mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Update deprecated ValManager::GetBool usages
This commit is contained in:
parent
9af84bb2b0
commit
d9edd855da
68 changed files with 370 additions and 370 deletions
|
@ -768,7 +768,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
|
||||||
if ( tag == TYPE_ENUM )
|
if ( tag == TYPE_ENUM )
|
||||||
*pval = t->AsEnumType()->GetVal(*kp);
|
*pval = t->AsEnumType()->GetVal(*kp);
|
||||||
else if ( tag == TYPE_BOOL )
|
else if ( tag == TYPE_BOOL )
|
||||||
*pval = {AdoptRef{}, val_mgr->GetBool(*kp)};
|
*pval = val_mgr->Bool(*kp);
|
||||||
else if ( tag == TYPE_INT )
|
else if ( tag == TYPE_INT )
|
||||||
*pval = {AdoptRef{}, val_mgr->GetInt(*kp)};
|
*pval = {AdoptRef{}, val_mgr->GetInt(*kp)};
|
||||||
else
|
else
|
||||||
|
|
|
@ -261,7 +261,7 @@ void Connection::HistoryThresholdEvent(EventHandlerPtr e, bool is_orig,
|
||||||
|
|
||||||
EnqueueEvent(e, nullptr,
|
EnqueueEvent(e, nullptr,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)}
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -391,7 +391,7 @@ RecordVal* Connection::BuildConnVal()
|
||||||
conn_val->Assign(3, make_intrusive<Val>(start_time, TYPE_TIME)); // ###
|
conn_val->Assign(3, make_intrusive<Val>(start_time, TYPE_TIME)); // ###
|
||||||
conn_val->Assign(4, make_intrusive<Val>(last_time - start_time, TYPE_INTERVAL));
|
conn_val->Assign(4, make_intrusive<Val>(last_time - start_time, TYPE_INTERVAL));
|
||||||
conn_val->Assign(6, make_intrusive<StringVal>(history.c_str()));
|
conn_val->Assign(6, make_intrusive<StringVal>(history.c_str()));
|
||||||
conn_val->Assign(11, val_mgr->GetBool(is_successful));
|
conn_val->Assign(11, val_mgr->Bool(is_successful));
|
||||||
|
|
||||||
conn_val->SetOrigin(this);
|
conn_val->SetOrigin(this);
|
||||||
|
|
||||||
|
@ -698,7 +698,7 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label)
|
||||||
{
|
{
|
||||||
EnqueueEvent(connection_flow_label_changed, nullptr,
|
EnqueueEvent(connection_flow_label_changed, nullptr,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(my_flow_label)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(my_flow_label)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flow_label)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flow_label)}
|
||||||
);
|
);
|
||||||
|
|
|
@ -738,7 +738,7 @@ IntrusivePtr<Val> DNS_Mgr::BuildMappingVal(DNS_Mapping* dm)
|
||||||
r->Assign(0, make_intrusive<Val>(dm->CreationTime(), TYPE_TIME));
|
r->Assign(0, make_intrusive<Val>(dm->CreationTime(), TYPE_TIME));
|
||||||
r->Assign(1, make_intrusive<StringVal>(dm->ReqHost() ? dm->ReqHost() : ""));
|
r->Assign(1, make_intrusive<StringVal>(dm->ReqHost() ? dm->ReqHost() : ""));
|
||||||
r->Assign(2, make_intrusive<AddrVal>(dm->ReqAddr()));
|
r->Assign(2, make_intrusive<AddrVal>(dm->ReqAddr()));
|
||||||
r->Assign(3, val_mgr->GetBool(dm->Valid()));
|
r->Assign(3, val_mgr->Bool(dm->Valid()));
|
||||||
|
|
||||||
auto h = dm->Host();
|
auto h = dm->Host();
|
||||||
r->Assign(4, h ? h.release() : new StringVal("<none>"));
|
r->Assign(4, h ? h.release() : new StringVal("<none>"));
|
||||||
|
|
30
src/Expr.cc
30
src/Expr.cc
|
@ -684,7 +684,7 @@ IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
|
||||||
else if ( ret_type->InternalType() == TYPE_INTERNAL_UNSIGNED )
|
else if ( ret_type->InternalType() == TYPE_INTERNAL_UNSIGNED )
|
||||||
return {AdoptRef{}, val_mgr->GetCount(u3)};
|
return {AdoptRef{}, val_mgr->GetCount(u3)};
|
||||||
else if ( ret_type->Tag() == TYPE_BOOL )
|
else if ( ret_type->Tag() == TYPE_BOOL )
|
||||||
return {AdoptRef{}, val_mgr->GetBool(i3)};
|
return val_mgr->Bool(i3);
|
||||||
else
|
else
|
||||||
return {AdoptRef{}, val_mgr->GetInt(i3)};
|
return {AdoptRef{}, val_mgr->GetInt(i3)};
|
||||||
}
|
}
|
||||||
|
@ -720,7 +720,7 @@ IntrusivePtr<Val> BinaryExpr::StringFold(Val* v1, Val* v2) const
|
||||||
BadTag("BinaryExpr::StringFold", expr_name(tag));
|
BadTag("BinaryExpr::StringFold", expr_name(tag));
|
||||||
}
|
}
|
||||||
|
|
||||||
return {AdoptRef{}, val_mgr->GetBool(result)};
|
return val_mgr->Bool(result);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -796,7 +796,7 @@ IntrusivePtr<Val> BinaryExpr::SetFold(Val* v1, Val* v2) const
|
||||||
return nullptr;
|
return nullptr;
|
||||||
}
|
}
|
||||||
|
|
||||||
return {AdoptRef{}, val_mgr->GetBool(res)};
|
return val_mgr->Bool(res);
|
||||||
}
|
}
|
||||||
|
|
||||||
IntrusivePtr<Val> BinaryExpr::AddrFold(Val* v1, Val* v2) const
|
IntrusivePtr<Val> BinaryExpr::AddrFold(Val* v1, Val* v2) const
|
||||||
|
@ -830,7 +830,7 @@ IntrusivePtr<Val> BinaryExpr::AddrFold(Val* v1, Val* v2) const
|
||||||
BadTag("BinaryExpr::AddrFold", expr_name(tag));
|
BadTag("BinaryExpr::AddrFold", expr_name(tag));
|
||||||
}
|
}
|
||||||
|
|
||||||
return {AdoptRef{}, val_mgr->GetBool(result)};
|
return val_mgr->Bool(result);
|
||||||
}
|
}
|
||||||
|
|
||||||
IntrusivePtr<Val> BinaryExpr::SubNetFold(Val* v1, Val* v2) const
|
IntrusivePtr<Val> BinaryExpr::SubNetFold(Val* v1, Val* v2) const
|
||||||
|
@ -843,7 +843,7 @@ IntrusivePtr<Val> BinaryExpr::SubNetFold(Val* v1, Val* v2) const
|
||||||
if ( tag == EXPR_NE )
|
if ( tag == EXPR_NE )
|
||||||
result = ! result;
|
result = ! result;
|
||||||
|
|
||||||
return {AdoptRef{}, val_mgr->GetBool(result)};
|
return val_mgr->Bool(result);
|
||||||
}
|
}
|
||||||
|
|
||||||
void BinaryExpr::SwapOps()
|
void BinaryExpr::SwapOps()
|
||||||
|
@ -1037,7 +1037,7 @@ NotExpr::NotExpr(IntrusivePtr<Expr> arg_op)
|
||||||
|
|
||||||
IntrusivePtr<Val> NotExpr::Fold(Val* v) const
|
IntrusivePtr<Val> NotExpr::Fold(Val* v) const
|
||||||
{
|
{
|
||||||
return {AdoptRef{}, val_mgr->GetBool(! v->InternalInt())};
|
return val_mgr->Bool(! v->InternalInt());
|
||||||
}
|
}
|
||||||
|
|
||||||
PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
|
PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
|
||||||
|
@ -1620,7 +1620,7 @@ IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
|
||||||
(! op1->IsZero() && ! op2->IsZero()) :
|
(! op1->IsZero() && ! op2->IsZero()) :
|
||||||
(! op1->IsZero() || ! op2->IsZero());
|
(! op1->IsZero() || ! op2->IsZero());
|
||||||
|
|
||||||
result->Assign(i, val_mgr->GetBool(local_result));
|
result->Assign(i, val_mgr->Bool(local_result));
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
result->Assign(i, nullptr);
|
result->Assign(i, nullptr);
|
||||||
|
@ -1775,9 +1775,9 @@ IntrusivePtr<Val> EqExpr::Fold(Val* v1, Val* v2) const
|
||||||
RE_Matcher* re = v1->AsPattern();
|
RE_Matcher* re = v1->AsPattern();
|
||||||
const BroString* s = v2->AsString();
|
const BroString* s = v2->AsString();
|
||||||
if ( tag == EXPR_EQ )
|
if ( tag == EXPR_EQ )
|
||||||
return {AdoptRef{}, val_mgr->GetBool(re->MatchExactly(s))};
|
return val_mgr->Bool(re->MatchExactly(s));
|
||||||
else
|
else
|
||||||
return {AdoptRef{}, val_mgr->GetBool(! re->MatchExactly(s))};
|
return val_mgr->Bool(! re->MatchExactly(s));
|
||||||
}
|
}
|
||||||
|
|
||||||
else
|
else
|
||||||
|
@ -2972,7 +2972,7 @@ HasFieldExpr::~HasFieldExpr()
|
||||||
IntrusivePtr<Val> HasFieldExpr::Fold(Val* v) const
|
IntrusivePtr<Val> HasFieldExpr::Fold(Val* v) const
|
||||||
{
|
{
|
||||||
auto rv = v->AsRecordVal();
|
auto rv = v->AsRecordVal();
|
||||||
return {AdoptRef{}, val_mgr->GetBool(rv->Lookup(field))};
|
return val_mgr->Bool(rv->Lookup(field));
|
||||||
}
|
}
|
||||||
|
|
||||||
void HasFieldExpr::ExprDescribe(ODesc* d) const
|
void HasFieldExpr::ExprDescribe(ODesc* d) const
|
||||||
|
@ -4024,7 +4024,7 @@ IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
|
||||||
{
|
{
|
||||||
RE_Matcher* re = v1->AsPattern();
|
RE_Matcher* re = v1->AsPattern();
|
||||||
const BroString* s = v2->AsString();
|
const BroString* s = v2->AsString();
|
||||||
return {AdoptRef{}, val_mgr->GetBool(re->MatchAnywhere(s) != 0)};
|
return val_mgr->Bool(re->MatchAnywhere(s) != 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( v2->Type()->Tag() == TYPE_STRING )
|
if ( v2->Type()->Tag() == TYPE_STRING )
|
||||||
|
@ -4035,12 +4035,12 @@ IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
|
||||||
// Could do better here e.g. Boyer-Moore if done repeatedly.
|
// Could do better here e.g. Boyer-Moore if done repeatedly.
|
||||||
auto s = reinterpret_cast<const unsigned char*>(s1->CheckString());
|
auto s = reinterpret_cast<const unsigned char*>(s1->CheckString());
|
||||||
auto res = strstr_n(s2->Len(), s2->Bytes(), s1->Len(), s) != -1;
|
auto res = strstr_n(s2->Len(), s2->Bytes(), s1->Len(), s) != -1;
|
||||||
return {AdoptRef{}, val_mgr->GetBool(res)};
|
return val_mgr->Bool(res);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( v1->Type()->Tag() == TYPE_ADDR &&
|
if ( v1->Type()->Tag() == TYPE_ADDR &&
|
||||||
v2->Type()->Tag() == TYPE_SUBNET )
|
v2->Type()->Tag() == TYPE_SUBNET )
|
||||||
return {AdoptRef{}, val_mgr->GetBool(v2->AsSubNetVal()->Contains(v1->AsAddr()))};
|
return val_mgr->Bool(v2->AsSubNetVal()->Contains(v1->AsAddr()));
|
||||||
|
|
||||||
bool res;
|
bool res;
|
||||||
|
|
||||||
|
@ -4049,7 +4049,7 @@ IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
|
||||||
else
|
else
|
||||||
res = (bool)v2->AsTableVal()->Lookup(v1, false);
|
res = (bool)v2->AsTableVal()->Lookup(v1, false);
|
||||||
|
|
||||||
return {AdoptRef{}, val_mgr->GetBool(res)};
|
return val_mgr->Bool(res);
|
||||||
}
|
}
|
||||||
|
|
||||||
CallExpr::CallExpr(IntrusivePtr<Expr> arg_func,
|
CallExpr::CallExpr(IntrusivePtr<Expr> arg_func,
|
||||||
|
@ -4906,7 +4906,7 @@ IntrusivePtr<Val> IsExpr::Fold(Val* v) const
|
||||||
if ( IsError() )
|
if ( IsError() )
|
||||||
return nullptr;
|
return nullptr;
|
||||||
|
|
||||||
return {AdoptRef{}, val_mgr->GetBool(can_cast_value_to_type(v, t.get()))};
|
return val_mgr->Bool(can_cast_value_to_type(v, t.get()));
|
||||||
}
|
}
|
||||||
|
|
||||||
void IsExpr::ExprDescribe(ODesc* d) const
|
void IsExpr::ExprDescribe(ODesc* d) const
|
||||||
|
|
12
src/IP.cc
12
src/IP.cc
|
@ -144,7 +144,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
|
||||||
rv->Assign(1, val_mgr->GetCount(frag->ip6f_reserved));
|
rv->Assign(1, val_mgr->GetCount(frag->ip6f_reserved));
|
||||||
rv->Assign(2, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0xfff8)>>3));
|
rv->Assign(2, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0xfff8)>>3));
|
||||||
rv->Assign(3, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0x0006)>>1));
|
rv->Assign(3, val_mgr->GetCount((ntohs(frag->ip6f_offlg) & 0x0006)>>1));
|
||||||
rv->Assign(4, val_mgr->GetBool(ntohs(frag->ip6f_offlg) & 0x0001));
|
rv->Assign(4, val_mgr->Bool(ntohs(frag->ip6f_offlg) & 0x0001));
|
||||||
rv->Assign(5, val_mgr->GetCount(ntohl(frag->ip6f_ident)));
|
rv->Assign(5, val_mgr->GetCount(ntohl(frag->ip6f_ident)));
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
|
@ -255,10 +255,10 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
|
||||||
{
|
{
|
||||||
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_bu"));
|
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_bu"));
|
||||||
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data))));
|
m->Assign(0, val_mgr->GetCount(ntohs(*((uint16_t*)msg_data))));
|
||||||
m->Assign(1, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000));
|
m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000));
|
||||||
m->Assign(2, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000));
|
m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000));
|
||||||
m->Assign(3, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000));
|
m->Assign(3, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x2000));
|
||||||
m->Assign(4, val_mgr->GetBool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000));
|
m->Assign(4, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x1000));
|
||||||
m->Assign(5, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
|
m->Assign(5, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
|
||||||
off += 3 * sizeof(uint16_t);
|
off += 3 * sizeof(uint16_t);
|
||||||
m->Assign(6, BuildOptionsVal(data + off, Length() - off));
|
m->Assign(6, BuildOptionsVal(data + off, Length() - off));
|
||||||
|
@ -270,7 +270,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
|
||||||
{
|
{
|
||||||
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_back"));
|
RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_back"));
|
||||||
m->Assign(0, val_mgr->GetCount(*((uint8_t*)msg_data)));
|
m->Assign(0, val_mgr->GetCount(*((uint8_t*)msg_data)));
|
||||||
m->Assign(1, val_mgr->GetBool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80));
|
m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80));
|
||||||
m->Assign(2, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t))))));
|
m->Assign(2, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t))))));
|
||||||
m->Assign(3, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
|
m->Assign(3, val_mgr->GetCount(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
|
||||||
off += 3 * sizeof(uint16_t);
|
off += 3 * sizeof(uint16_t);
|
||||||
|
|
|
@ -82,7 +82,7 @@ Val* RuleMatcher::BuildRuleStateValue(const Rule* rule,
|
||||||
RecordVal* val = new RecordVal(signature_state);
|
RecordVal* val = new RecordVal(signature_state);
|
||||||
val->Assign(0, make_intrusive<StringVal>(rule->ID()));
|
val->Assign(0, make_intrusive<StringVal>(rule->ID()));
|
||||||
val->Assign(1, state->GetAnalyzer()->BuildConnVal());
|
val->Assign(1, state->GetAnalyzer()->BuildConnVal());
|
||||||
val->Assign(2, val_mgr->GetBool(state->is_orig));
|
val->Assign(2, val_mgr->Bool(state->is_orig));
|
||||||
val->Assign(3, val_mgr->GetCount(state->payload_size));
|
val->Assign(3, val_mgr->GetCount(state->payload_size));
|
||||||
return val;
|
return val;
|
||||||
}
|
}
|
||||||
|
|
|
@ -101,7 +101,7 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec)
|
||||||
}
|
}
|
||||||
|
|
||||||
st_val->Assign(1, std::move(aligns));
|
st_val->Assign(1, std::move(aligns));
|
||||||
st_val->Assign(2, val_mgr->GetBool(bst->IsNewAlignment()));
|
st_val->Assign(2, val_mgr->Bool(bst->IsNewAlignment()));
|
||||||
result->Assign(i + 1, std::move(st_val));
|
result->Assign(i + 1, std::move(st_val));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -314,7 +314,7 @@ void ProfileLogger::Log()
|
||||||
Ref(file);
|
Ref(file);
|
||||||
mgr.Dispatch(new Event(profiling_update, {
|
mgr.Dispatch(new Event(profiling_update, {
|
||||||
make_intrusive<Val>(file),
|
make_intrusive<Val>(file),
|
||||||
{AdoptRef{}, val_mgr->GetBool(expensive)},
|
val_mgr->Bool(expensive),
|
||||||
}));
|
}));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -840,7 +840,7 @@ IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
|
||||||
|
|
||||||
string s = container_type_name(ft);
|
string s = container_type_name(ft);
|
||||||
nr->Assign(0, make_intrusive<StringVal>(s));
|
nr->Assign(0, make_intrusive<StringVal>(s));
|
||||||
nr->Assign(1, val_mgr->GetBool(logged));
|
nr->Assign(1, val_mgr->Bool(logged));
|
||||||
nr->Assign(2, fv);
|
nr->Assign(2, fv);
|
||||||
nr->Assign(3, FieldDefault(i));
|
nr->Assign(3, FieldDefault(i));
|
||||||
Val* field_name = new StringVal(FieldName(i));
|
Val* field_name = new StringVal(FieldName(i));
|
||||||
|
|
|
@ -11,13 +11,13 @@ module Analyzer;
|
||||||
function Analyzer::__enable_analyzer%(id: Analyzer::Tag%) : bool
|
function Analyzer::__enable_analyzer%(id: Analyzer::Tag%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = analyzer_mgr->EnableAnalyzer(id->AsEnumVal());
|
bool result = analyzer_mgr->EnableAnalyzer(id->AsEnumVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Analyzer::__disable_analyzer%(id: Analyzer::Tag%) : bool
|
function Analyzer::__disable_analyzer%(id: Analyzer::Tag%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = analyzer_mgr->DisableAnalyzer(id->AsEnumVal());
|
bool result = analyzer_mgr->DisableAnalyzer(id->AsEnumVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Analyzer::__disable_all_analyzers%(%) : any
|
function Analyzer::__disable_all_analyzers%(%) : any
|
||||||
|
@ -29,7 +29,7 @@ function Analyzer::__disable_all_analyzers%(%) : any
|
||||||
function Analyzer::__register_for_port%(id: Analyzer::Tag, p: port%) : bool
|
function Analyzer::__register_for_port%(id: Analyzer::Tag, p: port%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = analyzer_mgr->RegisterAnalyzerForPort(id->AsEnumVal(), p);
|
bool result = analyzer_mgr->RegisterAnalyzerForPort(id->AsEnumVal(), p);
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Analyzer::__schedule_analyzer%(orig: addr, resp: addr, resp_p: port,
|
function Analyzer::__schedule_analyzer%(orig: addr, resp: addr, resp_p: port,
|
||||||
|
|
|
@ -113,7 +113,7 @@ Val* asn1_integer_to_val(const ASN1Encoding* i, TypeTag t)
|
||||||
|
|
||||||
switch ( t ) {
|
switch ( t ) {
|
||||||
case TYPE_BOOL:
|
case TYPE_BOOL:
|
||||||
return val_mgr->GetBool(v);
|
return val_mgr->Bool(v)->Ref();
|
||||||
