Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Move Session code to namespaces

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-07-22 11:15:58 -07:00
parent 4e9a5e9d98
commit e3ee1860b8
21 changed files with 89 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/Conn.cc
View file

@ -57,7 +57,7 @@ void ConnectionTimer::Dispatch(double t, bool is_expire)
uint64_t Connection::total_connections = 0; uint64_t Connection::total_connections = 0;
uint64_t Connection::current_connections = 0; uint64_t Connection::current_connections = 0;
Connection::Connection(NetSessions* s, const zeek::detail::ConnIDKey& k, double t, Connection::Connection(zeek::NetSessions* s, const zeek::detail::ConnIDKey& k, double t,
const ConnID* id, uint32_t flow, const zeek::Packet* pkt, const ConnID* id, uint32_t flow, const zeek::Packet* pkt,
const zeek::EncapsulationStack* arg_encap) const zeek::EncapsulationStack* arg_encap)
{ {

6
src/Conn.h
View file

@ -23,7 +23,7 @@
class Connection; class Connection;
class ConnectionTimer; class ConnectionTimer;
class NetSessions; ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
class LoginConn; class LoginConn;
ZEEK_FORWARD_DECLARE_NAMESPACED(EncapsulationStack, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(EncapsulationStack, zeek);
@ -65,7 +65,7 @@ static inline int addr_port_canon_lt(const zeek::IPAddr& addr1, uint32_t p1,
class Connection final : public zeek::Obj { class Connection final : public zeek::Obj {
public: public:
Connection(NetSessions* s, const zeek::detail::ConnIDKey& k, double t, const ConnID* id, Connection(zeek::NetSessions* s, const zeek::detail::ConnIDKey& k, double t, const ConnID* id,
uint32_t flow, const zeek::Packet* pkt, const zeek::EncapsulationStack* arg_encap); uint32_t flow, const zeek::Packet* pkt, const zeek::EncapsulationStack* arg_encap);
~Connection() override; ~Connection() override;
@ -343,7 +343,7 @@ protected:
void StatusUpdateTimer(double t); void StatusUpdateTimer(double t);
void RemoveConnectionTimer(double t); void RemoveConnectionTimer(double t);
NetSessions* sessions; zeek::NetSessions* sessions;
zeek::detail::ConnIDKey key; zeek::detail::ConnIDKey key;
bool key_valid; bool key_valid;

8
src/Frag.cc
View file

@ -26,9 +26,9 @@ void FragTimer::Dispatch(double t, bool /* is_expire */)
zeek::reporter->InternalWarning("fragment timer dispatched w/o reassembler"); zeek::reporter->InternalWarning("fragment timer dispatched w/o reassembler");
} }
FragReassembler::FragReassembler(NetSessions* arg_s, FragReassembler::FragReassembler(zeek::NetSessions* arg_s,
const zeek::IP_Hdr* ip, const u_char* pkt, const zeek::IP_Hdr* ip, const u_char* pkt,
const FragReassemblerKey& k, double t) const FragReassemblerKey& k, double t)
: Reassembler(0, REASSEM_FRAG) : Reassembler(0, REASSEM_FRAG)
{ {
s = arg_s; s = arg_s;
@ -320,7 +320,7 @@ void FragReassembler::Expire(double t)
expire_timer->ClearReassembler(); expire_timer->ClearReassembler();
expire_timer = nullptr; // timer manager will delete it expire_timer = nullptr; // timer manager will delete it
sessions->Remove(this); zeek::sessions->Remove(this);
} }
void FragReassembler::DeleteTimer() void FragReassembler::DeleteTimer()

