Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Rename NetSessions to SessionManager

Browse source 
This also includes:
- Deprecating the NetSessions name.
- Renaming the zeek::sessions global to zeek::session_mgr and deprecating the old name.
- Renaming Sessions.{h,cc} to SessionManager.{h,cc}.
This commit is contained in:
Tim Wojtulewicz 2021-04-08 18:11:14 -07:00
parent f7e3556a67
commit db1d753b35
42 changed files with 148 additions and 155 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/CMakeLists.txt
View file

@ -287,7 +287,7 @@ set(MAIN_SRCS
ScriptCoverageManager.cc
SerializationFormat.cc
Session.cc
Sessions.cc
SessionManager.cc
SmithWaterman.cc
Stats.cc
Stmt.cc

7
src/Conn.cc
View file

@ -10,7 +10,7 @@
#include "zeek/RunState.h"
#include "zeek/NetVar.h"
#include "zeek/Event.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Reporter.h"
#include "zeek/Timer.h"
#include "zeek/iosource/IOSource.h"
@ -25,12 +25,11 @@ namespace zeek {
uint64_t Connection::total_connections = 0;
uint64_t Connection::current_connections = 0;
Connection::Connection(NetSessions* s, const detail::ConnIDKey& k, double t,
Connection::Connection(const detail::ConnIDKey& k, double t,
const ConnID* id, uint32_t flow, const Packet* pkt)
: Session(t, connection_timeout, connection_status_update,
detail::connection_status_update_interval)
{
sessions = s;
key = k;
key_valid = true;
@ -137,7 +136,7 @@ void Connection::Done()
analyzer::tcp::TCP_Endpoint* to = ta->Orig();
analyzer::tcp::TCP_Endpoint* tr = ta->Resp();
sessions->tcp_stats.StateLeft(to->state, tr->state);
session_mgr->tcp_stats.StateLeft(to->state, tr->state);
}
finished = 1;

6
src/Conn.h
View file

@ -25,7 +25,7 @@
namespace zeek {
class Connection;
class NetSessions;
class SessionManager;
class EncapsulationStack;
class Val;
class RecordVal;
@ -73,7 +73,7 @@ static inline int addr_port_canon_lt(const IPAddr& addr1, uint32_t p1,
class Connection final : public Session {
public:
Connection(NetSessions* s, const detail::ConnIDKey& k, double t, const ConnID* id,
Connection(const detail::ConnIDKey& k, double t, const ConnID* id,
uint32_t flow, const Packet* pkt);
~Connection() override;
@ -247,8 +247,6 @@ protected:
// Allow other classes to access pointers to these:
friend class detail::SessionTimer;
NetSessions* sessions;
IPAddr orig_addr;
IPAddr resp_addr;
uint32_t orig_port, resp_port; // in network order

6
src/Frag.cc
View file

@ -6,7 +6,7 @@
#include "zeek/Hash.h"
#include "zeek/IP.h"
#include "zeek/NetVar.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Reporter.h"
#include "zeek/RunState.h"
@ -29,7 +29,7 @@ void FragTimer::Dispatch(double t, bool /* is_expire */)
reporter->InternalWarning("fragment timer dispatched w/o reassembler");
}
FragReassembler::FragReassembler(NetSessions* arg_s,
FragReassembler::FragReassembler(SessionManager* arg_s,
const std::unique_ptr<IP_Hdr>& ip, const u_char* pkt,
const FragReassemblerKey& k, double t)
: Reassembler(0, REASSEM_FRAG)
@ -355,7 +355,7 @@ FragReassembler* FragmentManager::NextFragment(double t, const std::unique_ptr<I
if ( ! f )
{
f = new FragReassembler(sessions, ip, pkt, key, t);
f = new FragReassembler(session_mgr, ip, pkt, key, t);
fragments[key] = f;
if ( fragments.size() > max_fragments )
max_fragments = fragments.size();

6
src/Frag.h
View file

@ -12,7 +12,7 @@
namespace zeek {
class NetSessions;
class SessionManager;
class IP_Hdr;
namespace detail {
@ -24,7 +24,7 @@ using FragReassemblerKey = std::tuple<IPAddr, IPAddr, bro_uint_t>;
class FragReassembler : public Reassembler {
public:
FragReassembler(NetSessions* s, const std::unique_ptr<IP_Hdr>& ip, const u_char* pkt,
FragReassembler(SessionManager* s, const std::unique_ptr<IP_Hdr>& ip, const u_char* pkt,
const FragReassemblerKey& k, double t);
~FragReassembler() override;
@ -44,7 +44,7 @@ protected:
u_char* proto_hdr;
std::unique_ptr<IP_Hdr> reassembled_pkt;
NetSessions* s;
SessionManager* s;
uint64_t frag_size; // size of fully reassembled fragment
FragReassemblerKey key;
uint16_t next_proto; // first IPv6 fragment header's next proto field

2
src/Func.cc
View file

@ -45,7 +45,7 @@
#include "zeek/Frame.h"
#include "zeek/Var.h"
#include "zeek/analyzer/protocol/login/Login.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/RE.h"
#include "zeek/Event.h"
#include "zeek/Traverse.h"