case TYPE_INT:
|
case TYPE_INT:
|
||||||
return val_mgr->GetInt(v);
|
return val_mgr->GetInt(v);
|
||||||
case TYPE_COUNT:
|
case TYPE_COUNT:
|
||||||
|
|
|
@ -121,7 +121,7 @@ void BitTorrent_Analyzer::DeliverWeird(const char* msg, bool orig)
|
||||||
if ( bittorrent_peer_weird )
|
if ( bittorrent_peer_weird )
|
||||||
EnqueueConnEvent(bittorrent_peer_weird,
|
EnqueueConnEvent(bittorrent_peer_weird,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(msg)
|
make_intrusive<StringVal>(msg)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
|
@ -248,7 +248,7 @@ void BitTorrentTracker_Analyzer::DeliverWeird(const char* msg, bool orig)
|
||||||
if ( bt_tracker_weird )
|
if ( bt_tracker_weird )
|
||||||
EnqueueConnEvent(bt_tracker_weird,
|
EnqueueConnEvent(bt_tracker_weird,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(msg)
|
make_intrusive<StringVal>(msg)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
|
@ -53,7 +53,7 @@ void ConnSize_Analyzer::ThresholdEvent(EventHandlerPtr f, uint64_t threshold, bo
|
||||||
EnqueueConnEvent(f,
|
EnqueueConnEvent(f,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(threshold)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}
|
val_mgr->Bool(is_orig)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -95,7 +95,7 @@ void ConnSize_Analyzer::CheckThresholds(bool is_orig)
|
||||||
EnqueueConnEvent(conn_duration_threshold_crossed,
|
EnqueueConnEvent(conn_duration_threshold_crossed,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
make_intrusive<Val>(duration_thresh, TYPE_INTERVAL),
|
make_intrusive<Val>(duration_thresh, TYPE_INTERVAL),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}
|
val_mgr->Bool(is_orig)
|
||||||
);
|
);
|
||||||
duration_thresh = 0;
|
duration_thresh = 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -250,7 +250,7 @@ refine casetype OptionValue += {
|
||||||
refine flow DHCP_Flow += {
|
refine flow DHCP_Flow += {
|
||||||
function process_forwarding_option(v: OptionValue): bool
|
function process_forwarding_option(v: OptionValue): bool
|
||||||
%{
|
%{
|
||||||
${context.flow}->options->Assign(6, val_mgr->GetBool(${v.forwarding} == 0 ? false : true));
|
${context.flow}->options->Assign(6, val_mgr->Bool(${v.forwarding} == 0 ? false : true));
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
%}
|
%}
|
||||||
|
@ -781,7 +781,7 @@ refine casetype OptionValue += {
|
||||||
refine flow DHCP_Flow += {
|
refine flow DHCP_Flow += {
|
||||||
function process_auto_config_option(v: OptionValue): bool
|
function process_auto_config_option(v: OptionValue): bool
|
||||||
%{
|
%{
|
||||||
${context.flow}->options->Assign(23, val_mgr->GetBool(${v.auto_config} == 0 ? false : true));
|
${context.flow}->options->Assign(23, val_mgr->Bool(${v.auto_config} == 0 ? false : true));
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
%}
|
%}
|
||||||
|
|
|
@ -50,7 +50,7 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
|
||||||
if ( dns_message )
|
if ( dns_message )
|
||||||
analyzer->EnqueueConnEvent(dns_message,
|
analyzer->EnqueueConnEvent(dns_message,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_query)},
|
val_mgr->Bool(is_query),
|
||||||
IntrusivePtr{AdoptRef{}, msg.BuildHdrVal()},
|
IntrusivePtr{AdoptRef{}, msg.BuildHdrVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}
|
||||||
);
|
);
|
||||||
|
@ -1449,11 +1449,11 @@ Val* DNS_MsgInfo::BuildHdrVal()
|
||||||
r->Assign(0, val_mgr->GetCount(id));
|
r->Assign(0, val_mgr->GetCount(id));
|
||||||
r->Assign(1, val_mgr->GetCount(opcode));
|
r->Assign(1, val_mgr->GetCount(opcode));
|
||||||
r->Assign(2, val_mgr->GetCount(rcode));
|
r->Assign(2, val_mgr->GetCount(rcode));
|
||||||
r->Assign(3, val_mgr->GetBool(QR));
|
r->Assign(3, val_mgr->Bool(QR));
|
||||||
r->Assign(4, val_mgr->GetBool(AA));
|
r->Assign(4, val_mgr->Bool(AA));
|
||||||
r->Assign(5, val_mgr->GetBool(TC));
|
r->Assign(5, val_mgr->Bool(TC));
|
||||||
r->Assign(6, val_mgr->GetBool(RD));
|
r->Assign(6, val_mgr->Bool(RD));
|
||||||
r->Assign(7, val_mgr->GetBool(RA));
|
r->Assign(7, val_mgr->Bool(RA));
|
||||||
r->Assign(8, val_mgr->GetCount(Z));
|
r->Assign(8, val_mgr->GetCount(Z));
|
||||||
r->Assign(9, val_mgr->GetCount(qdcount));
|
r->Assign(9, val_mgr->GetCount(qdcount));
|
||||||
r->Assign(10, val_mgr->GetCount(ancount));
|
r->Assign(10, val_mgr->GetCount(ancount));
|
||||||
|
|
|
@ -69,7 +69,7 @@ void Finger_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig
|
||||||
if ( finger_request )
|
if ( finger_request )
|
||||||
EnqueueConnEvent(finger_request,
|
EnqueueConnEvent(finger_request,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(long_cnt)},
|
val_mgr->Bool(long_cnt),
|
||||||
make_intrusive<StringVal>(at - line, line),
|
make_intrusive<StringVal>(at - line, line),
|
||||||
make_intrusive<StringVal>(end_of_line - host, host)
|
make_intrusive<StringVal>(end_of_line - host, host)
|
||||||
);
|
);
|
||||||
|
|
|
@ -179,7 +179,7 @@ void FTP_Analyzer::DeliverStream(int length, const u_char* data, bool orig)
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)},
|
||||||
make_intrusive<StringVal>(end_of_line - line, line),
|
make_intrusive<StringVal>(end_of_line - line, line),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(cont_resp)}
|
val_mgr->Bool(cont_resp)
|
||||||
};
|
};
|
||||||
|
|
||||||
f = ftp_reply;
|
f = ftp_reply;
|
||||||
|
|
|
@ -35,7 +35,7 @@ static Val* parse_port(const char* line)
|
||||||
|
|
||||||
r->Assign(0, make_intrusive<AddrVal>(htonl(addr)));
|
r->Assign(0, make_intrusive<AddrVal>(htonl(addr)));
|
||||||
r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP));
|
r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP));
|
||||||
r->Assign(2, val_mgr->GetBool(good));
|
r->Assign(2, val_mgr->Bool(good));
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
|
@ -111,7 +111,7 @@ static Val* parse_eftp(const char* line)
|
||||||
|
|
||||||
r->Assign(0, make_intrusive<AddrVal>(addr));
|
r->Assign(0, make_intrusive<AddrVal>(addr));
|
||||||
r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP));
|
r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP));
|
||||||
r->Assign(2, val_mgr->GetBool(good));
|
r->Assign(2, val_mgr->Bool(good));
|
||||||
|
|
||||||
return r;
|
return r;
|
||||||
}
|
}
|
||||||
|
|
|
@ -74,7 +74,7 @@ void Gnutella_Analyzer::Done()
|
||||||
EnqueueConnEvent(gnutella_partial_binary_msg,
|
EnqueueConnEvent(gnutella_partial_binary_msg,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
make_intrusive<StringVal>(p->msg),
|
make_intrusive<StringVal>(p->msg),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool((i == 0))},
|
val_mgr->Bool((i == 0)),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_pos)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_pos)}
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -178,7 +178,7 @@ void Gnutella_Analyzer::DeliverLines(int len, const u_char* data, bool orig)
|
||||||
if ( gnutella_text_msg )
|
if ( gnutella_text_msg )
|
||||||
EnqueueConnEvent(gnutella_text_msg,
|
EnqueueConnEvent(gnutella_text_msg,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(ms->headers.data())
|
make_intrusive<StringVal>(ms->headers.data())
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -216,15 +216,15 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig)
|
||||||
if ( gnutella_binary_msg )
|
if ( gnutella_binary_msg )
|
||||||
EnqueueConnEvent(gnutella_binary_msg,
|
EnqueueConnEvent(gnutella_binary_msg,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_type)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_type)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_ttl)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_ttl)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_hops)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_hops)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_len)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->msg_len)},
|
||||||
make_intrusive<StringVal>(p->payload),
|
make_intrusive<StringVal>(p->payload),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->payload_len)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(p->payload_len)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD)))},
|
val_mgr->Bool((p->payload_len < std::min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD))),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool((p->payload_left == 0))}
|
val_mgr->Bool((p->payload_left == 0))
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -9,11 +9,11 @@ RecordVal* BuildGTPv1Hdr(const GTPv1_Header* pdu)
|
||||||
RecordVal* rv = new RecordVal(BifType::Record::gtpv1_hdr);
|
RecordVal* rv = new RecordVal(BifType::Record::gtpv1_hdr);
|
||||||
|
|
||||||
rv->Assign(0, val_mgr->GetCount(pdu->version()));
|
rv->Assign(0, val_mgr->GetCount(pdu->version()));
|
||||||
rv->Assign(1, val_mgr->GetBool(pdu->pt_flag()));
|
rv->Assign(1, val_mgr->Bool(pdu->pt_flag()));
|
||||||
rv->Assign(2, val_mgr->GetBool(pdu->rsv()));
|
rv->Assign(2, val_mgr->Bool(pdu->rsv()));
|
||||||
rv->Assign(3, val_mgr->GetBool(pdu->e_flag()));
|
rv->Assign(3, val_mgr->Bool(pdu->e_flag()));
|
||||||
rv->Assign(4, val_mgr->GetBool(pdu->s_flag()));
|
rv->Assign(4, val_mgr->Bool(pdu->s_flag()));
|
||||||
rv->Assign(5, val_mgr->GetBool(pdu->pn_flag()));
|
rv->Assign(5, val_mgr->Bool(pdu->pn_flag()));
|
||||||
rv->Assign(6, val_mgr->GetCount(pdu->msg_type()));
|
rv->Assign(6, val_mgr->GetCount(pdu->msg_type()));
|
||||||
rv->Assign(7, val_mgr->GetCount(pdu->length()));
|
rv->Assign(7, val_mgr->GetCount(pdu->length()));
|
||||||
rv->Assign(8, val_mgr->GetCount(pdu->teid()));
|
rv->Assign(8, val_mgr->GetCount(pdu->teid()));
|
||||||
|
@ -206,9 +206,9 @@ Val* BuildCause(const InformationElement* ie)
|
||||||
return val_mgr->GetCount(ie->cause()->value());
|
return val_mgr->GetCount(ie->cause()->value());
|
||||||
}
|
}
|
||||||
|
|
||||||
Val* BuildReorderReq(const InformationElement* ie)
|
static IntrusivePtr<Val> BuildReorderReq(const InformationElement* ie)
|
||||||
{
|
{
|
||||||
return val_mgr->GetBool(ie->reorder_req()->req());
|
return val_mgr->Bool(ie->reorder_req()->req());
|
||||||
}
|
}
|
||||||
|
|
||||||
Val* BuildChargingID(const InformationElement* ie)
|
Val* BuildChargingID(const InformationElement* ie)
|
||||||
|
@ -228,9 +228,9 @@ Val* BuildChargingGatewayAddr(const InformationElement* ie)
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
Val* BuildTeardownInd(const InformationElement* ie)
|
static IntrusivePtr<Val> BuildTeardownInd(const InformationElement* ie)
|
||||||
{
|
{
|
||||||
return val_mgr->GetBool(ie->teardown_ind()->ind());
|
return val_mgr->Bool(ie->teardown_ind()->ind());
|
||||||
}
|
}
|
||||||
|
|
||||||
void CreatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
|
void CreatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
|
||||||
|
|
|
@ -618,7 +618,7 @@ Val* HTTP_Message::BuildMessageStat(bool interrupted, const char* msg)
|
||||||
RecordVal* stat = new RecordVal(http_message_stat);
|
RecordVal* stat = new RecordVal(http_message_stat);
|
||||||
int field = 0;
|
int field = 0;
|
||||||
stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME));
|
stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME));
|
||||||
stat->Assign(field++, val_mgr->GetBool(interrupted));
|
stat->Assign(field++, val_mgr->Bool(interrupted));
|
||||||
stat->Assign(field++, make_intrusive<StringVal>(msg));
|
stat->Assign(field++, make_intrusive<StringVal>(msg));
|
||||||
stat->Assign(field++, val_mgr->GetCount(body_length));
|
stat->Assign(field++, val_mgr->GetCount(body_length));
|
||||||
stat->Assign(field++, val_mgr->GetCount(content_gap_length));
|
stat->Assign(field++, val_mgr->GetCount(content_gap_length));
|
||||||
|
@ -651,7 +651,7 @@ void HTTP_Message::Done(bool interrupted, const char* detail)
|
||||||
if ( http_message_done )
|
if ( http_message_done )
|
||||||
GetAnalyzer()->EnqueueConnEvent(http_message_done,
|
GetAnalyzer()->EnqueueConnEvent(http_message_done,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, BuildMessageStat(interrupted, detail)}
|
IntrusivePtr{AdoptRef{}, BuildMessageStat(interrupted, detail)}
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -682,7 +682,7 @@ void HTTP_Message::BeginEntity(mime::MIME_Entity* entity)
|
||||||
if ( http_begin_entity )
|
if ( http_begin_entity )
|
||||||
analyzer->EnqueueConnEvent(http_begin_entity,
|
analyzer->EnqueueConnEvent(http_begin_entity,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}
|
val_mgr->Bool(is_orig)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -697,7 +697,7 @@ void HTTP_Message::EndEntity(mime::MIME_Entity* entity)
|
||||||
if ( http_end_entity )
|
if ( http_end_entity )
|
||||||
analyzer->EnqueueConnEvent(http_end_entity,
|
analyzer->EnqueueConnEvent(http_end_entity,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}
|
val_mgr->Bool(is_orig)
|
||||||
);
|
);
|
||||||
|
|
||||||
current_entity = (HTTP_Entity*) entity->Parent();
|
current_entity = (HTTP_Entity*) entity->Parent();
|
||||||
|
@ -736,7 +736,7 @@ void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist)
|
||||||
if ( http_all_headers )
|
if ( http_all_headers )
|
||||||
analyzer->EnqueueConnEvent(http_all_headers,
|
analyzer->EnqueueConnEvent(http_all_headers,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, BuildHeaderTable(hlist)}
|
IntrusivePtr{AdoptRef{}, BuildHeaderTable(hlist)}
|
||||||
);
|
);
|
||||||
|
|
||||||
|
@ -747,7 +747,7 @@ void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist)
|
||||||
|
|
||||||
analyzer->EnqueueConnEvent(http_content_type,
|
analyzer->EnqueueConnEvent(http_content_type,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{NewRef{}, ty},
|
IntrusivePtr{NewRef{}, ty},
|
||||||
IntrusivePtr{NewRef{}, subty}
|
IntrusivePtr{NewRef{}, subty}
|
||||||
);
|
);
|
||||||
|
@ -1671,7 +1671,7 @@ void HTTP_Analyzer::HTTP_Header(bool is_orig, mime::MIME_Header* h)
|
||||||
|
|
||||||
EnqueueConnEvent(http_header,
|
EnqueueConnEvent(http_header,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())->ToUpper()},
|
IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())->ToUpper()},
|
||||||
IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_value())}
|
IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_value())}
|
||||||
);
|
);
|
||||||
|
@ -1683,7 +1683,7 @@ void HTTP_Analyzer::HTTP_EntityData(bool is_orig, BroString* entity_data)
|
||||||
if ( http_entity_data )
|
if ( http_entity_data )
|
||||||
EnqueueConnEvent(http_entity_data,
|
EnqueueConnEvent(http_entity_data,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(entity_data->Len())},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(entity_data->Len())},
|
||||||
make_intrusive<StringVal>(entity_data)
|
make_intrusive<StringVal>(entity_data)
|
||||||
);
|
);
|
||||||
|
|
|
@ -232,7 +232,7 @@ RecordVal* ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
|
||||||
icmp_conn_val->Assign(3, val_mgr->GetCount(icmpp->icmp_code));
|
icmp_conn_val->Assign(3, val_mgr->GetCount(icmpp->icmp_code));
|
||||||
icmp_conn_val->Assign(4, val_mgr->GetCount(len));
|
icmp_conn_val->Assign(4, val_mgr->GetCount(len));
|
||||||
icmp_conn_val->Assign(5, val_mgr->GetCount(ip_hdr->TTL()));
|
icmp_conn_val->Assign(5, val_mgr->GetCount(ip_hdr->TTL()));
|
||||||
icmp_conn_val->Assign(6, val_mgr->GetBool(icmpv6));
|
icmp_conn_val->Assign(6, val_mgr->Bool(icmpv6));
|
||||||
}
|
}
|
||||||
|
|
||||||
Ref(icmp_conn_val);
|
Ref(icmp_conn_val);
|
||||||
|
@ -363,10 +363,10 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
|
||||||
iprec->Assign(1, val_mgr->GetCount(ip_len));
|
iprec->Assign(1, val_mgr->GetCount(ip_len));
|
||||||
iprec->Assign(2, val_mgr->GetCount(proto));
|
iprec->Assign(2, val_mgr->GetCount(proto));
|
||||||
iprec->Assign(3, val_mgr->GetCount(frag_offset));
|
iprec->Assign(3, val_mgr->GetCount(frag_offset));
|
||||||
iprec->Assign(4, val_mgr->GetBool(bad_hdr_len));
|
iprec->Assign(4, val_mgr->Bool(bad_hdr_len));
|
||||||
iprec->Assign(5, val_mgr->GetBool(bad_checksum));
|
iprec->Assign(5, val_mgr->Bool(bad_checksum));
|
||||||
iprec->Assign(6, val_mgr->GetBool(MF));
|
iprec->Assign(6, val_mgr->Bool(MF));
|
||||||
iprec->Assign(7, val_mgr->GetBool(DF));
|
iprec->Assign(7, val_mgr->Bool(DF));
|
||||||
|
|
||||||
return iprec;
|
return iprec;
|
||||||
}
|
}
|
||||||
|
@ -422,11 +422,11 @@ RecordVal* ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
|
||||||
iprec->Assign(1, val_mgr->GetCount(ip_len));
|
iprec->Assign(1, val_mgr->GetCount(ip_len));
|
||||||
iprec->Assign(2, val_mgr->GetCount(proto));
|
iprec->Assign(2, val_mgr->GetCount(proto));
|
||||||
iprec->Assign(3, val_mgr->GetCount(frag_offset));
|
iprec->Assign(3, val_mgr->GetCount(frag_offset));
|
||||||
iprec->Assign(4, val_mgr->GetBool(bad_hdr_len));
|
iprec->Assign(4, val_mgr->Bool(bad_hdr_len));
|
||||||
// bad_checksum is always false since IPv6 layer doesn't have a checksum.