6
src/Frag.h
View file

@ -11,7 +11,7 @@
#include <sys/types.h> // for u_char #include <sys/types.h> // for u_char
class NetSessions; ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
class FragReassembler; class FragReassembler;
@ -23,7 +23,7 @@ using FragReassemblerKey = std::tuple<zeek::IPAddr, zeek::IPAddr, bro_uint_t>;
class FragReassembler : public Reassembler { class FragReassembler : public Reassembler {
public: public:
FragReassembler(NetSessions* s, const zeek::IP_Hdr* ip, const u_char* pkt, FragReassembler(zeek::NetSessions* s, const zeek::IP_Hdr* ip, const u_char* pkt,
const FragReassemblerKey& k, double t); const FragReassemblerKey& k, double t);
~FragReassembler() override; ~FragReassembler() override;
@ -43,7 +43,7 @@ protected:
u_char* proto_hdr; u_char* proto_hdr;
zeek::IP_Hdr* reassembled_pkt; zeek::IP_Hdr* reassembled_pkt;
NetSessions* s; zeek::NetSessions* s;
uint64_t frag_size; // size of fully reassembled fragment uint64_t frag_size; // size of fully reassembled fragment
FragReassemblerKey key; FragReassemblerKey key;
uint16_t next_proto; // first IPv6 fragment header's next proto field uint16_t next_proto; // first IPv6 fragment header's next proto field

14
src/Net.cc
View file

@ -200,7 +200,7 @@ void net_init(const std::optional<std::string>& interface,
zeek::detail::init_ip_addr_anonymizers(); zeek::detail::init_ip_addr_anonymizers();
sessions = new NetSessions(); zeek::sessions = new zeek::NetSessions();
if ( do_watchdog ) if ( do_watchdog )
{ {
@ -258,7 +258,7 @@ void net_packet_dispatch(double t, const zeek::Packet* pkt, iosource::PktSrc* sr
} }
} }
sessions->NextPacket(t, pkt); zeek::sessions->NextPacket(t, pkt);
zeek::event_mgr.Drain(); zeek::event_mgr.Drain();
if ( sp ) if ( sp )
@ -383,13 +383,13 @@ void net_finish(int drain_events)
if ( drain_events ) if ( drain_events )
{ {
if ( sessions ) if ( zeek::sessions )
sessions->Drain(); zeek::sessions->Drain();
zeek::event_mgr.Drain(); zeek::event_mgr.Drain();
if ( sessions ) if ( zeek::sessions )
sessions->Done(); zeek::sessions->Done();
} }
#ifdef DEBUG #ifdef DEBUG
@ -406,7 +406,7 @@ void net_delete()
{ {
set_processing_status("TERMINATING", "net_delete"); set_processing_status("TERMINATING", "net_delete");
delete sessions; delete zeek::sessions;
for ( int i = 0; i < zeek::detail::NUM_ADDR_ANONYMIZATION_METHODS; ++i ) for ( int i = 0; i < zeek::detail::NUM_ADDR_ANONYMIZATION_METHODS; ++i )
delete zeek::detail::ip_anonymizer[i]; delete zeek::detail::ip_anonymizer[i];