14
src/RunState.cc
View file

@ -24,7 +24,7 @@ extern "C" {
};
#include "zeek/NetVar.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Event.h"
#include "zeek/Timer.h"
#include "zeek/ID.h"
@ -195,7 +195,7 @@ void init_run(const std::optional<std::string>& interface,
zeek::detail::init_ip_addr_anonymizers();
sessions = new NetSessions();
session_mgr = new SessionManager();
// Initialize the stepping stone manager. We intentionally throw away the result here.
SteppingStoneManager::Get();
@ -390,13 +390,13 @@ void finish_run(int drain_events)
if ( drain_events )
{
if ( sessions )
sessions->Drain();
if ( session_mgr )
session_mgr->Drain();
event_mgr.Drain();
if ( sessions )
sessions->Done();
if ( session_mgr )
session_mgr->Done();
}
#ifdef DEBUG
@ -413,7 +413,7 @@ void delete_run()
{
util::detail::set_processing_status("TERMINATING", "delete_run");
delete sessions;
delete session_mgr;
delete SteppingStoneManager::Get();
for ( int i = 0; i < zeek::detail::NUM_ADDR_ANONYMIZATION_METHODS; ++i )

8
src/Session.cc
View file

@ -7,7 +7,7 @@
#include "zeek/Val.h"
#include "zeek/Event.h"
#include "zeek/Desc.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/IP.h"
namespace zeek {
@ -217,7 +217,7 @@ void Session::DeleteTimer(double /* t */)
if ( is_active )
Event(session_timeout_event, nullptr);
sessions->Remove(this);
session_mgr->Remove(this);
}
void Session::AddTimer(timer_func timer, double t, bool do_expire,
@ -247,7 +247,7 @@ void Session::InactivityTimer(double t)
if ( last_time + inactivity_timeout <= t )
{
Event(session_timeout_event, nullptr);
sessions->Remove(this);
session_mgr->Remove(this);
++detail::killed_by_inactivity;
}
else
@ -267,7 +267,7 @@ void Session::StatusUpdateTimer(double t)
void Session::RemoveConnectionTimer(double t)
{
RemovalEvent();
sessions->Remove(this);
session_mgr->Remove(this);
}
} // namespace zeek