|
// bad_checksum is always false since IPv6 layer doesn't have a checksum.
|
||||||
iprec->Assign(5, val_mgr->False());
|
iprec->Assign(5, val_mgr->False());
|
||||||
iprec->Assign(6, val_mgr->GetBool(MF));
|
iprec->Assign(6, val_mgr->Bool(MF));
|
||||||
iprec->Assign(7, val_mgr->GetBool(DF));
|
iprec->Assign(7, val_mgr->Bool(DF));
|
||||||
|
|
||||||
return iprec;
|
return iprec;
|
||||||
}
|
}
|
||||||
|
@ -546,11 +546,11 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
|
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_num_addrs)}, // Cur Hop Limit
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_num_addrs)}, // Cur Hop Limit
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x80)}, // Managed
|
val_mgr->Bool(icmpp->icmp_wpa & 0x80), // Managed
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x40)}, // Other
|
val_mgr->Bool(icmpp->icmp_wpa & 0x40), // Other
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x20)}, // Home Agent
|
val_mgr->Bool(icmpp->icmp_wpa & 0x20), // Home Agent
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount((icmpp->icmp_wpa & 0x18)>>3)}, // Pref
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount((icmpp->icmp_wpa & 0x18)>>3)}, // Pref
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_wpa & 0x04)}, // Proxy
|
val_mgr->Bool(icmpp->icmp_wpa & 0x04), // Proxy
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_wpa & 0x02)}, // Reserved
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(icmpp->icmp_wpa & 0x02)}, // Reserved
|
||||||
make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds),
|
make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds),
|
||||||
make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds),
|
make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds),
|
||||||
|
@ -578,9 +578,9 @@ void ICMP_Analyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len,
|
||||||
EnqueueConnEvent(f,
|
EnqueueConnEvent(f,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
|
IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x80)}, // Router
|
val_mgr->Bool(icmpp->icmp_num_addrs & 0x80), // Router
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x40)}, // Solicited
|
val_mgr->Bool(icmpp->icmp_num_addrs & 0x40), // Solicited
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(icmpp->icmp_num_addrs & 0x20)}, // Override
|
val_mgr->Bool(icmpp->icmp_num_addrs & 0x20), // Override
|
||||||
make_intrusive<AddrVal>(tgtaddr),
|
make_intrusive<AddrVal>(tgtaddr),
|
||||||
IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)}
|
IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)}
|
||||||
);
|
);
|
||||||
|
@ -793,8 +793,8 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
|
||||||
uint32_t prefer_life = *((const uint32_t*)(data + 6));
|
uint32_t prefer_life = *((const uint32_t*)(data + 6));
|
||||||
in6_addr prefix = *((const in6_addr*)(data + 14));
|
in6_addr prefix = *((const in6_addr*)(data + 14));
|
||||||
info->Assign(0, val_mgr->GetCount(prefix_len));
|
info->Assign(0, val_mgr->GetCount(prefix_len));
|
||||||
info->Assign(1, val_mgr->GetBool(L_flag));
|
info->Assign(1, val_mgr->Bool(L_flag));
|
||||||
info->Assign(2, val_mgr->GetBool(A_flag));
|
info->Assign(2, val_mgr->Bool(A_flag));
|
||||||
info->Assign(3, make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds));
|
info->Assign(3, make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds));
|
||||||
info->Assign(4, make_intrusive<IntervalVal>((double)ntohl(prefer_life), Seconds));
|
info->Assign(4, make_intrusive<IntervalVal>((double)ntohl(prefer_life), Seconds));
|
||||||
info->Assign(5, make_intrusive<AddrVal>(IPAddr(prefix)));
|
info->Assign(5, make_intrusive<AddrVal>(IPAddr(prefix)));
|
||||||
|
|
|
@ -236,7 +236,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_network_info,
|
EnqueueConnEvent(irc_network_info,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)}
|
||||||
|
@ -283,7 +283,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_names_info,
|
EnqueueConnEvent(irc_names_info,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(type.c_str()),
|
make_intrusive<StringVal>(type.c_str()),
|
||||||
make_intrusive<StringVal>(channel.c_str()),
|
make_intrusive<StringVal>(channel.c_str()),
|
||||||
std::move(set)
|
std::move(set)
|
||||||
|
@ -317,7 +317,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_server_info,
|
EnqueueConnEvent(irc_server_info,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(users)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(services)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(servers)}
|
||||||
|
@ -339,7 +339,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_channel_info,
|
EnqueueConnEvent(irc_channel_info,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(channels)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(channels)}
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -371,7 +371,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_global_users,
|
EnqueueConnEvent(irc_global_users,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(eop - prefix, prefix),
|
make_intrusive<StringVal>(eop - prefix, prefix),
|
||||||
make_intrusive<StringVal>(++msg)
|
make_intrusive<StringVal>(++msg)
|
||||||
);
|
);
|
||||||
|
@ -397,7 +397,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
zeek::Args vl;
|
zeek::Args vl;
|
||||||
vl.reserve(6);
|
vl.reserve(6);
|
||||||
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
||||||
vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig));
|
vl.emplace_back(val_mgr->Bool(orig));
|
||||||
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
|
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
|
||||||
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
|
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
|
||||||
vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
|
vl.emplace_back(make_intrusive<StringVal>(parts[2].c_str()));
|
||||||
|
@ -436,7 +436,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_whois_operator_line,
|
EnqueueConnEvent(irc_whois_operator_line,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(parts[0].c_str())
|
make_intrusive<StringVal>(parts[0].c_str())
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -474,7 +474,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_whois_channel_line,
|
EnqueueConnEvent(irc_whois_channel_line,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(nick.c_str()),
|
make_intrusive<StringVal>(nick.c_str()),
|
||||||
std::move(set)
|
std::move(set)
|
||||||
);
|
);
|
||||||
|
@ -505,7 +505,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_channel_topic,
|
EnqueueConnEvent(irc_channel_topic,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(parts[1].c_str()),
|
make_intrusive<StringVal>(parts[1].c_str()),
|
||||||
make_intrusive<StringVal>(t)
|
make_intrusive<StringVal>(t)
|
||||||
);
|
);
|
||||||
|
@ -539,7 +539,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_who_line,
|
EnqueueConnEvent(irc_who_line,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(parts[0].c_str()),
|
make_intrusive<StringVal>(parts[0].c_str()),
|
||||||
make_intrusive<StringVal>(parts[1].c_str()),
|
make_intrusive<StringVal>(parts[1].c_str()),
|
||||||
make_intrusive<StringVal>(parts[2].c_str()),
|
make_intrusive<StringVal>(parts[2].c_str()),
|
||||||
|
@ -561,7 +561,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
if ( irc_invalid_nick )
|
if ( irc_invalid_nick )
|
||||||
EnqueueConnEvent(irc_invalid_nick,
|
EnqueueConnEvent(irc_invalid_nick,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)}
|
val_mgr->Bool(orig)
|
||||||
);
|
);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
@ -571,8 +571,8 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
if ( irc_oper_response )
|
if ( irc_oper_response )
|
||||||
EnqueueConnEvent(irc_oper_response,
|
EnqueueConnEvent(irc_oper_response,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(code == 381)}
|
val_mgr->Bool(code == 381)
|
||||||
);
|
);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
@ -586,7 +586,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
if ( irc_reply )
|
if ( irc_reply )
|
||||||
EnqueueConnEvent(irc_reply,
|
EnqueueConnEvent(irc_reply,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(code)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(code)},
|
||||||
make_intrusive<StringVal>(params.c_str())
|
make_intrusive<StringVal>(params.c_str())
|
||||||
|
@ -657,7 +657,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
if ( irc_dcc_message )
|
if ( irc_dcc_message )
|
||||||
EnqueueConnEvent(irc_dcc_message,
|
EnqueueConnEvent(irc_dcc_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(target.c_str()),
|
make_intrusive<StringVal>(target.c_str()),
|
||||||
make_intrusive<StringVal>(parts[1].c_str()),
|
make_intrusive<StringVal>(parts[1].c_str()),
|
||||||
|
@ -675,7 +675,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
if ( irc_privmsg_message )
|
if ( irc_privmsg_message )
|
||||||
EnqueueConnEvent(irc_privmsg_message,
|
EnqueueConnEvent(irc_privmsg_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(target.c_str()),
|
make_intrusive<StringVal>(target.c_str()),
|
||||||
make_intrusive<StringVal>(message.c_str())
|
make_intrusive<StringVal>(message.c_str())
|
||||||
|
@ -700,7 +700,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_notice_message,
|
EnqueueConnEvent(irc_notice_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(target.c_str()),
|
make_intrusive<StringVal>(target.c_str()),
|
||||||
make_intrusive<StringVal>(message.c_str())
|
make_intrusive<StringVal>(message.c_str())
|
||||||
|
@ -724,7 +724,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_squery_message,
|
EnqueueConnEvent(irc_squery_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(target.c_str()),
|
make_intrusive<StringVal>(target.c_str()),
|
||||||
make_intrusive<StringVal>(message.c_str())
|
make_intrusive<StringVal>(message.c_str())
|
||||||
|
@ -738,7 +738,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
zeek::Args vl;
|
zeek::Args vl;
|
||||||
vl.reserve(6);
|
vl.reserve(6);
|
||||||
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
||||||
vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig));
|
vl.emplace_back(val_mgr->Bool(orig));
|
||||||
|
|
||||||
if ( parts.size() > 0 )
|
if ( parts.size() > 0 )
|
||||||
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
|
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
|
||||||
|
@ -773,7 +773,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
if ( parts.size() == 2 )
|
if ( parts.size() == 2 )
|
||||||
EnqueueConnEvent(irc_oper_message,
|
EnqueueConnEvent(irc_oper_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(parts[0].c_str()),
|
make_intrusive<StringVal>(parts[0].c_str()),
|
||||||
make_intrusive<StringVal>(parts[1].c_str())
|
make_intrusive<StringVal>(parts[1].c_str())
|
||||||
);
|
);
|
||||||
|
@ -795,7 +795,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
zeek::Args vl;
|
zeek::Args vl;
|
||||||
vl.reserve(6);
|
vl.reserve(6);
|
||||||
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
||||||
vl.emplace_back(AdoptRef{}, val_mgr->GetBool(orig));
|
vl.emplace_back(val_mgr->Bool(orig));
|
||||||
vl.emplace_back(make_intrusive<StringVal>(prefix.c_str()));
|
vl.emplace_back(make_intrusive<StringVal>(prefix.c_str()));
|
||||||
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
|
vl.emplace_back(make_intrusive<StringVal>(parts[0].c_str()));
|
||||||
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
|
vl.emplace_back(make_intrusive<StringVal>(parts[1].c_str()));
|
||||||
|
@ -864,7 +864,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_join_message,
|
EnqueueConnEvent(irc_join_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
std::move(list)
|
std::move(list)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -924,7 +924,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_join_message,
|
EnqueueConnEvent(irc_join_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
std::move(list)
|
std::move(list)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -963,7 +963,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_part_message,
|
EnqueueConnEvent(irc_part_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(nick.c_str()),
|
make_intrusive<StringVal>(nick.c_str()),
|
||||||
std::move(set),
|
std::move(set),
|
||||||
make_intrusive<StringVal>(message.c_str())
|
make_intrusive<StringVal>(message.c_str())
|
||||||
|
@ -986,7 +986,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_quit_message,
|
EnqueueConnEvent(irc_quit_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(nickname.c_str()),
|
make_intrusive<StringVal>(nickname.c_str()),
|
||||||
make_intrusive<StringVal>(message.c_str())
|
make_intrusive<StringVal>(message.c_str())
|
||||||
);
|
);
|
||||||
|
@ -1000,7 +1000,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_nick_message,
|
EnqueueConnEvent(irc_nick_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(nick.c_str())
|
make_intrusive<StringVal>(nick.c_str())
|
||||||
);
|
);
|
||||||
|
@ -1025,11 +1025,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_who_message,
|
EnqueueConnEvent(irc_who_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
parts.size() > 0 ?
|
parts.size() > 0 ?