28
src/Sessions.cc
View file

@ -41,7 +41,11 @@ enum NetBIOS_Service {
NETBIOS_SERVICE_DCE_RPC, NETBIOS_SERVICE_DCE_RPC,
}; };
NetSessions* sessions; zeek::NetSessions* zeek::sessions;
zeek::NetSessions*& sessions = zeek::sessions;
namespace zeek {
namespace detail {
void IPTunnelTimer::Dispatch(double t, bool is_expire) void IPTunnelTimer::Dispatch(double t, bool is_expire)
{ {
@ -63,10 +67,12 @@ void IPTunnelTimer::Dispatch(double t, bool is_expire)
zeek::detail::timer_mgr->Add(new IPTunnelTimer(t, tunnel_idx)); zeek::detail::timer_mgr->Add(new IPTunnelTimer(t, tunnel_idx));
} }
} // namespace detail
NetSessions::NetSessions() NetSessions::NetSessions()
{ {
if ( stp_correlate_pair ) if ( stp_correlate_pair )
stp_manager = new analyzer::stepping_stone::SteppingStoneManager(); stp_manager = new ::analyzer::stepping_stone::SteppingStoneManager();
else else
stp_manager = nullptr; stp_manager = nullptr;
@ -90,7 +96,7 @@ NetSessions::NetSessions()
pkt_profiler = nullptr; pkt_profiler = nullptr;
if ( arp_request || arp_reply || bad_arp ) if ( arp_request || arp_reply || bad_arp )
arp_analyzer = new analyzer::arp::ARP_Analyzer(); arp_analyzer = new ::analyzer::arp::ARP_Analyzer();
else else
arp_analyzer = nullptr; arp_analyzer = nullptr;
@ -317,7 +323,7 @@ void NetSessions::DoNextPacket(double t, const zeek::Packet* pkt, const zeek::IP
} }
} }
FragReassemblerTracker frt(this, f); detail::FragReassemblerTracker frt(this, f);
len -= ip_hdr_len; // remove IP header len -= ip_hdr_len; // remove IP header
caplen -= ip_hdr_len; caplen -= ip_hdr_len;
@ -397,7 +403,7 @@ void NetSessions::DoNextPacket(double t, const zeek::Packet* pkt, const zeek::IP
const struct icmp* icmpp = (const struct icmp *) data; const struct icmp* icmpp = (const struct icmp *) data;
id.src_port = icmpp->icmp_type; id.src_port = icmpp->icmp_type;
id.dst_port = analyzer::icmp::ICMP4_counterpart(icmpp->icmp_type, id.dst_port = ::analyzer::icmp::ICMP4_counterpart(icmpp->icmp_type,
icmpp->icmp_code, icmpp->icmp_code,
id.is_one_way); id.is_one_way);
@ -413,7 +419,7 @@ void NetSessions::DoNextPacket(double t, const zeek::Packet* pkt, const zeek::IP
const struct icmp* icmpp = (const struct icmp *) data; const struct icmp* icmpp = (const struct icmp *) data;
id.src_port = icmpp->icmp_type; id.src_port = icmpp->icmp_type;
id.dst_port = analyzer::icmp::ICMP6_counterpart(icmpp->icmp_type, id.dst_port = ::analyzer::icmp::ICMP6_counterpart(icmpp->icmp_type,
icmpp->icmp_code, icmpp->icmp_code,
id.is_one_way); id.is_one_way);
@ -627,7 +633,7 @@ void NetSessions::DoNextPacket(double t, const zeek::Packet* pkt, const zeek::IP
EncapsulatingConn ec(ip_hdr->SrcAddr(), ip_hdr->DstAddr(), EncapsulatingConn ec(ip_hdr->SrcAddr(), ip_hdr->DstAddr(),
tunnel_type); tunnel_type);
ip_tunnels[tunnel_idx] = TunnelActivity(ec, network_time); ip_tunnels[tunnel_idx] = TunnelActivity(ec, network_time);
zeek::detail::timer_mgr->Add(new IPTunnelTimer(network_time, tunnel_idx)); zeek::detail::timer_mgr->Add(new detail::IPTunnelTimer(network_time, tunnel_idx));
} }
else else
it->second.second = network_time; it->second.second = network_time;
@ -1005,10 +1011,10 @@ void NetSessions::Remove(Connection* c)
if ( c->ConnTransport() == TRANSPORT_TCP ) if ( c->ConnTransport() == TRANSPORT_TCP )
{ {
auto ta = static_cast<analyzer::tcp::TCP_Analyzer*>(c->GetRootAnalyzer()); auto ta = static_cast<::analyzer::tcp::TCP_Analyzer*>(c->GetRootAnalyzer());
assert(ta->IsAnalyzer("TCP")); assert(ta->IsAnalyzer("TCP"));
analyzer::tcp::TCP_Endpoint* to = ta->Orig(); ::analyzer::tcp::TCP_Endpoint* to = ta->Orig();
analyzer::tcp::TCP_Endpoint* tr = ta->Resp(); ::analyzer::tcp::TCP_Endpoint* tr = ta->Resp();
tcp_stats.StateLeft(to->state, tr->state); tcp_stats.StateLeft(to->state, tr->state);
} }
@ -1420,3 +1426,5 @@ void NetSessions::InsertConnection(ConnectionMap* m, const zeek::detail::ConnIDK
default: break; default: break;
} }
} }
} // namespace zeek