57
src/Sessions.cc → src/SessionManager.cc
View file

@ -1,7 +1,7 @@
// See the file "COPYING" in the main distribution directory for copyright.
#include "zeek/zeek-config.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include <netinet/in.h>
#include <arpa/inet.h>
@ -31,27 +31,28 @@
#include "zeek/analyzer/protocol/stepping-stone/events.bif.h"
zeek::NetSessions* zeek::sessions;
zeek::SessionManager* zeek::session_mgr = nullptr;
zeek::SessionManager*& zeek::sessions = zeek::session_mgr;
namespace zeek {
NetSessions::NetSessions()
SessionManager::SessionManager()
: stats(telemetry_mgr->GaugeFamily("zeek", "session_stats",
{"tcp", "udp", "icmp"},
"Zeek Session Stats", "1", false))
{
}
NetSessions::~NetSessions()
SessionManager::~SessionManager()
{
Clear();
}
void NetSessions::Done()
void SessionManager::Done()
{
}
void NetSessions::ProcessTransportLayer(double t, const Packet* pkt, size_t remaining)
void SessionManager::ProcessTransportLayer(double t, const Packet* pkt, size_t remaining)
{
const std::unique_ptr<IP_Hdr>& ip_hdr = pkt->ip_hdr;
@ -60,7 +61,7 @@ void NetSessions::ProcessTransportLayer(double t, const Packet* pkt, size_t rema
if ( len < ip_hdr_len )
{
sessions->Weird("bogus_IP_header_lengths", pkt);
session_mgr->Weird("bogus_IP_header_lengths", pkt);
return;
}
@ -208,7 +209,7 @@ void NetSessions::ProcessTransportLayer(double t, const Packet* pkt, size_t rema
}
}
int NetSessions::ParseIPPacket(int caplen, const u_char* const pkt, int proto,
int SessionManager::ParseIPPacket(int caplen, const u_char* const pkt, int proto,
IP_Hdr*& inner)
{
if ( proto == IPPROTO_IPV6 )
@ -245,7 +246,7 @@ int NetSessions::ParseIPPacket(int caplen, const u_char* const pkt, int proto,
return 0;
}
bool NetSessions::CheckHeaderTrunc(int proto, uint32_t len, uint32_t caplen,
bool SessionManager::CheckHeaderTrunc(int proto, uint32_t len, uint32_t caplen,
const Packet* p)
{
uint32_t min_hdr_len = 0;
@ -279,7 +280,7 @@ bool NetSessions::CheckHeaderTrunc(int proto, uint32_t len, uint32_t caplen,
return false;
}
Connection* NetSessions::FindConnection(Val* v)
Connection* SessionManager::FindConnection(Val* v)
{
const auto& vt = v->GetType();
if ( ! IsRecord(vt->Tag()) )
@ -342,7 +343,7 @@ Connection* NetSessions::FindConnection(Val* v)
return conn;
}
void NetSessions::Remove(Session* s)
void SessionManager::Remove(Session* s)
{
Connection* c = static_cast<Connection*>(s);
@ -378,7 +379,7 @@ void NetSessions::Remove(Session* s)
}
}
void NetSessions::Insert(Session* s)
void SessionManager::Insert(Session* s)
{
assert(s->IsKeyValid());
@ -402,7 +403,7 @@ void NetSessions::Insert(Session* s)
}
}
void NetSessions::Drain()
void SessionManager::Drain()
{
for ( const auto& entry : session_map )
{
@ -412,7 +413,7 @@ void NetSessions::Drain()
}
}
void NetSessions::Clear()
void SessionManager::Clear()
{
for ( const auto& entry : session_map )
Unref(entry.second);
@ -422,7 +423,7 @@ void NetSessions::Clear()
detail::fragment_mgr->Clear();
}
void NetSessions::GetStats(SessionStats& s)
void SessionManager::GetStats(SessionStats& s)
{
s.max_TCP_conns = stats.GetOrAdd({{"tcp", "max_conns"}}).Value();
s.num_TCP_conns = stats.GetOrAdd({{"tcp", "num_conns"}}).Value();
@ -441,9 +442,9 @@ void NetSessions::GetStats(SessionStats& s)
s.num_packets = packet_mgr->PacketsProcessed();
}
Connection* NetSessions::NewConn(const detail::ConnIDKey& k, double t, const ConnID* id,
const u_char* data, int proto, uint32_t flow_label,
const Packet* pkt)
Connection* SessionManager::NewConn(const detail::ConnIDKey& k, double t, const ConnID* id,
const u_char* data, int proto, uint32_t flow_label,
const Packet* pkt)
{
// FIXME: This should be cleaned up a bit, it's too protocol-specific.
// But I'm not yet sure what the right abstraction for these things is.
@ -482,7 +483,7 @@ Connection* NetSessions::NewConn(const detail::ConnIDKey& k, double t, const Con
if ( ! WantConnection(src_h, dst_h, tproto, flags, flip) )
return nullptr;
Connection* conn = new Connection(this, k, t, id, flow_label, pkt);
Connection* conn = new Connection(k, t, id, flow_label, pkt);
conn->SetTransport(tproto);
if ( flip )
@ -501,7 +502,7 @@ Connection* NetSessions::NewConn(const detail::ConnIDKey& k, double t, const Con
return conn;
}
bool NetSessions::IsLikelyServerPort(uint32_t port, TransportProto proto) const
bool SessionManager::IsLikelyServerPort(uint32_t port, TransportProto proto) const
{
// We keep a cached in-core version of the table to speed up the lookup.
static std::set<bro_uint_t> port_cache;
@ -528,7 +529,7 @@ bool NetSessions::IsLikelyServerPort(uint32_t port, TransportProto proto) const
return port_cache.find(port) != port_cache.end();
}
bool NetSessions::WantConnection(uint16_t src_port, uint16_t dst_port,
bool SessionManager::WantConnection(uint16_t src_port, uint16_t dst_port,
TransportProto transport_proto,
uint8_t tcp_flags, bool& flip_roles)
{
@ -575,7 +576,7 @@ bool NetSessions::WantConnection(uint16_t src_port, uint16_t dst_port,
return true;
}
void NetSessions::Weird(const char* name, const Packet* pkt, const char* addl, const char* source)
void SessionManager::Weird(const char* name, const Packet* pkt, const char* addl, const char* source)
{
const char* weird_name = name;
@ -596,12 +597,12 @@ void NetSessions::Weird(const char* name, const Packet* pkt, const char* addl, c
reporter->Weird(weird_name, addl, source);
}
void NetSessions::Weird(const char* name, const IP_Hdr* ip, const char* addl)
void SessionManager::Weird(const char* name, const IP_Hdr* ip, const char* addl)
{
reporter->Weird(ip->SrcAddr(), ip->DstAddr(), name, addl);
}
unsigned int NetSessions::ConnectionMemoryUsage()
unsigned int SessionManager::ConnectionMemoryUsage()
{
unsigned int mem = 0;
@ -615,7 +616,7 @@ unsigned int NetSessions::ConnectionMemoryUsage()
return mem;
}
unsigned int NetSessions::ConnectionMemoryUsageConnVals()
unsigned int SessionManager::ConnectionMemoryUsageConnVals()
{
unsigned int mem = 0;
@ -629,7 +630,7 @@ unsigned int NetSessions::ConnectionMemoryUsageConnVals()
return mem;
}
unsigned int NetSessions::MemoryAllocation()
unsigned int SessionManager::MemoryAllocation()
{
if ( run_state::terminating )
// Connections have been flushed already.
@ -643,7 +644,7 @@ unsigned int NetSessions::MemoryAllocation()
;
}
void NetSessions::InsertSession(detail::SessionKey key, Session* session)
void SessionManager::InsertSession(detail::SessionKey key, Session* session)
{
key.CopyData();
session_map.insert_or_assign(std::move(key), session);
@ -676,7 +677,7 @@ void NetSessions::InsertSession(detail::SessionKey key, Session* session)
}
}
detail::PacketFilter* NetSessions::GetPacketFilter(bool init)
detail::PacketFilter* SessionManager::GetPacketFilter(bool init)
{
return packet_mgr->GetPacketFilter(init);
}

13
src/Sessions.h → src/SessionManager.h
View file

@ -40,10 +40,10 @@ struct SessionStats {
uint64_t num_packets;
};
class NetSessions final {
class SessionManager final {
public:
NetSessions();
~NetSessions();
SessionManager();
~SessionManager();
void Done(); // call to drain events before destructing
@ -130,7 +130,7 @@ public:
// TODO: should this move somewhere else?
analyzer::tcp::TCPStateStats tcp_stats; // keeps statistics on TCP states
protected:
private:
using SessionMap = std::map<detail::SessionKey, Session*>;
@ -172,6 +172,9 @@ protected:
};
// Manager for the currently active sessions.
extern NetSessions* sessions;
extern SessionManager* session_mgr;
extern SessionManager*& sessions [[deprecated("Remove in v5.1. Use zeek::session_mgr.")]];
using NetSessions [[deprecated("Remove in v5.1. Use zeek::SessionManager.")]] = SessionManager;
} // namespace zeek

