log::ID%) : bool %{ bool result = log_mgr->RemoveStream(id->AsEnumVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__enable_stream%(id: Log::ID%) : bool %{ bool result = log_mgr->EnableStream(id->AsEnumVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__disable_stream%(id: Log::ID%) : bool %{ bool result = log_mgr->DisableStream(id->AsEnumVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__add_filter%(id: Log::ID, filter: Log::Filter%) : bool %{ bool result = log_mgr->AddFilter(id->AsEnumVal(), filter->AsRecordVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__remove_filter%(id: Log::ID, name: string%) : bool %{ bool result = log_mgr->RemoveFilter(id->AsEnumVal(), name); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__write%(id: Log::ID, columns: any%) : bool %{ bool result = log_mgr->Write(id->AsEnumVal(), columns->AsRecordVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__set_buf%(id: Log::ID, buffered: bool%): bool %{ bool result = log_mgr->SetBuf(id->AsEnumVal(), buffered); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} function Log::__flush%(id: Log::ID%): bool %{ bool result = log_mgr->Flush(id->AsEnumVal()); - return val_mgr->GetBool(result); + return val_mgr->Bool(result); %} diff --git a/src/option.bif b/src/option.bif index 066dd7a7c2..49d63bdca7 100644 --- a/src/option.bif +++ b/src/option.bif @@ -92,7 +92,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool } auto rval = call_option_handlers_and_set_value(ID, i, std::move(val_from_data), location); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); } if ( ! same_type(i->Type(), val->Type()) ) @@ -106,7 +106,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool IntrusivePtr{NewRef{}, i->Type()->AsTableType()}, IntrusivePtr{NewRef{}, i->ID_Val()->AsTableVal()->Attrs()}); auto rval = call_option_handlers_and_set_value(ID, i, std::move(tv), location); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); } builtin_error(fmt("Incompatible type for set of ID '%s': got '%s', need '%s'", @@ -115,7 +115,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool } auto rval = call_option_handlers_and_set_value(ID, i, {NewRef{}, val}, location); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} ## Set a change handler for an option. The change handler will be diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc index fd96a15874..8f65611a74 100644 --- a/src/supervisor/Supervisor.cc +++ b/src/supervisor/Supervisor.cc @@ -1230,7 +1230,7 @@ bool Supervisor::SupervisedNode::InitCluster() const cluster_nodes->Assign(key.get(), std::move(val)); } - cluster_manager_is_logger_id->SetVal({AdoptRef{}, val_mgr->GetBool(! has_logger)}); + cluster_manager_is_logger_id->SetVal(val_mgr->Bool(! has_logger)); return true; } diff --git a/src/supervisor/supervisor.bif b/src/supervisor/supervisor.bif index b297c2944f..c6b07a42b2 100644 --- a/src/supervisor/supervisor.bif +++ b/src/supervisor/supervisor.bif @@ -47,11 +47,11 @@ function Supervisor::__destroy%(node: string%): bool if ( ! zeek::supervisor_mgr ) { builtin_error("supervisor mode not enabled"); - return val_mgr->GetBool(false); + return val_mgr->Bool(false); } auto rval = zeek::supervisor_mgr->Destroy(node->CheckString()); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Supervisor::__restart%(node: string%): bool @@ -59,24 +59,24 @@ function Supervisor::__restart%(node: string%): bool if ( ! zeek::supervisor_mgr ) { builtin_error("supervisor mode not enabled"); - return val_mgr->GetBool(false); + return val_mgr->Bool(false); } auto rval = zeek::supervisor_mgr->Restart(node->CheckString()); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} function Supervisor::__init_cluster%(%): bool %{ if ( zeek::Supervisor::ThisNode() ) - return val_mgr->GetBool(zeek::Supervisor::ThisNode()->InitCluster()); + return val_mgr->Bool(zeek::Supervisor::ThisNode()->InitCluster()); - return val_mgr->GetBool(false); + return val_mgr->Bool(false); %} function Supervisor::__is_supervised%(%): bool %{ - return val_mgr->GetBool(zeek::Supervisor::ThisNode().has_value()); + return val_mgr->Bool(zeek::Supervisor::ThisNode().has_value()); %} function Supervisor::__node%(%): Supervisor::NodeConfig @@ -96,7 +96,7 @@ function