24
src/Sessions.h
View file

@ -25,6 +25,10 @@ ZEEK_FORWARD_DECLARE_NAMESPACED(Discarder, zeek::detail);
namespace analyzer { namespace stepping_stone { class SteppingStoneManager; } } namespace analyzer { namespace stepping_stone { class SteppingStoneManager; } }
namespace analyzer { namespace arp { class ARP_Analyzer; } } namespace analyzer { namespace arp { class ARP_Analyzer; } }
namespace zeek {
namespace detail { class IPTunnelTimer; }
struct SessionStats { struct SessionStats {
size_t num_TCP_conns; size_t num_TCP_conns;
size_t max_TCP_conns; size_t max_TCP_conns;
@ -89,7 +93,7 @@ public:
return packet_filter; return packet_filter;
} }
analyzer::stepping_stone::SteppingStoneManager* GetSTPManager() { return stp_manager; } ::analyzer::stepping_stone::SteppingStoneManager* GetSTPManager() { return stp_manager; }
unsigned int CurrentConnections() unsigned int CurrentConnections()
{ {
@ -166,7 +170,7 @@ public:
unsigned int ConnectionMemoryUsage(); unsigned int ConnectionMemoryUsage();
unsigned int ConnectionMemoryUsageConnVals(); unsigned int ConnectionMemoryUsageConnVals();
unsigned int MemoryAllocation(); unsigned int MemoryAllocation();
analyzer::tcp::TCPStateStats tcp_stats; // keeps statistics on TCP states ::analyzer::tcp::TCPStateStats tcp_stats; // keeps statistics on TCP states
protected: protected:
friend class ConnCompressor; friend class ConnCompressor;
@ -229,9 +233,9 @@ protected:
using IPTunnelMap = std::map<IPPair, TunnelActivity>; using IPTunnelMap = std::map<IPPair, TunnelActivity>;
IPTunnelMap ip_tunnels; IPTunnelMap ip_tunnels;
analyzer::arp::ARP_Analyzer* arp_analyzer; ::analyzer::arp::ARP_Analyzer* arp_analyzer;
analyzer::stepping_stone::SteppingStoneManager* stp_manager; ::analyzer::stepping_stone::SteppingStoneManager* stp_manager;
zeek::detail::Discarder* discarder; zeek::detail::Discarder* discarder;
zeek::detail::PacketFilter* packet_filter; zeek::detail::PacketFilter* packet_filter;
uint64_t num_packets_processed; uint64_t num_packets_processed;
@ -239,6 +243,7 @@ protected:
bool dump_this_packet; // if true, current packet should be recorded bool dump_this_packet; // if true, current packet should be recorded
}; };
namespace detail {
class IPTunnelTimer final : public zeek::detail::Timer { class IPTunnelTimer final : public zeek::detail::Timer {
public: public:
@ -269,5 +274,16 @@ private:
FragReassembler* frag_reassembler; FragReassembler* frag_reassembler;
}; };
} // namespace detail
// Manager for the currently active sessions. // Manager for the currently active sessions.
extern NetSessions* sessions; extern NetSessions* sessions;
} // namespace zeek
using SessionStats [[deprecated("Remove in v4.1. Use zeek::SessionStats.")]] = zeek::SessionStats;
using NetSessions [[deprecated("Remove in v4.1. Use zeek::NetSessions.")]] = zeek::NetSessions;
using IPTunnelTimer [[deprecated("Remove in v4.1. Use zeek::detail::IPTunnelTimer.")]] = zeek::detail::IPTunnelTimer;
using FragReassemblerTracker [[deprecated("Remove in v4.1. Use zeek::detail::FragReassemblerTracker.")]] = zeek::detail::FragReassemblerTracker;
extern zeek::NetSessions*& sessions [[deprecated("Remove in v4.1. Use zeek:sessions.")]];

4
src/analyzer/protocol/ayiya/ayiya-analyzer.pac
View file

@ -57,7 +57,7 @@ flow AYIYA_Flow
} }
zeek::IP_Hdr* inner = 0; zeek::IP_Hdr* inner = 0;
int result = sessions->ParseIPPacket(${pdu.packet}.length(), int result = zeek::sessions->ParseIPPacket(${pdu.packet}.length(),
${pdu.packet}.data(), ${pdu.next_header}, inner); ${pdu.packet}.data(), ${pdu.next_header}, inner);
if ( result == 0 ) if ( result == 0 )
@ -86,7 +86,7 @@ flow AYIYA_Flow
zeek::EncapsulatingConn ec(c, BifEnum::Tunnel::AYIYA); zeek::EncapsulatingConn ec(c, BifEnum::Tunnel::AYIYA);
sessions->DoNextInnerPacket(network_time(), 0, inner, e, ec); zeek::sessions->DoNextInnerPacket(network_time(), 0, inner, e, ec);
return true; return true;
%} %}