36
src/Stats.cc
View file

@ -7,7 +7,7 @@
#include "zeek/RunState.h"
#include "zeek/NetVar.h"
#include "zeek/ID.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Scope.h"
#include "zeek/DNS_Mgr.h"
#include "zeek/Trigger.h"
@ -126,25 +126,25 @@ void ProfileLogger::Log()
run_state::network_time, (utime + stime) - (first_utime + first_stime),
utime - first_utime, stime - first_stime, rtime - first_rtime));
int conn_mem_use = expensive ? sessions->ConnectionMemoryUsage() : 0;
int conn_mem_use = expensive ? session_mgr->ConnectionMemoryUsage() : 0;
double avg_conn_mem_use = 0;
if ( expensive && sessions->CurrentConnections() != 0 )
avg_conn_mem_use = conn_mem_use / static_cast<double>(sessions->CurrentConnections());
if ( expensive && session_mgr->CurrentConnections() != 0 )
avg_conn_mem_use = conn_mem_use / static_cast<double>(session_mgr->CurrentConnections());
file->Write(util::fmt("%.06f Conns: total=%" PRIu64 " current=%" PRIu64 "/%" PRIi32 " mem=%" PRIi32 "K avg=%.1f table=%" PRIu32 "K connvals=%" PRIu32 "K\n",
run_state::network_time,
Connection::TotalConnections(),
Connection::CurrentConnections(),
sessions->CurrentConnections(),
session_mgr->CurrentConnections(),
conn_mem_use,
avg_conn_mem_use,
expensive ? sessions->MemoryAllocation() / 1024 : 0,
expensive ? sessions->ConnectionMemoryUsageConnVals() / 1024 : 0
expensive ? session_mgr->MemoryAllocation() / 1024 : 0,
expensive ? session_mgr->ConnectionMemoryUsageConnVals() / 1024 : 0
));
SessionStats s;
sessions->GetStats(s);
session_mgr->GetStats(s);
file->Write(util::fmt("%.06f Conns: tcp=%zu/%zu udp=%zu/%zu icmp=%zu/%zu\n",
run_state::network_time,
@ -153,22 +153,22 @@ void ProfileLogger::Log()
s.num_ICMP_conns, s.max_ICMP_conns
));
sessions->tcp_stats.PrintStats(file,
session_mgr->tcp_stats.PrintStats(file,
util::fmt("%.06f TCP-States:", run_state::network_time));
// Alternatively, if you prefer more compact output...
/*
file->Write(util::fmt("%.8f TCP-States: I=%d S=%d SA=%d SR=%d E=%d EF=%d ER=%d F=%d P=%d\n",
run_state::network_time,
sessions->tcp_stats.StateInactive(),
sessions->tcp_stats.StateRequest(),
sessions->tcp_stats.StateSuccRequest(),
sessions->tcp_stats.StateRstRequest(),
sessions->tcp_stats.StateEstablished(),
sessions->tcp_stats.StateHalfClose(),
sessions->tcp_stats.StateHalfRst(),
sessions->tcp_stats.StateClosed(),
sessions->tcp_stats.StatePartial()
session_mgr->tcp_stats.StateInactive(),
session_mgr->tcp_stats.StateRequest(),
session_mgr->tcp_stats.StateSuccRequest(),
session_mgr->tcp_stats.StateRstRequest(),
session_mgr->tcp_stats.StateEstablished(),
session_mgr->tcp_stats.StateHalfClose(),
session_mgr->tcp_stats.StateHalfRst(),
session_mgr->tcp_stats.StateClosed(),
session_mgr->tcp_stats.StatePartial()
));
*/

3
src/analyzer/protocol/ayiya/AYIYA.cc
View file

@ -2,6 +2,7 @@
#include "zeek/analyzer/protocol/ayiya/AYIYA.h"
#include "zeek/SessionManager.h"
#include "zeek/Func.h"
#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
@ -46,7 +47,7 @@ void AYIYA_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint6
inner_packet_offset = -1;
IP_Hdr* inner = nullptr;
int result = sessions->ParseIPPacket(len, data, next_header, inner);
int result = session_mgr->ParseIPPacket(len, data, next_header, inner);
if ( result == 0 )
{

1
src/analyzer/protocol/ayiya/ayiya-analyzer.pac
View file

@ -1,5 +1,4 @@
%extern{
#include "zeek/Sessions.h"
#include "zeek/Conn.h"
#include "zeek/analyzer/protocol/ayiya/AYIYA.h"
%}

4
src/analyzer/protocol/conn-size/functions.bif
View file

@ -1,11 +1,11 @@
%%{
#include "zeek/analyzer/protocol/conn-size/ConnSize.h"
#include "zeek/Reporter.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
static zeek::analyzer::Analyzer* GetConnsizeAnalyzer(zeek::Val* cid)
{
zeek::Connection* c = zeek::sessions->FindConnection(cid);
zeek::Connection* c = zeek::session_mgr->FindConnection(cid);
if ( ! c )
return nullptr;