Supervisor::__node%(%): Supervisor::NodeConfig function Supervisor::__is_supervisor%(%): bool %{ - return val_mgr->GetBool(zeek::supervisor_mgr != nullptr); + return val_mgr->Bool(zeek::supervisor_mgr != nullptr); %} function Supervisor::__stem_pid%(%): int diff --git a/src/zeek.bif b/src/zeek.bif index 44ef202a1a..bea1145287 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -3942,7 +3942,7 @@ static bool mmdb_try_open_asn () function mmdb_open_location_db%(f: string%) : bool %{ #ifdef USE_GEOIP - return val_mgr->GetBool(mmdb_open_loc(f->CheckString())); + return val_mgr->Bool(mmdb_open_loc(f->CheckString())); #else return val_mgr->False(); #endif @@ -3959,7 +3959,7 @@ function mmdb_open_location_db%(f: string%) : bool function mmdb_open_asn_db%(f: string%) : bool %{ #ifdef USE_GEOIP - return val_mgr->GetBool(mmdb_open_asn(f->CheckString())); + return val_mgr->Bool(mmdb_open_asn(f->CheckString())); #else return val_mgr->False(); #endif @@ -4276,7 +4276,7 @@ function disable_analyzer%(cid: conn_id, aid: count, err_if_no_conn: bool &defau a->Parent()->PreventChildren(a->GetAnalyzerTag()); auto rval = a->Remove(); - return val_mgr->GetBool(rval); + return val_mgr->Bool(rval); %} ## Informs Zeek that it should skip any further processing of the contents of @@ -4405,7 +4405,7 @@ function open_for_append%(f: string%): file ## rmdir unlink rename function close%(f: file%): bool %{ - return val_mgr->GetBool(f->Close()); + return val_mgr->Bool(f->Close()); %} ## Writes data to an open file. @@ -4424,7 +4424,7 @@ function write_file%(f: file, data: string%): bool if ( ! f ) return val_mgr->False(); - return val_mgr->GetBool(f->Write((const char*) data->Bytes(), data->Len())); + return val_mgr->Bool(f->Write((const char*) data->Bytes(), data->Len())); %} ## Alters the buffering behavior of a file. @@ -4454,7 +4454,7 @@ function set_buf%(f: file, buffered: bool%): any ## rmdir unlink rename function flush_all%(%): bool %{ - return val_mgr->GetBool(fflush(0) == 0); + return val_mgr->Bool(fflush(0) == 0); %} ## Creates a new directory. @@ -4572,7 +4572,7 @@ function rename%(src_f: string, dst_f: string%): bool ## .. todo:: Rename to ``is_open``. function active_file%(f: file%): bool %{ - return val_mgr->GetBool(f->IsOpen()); + return val_mgr->Bool(f->IsOpen()); %} ## Gets the filename associated with a file handle. @@ -4796,7 +4796,7 @@ function install_src_net_filter%(snet: subnet, tcp_flags: count, prob: double%) ## Pcap::error function uninstall_src_addr_filter%(ip: addr%) : bool %{ - return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveSrc(ip->AsAddr())); + return val_mgr->Bool(sessions->GetPacketFilter()->RemoveSrc(ip->AsAddr())); %} ## Removes a source subnet filter. @@ -4817,7 +4817,7 @@ function uninstall_src_addr_filter%(ip: addr%) : bool ## Pcap::error function uninstall_src_net_filter%(snet: subnet%) : bool %{ - return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveSrc(snet)); + return val_mgr->Bool(sessions->GetPacketFilter()->RemoveSrc(snet)); %} ## Installs a filter to drop packets destined to a given IP address with @@ -4901,7 +4901,7 @@ function install_dst_net_filter%(snet: subnet, tcp_flags: count, prob: double%) ## Pcap::error function uninstall_dst_addr_filter%(ip: addr%) : bool %{ - return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveDst(ip->AsAddr())); + return val_mgr->Bool(sessions->GetPacketFilter()->RemoveDst(ip->AsAddr())); %} ## Removes a destination subnet filter. @@ -4922,7 +4922,7 @@ function uninstall_dst_addr_filter%(ip: addr%) : bool ## Pcap::error function uninstall_dst_net_filter%(snet: subnet%) : bool %{ - return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveDst(snet)); + return val_mgr->Bool(sessions->GetPacketFilter()->RemoveDst(snet)); %} ## Checks whether the last raised event came from a remote peer. @@ -4930,7 +4930,7 @@ function uninstall_dst_net_filter%(snet: subnet%) : bool ## Returns: True if the last raised event came from a remote peer. function is_remote_event%(%) : bool %{ - return val_mgr->GetBool(mgr.CurrentSource() != SOURCE_LOCAL); + return val_mgr->Bool(mgr.CurrentSource() != SOURCE_LOCAL); %} ## Stops Zeek's packet processing. This function is used to synchronize