2
src/analyzer/protocol/conn-size/functions.bif
View file

@ -5,7 +5,7 @@
static zeek::analyzer::Analyzer* GetConnsizeAnalyzer(zeek::Val* cid) static zeek::analyzer::Analyzer* GetConnsizeAnalyzer(zeek::Val* cid)
{ {
Connection* c = sessions->FindConnection(cid); Connection* c = zeek::sessions->FindConnection(cid);
if ( ! c ) if ( ! c )
return nullptr; return nullptr;

2
src/analyzer/protocol/dns/DNS.cc
View file

@ -1857,7 +1857,7 @@ void DNS_Analyzer::ExpireTimer(double t)
if ( t - Conn()->LastTime() >= dns_session_timeout - 1.0 || terminating ) if ( t - Conn()->LastTime() >= dns_session_timeout - 1.0 || terminating )
{ {
Event(connection_timeout); Event(connection_timeout);
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
} }
else else
ADD_ANALYZER_TIMER(&DNS_Analyzer::ExpireTimer, ADD_ANALYZER_TIMER(&DNS_Analyzer::ExpireTimer,

4
src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
View file

@ -730,7 +730,7 @@ flow GTPv1_Flow(is_orig: bool)
} }
zeek::IP_Hdr* inner = nullptr; zeek::IP_Hdr* inner = nullptr;
int result = sessions->ParseIPPacket(${pdu.packet}.length(), int result = zeek::sessions->ParseIPPacket(${pdu.packet}.length(),
${pdu.packet}.data(), ip->ip_v == 6 ? IPPROTO_IPV6 : IPPROTO_IPV4, ${pdu.packet}.data(), ip->ip_v == 6 ? IPPROTO_IPV6 : IPPROTO_IPV4,
inner); inner);
@ -764,7 +764,7 @@ flow GTPv1_Flow(is_orig: bool)
zeek::EncapsulatingConn ec(c, BifEnum::Tunnel::GTPv1); zeek::EncapsulatingConn ec(c, BifEnum::Tunnel::GTPv1);
sessions->DoNextInnerPacket(network_time(), 0, inner, e, ec); zeek::sessions->DoNextInnerPacket(network_time(), 0, inner, e, ec);
return true; return true;
%} %}

2
src/analyzer/protocol/netbios/NetbiosSSN.cc
View file

@ -531,7 +531,7 @@ void NetbiosSSN_Analyzer::ExpireTimer(double t)
netbios_ssn_session_timeout - 1.0 ) netbios_ssn_session_timeout - 1.0 )
{ {
Event(connection_timeout); Event(connection_timeout);
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
} }
else else
ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer, ADD_ANALYZER_TIMER(&NetbiosSSN_Analyzer::ExpireTimer,

2
src/analyzer/protocol/rpc/RPC.cc
View file

@ -764,5 +764,5 @@ void RPC_Analyzer::Done()
void RPC_Analyzer::ExpireTimer(double /* t */) void RPC_Analyzer::ExpireTimer(double /* t */)
{ {
Event(connection_timeout); Event(connection_timeout);
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
} }

2
src/analyzer/protocol/stepping-stone/SteppingStone.cc
View file

@ -155,7 +155,7 @@ void SteppingStoneEndpoint::CreateEndpEvent(bool is_orig)
SteppingStone_Analyzer::SteppingStone_Analyzer(Connection* c) SteppingStone_Analyzer::SteppingStone_Analyzer(Connection* c)
: tcp::TCP_ApplicationAnalyzer("STEPPINGSTONE", c) : tcp::TCP_ApplicationAnalyzer("STEPPINGSTONE", c)
{ {
stp_manager = sessions->GetSTPManager(); stp_manager = zeek::sessions->GetSTPManager();
orig_endp = resp_endp = nullptr; orig_endp = resp_endp = nullptr;
orig_stream_pos = resp_stream_pos = 1; orig_stream_pos = resp_stream_pos = 1;

2
src/analyzer/protocol/stepping-stone/SteppingStone.h
View file

@ -5,7 +5,7 @@
#include "Queue.h" #include "Queue.h"
#include "analyzer/protocol/tcp/TCP.h" #include "analyzer/protocol/tcp/TCP.h"
class NetSessions; ZEEK_FORWARD_DECLARE_NAMESPACED(NetSessions, zeek);
namespace analyzer::stepping_stone { namespace analyzer::stepping_stone {