8
src/analyzer/protocol/dns/DNS.cc
View file

@ -11,7 +11,7 @@
#include "zeek/ZeekString.h"
#include "zeek/NetVar.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Event.h"
#include "zeek/RunState.h"
@ -346,7 +346,7 @@ bool DNS_Interpreter::ParseAnswer(detail::DNS_MsgInfo* msg,
case detail::TYPE_DS:
status = ParseRR_DS(msg, data, len, rdlength, msg_start);
break;
case detail::TYPE_BINDS:
status = ParseRR_BINDS(msg, data, len, rdlength, msg_start);
break;
@ -354,7 +354,7 @@ bool DNS_Interpreter::ParseAnswer(detail::DNS_MsgInfo* msg,
case detail::TYPE_SSHFP:
status = ParseRR_SSHFP(msg, data, len, rdlength, msg_start);
break;
case detail::TYPE_LOC:
status = ParseRR_LOC(msg, data, len, rdlength, msg_start);
break;
@ -2261,7 +2261,7 @@ void DNS_Analyzer::ExpireTimer(double t)
if ( t - Conn()->LastTime() >= zeek::detail::dns_session_timeout - 1.0 || run_state::terminating )
{
Event(connection_timeout);
sessions->Remove(Conn());
session_mgr->Remove(Conn());
}
else
ADD_ANALYZER_TIMER(&DNS_Analyzer::ExpireTimer,

3
src/analyzer/protocol/gtpv1/GTPv1.cc
View file

@ -3,6 +3,7 @@
#include "zeek/analyzer/protocol/gtpv1/GTPv1.h"
#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
#include "zeek/SessionManager.h"
#include "zeek/analyzer/protocol/gtpv1/events.bif.h"
namespace zeek::analyzer::gtpv1 {
@ -47,7 +48,7 @@ void GTPv1_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint6
inner_packet_offset = -1;
IP_Hdr* inner = nullptr;
int result = sessions->ParseIPPacket(len, data, next_header, inner);
int result = session_mgr->ParseIPPacket(len, data, next_header, inner);
if ( result == 0 )
{

1
src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
View file

@ -1,5 +1,4 @@
%extern{
#include "zeek/Sessions.h"
#include "zeek/ZeekString.h"
#include "zeek/analyzer/protocol/gtpv1/GTPv1.h"
%}

6
src/analyzer/protocol/login/functions.bif
View file

@ -2,7 +2,7 @@
%%{
#include "zeek/analyzer/protocol/login/Login.h"
#include "zeek/Reporter.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
%%}
## Returns the state of the given login (Telnet or Rlogin) connection.
@ -26,7 +26,7 @@
## .. zeek:see:: set_login_state
function get_login_state%(cid: conn_id%): count
%{
zeek::Connection* c = sessions->FindConnection(cid);
zeek::Connection* c = session_mgr->FindConnection(cid);
if ( ! c )
return zeek::val_mgr->False();
@ -50,7 +50,7 @@ function get_login_state%(cid: conn_id%): count
## .. zeek:see:: get_login_state
function set_login_state%(cid: conn_id, new_state: count%): bool
%{
zeek::Connection* c = sessions->FindConnection(cid);
zeek::Connection* c = session_mgr->FindConnection(cid);
if ( ! c )
return zeek::val_mgr->False();

2
src/analyzer/protocol/ncp/NCP.cc
View file

@ -7,8 +7,6 @@
#include <string>
#include <map>
#include "zeek/Sessions.h"
#include "zeek/analyzer/protocol/ncp/events.bif.h"
#include "zeek/analyzer/protocol/ncp/consts.bif.h"

4
src/analyzer/protocol/netbios/NetbiosSSN.cc
View file

@ -7,7 +7,7 @@
#include "zeek/ZeekString.h"
#include "zeek/NetVar.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Event.h"
#include "zeek/RunState.h"
@ -531,7 +531,7 @@ void NetbiosSSN_Analyzer::ExpireTimer(double t)
netbios_ssn_session_timeout - 1.0 )
{
Event(connection_timeout);
sessions->Remove(Conn());
session_mgr->Remove(Conn());
}
else
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer,

4
src/analyzer/protocol/rpc/RPC.cc
View file

@ -9,7 +9,7 @@
#include "zeek/NetVar.h"
#include "zeek/analyzer/protocol/rpc/XDR.h"
#include "zeek/Reporter.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/RunState.h"
#include "zeek/analyzer/protocol/rpc/events.bif.h"
@ -766,7 +766,7 @@ void RPC_Analyzer::Done()
void RPC_Analyzer::ExpireTimer(double /* t */)
{
Event(connection_timeout);
sessions->Remove(Conn());
session_mgr->Remove(Conn());
}
} // namespace zeek::analyzer::rpc

1
src/analyzer/protocol/stepping-stone/SteppingStone.cc
View file

@ -9,7 +9,6 @@
#include "zeek/RunState.h"
#include "zeek/NetVar.h"
#include "zeek/analyzer/protocol/tcp/TCP.h"
#include "zeek/Sessions.h"
#include "zeek/util.h"
#include "zeek/analyzer/protocol/stepping-stone/events.bif.h"

2
src/analyzer/protocol/stepping-stone/SteppingStone.h
View file

@ -8,8 +8,6 @@
namespace zeek {
class NetSessions;
namespace analyzer::stepping_stone {
class SteppingStoneEndpoint;

2
src/analyzer/protocol/syslog/Syslog.cc
View file

@ -41,7 +41,7 @@ void Syslog_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint
// if ( t - Conn()->LastTime() >= Syslog_session_timeout - 1.0 || terminating )
// {
// Event(connection_timeout);
// sessions->Remove(Conn());
// session_mgr->Remove(Conn());
// }
// else
// ADD_ANALYZER_TIMER(&Syslog_Analyzer::ExpireTimer,