|
||||||
make_intrusive<StringVal>(parts[0].c_str()) :
|
make_intrusive<StringVal>(parts[0].c_str()) :
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetEmptyString()},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetEmptyString()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(oper)}
|
val_mgr->Bool(oper)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1055,7 +1055,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_whois_message,
|
EnqueueConnEvent(irc_whois_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(server.c_str()),
|
make_intrusive<StringVal>(server.c_str()),
|
||||||
make_intrusive<StringVal>(users.c_str())
|
make_intrusive<StringVal>(users.c_str())
|
||||||
);
|
);
|
||||||
|
@ -1068,7 +1068,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_error_message,
|
EnqueueConnEvent(irc_error_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(params.c_str())
|
make_intrusive<StringVal>(params.c_str())
|
||||||
);
|
);
|
||||||
|
@ -1084,7 +1084,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_invite_message,
|
EnqueueConnEvent(irc_invite_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(parts[0].c_str()),
|
make_intrusive<StringVal>(parts[0].c_str()),
|
||||||
make_intrusive<StringVal>(parts[1].c_str())
|
make_intrusive<StringVal>(parts[1].c_str())
|
||||||
|
@ -1099,7 +1099,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
if ( params.size() > 0 )
|
if ( params.size() > 0 )
|
||||||
EnqueueConnEvent(irc_mode_message,
|
EnqueueConnEvent(irc_mode_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(params.c_str())
|
make_intrusive<StringVal>(params.c_str())
|
||||||
);
|
);
|
||||||
|
@ -1112,7 +1112,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
{
|
{
|
||||||
EnqueueConnEvent(irc_password_message,
|
EnqueueConnEvent(irc_password_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(params.c_str())
|
make_intrusive<StringVal>(params.c_str())
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -1134,7 +1134,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(irc_squit_message,
|
EnqueueConnEvent(irc_squit_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(server.c_str()),
|
make_intrusive<StringVal>(server.c_str()),
|
||||||
make_intrusive<StringVal>(message.c_str())
|
make_intrusive<StringVal>(message.c_str())
|
||||||
|
@ -1148,7 +1148,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
{
|
{
|
||||||
EnqueueConnEvent(irc_request,
|
EnqueueConnEvent(irc_request,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(command.c_str()),
|
make_intrusive<StringVal>(command.c_str()),
|
||||||
make_intrusive<StringVal>(params.c_str())
|
make_intrusive<StringVal>(params.c_str())
|
||||||
|
@ -1162,7 +1162,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
|
||||||
{
|
{
|
||||||
EnqueueConnEvent(irc_message,
|
EnqueueConnEvent(irc_message,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(prefix.c_str()),
|
make_intrusive<StringVal>(prefix.c_str()),
|
||||||
make_intrusive<StringVal>(command.c_str()),
|
make_intrusive<StringVal>(command.c_str()),
|
||||||
make_intrusive<StringVal>(params.c_str())
|
make_intrusive<StringVal>(params.c_str())
|
||||||
|
|
|
@ -10,19 +10,19 @@ RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts)
|
||||||
{
|
{
|
||||||
RecordVal* rv = new RecordVal(BifType::Record::KRB::KDC_Options);
|
RecordVal* rv = new RecordVal(BifType::Record::KRB::KDC_Options);
|
||||||
|
|
||||||
rv->Assign(0, val_mgr->GetBool(opts->forwardable()));
|
rv->Assign(0, val_mgr->Bool(opts->forwardable()));
|
||||||
rv->Assign(1, val_mgr->GetBool(opts->forwarded()));
|
rv->Assign(1, val_mgr->Bool(opts->forwarded()));
|
||||||
rv->Assign(2, val_mgr->GetBool(opts->proxiable()));
|
rv->Assign(2, val_mgr->Bool(opts->proxiable()));
|
||||||
rv->Assign(3, val_mgr->GetBool(opts->proxy()));
|
rv->Assign(3, val_mgr->Bool(opts->proxy()));
|
||||||
rv->Assign(4, val_mgr->GetBool(opts->allow_postdate()));
|
rv->Assign(4, val_mgr->Bool(opts->allow_postdate()));
|
||||||
rv->Assign(5, val_mgr->GetBool(opts->postdated()));
|
rv->Assign(5, val_mgr->Bool(opts->postdated()));
|
||||||
rv->Assign(6, val_mgr->GetBool(opts->renewable()));
|
rv->Assign(6, val_mgr->Bool(opts->renewable()));
|
||||||
rv->Assign(7, val_mgr->GetBool(opts->opt_hardware_auth()));
|
rv->Assign(7, val_mgr->Bool(opts->opt_hardware_auth()));
|
||||||
rv->Assign(8, val_mgr->GetBool(opts->disable_transited_check()));
|
rv->Assign(8, val_mgr->Bool(opts->disable_transited_check()));
|
||||||
rv->Assign(9, val_mgr->GetBool(opts->renewable_ok()));
|
rv->Assign(9, val_mgr->Bool(opts->renewable_ok()));
|
||||||
rv->Assign(10, val_mgr->GetBool(opts->enc_tkt_in_skey()));
|
rv->Assign(10, val_mgr->Bool(opts->enc_tkt_in_skey()));
|
||||||
rv->Assign(11, val_mgr->GetBool(opts->renew()));
|
rv->Assign(11, val_mgr->Bool(opts->renew()));
|
||||||
rv->Assign(12, val_mgr->GetBool(opts->validate()));
|
rv->Assign(12, val_mgr->Bool(opts->validate()));
|
||||||
|
|
||||||
return rv;
|
return rv;
|
||||||
}
|
}
|
||||||
|
@ -259,8 +259,8 @@ refine connection KRB_Conn += {
|
||||||
if ( krb_ap_request )
|
if ( krb_ap_request )
|
||||||
{
|
{
|
||||||
RecordVal* rv = new RecordVal(BifType::Record::KRB::AP_Options);
|
RecordVal* rv = new RecordVal(BifType::Record::KRB::AP_Options);
|
||||||
rv->Assign(0, val_mgr->GetBool(${msg.ap_options.use_session_key}));
|
rv->Assign(0, val_mgr->Bool(${msg.ap_options.use_session_key}));
|
||||||
rv->Assign(1, val_mgr->GetBool(${msg.ap_options.mutual_required}));
|
rv->Assign(1, val_mgr->Bool(${msg.ap_options.mutual_required}));
|
||||||
|
|
||||||
RecordVal* rvticket = proc_ticket(${msg.ticket});
|
RecordVal* rvticket = proc_ticket(${msg.ticket});
|
||||||
StringVal* authenticationinfo = bro_analyzer()->GetAuthenticationInfo(rvticket->Lookup(2)->AsString(), rvticket->Lookup(4)->AsString(), rvticket->Lookup(3)->AsCount());
|
StringVal* authenticationinfo = bro_analyzer()->GetAuthenticationInfo(rvticket->Lookup(2)->AsString(), rvticket->Lookup(4)->AsString(), rvticket->Lookup(3)->AsCount());
|
||||||
|
|
|
@ -20,7 +20,7 @@
|
||||||
for ( uint i = 0; i < quantity; i++ )
|
for ( uint i = 0; i < quantity; i++ )
|
||||||
{
|
{
|
||||||
char currentCoil = (coils[i/8] >> (i % 8)) % 2;
|
char currentCoil = (coils[i/8] >> (i % 8)) % 2;
|
||||||
modbus_coils->Assign(i, val_mgr->GetBool(currentCoil));
|
modbus_coils->Assign(i, val_mgr->Bool(currentCoil));
|
||||||
}
|
}
|
||||||
|
|
||||||
return modbus_coils;
|
return modbus_coils;
|
||||||
|
|
|
@ -17,7 +17,7 @@ refine flow MQTT_Flow += {
|
||||||
{
|
{
|
||||||
auto m = new RecordVal(BifType::Record::MQTT::ConnectAckMsg);
|
auto m = new RecordVal(BifType::Record::MQTT::ConnectAckMsg);
|
||||||
m->Assign(0, val_mgr->GetCount(${msg.return_code}));
|
m->Assign(0, val_mgr->GetCount(${msg.return_code}));
|
||||||
m->Assign(1, val_mgr->GetBool(${msg.session_present}));
|
m->Assign(1, val_mgr->Bool(${msg.session_present}));
|
||||||
BifEvent::generate_mqtt_connack(connection()->bro_analyzer(),
|
BifEvent::generate_mqtt_connack(connection()->bro_analyzer(),
|
||||||
connection()->bro_analyzer()->Conn(),
|
connection()->bro_analyzer()->Conn(),
|
||||||
m);
|
m);
|
||||||
|
|
|
@ -52,8 +52,8 @@ refine flow MQTT_Flow += {
|
||||||
reinterpret_cast<const char*>(${msg.client_id.str}.begin())));
|
reinterpret_cast<const char*>(${msg.client_id.str}.begin())));
|
||||||
m->Assign(3, make_intrusive<IntervalVal>(double(${msg.keep_alive}), Seconds));
|
m->Assign(3, make_intrusive<IntervalVal>(double(${msg.keep_alive}), Seconds));
|
||||||
|
|
||||||
m->Assign(4, val_mgr->GetBool(${msg.clean_session}));
|
m->Assign(4, val_mgr->Bool(${msg.clean_session}));
|
||||||
m->Assign(5, val_mgr->GetBool(${msg.will_retain}));
|
m->Assign(5, val_mgr->Bool(${msg.will_retain}));
|
||||||
m->Assign(6, val_mgr->GetCount(${msg.will_qos}));
|
m->Assign(6, val_mgr->GetCount(${msg.will_qos}));
|
||||||
|
|
||||||
if ( ${msg.will_flag} )
|
if ( ${msg.will_flag} )
|
||||||
|
|
|
@ -24,9 +24,9 @@ refine flow MQTT_Flow += {
|
||||||
if ( mqtt_publish )
|
if ( mqtt_publish )
|
||||||
{
|
{
|
||||||
auto m = new RecordVal(BifType::Record::MQTT::PublishMsg);
|
auto m = new RecordVal(BifType::Record::MQTT::PublishMsg);
|
||||||
m->Assign(0, val_mgr->GetBool(${msg.dup}));
|
m->Assign(0, val_mgr->Bool(${msg.dup}));
|
||||||
m->Assign(1, val_mgr->GetCount(${msg.qos}));
|
m->Assign(1, val_mgr->GetCount(${msg.qos}));
|
||||||
m->Assign(2, val_mgr->GetBool(${msg.retain}));
|
m->Assign(2, val_mgr->Bool(${msg.retain}));
|
||||||
m->Assign(3, new StringVal(${msg.topic.str}.length(),
|
m->Assign(3, new StringVal(${msg.topic.str}.length(),
|
||||||
reinterpret_cast<const char*>(${msg.topic.str}.begin())));
|
reinterpret_cast<const char*>(${msg.topic.str}.begin())));
|
||||||
|
|
||||||
|
|
|
@ -61,7 +61,7 @@ void NetbiosSSN_Interpreter::ParseMessage(unsigned int type, unsigned int flags,
|
||||||
if ( netbios_session_message )
|
if ( netbios_session_message )
|
||||||
analyzer->EnqueueConnEvent(netbios_session_message,
|
analyzer->EnqueueConnEvent(netbios_session_message,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_query)},
|
val_mgr->Bool(is_query),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(type)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(type)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}
|
||||||
);
|
);
|
||||||
|
@ -323,7 +323,7 @@ void NetbiosSSN_Interpreter::Event(EventHandlerPtr event, const u_char* data,
|
||||||
if ( is_orig >= 0 )
|
if ( is_orig >= 0 )
|
||||||
analyzer->EnqueueConnEvent(event,
|
analyzer->EnqueueConnEvent(event,
|
||||||
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
make_intrusive<StringVal>(new BroString(data, len, false))
|
make_intrusive<StringVal>(new BroString(data, len, false))
|
||||||
);
|
);
|
||||||
else
|
else
|
||||||
|
|
|
@ -60,7 +60,7 @@ refine connection NTLM_Conn += {
|
||||||
result->Assign(4, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_tree_name.data}));
|
result->Assign(4, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_tree_name.data}));
|
||||||
break;
|
break;
|
||||||
case 6:
|
case 6:
|
||||||
result->Assign(5, val_mgr->GetBool(${val.pairs[i].constrained_auth}));
|
result->Assign(5, val_mgr->Bool(${val.pairs[i].constrained_auth}));
|
||||||
break;
|
break;
|
||||||
case 7:
|
case 7:
|
||||||
result->Assign(6, filetime2brotime(${val.pairs[i].timestamp}));
|
result->Assign(6, filetime2brotime(${val.pairs[i].timestamp}));
|
||||||
|
@ -79,28 +79,28 @@ refine connection NTLM_Conn += {
|
||||||
function build_negotiate_flag_record(val: NTLM_Negotiate_Flags): BroVal
|
function build_negotiate_flag_record(val: NTLM_Negotiate_Flags): BroVal
|
||||||
%{
|
%{
|
||||||
RecordVal* flags = new RecordVal(BifType::Record::NTLM::NegotiateFlags);
|
RecordVal* flags = new RecordVal(BifType::Record::NTLM::NegotiateFlags);
|
||||||
flags->Assign(0, val_mgr->GetBool(${val.negotiate_56}));
|
flags->Assign(0, val_mgr->Bool(${val.negotiate_56}));
|
||||||
flags->Assign(1, val_mgr->GetBool(${val.negotiate_key_exch}));
|
flags->Assign(1, val_mgr->Bool(${val.negotiate_key_exch}));
|
||||||
flags->Assign(2, val_mgr->GetBool(${val.negotiate_128}));
|
flags->Assign(2, val_mgr->Bool(${val.negotiate_128}));
|
||||||
flags->Assign(3, val_mgr->GetBool(${val.negotiate_version}));
|
flags->Assign(3, val_mgr->Bool(${val.negotiate_version}));
|
||||||
flags->Assign(4, val_mgr->GetBool(${val.negotiate_target_info}));
|
flags->Assign(4, val_mgr->Bool(${val.negotiate_target_info}));
|
||||||
flags->Assign(5, val_mgr->GetBool(${val.request_non_nt_session_key}));
|
flags->Assign(5, val_mgr->Bool(${val.request_non_nt_session_key}));
|
||||||
flags->Assign(6, val_mgr->GetBool(${val.negotiate_identify}));
|
flags->Assign(6, val_mgr->Bool(${val.negotiate_identify}));
|
||||||
flags->Assign(7, val_mgr->GetBool(${val.negotiate_extended_sessionsecurity}));
|
flags->Assign(7, val_mgr->Bool(${val.negotiate_extended_sessionsecurity}));
|
||||||
flags->Assign(8, val_mgr->GetBool(${val.target_type_server}));
|
flags->Assign(8, val_mgr->Bool(${val.target_type_server}));
|
||||||
flags->Assign(9, val_mgr->GetBool(${val.target_type_domain}));
|
flags->Assign(9, val_mgr->Bool(${val.target_type_domain}));
|
||||||
flags->Assign(10, val_mgr->GetBool(${val.negotiate_always_sign}));
|
flags->Assign(10, val_mgr->Bool(${val.negotiate_always_sign}));
|
||||||
flags->Assign(11, val_mgr->GetBool(${val.negotiate_oem_workstation_supplied}));
|
flags->Assign(11, val_mgr->Bool(${val.negotiate_oem_workstation_supplied}));
|
||||||
flags->Assign(12, val_mgr->GetBool(${val.negotiate_oem_domain_supplied}));
|
flags->Assign(12, val_mgr->Bool(${val.negotiate_oem_domain_supplied}));
|
||||||
flags->Assign(13, val_mgr->GetBool(${val.negotiate_anonymous_connection}));
|
flags->Assign(13, val_mgr->Bool(${val.negotiate_anonymous_connection}));
|
||||||
flags->Assign(14, val_mgr->GetBool(${val.negotiate_ntlm}));
|
flags->Assign(14, val_mgr->Bool(${val.negotiate_ntlm}));
|
||||||
flags->Assign(15, val_mgr->GetBool(${val.negotiate_lm_key}));
|
flags->Assign(15, val_mgr->Bool(${val.negotiate_lm_key}));
|
||||||
flags->Assign(16, val_mgr->GetBool(${val.negotiate_datagram}));
|
flags->Assign(16, val_mgr->Bool(${val.negotiate_datagram}));
|
||||||
flags->Assign(17, val_mgr->GetBool(${val.negotiate_seal}));
|
flags->Assign(17, val_mgr->Bool(${val.negotiate_seal}));
|
||||||
flags->Assign(18, val_mgr->GetBool(${val.negotiate_sign}));
|
flags->Assign(18, val_mgr->Bool(${val.negotiate_sign}));
|
||||||
flags->Assign(19, val_mgr->GetBool(${val.request_target}));
|
flags->Assign(19, val_mgr->Bool(${val.request_target}));
|
||||||
flags->Assign(20, val_mgr->GetBool(${val.negotiate_oem}));
|
flags->Assign(20, val_mgr->Bool(${val.negotiate_oem}));
|
||||||
flags->Assign(21, val_mgr->GetBool(${val.negotiate_unicode}));
|
flags->Assign(21, val_mgr->Bool(${val.negotiate_unicode}));
|
||||||
|
|
||||||
return flags;
|
return flags;
|
||||||
%}
|
%}
|
||||||
|
|
|
@ -91,9 +91,9 @@ refine flow NTP_Flow += {
|
||||||
RecordVal* rv = new RecordVal(BifType::Record::NTP::ControlMessage);
|
RecordVal* rv = new RecordVal(BifType::Record::NTP::ControlMessage);
|
||||||
|
|
||||||
rv->Assign(0, val_mgr->GetCount(${ncm.OpCode}));
|
rv->Assign(0, val_mgr->GetCount(${ncm.OpCode}));
|
||||||
rv->Assign(1, val_mgr->GetBool(${ncm.R}));
|
rv->Assign(1, val_mgr->Bool(${ncm.R}));
|
||||||
rv->Assign(2, val_mgr->GetBool(${ncm.E}));
|
rv->Assign(2, val_mgr->Bool(${ncm.E}));
|
||||||
rv->Assign(3, val_mgr->GetBool(${ncm.M}));
|
rv->Assign(3, val_mgr->Bool(${ncm.M}));
|
||||||
rv->Assign(4, val_mgr->GetCount(${ncm.sequence}));
|
rv->Assign(4, val_mgr->GetCount(${ncm.sequence}));
|
||||||
rv->Assign(5, val_mgr->GetCount(${ncm.status}));
|
rv->Assign(5, val_mgr->GetCount(${ncm.status}));
|
||||||
rv->Assign(6, val_mgr->GetCount(${ncm.association_id}));
|
rv->Assign(6, val_mgr->GetCount(${ncm.association_id}));
|
||||||
|
@ -116,7 +116,7 @@ refine flow NTP_Flow += {
|
||||||
RecordVal* rv = new RecordVal(BifType::Record::NTP::Mode7Message);
|
RecordVal* rv = new RecordVal(BifType::Record::NTP::Mode7Message);
|
||||||
|
|
||||||
rv->Assign(0, val_mgr->GetCount(${m7.request_code}));
|
rv->Assign(0, val_mgr->GetCount(${m7.request_code}));
|
||||||
rv->Assign(1, val_mgr->GetBool(${m7.auth_bit}));
|
rv->Assign(1, val_mgr->Bool(${m7.auth_bit}));
|
||||||
rv->Assign(2, val_mgr->GetCount(${m7.sequence}));
|
rv->Assign(2, val_mgr->GetCount(${m7.sequence}));
|
||||||
rv->Assign(3, val_mgr->GetCount(${m7.implementation}));
|
rv->Assign(3, val_mgr->GetCount(${m7.implementation}));
|
||||||
rv->Assign(4, val_mgr->GetCount(${m7.error_code}));
|
rv->Assign(4, val_mgr->GetCount(${m7.error_code}));
|
||||||
|
|
|
@ -920,7 +920,7 @@ void POP3_Analyzer::POP3Event(EventHandlerPtr event, bool is_orig,
|
||||||
vl.reserve(2 + (bool)arg1 + (bool)arg2);
|
vl.reserve(2 + (bool)arg1 + (bool)arg2);
|
||||||
|
|
||||||
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
vl.emplace_back(AdoptRef{}, BuildConnVal());
|
||||||
vl.emplace_back(AdoptRef{}, val_mgr->GetBool(is_orig));
|
vl.emplace_back(val_mgr->Bool(is_orig));
|
||||||
|
|
||||||
if ( arg1 )
|
if ( arg1 )
|
||||||
vl.emplace_back(make_intrusive<StringVal>(arg1));
|
vl.emplace_back(make_intrusive<StringVal>(arg1));
|
||||||
|
|
|
@ -62,15 +62,15 @@ refine flow RDP_Flow += {
|
||||||
if ( rdp_client_core_data )
|
if ( rdp_client_core_data )
|
||||||
{
|
{
|
||||||
RecordVal* ec_flags = new RecordVal(BifType::Record::RDP::EarlyCapabilityFlags);
|
RecordVal* ec_flags = new RecordVal(BifType::Record::RDP::EarlyCapabilityFlags);
|
||||||
ec_flags->Assign(0, val_mgr->GetBool(${ccore.SUPPORT_ERRINFO_PDU}));
|
ec_flags->Assign(0, val_mgr->Bool(${ccore.SUPPORT_ERRINFO_PDU}));
|
||||||
ec_flags->Assign(1, val_mgr->GetBool(${ccore.WANT_32BPP_SESSION}));
|
ec_flags->Assign(1, val_mgr->Bool(${ccore.WANT_32BPP_SESSION}));
|
||||||
ec_flags->Assign(2, val_mgr->GetBool(${ccore.SUPPORT_STATUSINFO_PDU}));
|
ec_flags->Assign(2, val_mgr->Bool(${ccore.SUPPORT_STATUSINFO_PDU}));
|
||||||
ec_flags->Assign(3, val_mgr->GetBool(${ccore.STRONG_ASYMMETRIC_KEYS}));
|
ec_flags->Assign(3, val_mgr->Bool(${ccore.STRONG_ASYMMETRIC_KEYS}));
|
||||||
ec_flags->Assign(4, val_mgr->GetBool(${ccore.SUPPORT_MONITOR_LAYOUT_PDU}));
|
ec_flags->Assign(4, val_mgr->Bool(${ccore.SUPPORT_MONITOR_LAYOUT_PDU}));
|
||||||
ec_flags->Assign(5, val_mgr->GetBool(${ccore.SUPPORT_NETCHAR_AUTODETECT}));
|
ec_flags->Assign(5, val_mgr->Bool(${ccore.SUPPORT_NETCHAR_AUTODETECT}));