16
src/analyzer/protocol/tcp/TCP.cc
View file

@ -1277,7 +1277,7 @@ void TCP_Analyzer::FlipRoles()
{ {
Analyzer::FlipRoles(); Analyzer::FlipRoles();
sessions->tcp_stats.FlipState(orig->state, resp->state); zeek::sessions->tcp_stats.FlipState(orig->state, resp->state);
TCP_Endpoint* tmp_ep = resp; TCP_Endpoint* tmp_ep = resp;
resp = orig; resp = orig;
orig = tmp_ep; orig = tmp_ep;
@ -1485,7 +1485,7 @@ void TCP_Analyzer::AttemptTimer(double /* t */)
is_active = 0; is_active = 0;
// All done with this connection. // All done with this connection.
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
} }
} }
@ -1505,7 +1505,7 @@ void TCP_Analyzer::PartialCloseTimer(double /* t */)
return; return;
Event(connection_partial_close); Event(connection_partial_close);
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
} }
} }
@ -1535,7 +1535,7 @@ void TCP_Analyzer::ExpireTimer(double t)
// the session remove and Unref() us here. // the session remove and Unref() us here.
Event(connection_timeout); Event(connection_timeout);
is_active = 0; is_active = 0;
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
return; return;
} }
} }
@ -1550,7 +1550,7 @@ void TCP_Analyzer::ExpireTimer(double t)
// before setting up an attempt timer, // before setting up an attempt timer,
// so we need to clean it up here. // so we need to clean it up here.
Event(connection_timeout); Event(connection_timeout);
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
return; return;
} }
} }
@ -1571,12 +1571,12 @@ void TCP_Analyzer::ResetTimer(double /* t */)
if ( ! BothClosed() ) if ( ! BothClosed() )
ConnectionReset(); ConnectionReset();
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
} }
void TCP_Analyzer::DeleteTimer(double /* t */) void TCP_Analyzer::DeleteTimer(double /* t */)
{ {
sessions->Remove(Conn()); zeek::sessions->Remove(Conn());
} }
void TCP_Analyzer::ConnDeleteTimer(double t) void TCP_Analyzer::ConnDeleteTimer(double t)
@ -1694,7 +1694,7 @@ void TCP_Analyzer::ConnectionClosed(TCP_Endpoint* endpoint, TCP_Endpoint* peer,
// Note, even if tcp_close_delay is zero, we can't // Note, even if tcp_close_delay is zero, we can't
// simply do: // simply do:
// //
// sessions->Remove(this); // zeek::sessions->Remove(this);
// //
// here, because that would cause the object to be // here, because that would cause the object to be
// deleted out from under us. // deleted out from under us.

10
src/analyzer/protocol/tcp/TCP_Endpoint.cc
View file

@ -72,7 +72,7 @@ void TCP_Endpoint::SetPeer(TCP_Endpoint* p)
peer = p; peer = p;
if ( IsOrig() ) if ( IsOrig() )
// Only one Endpoint adds the initial state to the counter. // Only one Endpoint adds the initial state to the counter.
sessions->tcp_stats.StateEntered(state, peer->state); zeek::sessions->tcp_stats.StateEntered(state, peer->state);
} }
bool TCP_Endpoint::HadGap() const bool TCP_Endpoint::HadGap() const
@ -156,11 +156,11 @@ void TCP_Endpoint::SetState(EndpointState new_state)
prev_state = state; prev_state = state;
state = new_state; state = new_state;
if ( IsOrig() ) if ( IsOrig() )
sessions->tcp_stats.ChangeState(prev_state, state, zeek::sessions->tcp_stats.ChangeState(prev_state, state,
peer->state, peer->state); peer->state, peer->state);
else else
sessions->tcp_stats.ChangeState(peer->state, peer->state, zeek::sessions->tcp_stats.ChangeState(peer->state, peer->state,
prev_state, state); prev_state, state);
} }
} }