18
src/analyzer/protocol/tcp/TCP.cc
View file

@ -13,7 +13,7 @@
#include "zeek/File.h"
#include "zeek/Event.h"
#include "zeek/Reporter.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/DebugLogger.h"
#include "zeek/analyzer/protocol/tcp/events.bif.h"
@ -1272,7 +1272,7 @@ void TCP_Analyzer::FlipRoles()
{
Analyzer::FlipRoles();
sessions->tcp_stats.FlipState(orig->state, resp->state);
session_mgr->tcp_stats.FlipState(orig->state, resp->state);
TCP_Endpoint* tmp_ep = resp;
resp = orig;
orig = tmp_ep;
@ -1480,7 +1480,7 @@ void TCP_Analyzer::AttemptTimer(double /* t */)
is_active = 0;
// All done with this connection.
sessions->Remove(Conn());
session_mgr->Remove(Conn());
}
}
@ -1500,7 +1500,7 @@ void TCP_Analyzer::PartialCloseTimer(double /* t */)
return;
Event(connection_partial_close);
sessions->Remove(Conn());
session_mgr->Remove(Conn());
}
}
@ -1530,7 +1530,7 @@ void TCP_Analyzer::ExpireTimer(double t)
// the session remove and Unref() us here.
Event(connection_timeout);
is_active = 0;
sessions->Remove(Conn());
session_mgr->Remove(Conn());
return;
}
}
@ -1545,7 +1545,7 @@ void TCP_Analyzer::ExpireTimer(double t)
// before setting up an attempt timer,
// so we need to clean it up here.
Event(connection_timeout);
sessions->Remove(Conn());
session_mgr->Remove(Conn());
return;
}
}
@ -1566,12 +1566,12 @@ void TCP_Analyzer::ResetTimer(double /* t */)
if ( ! BothClosed() )
ConnectionReset();
sessions->Remove(Conn());
session_mgr->Remove(Conn());
}
void TCP_Analyzer::DeleteTimer(double /* t */)
{
sessions->Remove(Conn());
session_mgr->Remove(Conn());
}
void TCP_Analyzer::ConnDeleteTimer(double t)
@ -1689,7 +1689,7 @@ void TCP_Analyzer::ConnectionClosed(TCP_Endpoint* endpoint, TCP_Endpoint* peer,
// Note, even if tcp_close_delay is zero, we can't
// simply do:
//
// sessions->Remove(this);
// session_mgr->Remove(this);
//
// here, because that would cause the object to be
// deleted out from under us.

12
src/analyzer/protocol/tcp/TCP_Endpoint.cc
View file

@ -9,7 +9,7 @@
#include "zeek/analyzer/protocol/tcp/TCP.h"
#include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
#include "zeek/Reporter.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Event.h"
#include "zeek/File.h"
#include "zeek/Val.h"
@ -66,7 +66,7 @@ void TCP_Endpoint::SetPeer(TCP_Endpoint* p)
peer = p;
if ( IsOrig() )
// Only one Endpoint adds the initial state to the counter.
sessions->tcp_stats.StateEntered(state, peer->state);
session_mgr->tcp_stats.StateEntered(state, peer->state);
}
bool TCP_Endpoint::HadGap() const
@ -145,11 +145,11 @@ void TCP_Endpoint::SetState(EndpointState new_state)
prev_state = state;
state = new_state;
if ( IsOrig() )
sessions->tcp_stats.ChangeState(prev_state, state,
peer->state, peer->state);
session_mgr->tcp_stats.ChangeState(prev_state, state,
peer->state, peer->state);
else
sessions->tcp_stats.ChangeState(peer->state, peer->state,
prev_state, state);
session_mgr->tcp_stats.ChangeState(peer->state, peer->state,
prev_state, state);
}
}

10
src/analyzer/protocol/tcp/functions.bif
View file

@ -1,7 +1,7 @@
%%{
#include "zeek/File.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/Reporter.h"
#include "zeek/analyzer/protocol/tcp/TCP.h"
%%}
@ -18,7 +18,7 @@
## .. zeek:see:: get_resp_seq
function get_orig_seq%(cid: conn_id%): count
%{
zeek::Connection* c = zeek::sessions->FindConnection(cid);
zeek::Connection* c = zeek::session_mgr->FindConnection(cid);
if ( ! c )
return zeek::val_mgr->Count(0);
@ -47,7 +47,7 @@ function get_orig_seq%(cid: conn_id%): count
## .. zeek:see:: get_orig_seq
function get_resp_seq%(cid: conn_id%): count
%{
zeek::Connection* c = zeek::sessions->FindConnection(cid);
zeek::Connection* c = zeek::session_mgr->FindConnection(cid);
if ( ! c )
return zeek::val_mgr->Count(0);
@ -97,7 +97,7 @@ function get_resp_seq%(cid: conn_id%): count
## .. zeek:see:: get_contents_file set_record_packets contents_file_write_failure
function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
%{
zeek::Connection* c = zeek::sessions->FindConnection(cid);
zeek::Connection* c = zeek::session_mgr->FindConnection(cid);
if ( ! c )
return zeek::val_mgr->False();
@ -120,7 +120,7 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
## .. zeek:see:: set_contents_file set_record_packets contents_file_write_failure
function get_contents_file%(cid: conn_id, direction: count%): file
%{
zeek::Connection* c = zeek::sessions->FindConnection(cid);
zeek::Connection* c = zeek::session_mgr->FindConnection(cid);
if ( c )
{