|
||||||
ec_flags->Assign(6, val_mgr->GetBool(${ccore.SUPPORT_DYNVC_GFX_PROTOCOL}));
|
ec_flags->Assign(6, val_mgr->Bool(${ccore.SUPPORT_DYNVC_GFX_PROTOCOL}));
|
||||||
ec_flags->Assign(7, val_mgr->GetBool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE}));
|
ec_flags->Assign(7, val_mgr->Bool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE}));
|
||||||
ec_flags->Assign(8, val_mgr->GetBool(${ccore.SUPPORT_HEARTBEAT_PDU}));
|
ec_flags->Assign(8, val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU}));
|
||||||
|
|
||||||
RecordVal* ccd = new RecordVal(BifType::Record::RDP::ClientCoreData);
|
RecordVal* ccd = new RecordVal(BifType::Record::RDP::ClientCoreData);
|
||||||
ccd->Assign(0, val_mgr->GetCount(${ccore.version_major}));
|
ccd->Assign(0, val_mgr->GetCount(${ccore.version_major}));
|
||||||
|
@ -133,17 +133,17 @@ refine flow RDP_Flow += {
|
||||||
channel_def->Assign(0, bytestring_to_val(${cnetwork.channel_def_array[i].name}));
|
channel_def->Assign(0, bytestring_to_val(${cnetwork.channel_def_array[i].name}));
|
||||||
channel_def->Assign(1, val_mgr->GetCount(${cnetwork.channel_def_array[i].options}));
|
channel_def->Assign(1, val_mgr->GetCount(${cnetwork.channel_def_array[i].options}));
|
||||||
|
|
||||||
channel_def->Assign(2, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED}));
|
channel_def->Assign(2, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_INITIALIZED}));
|
||||||
channel_def->Assign(3, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP}));
|
channel_def->Assign(3, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_RDP}));
|
||||||
channel_def->Assign(4, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_SC}));
|
channel_def->Assign(4, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_SC}));
|
||||||
channel_def->Assign(5, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_CS}));
|
channel_def->Assign(5, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_ENCRYPT_CS}));
|
||||||
channel_def->Assign(6, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_HIGH}));
|
channel_def->Assign(6, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_HIGH}));
|
||||||
channel_def->Assign(7, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_MED}));
|
channel_def->Assign(7, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_MED}));
|
||||||
channel_def->Assign(8, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_LOW}));
|
channel_def->Assign(8, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_PRI_LOW}));
|
||||||
channel_def->Assign(9, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS_RDP}));
|
channel_def->Assign(9, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS_RDP}));
|
||||||
channel_def->Assign(10, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS}));
|
channel_def->Assign(10, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_COMPRESS}));
|
||||||
channel_def->Assign(11, val_mgr->GetBool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_SHOW_PROTOCOL}));
|
channel_def->Assign(11, val_mgr->Bool(${cnetwork.channel_def_array[i].CHANNEL_OPTION_SHOW_PROTOCOL}));
|
||||||
channel_def->Assign(12, val_mgr->GetBool(${cnetwork.channel_def_array[i].REMOTE_CONTROL_PERSISTENT}));
|
channel_def->Assign(12, val_mgr->Bool(${cnetwork.channel_def_array[i].REMOTE_CONTROL_PERSISTENT}));
|
||||||
|
|
||||||
channels->Assign(channels->Size(), channel_def);
|
channels->Assign(channels->Size(), channel_def);
|
||||||
}
|
}
|
||||||
|
@ -164,10 +164,10 @@ refine flow RDP_Flow += {
|
||||||
RecordVal* ccld = new RecordVal(BifType::Record::RDP::ClientClusterData);
|
RecordVal* ccld = new RecordVal(BifType::Record::RDP::ClientClusterData);
|
||||||
ccld->Assign(0, val_mgr->GetCount(${ccluster.flags}));
|
ccld->Assign(0, val_mgr->GetCount(${ccluster.flags}));
|
||||||
ccld->Assign(1, val_mgr->GetCount(${ccluster.redir_session_id}));
|
ccld->Assign(1, val_mgr->GetCount(${ccluster.redir_session_id}));
|
||||||
ccld->Assign(2, val_mgr->GetBool(${ccluster.REDIRECTION_SUPPORTED}));
|
ccld->Assign(2, val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED}));
|
||||||
ccld->Assign(3, val_mgr->GetCount(${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK}));
|
ccld->Assign(3, val_mgr->GetCount(${ccluster.SERVER_SESSION_REDIRECTION_VERSION_MASK}));
|
||||||
ccld->Assign(4, val_mgr->GetBool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID}));
|
ccld->Assign(4, val_mgr->Bool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID}));
|
||||||
ccld->Assign(5, val_mgr->GetBool(${ccluster.REDIRECTED_SMARTCARD}));
|
ccld->Assign(5, val_mgr->Bool(${ccluster.REDIRECTED_SMARTCARD}));
|
||||||
|
|
||||||
BifEvent::generate_rdp_client_cluster_data(connection()->bro_analyzer(),
|
BifEvent::generate_rdp_client_cluster_data(connection()->bro_analyzer(),
|
||||||
connection()->bro_analyzer()->Conn(),
|
connection()->bro_analyzer()->Conn(),
|
||||||
|
|
|
@ -747,7 +747,7 @@ RecordVal* NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n)
|
||||||
{
|
{
|
||||||
RecordVal *args = new RecordVal(BifType::Record::NFS3::readdirargs_t);
|
RecordVal *args = new RecordVal(BifType::Record::NFS3::readdirargs_t);
|
||||||
|
|
||||||
args->Assign(0, val_mgr->GetBool(isplus));
|
args->Assign(0, val_mgr->Bool(isplus));
|
||||||
args->Assign(1, nfs3_fh(buf, n));
|
args->Assign(1, nfs3_fh(buf, n));
|
||||||
args->Assign(2, ExtractUint64(buf,n)); // cookie
|
args->Assign(2, ExtractUint64(buf,n)); // cookie
|
||||||
args->Assign(3, ExtractUint64(buf,n)); // cookieverf
|
args->Assign(3, ExtractUint64(buf,n)); // cookieverf
|
||||||
|
@ -764,7 +764,7 @@ RecordVal* NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
|
||||||
{
|
{
|
||||||
RecordVal *rep = new RecordVal(BifType::Record::NFS3::readdir_reply_t);
|
RecordVal *rep = new RecordVal(BifType::Record::NFS3::readdir_reply_t);
|
||||||
|
|
||||||
rep->Assign(0, val_mgr->GetBool(isplus));
|
rep->Assign(0, val_mgr->Bool(isplus));
|
||||||
|
|
||||||
if ( status == BifEnum::NFS3::NFS3ERR_OK )
|
if ( status == BifEnum::NFS3::NFS3ERR_OK )
|
||||||
{
|
{
|
||||||
|
@ -826,7 +826,7 @@ Val* NFS_Interp::ExtractInterval(const u_char*& buf, int& n)
|
||||||
|
|
||||||
Val* NFS_Interp::ExtractBool(const u_char*& buf, int& n)
|
Val* NFS_Interp::ExtractBool(const u_char*& buf, int& n)
|
||||||
{
|
{
|
||||||
return val_mgr->GetBool(extract_XDR_uint32(buf, n));
|
return val_mgr->Bool(extract_XDR_uint32(buf, n))->Ref();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -94,7 +94,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
|
||||||
if ( ! buf )
|
if ( ! buf )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
reply = val_mgr->GetBool(status);
|
reply = val_mgr->Bool(status)->Ref();
|
||||||
event = pm_request_set;
|
event = pm_request_set;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
@ -109,7 +109,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
|
||||||
if ( ! buf )
|
if ( ! buf )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
reply = val_mgr->GetBool(status);
|
reply = val_mgr->Bool(status)->Ref();
|
||||||
event = pm_request_unset;
|
event = pm_request_unset;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
@ -222,7 +222,7 @@ Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
|
||||||
pr->Assign(1, val_mgr->GetCount(extract_XDR_uint32(buf, len)));
|
pr->Assign(1, val_mgr->GetCount(extract_XDR_uint32(buf, len)));
|
||||||
|
|
||||||
bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP;
|
bool is_tcp = extract_XDR_uint32(buf, len) == IPPROTO_TCP;
|
||||||
pr->Assign(2, val_mgr->GetBool(is_tcp));
|
pr->Assign(2, val_mgr->Bool(is_tcp));
|
||||||
(void) extract_XDR_uint32(buf, len); // consume the bogus port
|
(void) extract_XDR_uint32(buf, len); // consume the bogus port
|
||||||
|
|
||||||
if ( ! buf )
|
if ( ! buf )
|
||||||
|
|
|
@ -53,12 +53,12 @@ refine connection SMB_Conn += {
|
||||||
|
|
||||||
case 0x0d:
|
case 0x0d:
|
||||||
security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity);
|
security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity);
|
||||||
security->Assign(0, val_mgr->GetBool(${val.lanman.security_user_level}));
|
security->Assign(0, val_mgr->Bool(${val.lanman.security_user_level}));
|
||||||
security->Assign(1, val_mgr->GetBool(${val.lanman.security_challenge_response}));
|
security->Assign(1, val_mgr->Bool(${val.lanman.security_challenge_response}));
|
||||||
|
|
||||||
raw = new RecordVal(BifType::Record::SMB1::NegotiateRawMode);
|
raw = new RecordVal(BifType::Record::SMB1::NegotiateRawMode);
|
||||||
raw->Assign(0, val_mgr->GetBool(${val.lanman.raw_read_supported}));
|
raw->Assign(0, val_mgr->Bool(${val.lanman.raw_read_supported}));
|
||||||
raw->Assign(1, val_mgr->GetBool(${val.lanman.raw_write_supported}));
|
raw->Assign(1, val_mgr->Bool(${val.lanman.raw_write_supported}));
|
||||||
|
|
||||||
lanman = new RecordVal(BifType::Record::SMB1::NegotiateResponseLANMAN);
|
lanman = new RecordVal(BifType::Record::SMB1::NegotiateResponseLANMAN);
|
||||||
lanman->Assign(0, val_mgr->GetCount(${val.word_count}));
|
lanman->Assign(0, val_mgr->GetCount(${val.word_count}));
|
||||||
|
@ -80,33 +80,33 @@ refine connection SMB_Conn += {
|
||||||
|
|
||||||
case 0x11:
|
case 0x11:
|
||||||
security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity);
|
security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity);
|
||||||
security->Assign(0, val_mgr->GetBool(${val.ntlm.security_user_level}));
|
security->Assign(0, val_mgr->Bool(${val.ntlm.security_user_level}));
|
||||||
security->Assign(1, val_mgr->GetBool(${val.ntlm.security_challenge_response}));
|
security->Assign(1, val_mgr->Bool(${val.ntlm.security_challenge_response}));
|
||||||
security->Assign(2, val_mgr->GetBool(${val.ntlm.security_signatures_enabled}));
|
security->Assign(2, val_mgr->Bool(${val.ntlm.security_signatures_enabled}));
|
||||||
security->Assign(3, val_mgr->GetBool(${val.ntlm.security_signatures_required}));
|
security->Assign(3, val_mgr->Bool(${val.ntlm.security_signatures_required}));
|
||||||
|
|
||||||
capabilities = new RecordVal(BifType::Record::SMB1::NegotiateCapabilities);
|
capabilities = new RecordVal(BifType::Record::SMB1::NegotiateCapabilities);
|
||||||
capabilities->Assign(0, val_mgr->GetBool(${val.ntlm.capabilities_raw_mode}));
|
capabilities->Assign(0, val_mgr->Bool(${val.ntlm.capabilities_raw_mode}));
|
||||||
capabilities->Assign(1, val_mgr->GetBool(${val.ntlm.capabilities_mpx_mode}));
|
capabilities->Assign(1, val_mgr->Bool(${val.ntlm.capabilities_mpx_mode}));
|
||||||
capabilities->Assign(2, val_mgr->GetBool(${val.ntlm.capabilities_unicode}));
|
capabilities->Assign(2, val_mgr->Bool(${val.ntlm.capabilities_unicode}));
|
||||||
capabilities->Assign(3, val_mgr->GetBool(${val.ntlm.capabilities_large_files}));
|
capabilities->Assign(3, val_mgr->Bool(${val.ntlm.capabilities_large_files}));
|
||||||
capabilities->Assign(4, val_mgr->GetBool(${val.ntlm.capabilities_nt_smbs}));
|
capabilities->Assign(4, val_mgr->Bool(${val.ntlm.capabilities_nt_smbs}));
|
||||||
|
|
||||||
capabilities->Assign(5, val_mgr->GetBool(${val.ntlm.capabilities_rpc_remote_apis}));
|
capabilities->Assign(5, val_mgr->Bool(${val.ntlm.capabilities_rpc_remote_apis}));
|
||||||
capabilities->Assign(6, val_mgr->GetBool(${val.ntlm.capabilities_status32}));
|
capabilities->Assign(6, val_mgr->Bool(${val.ntlm.capabilities_status32}));
|
||||||
capabilities->Assign(7, val_mgr->GetBool(${val.ntlm.capabilities_level_2_oplocks}));
|
capabilities->Assign(7, val_mgr->Bool(${val.ntlm.capabilities_level_2_oplocks}));
|
||||||
capabilities->Assign(8, val_mgr->GetBool(${val.ntlm.capabilities_lock_and_read}));
|
capabilities->Assign(8, val_mgr->Bool(${val.ntlm.capabilities_lock_and_read}));
|
||||||
capabilities->Assign(9, val_mgr->GetBool(${val.ntlm.capabilities_nt_find}));
|
capabilities->Assign(9, val_mgr->Bool(${val.ntlm.capabilities_nt_find}));
|
||||||
|
|
||||||
capabilities->Assign(10, val_mgr->GetBool(${val.ntlm.capabilities_dfs}));
|
capabilities->Assign(10, val_mgr->Bool(${val.ntlm.capabilities_dfs}));
|
||||||
capabilities->Assign(11, val_mgr->GetBool(${val.ntlm.capabilities_infolevel_passthru}));
|
capabilities->Assign(11, val_mgr->Bool(${val.ntlm.capabilities_infolevel_passthru}));
|
||||||
capabilities->Assign(12, val_mgr->GetBool(${val.ntlm.capabilities_large_readx}));
|
capabilities->Assign(12, val_mgr->Bool(${val.ntlm.capabilities_large_readx}));
|
||||||
capabilities->Assign(13, val_mgr->GetBool(${val.ntlm.capabilities_large_writex}));
|
capabilities->Assign(13, val_mgr->Bool(${val.ntlm.capabilities_large_writex}));
|
||||||
capabilities->Assign(14, val_mgr->GetBool(${val.ntlm.capabilities_unix}));
|
capabilities->Assign(14, val_mgr->Bool(${val.ntlm.capabilities_unix}));
|
||||||
|
|
||||||
capabilities->Assign(15, val_mgr->GetBool(${val.ntlm.capabilities_bulk_transfer}));
|
capabilities->Assign(15, val_mgr->Bool(${val.ntlm.capabilities_bulk_transfer}));
|
||||||
capabilities->Assign(16, val_mgr->GetBool(${val.ntlm.capabilities_compressed_data}));
|
capabilities->Assign(16, val_mgr->Bool(${val.ntlm.capabilities_compressed_data}));
|
||||||
capabilities->Assign(17, val_mgr->GetBool(${val.ntlm.capabilities_extended_security}));
|
capabilities->Assign(17, val_mgr->Bool(${val.ntlm.capabilities_extended_security}));
|
||||||
|
|
||||||
ntlm = new RecordVal(BifType::Record::SMB1::NegotiateResponseNTLM);
|
ntlm = new RecordVal(BifType::Record::SMB1::NegotiateResponseNTLM);
|
||||||
ntlm->Assign(0, val_mgr->GetCount(${val.word_count}));
|
ntlm->Assign(0, val_mgr->GetCount(${val.word_count}));
|
||||||
|
|
|
@ -32,12 +32,12 @@ refine connection SMB_Conn += {
|
||||||
break;
|
break;
|
||||||
case 12: // NT LM 0.12 with extended security
|
case 12: // NT LM 0.12 with extended security
|
||||||
capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities);
|
capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities);
|
||||||
capabilities->Assign(0, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.unicode}));
|
capabilities->Assign(0, val_mgr->Bool(${val.ntlm_extended_security.capabilities.unicode}));
|
||||||
capabilities->Assign(1, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.large_files}));
|
capabilities->Assign(1, val_mgr->Bool(${val.ntlm_extended_security.capabilities.large_files}));
|
||||||
capabilities->Assign(2, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.nt_smbs}));
|
capabilities->Assign(2, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_smbs}));
|
||||||
capabilities->Assign(3, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.status32}));
|
capabilities->Assign(3, val_mgr->Bool(${val.ntlm_extended_security.capabilities.status32}));
|
||||||
capabilities->Assign(4, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.level_2_oplocks}));
|
capabilities->Assign(4, val_mgr->Bool(${val.ntlm_extended_security.capabilities.level_2_oplocks}));
|
||||||
capabilities->Assign(5, val_mgr->GetBool(${val.ntlm_extended_security.capabilities.nt_find}));
|
capabilities->Assign(5, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_find}));
|
||||||
|
|
||||||
request->Assign(1, val_mgr->GetCount(${val.ntlm_extended_security.max_buffer_size}));
|
request->Assign(1, val_mgr->GetCount(${val.ntlm_extended_security.max_buffer_size}));
|
||||||
request->Assign(2, val_mgr->GetCount(${val.ntlm_extended_security.max_mpx_count}));
|
request->Assign(2, val_mgr->GetCount(${val.ntlm_extended_security.max_mpx_count}));
|
||||||
|
@ -52,12 +52,12 @@ refine connection SMB_Conn += {
|
||||||
|
|
||||||
case 13: // NT LM 0.12 without extended security
|
case 13: // NT LM 0.12 without extended security
|
||||||
capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities);
|
capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities);
|
||||||
capabilities->Assign(0, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.unicode}));
|
capabilities->Assign(0, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.unicode}));
|
||||||
capabilities->Assign(1, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.large_files}));
|
capabilities->Assign(1, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.large_files}));
|
||||||
capabilities->Assign(2, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.nt_smbs}));
|
capabilities->Assign(2, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_smbs}));
|
||||||
capabilities->Assign(3, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.status32}));
|
capabilities->Assign(3, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.status32}));
|
||||||
capabilities->Assign(4, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks}));
|
capabilities->Assign(4, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.level_2_oplocks}));
|
||||||
capabilities->Assign(5, val_mgr->GetBool(${val.ntlm_nonextended_security.capabilities.nt_find}));
|
capabilities->Assign(5, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_find}));
|
||||||
|
|
||||||
request->Assign(1, val_mgr->GetCount(${val.ntlm_nonextended_security.max_buffer_size}));
|
request->Assign(1, val_mgr->GetCount(${val.ntlm_nonextended_security.max_buffer_size}));
|
||||||
request->Assign(2, val_mgr->GetCount(${val.ntlm_nonextended_security.max_mpx_count}));
|
request->Assign(2, val_mgr->GetCount(${val.ntlm_nonextended_security.max_mpx_count}));
|
||||||
|
@ -90,13 +90,13 @@ refine connection SMB_Conn += {
|
||||||
switch ( ${val.word_count} )
|
switch ( ${val.word_count} )
|
||||||
{
|
{
|
||||||
case 3: // pre NT LM 0.12
|
case 3: // pre NT LM 0.12