8
src/analyzer/protocol/tcp/functions.bif
View file

@ -18,7 +18,7 @@
## .. zeek:see:: get_resp_seq ## .. zeek:see:: get_resp_seq
function get_orig_seq%(cid: conn_id%): count function get_orig_seq%(cid: conn_id%): count
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = zeek::sessions->FindConnection(cid);
if ( ! c ) if ( ! c )
return zeek::val_mgr->Count(0); return zeek::val_mgr->Count(0);
@ -47,7 +47,7 @@ function get_orig_seq%(cid: conn_id%): count
## .. zeek:see:: get_orig_seq ## .. zeek:see:: get_orig_seq
function get_resp_seq%(cid: conn_id%): count function get_resp_seq%(cid: conn_id%): count
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = zeek::sessions->FindConnection(cid);
if ( ! c ) if ( ! c )
return zeek::val_mgr->Count(0); return zeek::val_mgr->Count(0);
@ -97,7 +97,7 @@ function get_resp_seq%(cid: conn_id%): count
## .. zeek:see:: get_contents_file set_record_packets contents_file_write_failure ## .. zeek:see:: get_contents_file set_record_packets contents_file_write_failure
function set_contents_file%(cid: conn_id, direction: count, f: file%): bool function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = zeek::sessions->FindConnection(cid);
if ( ! c ) if ( ! c )
return zeek::val_mgr->False(); return zeek::val_mgr->False();
@ -120,7 +120,7 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
## .. zeek:see:: set_contents_file set_record_packets contents_file_write_failure ## .. zeek:see:: set_contents_file set_record_packets contents_file_write_failure
function get_contents_file%(cid: conn_id, direction: count%): file function get_contents_file%(cid: conn_id, direction: count%): file
%{ %{
Connection* c = sessions->FindConnection(cid); Connection* c = zeek::sessions->FindConnection(cid);
if ( c ) if ( c )
{ {

4
src/analyzer/protocol/teredo/Teredo.cc
View file

@ -161,7 +161,7 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
} }
zeek::IP_Hdr* inner = nullptr; zeek::IP_Hdr* inner = nullptr;
int rslt = sessions->ParseIPPacket(len, te.InnerIP(), IPPROTO_IPV6, inner); int rslt = zeek::sessions->ParseIPPacket(len, te.InnerIP(), IPPROTO_IPV6, inner);
if ( rslt > 0 ) if ( rslt > 0 )
{ {
@ -228,5 +228,5 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::TEREDO); zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::TEREDO);
sessions->DoNextInnerPacket(network_time, nullptr, inner, e, ec); zeek::sessions->DoNextInnerPacket(network_time, nullptr, inner, e, ec);
} }

6
src/analyzer/protocol/vxlan/VXLAN.cc
View file

@ -81,10 +81,10 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
switch ( pkt.l3_proto ) { switch ( pkt.l3_proto ) {
case zeek::L3_IPV4: case zeek::L3_IPV4:
res = sessions->ParseIPPacket(len, data, IPPROTO_IPV4, inner); res = zeek::sessions->ParseIPPacket(len, data, IPPROTO_IPV4, inner);
break; break;
case zeek::L3_IPV6: case zeek::L3_IPV6:
res = sessions->ParseIPPacket(len, data, IPPROTO_IPV6, inner); res = zeek::sessions->ParseIPPacket(len, data, IPPROTO_IPV6, inner);
break; break;
default: default:
return; return;
@ -105,5 +105,5 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
inner->ToPktHdrVal(), zeek::val_mgr->Count(vni)); inner->ToPktHdrVal(), zeek::val_mgr->Count(vni));
zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN); zeek::EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN);
sessions->DoNextInnerPacket(network_time, &pkt, inner, estack, ec); zeek::sessions->DoNextInnerPacket(network_time, &pkt, inner, estack, ec);
} }

2
src/iosource/PktSrc.cc
View file

@ -153,7 +153,7 @@ void PktSrc::Info(const std::string& msg)
void PktSrc::Weird(const std::string& msg, const zeek::Packet* p) void PktSrc::Weird(const std::string& msg, const zeek::Packet* p)
{ {
sessions->Weird(msg.c_str(), p, nullptr); zeek::sessions->Weird(msg.c_str(), p, nullptr);
} }
void PktSrc::InternalError(const std::string& msg) void PktSrc::InternalError(const std::string& msg)