4
src/analyzer/protocol/teredo/Teredo.cc
View file

@ -4,7 +4,7 @@
#include "zeek/Conn.h"
#include "zeek/IP.h"
#include "zeek/Reporter.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/ZeekString.h"
#include "zeek/RunState.h"
#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
@ -165,7 +165,7 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
}
IP_Hdr* inner = nullptr;
int rslt = sessions->ParseIPPacket(len, te.InnerIP(), IPPROTO_IPV6, inner);
int rslt = session_mgr->ParseIPPacket(len, te.InnerIP(), IPPROTO_IPV6, inner);
if ( rslt > 0 )
{

1
src/analyzer/protocol/vxlan/VXLAN.cc
View file

@ -10,7 +10,6 @@ extern "C" {
#include "zeek/Conn.h"
#include "zeek/IP.h"
#include "zeek/RunState.h"
#include "zeek/Sessions.h"
#include "zeek/Reporter.h"
#include "zeek/packet_analysis/Manager.h"
#include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"

6
src/fuzzers/fuzzer-setup.h
View file

@ -6,7 +6,7 @@
#include "zeek/zeek-setup.h"
#include "zeek/Event.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/broker/Manager.h"
#include "zeek/file_analysis/Manager.h"
@ -55,9 +55,9 @@ void fuzzer_cleanup_one_input()
timer_mgr->Expire();
zeek::event_mgr.Drain();
sessions->Drain();
zeek::session_mgr->Drain();
zeek::event_mgr.Drain();
sessions->Clear();
zeek::session_mgr->Clear();
run_state::terminating = false;
}

6
src/fuzzers/pop3-fuzzer.cc
View file

@ -2,7 +2,7 @@
#include "zeek/RunState.h"
#include "zeek/Conn.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/analyzer/Analyzer.h"
#include "zeek/analyzer/Manager.h"
#include "zeek/analyzer/protocol/pia/PIA.h"
@ -27,10 +27,10 @@ static zeek::Connection* add_connection()
conn_id.is_one_way = false;
conn_id.proto = TRANSPORT_TCP;
zeek::detail::ConnIDKey key = zeek::detail::BuildConnIDKey(conn_id);
zeek::Connection* conn = new zeek::Connection(zeek::sessions, key, network_time_start,
zeek::Connection* conn = new zeek::Connection(key, network_time_start,
&conn_id, 1, &p);
conn->SetTransport(TRANSPORT_TCP);
zeek::sessions->Insert(conn);
zeek::session_mgr->Insert(conn);
return conn;
}

1
src/iosource/Packet.cc
View file

@ -14,7 +14,6 @@ extern "C" {
#endif
}
#include "zeek/Sessions.h"
#include "zeek/Desc.h"
#include "zeek/IP.h"
#include "zeek/iosource/Manager.h"

4
src/iosource/PktSrc.cc
View file

@ -8,7 +8,7 @@
#include "zeek/util.h"
#include "zeek/Hash.h"
#include "zeek/RunState.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/broker/Manager.h"
#include "zeek/iosource/Manager.h"
#include "zeek/packet_analysis/Manager.h"
@ -125,7 +125,7 @@ void PktSrc::Info(const std::string& msg)
void PktSrc::Weird(const std::string& msg, const Packet* p)
{
sessions->Weird(msg.c_str(), p);
session_mgr->Weird(msg.c_str(), p);
}
void PktSrc::InternalError(const std::string& msg)

4
src/packet_analysis/Analyzer.cc
View file

@ -5,7 +5,7 @@
#include "zeek/Dict.h"
#include "zeek/DebugLogger.h"
#include "zeek/RunState.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/util.h"
namespace zeek::packet_analysis {
@ -121,7 +121,7 @@ void Analyzer::RegisterProtocol(uint32_t identifier, AnalyzerPtr child)
void Analyzer::Weird(const char* name, Packet* packet, const char* addl) const
{
sessions->Weird(name, packet, addl, GetAnalyzerName());
session_mgr->Weird(name, packet, addl, GetAnalyzerName());
}
} // namespace zeek::packet_analysis

1
src/packet_analysis/Manager.cc
View file

@ -6,7 +6,6 @@
#include "zeek/packet_analysis/Dispatcher.h"
#include "zeek/zeek-bif.h"
#include "zeek/Stats.h"
#include "zeek/Sessions.h"
#include "zeek/RunState.h"
#include "zeek/iosource/PktDumper.h"

2
src/packet_analysis/protocol/gre/GRE.cc
View file

@ -4,7 +4,7 @@
#include <pcap.h> // For DLT_ constants
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/RunState.h"
#include "zeek/IP.h"
#include "zeek/Reporter.h"

4
src/packet_analysis/protocol/ip/IP.cc
View file

@ -5,7 +5,7 @@
#include "zeek/IP.h"
#include "zeek/Discard.h"
#include "zeek/PacketFilter.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/RunState.h"
#include "zeek/Frag.h"
#include "zeek/Event.h"
@ -241,7 +241,7 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
case IPPROTO_ICMPV6:
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s succeeded, next layer identifier is %#x.",
GetAnalyzerName(), proto);
sessions->ProcessTransportLayer(run_state::processing_start_time, packet, len);
session_mgr->ProcessTransportLayer(run_state::processing_start_time, packet, len);
break;
case IPPROTO_NONE:
// If the packet is encapsulated in Teredo, then it was a bubble and