|
||||||
response->Assign(1, val_mgr->GetBool(${val.lanman.is_guest}));
|
response->Assign(1, val_mgr->Bool(${val.lanman.is_guest}));
|
||||||
response->Assign(2, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.native_os[0]}));
|
response->Assign(2, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.native_os[0]}));
|
||||||
response->Assign(3, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.native_lanman[0]}));
|
response->Assign(3, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.native_lanman[0]}));
|
||||||
response->Assign(4, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.primary_domain[0]}));
|
response->Assign(4, ${val.lanman.byte_count} == 0 ? val_mgr->GetEmptyString() : smb_string2stringval(${val.lanman.primary_domain[0]}));
|
||||||
break;
|
break;
|
||||||
case 4: // NT LM 0.12
|
case 4: // NT LM 0.12
|
||||||
response->Assign(1, val_mgr->GetBool(${val.ntlm.is_guest}));
|
response->Assign(1, val_mgr->Bool(${val.ntlm.is_guest}));
|
||||||
response->Assign(2, smb_string2stringval(${val.ntlm.native_os}));
|
response->Assign(2, smb_string2stringval(${val.ntlm.native_os}));
|
||||||
response->Assign(3, smb_string2stringval(${val.ntlm.native_lanman}));
|
response->Assign(3, smb_string2stringval(${val.ntlm.native_lanman}));
|
||||||
//response->Assign(4, smb_string2stringval(${val.ntlm.primary_domain}));
|
//response->Assign(4, smb_string2stringval(${val.ntlm.primary_domain}));
|
||||||
|
|
|
@ -21,9 +21,9 @@ refine connection SMB_Conn += {
|
||||||
if ( smb2_session_setup_response )
|
if ( smb2_session_setup_response )
|
||||||
{
|
{
|
||||||
RecordVal* flags = new RecordVal(BifType::Record::SMB2::SessionSetupFlags);
|
RecordVal* flags = new RecordVal(BifType::Record::SMB2::SessionSetupFlags);
|
||||||
flags->Assign(0, val_mgr->GetBool(${val.flag_guest}));
|
flags->Assign(0, val_mgr->Bool(${val.flag_guest}));
|
||||||
flags->Assign(1, val_mgr->GetBool(${val.flag_anonymous}));
|
flags->Assign(1, val_mgr->Bool(${val.flag_anonymous}));
|
||||||
flags->Assign(2, val_mgr->GetBool(${val.flag_encrypt}));
|
flags->Assign(2, val_mgr->Bool(${val.flag_encrypt}));
|
||||||
|
|
||||||
RecordVal* resp = new RecordVal(BifType::Record::SMB2::SessionSetupResponse);
|
RecordVal* resp = new RecordVal(BifType::Record::SMB2::SessionSetupResponse);
|
||||||
resp->Assign(0, flags);
|
resp->Assign(0, flags);
|
||||||
|
|
|
@ -238,21 +238,21 @@ function smb2_file_attrs_to_bro(val: SMB2_file_attributes): BroVal
|
||||||
%{
|
%{
|
||||||
RecordVal* r = new RecordVal(BifType::Record::SMB2::FileAttrs);
|
RecordVal* r = new RecordVal(BifType::Record::SMB2::FileAttrs);
|
||||||
|
|
||||||
r->Assign(0, val_mgr->GetBool(${val.read_only}));
|
r->Assign(0, val_mgr->Bool(${val.read_only}));
|
||||||
r->Assign(1, val_mgr->GetBool(${val.hidden}));
|
r->Assign(1, val_mgr->Bool(${val.hidden}));
|
||||||
r->Assign(2, val_mgr->GetBool(${val.system}));
|
r->Assign(2, val_mgr->Bool(${val.system}));
|
||||||
r->Assign(3, val_mgr->GetBool(${val.directory}));
|
r->Assign(3, val_mgr->Bool(${val.directory}));
|
||||||
r->Assign(4, val_mgr->GetBool(${val.archive}));
|
r->Assign(4, val_mgr->Bool(${val.archive}));
|
||||||
r->Assign(5, val_mgr->GetBool(${val.normal}));
|
r->Assign(5, val_mgr->Bool(${val.normal}));
|
||||||
r->Assign(6, val_mgr->GetBool(${val.temporary}));
|
r->Assign(6, val_mgr->Bool(${val.temporary}));
|
||||||
r->Assign(7, val_mgr->GetBool(${val.sparse_file}));
|
r->Assign(7, val_mgr->Bool(${val.sparse_file}));
|
||||||
r->Assign(8, val_mgr->GetBool(${val.reparse_point}));
|
r->Assign(8, val_mgr->Bool(${val.reparse_point}));
|
||||||
r->Assign(9, val_mgr->GetBool(${val.compressed}));
|
r->Assign(9, val_mgr->Bool(${val.compressed}));
|
||||||
r->Assign(10, val_mgr->GetBool(${val.offline}));
|
r->Assign(10, val_mgr->Bool(${val.offline}));
|
||||||
r->Assign(11, val_mgr->GetBool(${val.not_content_indexed}));
|
r->Assign(11, val_mgr->Bool(${val.not_content_indexed}));
|
||||||
r->Assign(12, val_mgr->GetBool(${val.encrypted}));
|
r->Assign(12, val_mgr->Bool(${val.encrypted}));
|
||||||
r->Assign(13, val_mgr->GetBool(${val.integrity_stream}));
|
r->Assign(13, val_mgr->Bool(${val.integrity_stream}));
|
||||||
r->Assign(14, val_mgr->GetBool(${val.no_scrub_data}));
|
r->Assign(14, val_mgr->Bool(${val.no_scrub_data}));
|
||||||
|
|
||||||
return r;
|
return r;
|
||||||
%}
|
%}
|
||||||
|
|
|
@ -221,7 +221,7 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig)
|
||||||
{
|
{
|
||||||
EnqueueConnEvent(smtp_data,
|
EnqueueConnEvent(smtp_data,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
make_intrusive<StringVal>(data_len, line)
|
make_intrusive<StringVal>(data_len, line)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -351,11 +351,11 @@ void SMTP_Analyzer::ProcessLine(int length, const char* line, bool orig)
|
||||||
|
|
||||||
EnqueueConnEvent(smtp_reply,
|
EnqueueConnEvent(smtp_reply,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig)},
|
val_mgr->Bool(orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(reply_code)},
|
||||||
make_intrusive<StringVal>(cmd),
|
make_intrusive<StringVal>(cmd),
|
||||||
make_intrusive<StringVal>(end_of_line - line, line),
|
make_intrusive<StringVal>(end_of_line - line, line),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool((pending_reply > 0))}
|
val_mgr->Bool((pending_reply > 0))
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -860,7 +860,7 @@ void SMTP_Analyzer::RequestEvent(int cmd_len, const char* cmd,
|
||||||
|
|
||||||
EnqueueConnEvent(smtp_request,
|
EnqueueConnEvent(smtp_request,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(orig_is_sender)},
|
val_mgr->Bool(orig_is_sender),
|
||||||
std::move(cmd_arg),
|
std::move(cmd_arg),
|
||||||
make_intrusive<StringVal>(arg_len, arg)
|
make_intrusive<StringVal>(arg_len, arg)
|
||||||
);
|
);
|
||||||
|
@ -881,7 +881,7 @@ void SMTP_Analyzer::Unexpected(bool is_sender, const char* msg,
|
||||||
|
|
||||||
EnqueueConnEvent(smtp_unexpected,
|
EnqueueConnEvent(smtp_unexpected,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
make_intrusive<StringVal>(msg),
|
make_intrusive<StringVal>(msg),
|
||||||
make_intrusive<StringVal>(detail_len, detail)
|
make_intrusive<StringVal>(detail_len, detail)
|
||||||
);
|
);
|
||||||
|
|
|
@ -134,9 +134,9 @@ RecordVal* build_hdrV3(const Header* header)
|
||||||
v3->Assign(1, asn1_integer_to_val(global_data->max_size(),
|
v3->Assign(1, asn1_integer_to_val(global_data->max_size(),
|
||||||
TYPE_COUNT));
|
TYPE_COUNT));
|
||||||
v3->Assign(2, val_mgr->GetCount(flags_byte));
|
v3->Assign(2, val_mgr->GetCount(flags_byte));
|
||||||
v3->Assign(3, val_mgr->GetBool(flags_byte & 0x01));
|
v3->Assign(3, val_mgr->Bool(flags_byte & 0x01));
|
||||||
v3->Assign(4, val_mgr->GetBool(flags_byte & 0x02));
|
v3->Assign(4, val_mgr->Bool(flags_byte & 0x02));
|
||||||
v3->Assign(5, val_mgr->GetBool(flags_byte & 0x04));
|
v3->Assign(5, val_mgr->Bool(flags_byte & 0x04));
|
||||||
v3->Assign(6, asn1_integer_to_val(global_data->security_model(),
|
v3->Assign(6, asn1_integer_to_val(global_data->security_model(),
|
||||||
TYPE_COUNT));
|
TYPE_COUNT));
|
||||||
v3->Assign(7, asn1_octet_string_to_val(v3hdr->security_parameters()));
|
v3->Assign(7, asn1_octet_string_to_val(v3hdr->security_parameters()));
|
||||||
|
|
|
@ -101,7 +101,7 @@ refine flow SSH_Flow += {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
result->Assign(6, val_mgr->GetBool(!${msg.is_orig}));
|
result->Assign(6, val_mgr->Bool(!${msg.is_orig}));
|
||||||
|
|
||||||
BifEvent::generate_ssh_capabilities(connection()->bro_analyzer(),
|
BifEvent::generate_ssh_capabilities(connection()->bro_analyzer(),
|
||||||
connection()->bro_analyzer()->Conn(), bytestring_to_val(${msg.cookie}),
|
connection()->bro_analyzer()->Conn(), bytestring_to_val(${msg.cookie}),
|
||||||
|
|
|
@ -149,7 +149,7 @@ void SteppingStoneEndpoint::CreateEndpEvent(bool is_orig)
|
||||||
endp->TCP()->EnqueueConnEvent(stp_create_endp,
|
endp->TCP()->EnqueueConnEvent(stp_create_endp,
|
||||||
IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(stp_id)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetInt(stp_id)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}
|
val_mgr->Bool(is_orig)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -109,14 +109,14 @@ static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip,
|
||||||
|
|
||||||
RecordVal* v = new RecordVal(SYN_packet);
|
RecordVal* v = new RecordVal(SYN_packet);
|
||||||
|
|
||||||
v->Assign(0, val_mgr->GetBool(is_orig));
|
v->Assign(0, val_mgr->Bool(is_orig));
|
||||||
v->Assign(1, val_mgr->GetBool(int(ip->DF())));
|
v->Assign(1, val_mgr->Bool(int(ip->DF())));
|
||||||
v->Assign(2, val_mgr->GetCount((ip->TTL())));
|
v->Assign(2, val_mgr->GetCount((ip->TTL())));
|
||||||
v->Assign(3, val_mgr->GetCount((ip->TotalLen())));
|
v->Assign(3, val_mgr->GetCount((ip->TotalLen())));
|
||||||
v->Assign(4, val_mgr->GetCount(ntohs(tcp->th_win)));
|
v->Assign(4, val_mgr->GetCount(ntohs(tcp->th_win)));
|
||||||
v->Assign(5, val_mgr->GetInt(winscale));
|
v->Assign(5, val_mgr->GetInt(winscale));
|
||||||
v->Assign(6, val_mgr->GetCount(MSS));
|
v->Assign(6, val_mgr->GetCount(MSS));
|
||||||
v->Assign(7, val_mgr->GetBool(SACK));
|
v->Assign(7, val_mgr->Bool(SACK));
|
||||||
|
|
||||||
return v;
|
return v;
|
||||||
}
|
}
|
||||||
|
@ -787,7 +787,7 @@ void TCP_Analyzer::GeneratePacketEvent(
|
||||||
{
|
{
|
||||||
EnqueueConnEvent(tcp_packet,
|
EnqueueConnEvent(tcp_packet,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
make_intrusive<StringVal>(flags.AsString()),
|
make_intrusive<StringVal>(flags.AsString()),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(rel_seq)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(rel_seq)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flags.ACK() ? rel_ack : 0)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(flags.ACK() ? rel_ack : 0)},
|
||||||
|
@ -1347,7 +1347,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
|
||||||
auto length = kind < 2 ? 1 : o[1];
|
auto length = kind < 2 ? 1 : o[1];
|
||||||
EnqueueConnEvent(tcp_option,
|
EnqueueConnEvent(tcp_option,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(kind)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(kind)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(length)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(length)}
|
||||||
);
|
);
|
||||||
|
@ -1460,7 +1460,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
|
||||||
|
|
||||||
EnqueueConnEvent(tcp_options,
|
EnqueueConnEvent(tcp_options,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
std::move(option_list)
|
std::move(option_list)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -1782,7 +1782,7 @@ void TCP_Analyzer::EndpointEOF(TCP_Reassembler* endp)
|
||||||
if ( connection_EOF )
|
if ( connection_EOF )
|
||||||
EnqueueConnEvent(connection_EOF,
|
EnqueueConnEvent(connection_EOF,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(endp->IsOrig())}
|
val_mgr->Bool(endp->IsOrig())
|
||||||
);
|
);
|
||||||
|
|
||||||
const analyzer_list& children(GetChildren());
|
const analyzer_list& children(GetChildren());
|
||||||
|
@ -2062,7 +2062,7 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl
|
||||||
if ( tcp_rexmit )
|
if ( tcp_rexmit )
|
||||||
endp->TCP()->EnqueueConnEvent(tcp_rexmit,
|
endp->TCP()->EnqueueConnEvent(tcp_rexmit,
|
||||||
IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, endp->TCP()->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(endp->IsOrig())},
|
val_mgr->Bool(endp->IsOrig()),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(data_in_flight)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(data_in_flight)},
|
||||||
|
|
|
@ -239,7 +239,7 @@ bool TCP_Endpoint::DataSent(double t, uint64_t seq, int len, int caplen,
|
||||||
if ( contents_file_write_failure )
|
if ( contents_file_write_failure )
|
||||||
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
|
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
|
||||||
IntrusivePtr{AdoptRef{}, Conn()->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, Conn()->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())},
|
val_mgr->Bool(IsOrig()),
|
||||||
make_intrusive<StringVal>(buf)
|
make_intrusive<StringVal>(buf)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
|
@ -153,7 +153,7 @@ void TCP_Reassembler::Gap(uint64_t seq, uint64_t len)
|
||||||
if ( report_gap(endp, endp->peer) )
|
if ( report_gap(endp, endp->peer) )
|
||||||
dst_analyzer->EnqueueConnEvent(content_gap,
|
dst_analyzer->EnqueueConnEvent(content_gap,
|
||||||
IntrusivePtr{AdoptRef{}, dst_analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, dst_analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())},
|
val_mgr->Bool(IsOrig()),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(len)}
|
||||||
);
|
);
|
||||||
|
@ -363,7 +363,7 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, BroFile* f)
|
||||||
if ( contents_file_write_failure )
|
if ( contents_file_write_failure )
|
||||||
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
|
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
|
||||||
IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())},
|
val_mgr->Bool(IsOrig()),
|
||||||
make_intrusive<StringVal>("TCP reassembler content write failure")
|
make_intrusive<StringVal>("TCP reassembler content write failure")
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -378,7 +378,7 @@ void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile*
|
||||||
if ( contents_file_write_failure )
|
if ( contents_file_write_failure )
|
||||||
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
|
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
|
||||||
IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, Endpoint()->Conn()->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())},
|
val_mgr->Bool(IsOrig()),
|
||||||
make_intrusive<StringVal>("TCP reassembler gap write failure")
|
make_intrusive<StringVal>("TCP reassembler gap write failure")
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
@ -614,7 +614,7 @@ void TCP_Reassembler::DeliverBlock(uint64_t seq, int len, const u_char* data)
|
||||||
if ( deliver_tcp_contents )
|
if ( deliver_tcp_contents )
|
||||||
tcp_analyzer->EnqueueConnEvent(tcp_contents,
|
tcp_analyzer->EnqueueConnEvent(tcp_contents,
|
||||||
IntrusivePtr{AdoptRef{}, tcp_analyzer->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, tcp_analyzer->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(IsOrig())},
|
val_mgr->Bool(IsOrig()),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)},
|
IntrusivePtr{AdoptRef{}, val_mgr->GetCount(seq)},
|
||||||
make_intrusive<StringVal>(len, (const char*) data)
|
make_intrusive<StringVal>(len, (const char*) data)
|
||||||
);
|
);
|
||||||
|
|
|
@ -166,7 +166,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
|
||||||
if ( do_udp_contents )
|
if ( do_udp_contents )
|
||||||
EnqueueConnEvent(udp_contents,
|
EnqueueConnEvent(udp_contents,
|
||||||
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
make_intrusive<StringVal>(len, (const char*) data)
|
make_intrusive<StringVal>(len, (const char*) data)
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
|
@ -90,7 +90,7 @@ struct val_converter {
|
||||||
result_type operator()(bool a)
|
result_type operator()(bool a)
|
||||||
{
|
{
|
||||||
if ( type->Tag() == TYPE_BOOL )
|
if ( type->Tag() == TYPE_BOOL )
|
||||||
return val_mgr->GetBool(a);
|
return val_mgr->Bool(a)->Ref();
|
||||||
return nullptr;
|
return nullptr;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -87,7 +87,7 @@ function Broker::__set_contains%(s: Broker::Data, key: any%): bool
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
}
|
}
|
||||||
|
|
||||||
return val_mgr->GetBool(v.find(*k) != v.end());
|
return val_mgr->Bool(v.find(*k) != v.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__set_insert%(s: Broker::Data, key: any%): bool
|
function Broker::__set_insert%(s: Broker::Data, key: any%): bool
|
||||||
|
@ -103,7 +103,7 @@ function Broker::__set_insert%(s: Broker::Data, key: any%): bool
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
}
|
}
|
||||||
|
|
||||||
return val_mgr->GetBool(v.insert(std::move(*k)).second);
|
return val_mgr->Bool(v.insert(std::move(*k)).second);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__set_remove%(s: Broker::Data, key: any%): bool
|
function Broker::__set_remove%(s: Broker::Data, key: any%): bool
|
||||||
|
@ -118,7 +118,7 @@ function Broker::__set_remove%(s: Broker::Data, key: any%): bool
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
}
|
}
|
||||||
|
|
||||||
return val_mgr->GetBool(v.erase(*k) > 0);
|
return val_mgr->Bool(v.erase(*k) > 0);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__set_iterator%(s: Broker::Data%): opaque of Broker::SetIterator
|
function Broker::__set_iterator%(s: Broker::Data%): opaque of Broker::SetIterator
|
||||||
|
@ -129,7 +129,7 @@ function Broker::__set_iterator%(s: Broker::Data%): opaque of Broker::SetIterato
|
||||||
function Broker::__set_iterator_last%(it: opaque of Broker::SetIterator%): bool
|
function Broker::__set_iterator_last%(it: opaque of Broker::SetIterator%): bool
|
||||||
%{
|
%{
|
||||||
auto set_it = static_cast<bro_broker::SetIterator*>(it);
|
auto set_it = static_cast<bro_broker::SetIterator*>(it);
|
||||||
return val_mgr->GetBool(set_it->it == set_it->dat.end());
|
return val_mgr->Bool(set_it->it == set_it->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool
|
function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool
|
||||||
|
@ -140,7 +140,7 @@ function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
|
|
||||||
++set_it->it;
|
++set_it->it;
|
||||||
return val_mgr->GetBool(set_it->it != set_it->dat.end());
|
return val_mgr->Bool(set_it->it != set_it->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Broker::Data
|
function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Broker::Data
|
||||||
|
@ -191,7 +191,7 @@ function Broker::__table_contains%(t: Broker::Data, key: any%): bool
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
}
|
}
|
||||||
|
|
||||||
return val_mgr->GetBool(v.find(*k) != v.end());
|
return val_mgr->Bool(v.find(*k) != v.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::Data
|
function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::Data
|
||||||
|
@ -283,7 +283,7 @@ function Broker::__table_iterator%(t: Broker::Data%): opaque of Broker::TableIte
|
||||||
function Broker::__table_iterator_last%(it: opaque of Broker::TableIterator%): bool
|
function Broker::__table_iterator_last%(it: opaque of Broker::TableIterator%): bool
|
||||||
%{
|
%{
|
||||||
auto ti = static_cast<bro_broker::TableIterator*>(it);
|
auto ti = static_cast<bro_broker::TableIterator*>(it);
|
||||||
return val_mgr->GetBool(ti->it == ti->dat.end());
|
return val_mgr->Bool(ti->it == ti->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): bool
|
function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): bool
|
||||||
|
@ -294,7 +294,7 @@ function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): b
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
|
|
||||||
++ti->it;
|
++ti->it;
|
||||||
return val_mgr->GetBool(ti->it != ti->dat.end());
|
return val_mgr->Bool(ti->it != ti->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%): Broker::TableItem
|
function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%): Broker::TableItem
|
||||||
|
@ -406,7 +406,7 @@ function Broker::__vector_iterator%(v: Broker::Data%): opaque of Broker::VectorI
|
||||||
function Broker::__vector_iterator_last%(it: opaque of Broker::VectorIterator%): bool
|
function Broker::__vector_iterator_last%(it: opaque of Broker::VectorIterator%): bool
|
||||||
%{
|
%{
|
||||||
auto vi = static_cast<bro_broker::VectorIterator*>(it);
|
auto vi = static_cast<bro_broker::VectorIterator*>(it);
|
||||||
return val_mgr->GetBool(vi->it == vi->dat.end());
|
return val_mgr->Bool(vi->it == vi->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%): bool
|
function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%): bool
|
||||||
|
@ -417,7 +417,7 @@ function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%):
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
|
|
||||||
++vi->it;
|
++vi->it;
|
||||||
return val_mgr->GetBool(vi->it != vi->dat.end());
|
return val_mgr->Bool(vi->it != vi->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%): Broker::Data
|
function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%): Broker::Data
|
||||||
|
@ -485,7 +485,7 @@ function Broker::__record_iterator%(r: Broker::Data%): opaque of Broker::RecordI
|
||||||
function Broker::__record_iterator_last%(it: opaque of Broker::RecordIterator%): bool
|
function Broker::__record_iterator_last%(it: opaque of Broker::RecordIterator%): bool
|
||||||
%{
|
%{
|
||||||
auto ri = static_cast<bro_broker::RecordIterator*>(it);
|
auto ri = static_cast<bro_broker::RecordIterator*>(it);
|
||||||
return val_mgr->GetBool(ri->it == ri->dat.end());
|
return val_mgr->Bool(ri->it == ri->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%): bool
|
function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%): bool
|
||||||
|
@ -496,7 +496,7 @@ function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%):
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
|
|
||||||
++ri->it;
|
++ri->it;
|
||||||
return val_mgr->GetBool(ri->it != ri->dat.end());
|
return val_mgr->Bool(ri->it != ri->dat.end());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%): Broker::Data
|
function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%): Broker::Data
|
||||||
|
|
|
@ -111,7 +111,7 @@ function Broker::publish%(topic: string, ...%): bool
|
||||||
args.push_back((*bif_args)[i].get());
|
args.push_back((*bif_args)[i].get());
|
||||||
|
|
||||||
auto rval = publish_event_args(args, topic->AsString(), frame);
|
auto rval = publish_event_args(args, topic->AsString(), frame);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__flush_logs%(%): count
|
function Broker::__flush_logs%(%): count
|
||||||
|
@ -125,42 +125,42 @@ function Broker::__publish_id%(topic: string, id: string%): bool
|
||||||
bro_broker::Manager::ScriptScopeGuard ssg;
|
bro_broker::Manager::ScriptScopeGuard ssg;
|
||||||
auto rval = broker_mgr->PublishIdentifier(topic->CheckString(),
|
auto rval = broker_mgr->PublishIdentifier(topic->CheckString(),
|
||||||
id->CheckString());
|
id->CheckString());
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__auto_publish%(topic: string, ev: any%): bool
|
function Broker::__auto_publish%(topic: string, ev: any%): bool
|
||||||
%{
|
%{
|
||||||
bro_broker::Manager::ScriptScopeGuard ssg;
|
bro_broker::Manager::ScriptScopeGuard ssg;
|
||||||
auto rval = broker_mgr->AutoPublishEvent(topic->CheckString(), ev);
|
auto rval = broker_mgr->AutoPublishEvent(topic->CheckString(), ev);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__auto_unpublish%(topic: string, ev: any%): bool
|
function Broker::__auto_unpublish%(topic: string, ev: any%): bool
|
||||||
%{
|
%{
|
||||||
bro_broker::Manager::ScriptScopeGuard ssg;
|
bro_broker::Manager::ScriptScopeGuard ssg;
|
||||||
auto rval = broker_mgr->AutoUnpublishEvent(topic->CheckString(), ev);
|
auto rval = broker_mgr->AutoUnpublishEvent(topic->CheckString(), ev);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__subscribe%(topic_prefix: string%): bool
|
function Broker::__subscribe%(topic_prefix: string%): bool
|
||||||
%{
|
%{
|
||||||
bro_broker::Manager::ScriptScopeGuard ssg;
|
bro_broker::Manager::ScriptScopeGuard ssg;
|
||||||
auto rval = broker_mgr->Subscribe(topic_prefix->CheckString());
|
auto rval = broker_mgr->Subscribe(topic_prefix->CheckString());
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__forward%(topic_prefix: string%): bool
|
function Broker::__forward%(topic_prefix: string%): bool
|
||||||
%{
|
%{
|
||||||
bro_broker::Manager::ScriptScopeGuard ssg;
|
bro_broker::Manager::ScriptScopeGuard ssg;
|
||||||
auto rval = broker_mgr->Forward(topic_prefix->CheckString());
|
auto rval = broker_mgr->Forward(topic_prefix->CheckString());
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__unsubscribe%(topic_prefix: string%): bool
|
function Broker::__unsubscribe%(topic_prefix: string%): bool
|
||||||
%{
|
%{
|
||||||
bro_broker::Manager::ScriptScopeGuard ssg;
|
bro_broker::Manager::ScriptScopeGuard ssg;
|
||||||
auto rval = broker_mgr->Unsubscribe(topic_prefix->CheckString());
|
auto rval = broker_mgr->Unsubscribe(topic_prefix->CheckString());
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
module Cluster;
|
module Cluster;
|
||||||
|
@ -201,7 +201,7 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool
|
||||||
args.push_back((*bif_args)[i].get());
|
args.push_back((*bif_args)[i].get());
|
||||||
|
|
||||||
auto rval = publish_event_args(args, topic->AsString(), frame);
|
auto rval = publish_event_args(args, topic->AsString(), frame);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
|
|
||||||
|
@ -238,5 +238,5 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool
|
||||||
args.push_back((*bif_args)[i].get());
|
args.push_back((*bif_args)[i].get());
|
||||||
|
|
||||||
auto rval = publish_event_args(args, topic->AsString(), frame);
|
auto rval = publish_event_args(args, topic->AsString(), frame);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
|
@ -98,7 +98,7 @@ function Broker::__is_closed%(h: opaque of Broker::Store%): bool
|
||||||
}
|
}
|
||||||
|
|
||||||
auto handle = static_cast<bro_broker::StoreHandleVal*>(h);
|
auto handle = static_cast<bro_broker::StoreHandleVal*>(h);
|
||||||
return val_mgr->GetBool(broker_mgr->LookupStore(handle->store.name()));
|
return val_mgr->Bool(broker_mgr->LookupStore(handle->store.name()));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__close%(h: opaque of Broker::Store%): bool
|
function Broker::__close%(h: opaque of Broker::Store%): bool
|
||||||
|
@ -112,7 +112,7 @@ function Broker::__close%(h: opaque of Broker::Store%): bool
|
||||||
}
|
}
|
||||||
|
|
||||||
auto handle = static_cast<bro_broker::StoreHandleVal*>(h);
|
auto handle = static_cast<bro_broker::StoreHandleVal*>(h);
|
||||||
return val_mgr->GetBool(broker_mgr->CloseStore(handle->store.name()));
|
return val_mgr->Bool(broker_mgr->CloseStore(handle->store.name()));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Broker::__store_name%(h: opaque of Broker::Store%): string
|
function Broker::__store_name%(h: opaque of Broker::Store%): string
|
||||||
|
|
|
@ -97,7 +97,7 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio
|
||||||
|
|
||||||
if ( conn )
|
if ( conn )
|
||||||
{
|
{
|
||||||
val->Assign(is_orig_idx, val_mgr->GetBool(is_orig));
|
val->Assign(is_orig_idx, val_mgr->Bool(is_orig));
|
||||||
UpdateConnectionFields(conn, is_orig);
|
UpdateConnectionFields(conn, is_orig);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -157,7 +157,7 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig)
|
||||||
FileEvent(file_over_new_connection, {
|
FileEvent(file_over_new_connection, {
|
||||||
IntrusivePtr{NewRef{}, val},
|
IntrusivePtr{NewRef{}, val},
|
||||||
IntrusivePtr{AdoptRef{}, conn->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, conn->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
|
val_mgr->Bool(is_orig),
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -437,7 +437,7 @@ string Manager::GetFileID(const analyzer::Tag& tag, Connection* c, bool is_orig)
|
||||||
mgr.Enqueue(get_file_handle,
|
mgr.Enqueue(get_file_handle,
|
||||||
IntrusivePtr{NewRef{}, tagval},
|
IntrusivePtr{NewRef{}, tagval},
|
||||||
IntrusivePtr{AdoptRef{}, c->BuildConnVal()},
|
IntrusivePtr{AdoptRef{}, c->BuildConnVal()},
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)}
|
val_mgr->Bool(is_orig)
|
||||||
);
|
);
|
||||||
mgr.Drain(); // need file handle immediately so we don't have to buffer data
|
mgr.Drain(); // need file handle immediately so we don't have to buffer data
|
||||||
return current_file_id;
|
return current_file_id;
|
||||||
|
|
|
@ -13,7 +13,7 @@ function FileExtract::__set_limit%(file_id: string, args: any, n: count%): bool
|
||||||
using BifType::Record::Files::AnalyzerArgs;
|
using BifType::Record::Files::AnalyzerArgs;
|
||||||
auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
|
auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
|
||||||
bool result = file_mgr->SetExtractionLimit(file_id->CheckString(), rv.get(), n);
|
bool result = file_mgr->SetExtractionLimit(file_id->CheckString(), rv.get(), n);
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
module GLOBAL;
|
module GLOBAL;
|
||||||
|
|
|
@ -290,7 +290,7 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex)
|
||||||
if ( x509_ext_basic_constraints )
|
if ( x509_ext_basic_constraints )
|
||||||
{
|
{
|
||||||
auto pBasicConstraint = make_intrusive<RecordVal>(BifType::Record::X509::BasicConstraints);
|
auto pBasicConstraint = make_intrusive<RecordVal>(BifType::Record::X509::BasicConstraints);
|
||||||
pBasicConstraint->Assign(0, val_mgr->GetBool(constr->ca));
|
pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca));
|
||||||
|
|
||||||
if ( constr->pathlen )
|
if ( constr->pathlen )
|
||||||
pBasicConstraint->Assign(1, val_mgr->GetCount((int32_t) ASN1_INTEGER_get(constr->pathlen)));
|
pBasicConstraint->Assign(1, val_mgr->GetCount((int32_t) ASN1_INTEGER_get(constr->pathlen)));
|
||||||
|
@ -434,7 +434,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
|
||||||
if ( ips != nullptr )
|
if ( ips != nullptr )
|
||||||
sanExt->Assign(3, ips);
|
sanExt->Assign(3, ips);
|
||||||
|
|
||||||
sanExt->Assign(4, val_mgr->GetBool(otherfields));
|
sanExt->Assign(4, val_mgr->Bool(otherfields));
|
||||||
|
|
||||||
mgr.Enqueue(x509_ext_subject_alternative_name,
|
mgr.Enqueue(x509_ext_subject_alternative_name,
|
||||||
IntrusivePtr{NewRef{}, GetFile()->GetVal()},
|
IntrusivePtr{NewRef{}, GetFile()->GetVal()},
|
||||||
|
|
|
@ -276,7 +276,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa
|
||||||
pX509Ext->Assign(1, make_intrusive<StringVal>(short_name));
|
pX509Ext->Assign(1, make_intrusive<StringVal>(short_name));
|
||||||
|
|
||||||
pX509Ext->Assign(2, make_intrusive<StringVal>(oid));
|
pX509Ext->Assign(2, make_intrusive<StringVal>(oid));
|
||||||
pX509Ext->Assign(3, val_mgr->GetBool(critical));
|
pX509Ext->Assign(3, val_mgr->Bool(critical));
|
||||||
pX509Ext->Assign(4, ext_val);
|
pX509Ext->Assign(4, ext_val);
|
||||||
|
|
||||||
// send off generic extension event
|
// send off generic extension event
|
||||||
|
@ -289,7 +289,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa
|
||||||
if ( h == ocsp_extension )
|
if ( h == ocsp_extension )
|
||||||
mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
|
mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
|
||||||
std::move(pX509Ext),
|
std::move(pX509Ext),
|
||||||
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(global)});
|
val_mgr->Bool(global));
|
||||||
else
|
else
|
||||||
mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
|
mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
|
||||||
std::move(pX509Ext));
|
std::move(pX509Ext));
|
||||||
|
|
|
@ -742,7 +742,7 @@ function sct_verify%(cert: opaque of x509, logid: string, log_key: string, signa
|
||||||
EVP_MD_CTX_destroy(mdctx);
|
EVP_MD_CTX_destroy(mdctx);
|
||||||
EVP_PKEY_free(key);
|
EVP_PKEY_free(key);
|
||||||
|
|
||||||
return val_mgr->GetBool(success);
|
return val_mgr->Bool(success);
|
||||||
|
|
||||||
sct_verify_err:
|
sct_verify_err:
|
||||||
if (mdctx)
|
if (mdctx)
|
||||||
|
|
|
@ -14,28 +14,28 @@ type AnalyzerArgs: record;
|
||||||
function Files::__set_timeout_interval%(file_id: string, t: interval%): bool
|
function Files::__set_timeout_interval%(file_id: string, t: interval%): bool
|
||||||
%{
|
%{
|
||||||
bool result = file_mgr->SetTimeoutInterval(file_id->CheckString(), t);
|
bool result = file_mgr->SetTimeoutInterval(file_id->CheckString(), t);
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## :zeek:see:`Files::enable_reassembly`.
|
## :zeek:see:`Files::enable_reassembly`.
|
||||||
function Files::__enable_reassembly%(file_id: string%): bool
|
function Files::__enable_reassembly%(file_id: string%): bool
|
||||||
%{
|
%{
|
||||||
bool result = file_mgr->EnableReassembly(file_id->CheckString());
|
bool result = file_mgr->EnableReassembly(file_id->CheckString());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## :zeek:see:`Files::disable_reassembly`.
|
## :zeek:see:`Files::disable_reassembly`.
|
||||||
function Files::__disable_reassembly%(file_id: string%): bool
|
function Files::__disable_reassembly%(file_id: string%): bool
|
||||||
%{
|
%{
|
||||||
bool result = file_mgr->DisableReassembly(file_id->CheckString());
|
bool result = file_mgr->DisableReassembly(file_id->CheckString());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## :zeek:see:`Files::set_reassembly_buffer_size`.
|
## :zeek:see:`Files::set_reassembly_buffer_size`.
|
||||||
function Files::__set_reassembly_buffer%(file_id: string, max: count%): bool
|
function Files::__set_reassembly_buffer%(file_id: string, max: count%): bool
|
||||||
%{
|
%{
|
||||||
bool result = file_mgr->SetReassemblyBuffer(file_id->CheckString(), max);
|
bool result = file_mgr->SetReassemblyBuffer(file_id->CheckString(), max);
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## :zeek:see:`Files::add_analyzer`.
|
## :zeek:see:`Files::add_analyzer`.
|
||||||
|
@ -45,7 +45,7 @@ function Files::__add_analyzer%(file_id: string, tag: Files::Tag, args: any%): b
|
||||||
auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
|
auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
|
||||||
bool result = file_mgr->AddAnalyzer(file_id->CheckString(),
|
bool result = file_mgr->AddAnalyzer(file_id->CheckString(),
|
||||||
file_mgr->GetComponentTag(tag), rv.get());
|
file_mgr->GetComponentTag(tag), rv.get());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## :zeek:see:`Files::remove_analyzer`.
|
## :zeek:see:`Files::remove_analyzer`.
|
||||||
|
@ -55,14 +55,14 @@ function Files::__remove_analyzer%(file_id: string, tag: Files::Tag, args: any%)
|
||||||
auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
|
auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
|
||||||
bool result = file_mgr->RemoveAnalyzer(file_id->CheckString(),
|
bool result = file_mgr->RemoveAnalyzer(file_id->CheckString(),
|
||||||
file_mgr->GetComponentTag(tag) , rv.get());
|
file_mgr->GetComponentTag(tag) , rv.get());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## :zeek:see:`Files::stop`.
|
## :zeek:see:`Files::stop`.
|
||||||
function Files::__stop%(file_id: string%): bool
|
function Files::__stop%(file_id: string%): bool
|
||||||
%{
|
%{
|
||||||
bool result = file_mgr->IgnoreFile(file_id->CheckString());
|
bool result = file_mgr->IgnoreFile(file_id->CheckString());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## :zeek:see:`Files::analyzer_name`.