4
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -4,7 +4,7 @@
#include <pcap.h> // For DLT_ constants
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "zeek/RunState.h"
#include "zeek/IP.h"
#include "zeek/TunnelEncapsulation.h"
@ -50,7 +50,7 @@ bool IPTunnelAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
if ( gre_version != 0 )
{
// Check for a valid inner packet first.
int result = sessions->ParseIPPacket(len, data, proto, inner);
int result = session_mgr->ParseIPPacket(len, data, proto, inner);
if ( result == -2 )
Weird("invalid_inner_IP_version", packet);
else if ( result < 0 )

8
src/stats.bif
View file

@ -88,14 +88,14 @@ function get_conn_stats%(%): ConnStats
r->Assign(n++, Connection::TotalConnections());
r->Assign(n++, Connection::CurrentConnections());
r->Assign(n++, sessions->CurrentConnections());
r->Assign(n++, session_mgr->CurrentConnections());
SessionStats s;
if ( sessions )
sessions->GetStats(s);
if ( session_mgr )
session_mgr->GetStats(s);
#define ADD_STAT(x) \
r->Assign(n++, static_cast<uint64_t>(sessions ? x : 0));
r->Assign(n++, static_cast<uint64_t>(session_mgr ? x : 0));
ADD_STAT(s.num_packets);
ADD_STAT(s.num_fragments);

16
src/zeek.bif
View file

@ -3052,7 +3052,7 @@ function decode_base64%(s: string, a: string &default=""%): string
## .. zeek:see:: decode_base64
function decode_base64_conn%(cid: conn_id, s: string, a: string &default=""%): string
%{
Connection* conn = sessions->FindConnection(cid);
Connection* conn = session_mgr->FindConnection(cid);
if ( ! conn )
{
zeek::emit_builtin_error("connection ID not a known connection", cid);
@ -3353,7 +3353,7 @@ static zeek::EnumValPtr map_conn_type(TransportProto tp)
## get_orig_seq get_resp_seq
function get_conn_transport_proto%(cid: conn_id%): transport_proto
%{
Connection* c = sessions->FindConnection(cid);
Connection* c = session_mgr->FindConnection(cid);
if ( ! c )
{
zeek::emit_builtin_error("unknown connection id in get_conn_transport_proto()", cid);
@ -3385,7 +3385,7 @@ function get_port_transport_proto%(p: port%): transport_proto
## .. zeek:see:: lookup_connection
function connection_exists%(c: conn_id%): bool
%{
if ( sessions->FindConnection(c) )
if ( session_mgr->FindConnection(c) )
return zeek::val_mgr->True();
else
return zeek::val_mgr->False();
@ -3402,7 +3402,7 @@ function connection_exists%(c: conn_id%): bool
## .. zeek:see:: connection_exists
function lookup_connection%(cid: conn_id%): connection
%{
Connection* conn = sessions->FindConnection(cid);
Connection* conn = session_mgr->FindConnection(cid);
if ( conn )
return conn->ConnVal();
@ -4388,7 +4388,7 @@ function file_mode%(mode: count%): string
## .. zeek:see:: Analyzer::schedule_analyzer Analyzer::name
function disable_analyzer%(cid: conn_id, aid: count, err_if_no_conn: bool &default=T, prevent: bool &default=F%) : bool
%{
Connection* c = sessions->FindConnection(cid);
Connection* c = session_mgr->FindConnection(cid);
if ( ! c )
{
zeek::reporter->Error("cannot find connection");
@ -4426,7 +4426,7 @@ function disable_analyzer%(cid: conn_id, aid: count, err_if_no_conn: bool &defau
## :zeek:id:`connection_finished`.
function skip_further_processing%(cid: conn_id%): bool
%{
Connection* c = sessions->FindConnection(cid);
Connection* c = session_mgr->FindConnection(cid);
if ( ! c )
return zeek::val_mgr->False();
@ -4456,7 +4456,7 @@ function skip_further_processing%(cid: conn_id%): bool
## .. zeek:see:: get_contents_file set_contents_file
function set_record_packets%(cid: conn_id, do_record: bool%): bool
%{
Connection* c = sessions->FindConnection(cid);
Connection* c = session_mgr->FindConnection(cid);
if ( ! c )
return zeek::val_mgr->False();
@ -4474,7 +4474,7 @@ function set_record_packets%(cid: conn_id, do_record: bool%): bool
## Returns: The previous timeout interval.
function set_inactivity_timeout%(cid: conn_id, t: interval%): interval
%{
Connection* c = sessions->FindConnection(cid);
Connection* c = session_mgr->FindConnection(cid);
if ( ! c )
return zeek::make_intrusive<zeek::IntervalVal>(0.0);

2
testing/btest/plugins/packet-protocol-plugin/src/LLCDemo.cc
View file

@ -1,7 +1,7 @@
#include "LLCDemo.h"
#include "zeek/Event.h"
#include "zeek/Val.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "events.bif.h"
using namespace zeek::packet_analysis::PacketDemo;

2
testing/btest/plugins/packet-protocol-plugin/src/RawLayer.cc
View file

@ -1,7 +1,7 @@
#include "RawLayer.h"
#include "zeek/Event.h"
#include "zeek/Val.h"
#include "zeek/Sessions.h"
#include "zeek/SessionManager.h"
#include "events.bif.h"