|
## :zeek:see:`Files::analyzer_name`.
|
||||||
|
|
|
@ -2259,7 +2259,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
|
||||||
|
|
||||||
switch ( val->type ) {
|
switch ( val->type ) {
|
||||||
case TYPE_BOOL:
|
case TYPE_BOOL:
|
||||||
return val_mgr->GetBool(val->val.int_val);
|
return val_mgr->Bool(val->val.int_val)->Ref();
|
||||||
|
|
||||||
case TYPE_INT:
|
case TYPE_INT:
|
||||||
return val_mgr->GetInt(val->val.int_val);
|
return val_mgr->GetInt(val->val.int_val);
|
||||||
|
@ -2407,7 +2407,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
|
||||||
|
|
||||||
switch ( val->type ) {
|
switch ( val->type ) {
|
||||||
case TYPE_BOOL:
|
case TYPE_BOOL:
|
||||||
return val_mgr->GetBool(val->val.int_val);
|
return val_mgr->Bool(val->val.int_val)->Ref();
|
||||||
|
|
||||||
case TYPE_INT:
|
case TYPE_INT:
|
||||||
return val_mgr->GetInt(val->val.int_val);
|
return val_mgr->GetInt(val->val.int_val);
|
||||||
|
|
|
@ -19,31 +19,31 @@ type AnalysisDescription: record;
|
||||||
function Input::__create_table_stream%(description: Input::TableDescription%) : bool
|
function Input::__create_table_stream%(description: Input::TableDescription%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->CreateTableStream(description->AsRecordVal());
|
bool res = input_mgr->CreateTableStream(description->AsRecordVal());
|
||||||
return val_mgr->GetBool(res);
|
return val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__create_event_stream%(description: Input::EventDescription%) : bool
|
function Input::__create_event_stream%(description: Input::EventDescription%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->CreateEventStream(description->AsRecordVal());
|
bool res = input_mgr->CreateEventStream(description->AsRecordVal());
|
||||||
return val_mgr->GetBool(res);
|
return val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__create_analysis_stream%(description: Input::AnalysisDescription%) : bool
|
function Input::__create_analysis_stream%(description: Input::AnalysisDescription%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->CreateAnalysisStream(description->AsRecordVal());
|
bool res = input_mgr->CreateAnalysisStream(description->AsRecordVal());
|
||||||
return val_mgr->GetBool(res);
|
return val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__remove_stream%(id: string%) : bool
|
function Input::__remove_stream%(id: string%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->RemoveStream(id->AsString()->CheckString());
|
bool res = input_mgr->RemoveStream(id->AsString()->CheckString());
|
||||||
return val_mgr->GetBool(res);
|
return val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Input::__force_update%(id: string%) : bool
|
function Input::__force_update%(id: string%) : bool
|
||||||
%{
|
%{
|
||||||
bool res = input_mgr->ForceUpdate(id->AsString()->CheckString());
|
bool res = input_mgr->ForceUpdate(id->AsString()->CheckString());
|
||||||
return val_mgr->GetBool(res);
|
return val_mgr->Bool(res);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
# Options for the input framework
|
# Options for the input framework
|
||||||
|
|
|
@ -43,7 +43,7 @@ function precompile_pcap_filter%(id: PcapFilterID, s: string%): bool
|
||||||
if ( ps && ! ps->PrecompileFilter(id->ForceAsInt(), s->CheckString()) )
|
if ( ps && ! ps->PrecompileFilter(id->ForceAsInt(), s->CheckString()) )
|
||||||
success = false;
|
success = false;
|
||||||
|
|
||||||
return val_mgr->GetBool(success);
|
return val_mgr->Bool(success);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Installs a PCAP filter that has been precompiled with
|
## Installs a PCAP filter that has been precompiled with
|
||||||
|
@ -72,7 +72,7 @@ function Pcap::install_pcap_filter%(id: PcapFilterID%): bool
|
||||||
if ( ps && ! ps->SetFilter(id->ForceAsInt()) )
|
if ( ps && ! ps->SetFilter(id->ForceAsInt()) )
|
||||||
success = false;
|
success = false;
|
||||||
|
|
||||||
return val_mgr->GetBool(success);
|
return val_mgr->Bool(success);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Returns a string representation of the last PCAP error.
|
## Returns a string representation of the last PCAP error.
|
||||||
|
|
|
@ -1521,7 +1521,7 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
|
||||||
info->Assign(2, make_intrusive<StringVal>(winfo->writer->Info().path));
|
info->Assign(2, make_intrusive<StringVal>(winfo->writer->Info().path));
|
||||||
info->Assign(3, make_intrusive<Val>(open, TYPE_TIME));
|
info->Assign(3, make_intrusive<Val>(open, TYPE_TIME));
|
||||||
info->Assign(4, make_intrusive<Val>(close, TYPE_TIME));
|
info->Assign(4, make_intrusive<Val>(close, TYPE_TIME));
|
||||||
info->Assign(5, val_mgr->GetBool(terminating));
|
info->Assign(5, val_mgr->Bool(terminating));
|
||||||
|
|
||||||
Func* func = winfo->postprocessor;
|
Func* func = winfo->postprocessor;
|
||||||
if ( ! func )
|
if ( ! func )
|
||||||
|
|
|
@ -19,53 +19,53 @@ enum PrintLogType %{
|
||||||
function Log::__create_stream%(id: Log::ID, stream: Log::Stream%) : bool
|
function Log::__create_stream%(id: Log::ID, stream: Log::Stream%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->CreateStream(id->AsEnumVal(), stream->AsRecordVal());
|
bool result = log_mgr->CreateStream(id->AsEnumVal(), stream->AsRecordVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__remove_stream%(id: Log::ID%) : bool
|
function Log::__remove_stream%(id: Log::ID%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->RemoveStream(id->AsEnumVal());
|
bool result = log_mgr->RemoveStream(id->AsEnumVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__enable_stream%(id: Log::ID%) : bool
|
function Log::__enable_stream%(id: Log::ID%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->EnableStream(id->AsEnumVal());
|
bool result = log_mgr->EnableStream(id->AsEnumVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__disable_stream%(id: Log::ID%) : bool
|
function Log::__disable_stream%(id: Log::ID%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->DisableStream(id->AsEnumVal());
|
bool result = log_mgr->DisableStream(id->AsEnumVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__add_filter%(id: Log::ID, filter: Log::Filter%) : bool
|
function Log::__add_filter%(id: Log::ID, filter: Log::Filter%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->AddFilter(id->AsEnumVal(), filter->AsRecordVal());
|
bool result = log_mgr->AddFilter(id->AsEnumVal(), filter->AsRecordVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__remove_filter%(id: Log::ID, name: string%) : bool
|
function Log::__remove_filter%(id: Log::ID, name: string%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->RemoveFilter(id->AsEnumVal(), name);
|
bool result = log_mgr->RemoveFilter(id->AsEnumVal(), name);
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__write%(id: Log::ID, columns: any%) : bool
|
function Log::__write%(id: Log::ID, columns: any%) : bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->Write(id->AsEnumVal(), columns->AsRecordVal());
|
bool result = log_mgr->Write(id->AsEnumVal(), columns->AsRecordVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__set_buf%(id: Log::ID, buffered: bool%): bool
|
function Log::__set_buf%(id: Log::ID, buffered: bool%): bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->SetBuf(id->AsEnumVal(), buffered);
|
bool result = log_mgr->SetBuf(id->AsEnumVal(), buffered);
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Log::__flush%(id: Log::ID%): bool
|
function Log::__flush%(id: Log::ID%): bool
|
||||||
%{
|
%{
|
||||||
bool result = log_mgr->Flush(id->AsEnumVal());
|
bool result = log_mgr->Flush(id->AsEnumVal());
|
||||||
return val_mgr->GetBool(result);
|
return val_mgr->Bool(result);
|
||||||
%}
|
%}
|
||||||
|
|
|
@ -92,7 +92,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
|
||||||
}
|
}
|
||||||
|
|
||||||
auto rval = call_option_handlers_and_set_value(ID, i, std::move(val_from_data), location);
|
auto rval = call_option_handlers_and_set_value(ID, i, std::move(val_from_data), location);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( ! same_type(i->Type(), val->Type()) )
|
if ( ! same_type(i->Type(), val->Type()) )
|
||||||
|
@ -106,7 +106,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
|
||||||
IntrusivePtr{NewRef{}, i->Type()->AsTableType()},
|
IntrusivePtr{NewRef{}, i->Type()->AsTableType()},
|
||||||
IntrusivePtr{NewRef{}, i->ID_Val()->AsTableVal()->Attrs()});
|
IntrusivePtr{NewRef{}, i->ID_Val()->AsTableVal()->Attrs()});
|
||||||
auto rval = call_option_handlers_and_set_value(ID, i, std::move(tv), location);
|
auto rval = call_option_handlers_and_set_value(ID, i, std::move(tv), location);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
}
|
}
|
||||||
|
|
||||||
builtin_error(fmt("Incompatible type for set of ID '%s': got '%s', need '%s'",
|
builtin_error(fmt("Incompatible type for set of ID '%s': got '%s', need '%s'",
|
||||||
|
@ -115,7 +115,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
|
||||||
}
|
}
|
||||||
|
|
||||||
auto rval = call_option_handlers_and_set_value(ID, i, {NewRef{}, val}, location);
|
auto rval = call_option_handlers_and_set_value(ID, i, {NewRef{}, val}, location);
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Set a change handler for an option. The change handler will be
|
## Set a change handler for an option. The change handler will be
|
||||||
|
|
|
@ -1230,7 +1230,7 @@ bool Supervisor::SupervisedNode::InitCluster() const
|
||||||
cluster_nodes->Assign(key.get(), std::move(val));
|
cluster_nodes->Assign(key.get(), std::move(val));
|
||||||
}
|
}
|
||||||
|
|
||||||
cluster_manager_is_logger_id->SetVal({AdoptRef{}, val_mgr->GetBool(! has_logger)});
|
cluster_manager_is_logger_id->SetVal(val_mgr->Bool(! has_logger));
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -47,11 +47,11 @@ function Supervisor::__destroy%(node: string%): bool
|
||||||
if ( ! zeek::supervisor_mgr )
|
if ( ! zeek::supervisor_mgr )
|
||||||
{
|
{
|
||||||
builtin_error("supervisor mode not enabled");
|
builtin_error("supervisor mode not enabled");
|
||||||
return val_mgr->GetBool(false);
|
return val_mgr->Bool(false);
|
||||||
}
|
}
|
||||||
|
|
||||||
auto rval = zeek::supervisor_mgr->Destroy(node->CheckString());
|
auto rval = zeek::supervisor_mgr->Destroy(node->CheckString());
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Supervisor::__restart%(node: string%): bool
|
function Supervisor::__restart%(node: string%): bool
|
||||||
|
@ -59,24 +59,24 @@ function Supervisor::__restart%(node: string%): bool
|
||||||
if ( ! zeek::supervisor_mgr )
|
if ( ! zeek::supervisor_mgr )
|
||||||
{
|
{
|
||||||
builtin_error("supervisor mode not enabled");
|
builtin_error("supervisor mode not enabled");
|
||||||
return val_mgr->GetBool(false);
|
return val_mgr->Bool(false);
|
||||||
}
|
}
|
||||||
|
|
||||||
auto rval = zeek::supervisor_mgr->Restart(node->CheckString());
|
auto rval = zeek::supervisor_mgr->Restart(node->CheckString());
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Supervisor::__init_cluster%(%): bool
|
function Supervisor::__init_cluster%(%): bool
|
||||||
%{
|
%{
|
||||||
if ( zeek::Supervisor::ThisNode() )
|
if ( zeek::Supervisor::ThisNode() )
|
||||||
return val_mgr->GetBool(zeek::Supervisor::ThisNode()->InitCluster());
|
return val_mgr->Bool(zeek::Supervisor::ThisNode()->InitCluster());
|
||||||
|
|
||||||
return val_mgr->GetBool(false);
|
return val_mgr->Bool(false);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Supervisor::__is_supervised%(%): bool
|
function Supervisor::__is_supervised%(%): bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(zeek::Supervisor::ThisNode().has_value());
|
return val_mgr->Bool(zeek::Supervisor::ThisNode().has_value());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Supervisor::__node%(%): Supervisor::NodeConfig
|
function Supervisor::__node%(%): Supervisor::NodeConfig
|
||||||
|
@ -96,7 +96,7 @@ function Supervisor::__node%(%): Supervisor::NodeConfig
|
||||||
|
|
||||||
function Supervisor::__is_supervisor%(%): bool
|
function Supervisor::__is_supervisor%(%): bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(zeek::supervisor_mgr != nullptr);
|
return val_mgr->Bool(zeek::supervisor_mgr != nullptr);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
function Supervisor::__stem_pid%(%): int
|
function Supervisor::__stem_pid%(%): int
|
||||||
|
|
24
src/zeek.bif
24
src/zeek.bif
|
@ -3942,7 +3942,7 @@ static bool mmdb_try_open_asn ()
|
||||||
function mmdb_open_location_db%(f: string%) : bool
|
function mmdb_open_location_db%(f: string%) : bool
|
||||||
%{
|
%{
|
||||||
#ifdef USE_GEOIP
|
#ifdef USE_GEOIP
|
||||||
return val_mgr->GetBool(mmdb_open_loc(f->CheckString()));
|
return val_mgr->Bool(mmdb_open_loc(f->CheckString()));
|
||||||
#else
|
#else
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
#endif
|
#endif
|
||||||
|
@ -3959,7 +3959,7 @@ function mmdb_open_location_db%(f: string%) : bool
|
||||||
function mmdb_open_asn_db%(f: string%) : bool
|
function mmdb_open_asn_db%(f: string%) : bool
|
||||||
%{
|
%{
|
||||||
#ifdef USE_GEOIP
|
#ifdef USE_GEOIP
|
||||||
return val_mgr->GetBool(mmdb_open_asn(f->CheckString()));
|
return val_mgr->Bool(mmdb_open_asn(f->CheckString()));
|
||||||
#else
|
#else
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
#endif
|
#endif
|
||||||
|
@ -4276,7 +4276,7 @@ function disable_analyzer%(cid: conn_id, aid: count, err_if_no_conn: bool &defau
|
||||||
a->Parent()->PreventChildren(a->GetAnalyzerTag());
|
a->Parent()->PreventChildren(a->GetAnalyzerTag());
|
||||||
|
|
||||||
auto rval = a->Remove();
|
auto rval = a->Remove();
|
||||||
return val_mgr->GetBool(rval);
|
return val_mgr->Bool(rval);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Informs Zeek that it should skip any further processing of the contents of
|
## Informs Zeek that it should skip any further processing of the contents of
|
||||||
|
@ -4405,7 +4405,7 @@ function open_for_append%(f: string%): file
|
||||||
## rmdir unlink rename
|
## rmdir unlink rename
|
||||||
function close%(f: file%): bool
|
function close%(f: file%): bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(f->Close());
|
return val_mgr->Bool(f->Close());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Writes data to an open file.
|
## Writes data to an open file.
|
||||||
|
@ -4424,7 +4424,7 @@ function write_file%(f: file, data: string%): bool
|
||||||
if ( ! f )
|
if ( ! f )
|
||||||
return val_mgr->False();
|
return val_mgr->False();
|
||||||
|
|
||||||
return val_mgr->GetBool(f->Write((const char*) data->Bytes(), data->Len()));
|
return val_mgr->Bool(f->Write((const char*) data->Bytes(), data->Len()));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Alters the buffering behavior of a file.
|
## Alters the buffering behavior of a file.
|
||||||
|
@ -4454,7 +4454,7 @@ function set_buf%(f: file, buffered: bool%): any
|
||||||
## rmdir unlink rename
|
## rmdir unlink rename
|
||||||
function flush_all%(%): bool
|
function flush_all%(%): bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(fflush(0) == 0);
|
return val_mgr->Bool(fflush(0) == 0);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Creates a new directory.
|
## Creates a new directory.
|
||||||
|
@ -4572,7 +4572,7 @@ function rename%(src_f: string, dst_f: string%): bool
|
||||||
## .. todo:: Rename to ``is_open``.
|
## .. todo:: Rename to ``is_open``.
|
||||||
function active_file%(f: file%): bool
|
function active_file%(f: file%): bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(f->IsOpen());
|
return val_mgr->Bool(f->IsOpen());
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Gets the filename associated with a file handle.
|
## Gets the filename associated with a file handle.
|
||||||
|
@ -4796,7 +4796,7 @@ function install_src_net_filter%(snet: subnet, tcp_flags: count, prob: double%)
|
||||||
## Pcap::error
|
## Pcap::error
|
||||||
function uninstall_src_addr_filter%(ip: addr%) : bool
|
function uninstall_src_addr_filter%(ip: addr%) : bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveSrc(ip->AsAddr()));
|
return val_mgr->Bool(sessions->GetPacketFilter()->RemoveSrc(ip->AsAddr()));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Removes a source subnet filter.
|
## Removes a source subnet filter.
|
||||||
|
@ -4817,7 +4817,7 @@ function uninstall_src_addr_filter%(ip: addr%) : bool
|
||||||
## Pcap::error
|
## Pcap::error
|
||||||
function uninstall_src_net_filter%(snet: subnet%) : bool
|
function uninstall_src_net_filter%(snet: subnet%) : bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveSrc(snet));
|
return val_mgr->Bool(sessions->GetPacketFilter()->RemoveSrc(snet));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Installs a filter to drop packets destined to a given IP address with
|
## Installs a filter to drop packets destined to a given IP address with
|
||||||
|
@ -4901,7 +4901,7 @@ function install_dst_net_filter%(snet: subnet, tcp_flags: count, prob: double%)
|
||||||
## Pcap::error
|
## Pcap::error
|
||||||
function uninstall_dst_addr_filter%(ip: addr%) : bool
|
function uninstall_dst_addr_filter%(ip: addr%) : bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveDst(ip->AsAddr()));
|
return val_mgr->Bool(sessions->GetPacketFilter()->RemoveDst(ip->AsAddr()));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Removes a destination subnet filter.
|
## Removes a destination subnet filter.
|
||||||
|
@ -4922,7 +4922,7 @@ function uninstall_dst_addr_filter%(ip: addr%) : bool
|
||||||
## Pcap::error
|
## Pcap::error
|
||||||
function uninstall_dst_net_filter%(snet: subnet%) : bool
|
function uninstall_dst_net_filter%(snet: subnet%) : bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(sessions->GetPacketFilter()->RemoveDst(snet));
|
return val_mgr->Bool(sessions->GetPacketFilter()->RemoveDst(snet));
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Checks whether the last raised event came from a remote peer.
|
## Checks whether the last raised event came from a remote peer.
|
||||||
|
@ -4930,7 +4930,7 @@ function uninstall_dst_net_filter%(snet: subnet%) : bool
|
||||||
## Returns: True if the last raised event came from a remote peer.
|
## Returns: True if the last raised event came from a remote peer.
|
||||||
function is_remote_event%(%) : bool
|
function is_remote_event%(%) : bool
|
||||||
%{
|
%{
|
||||||
return val_mgr->GetBool(mgr.CurrentSource() != SOURCE_LOCAL);
|
return val_mgr->Bool(mgr.CurrentSource() != SOURCE_LOCAL);
|
||||||
%}
|
%}
|
||||||
|
|
||||||
## Stops Zeek's packet processing. This function is used to synchronize
|
## Stops Zeek's packet processing. This function is used to synchronize
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue