Fix clang-tidy performance-enum-size warnings in headers

src/Anon.h

@@ -20,14 +20,14 @@ namespace zeek::detail {
 
 // TODO: Anon.h may not be the right place to put these functions ...
 
-enum ip_addr_anonymization_class_t {
+enum ip_addr_anonymization_class_t : uint8_t {
     ORIG_ADDR, // client address
     RESP_ADDR, // server address
     OTHER_ADDR,
     NUM_ADDR_ANONYMIZATION_CLASSES,
 };
 
-enum ip_addr_anonymization_method_t {
+enum ip_addr_anonymization_method_t : uint8_t {
     KEEP_ORIG_ADDR,
     SEQUENTIALLY_NUMBERED,
     RANDOM_MD5,

src/Attr.h

@@ -24,7 +24,7 @@ namespace detail {
 class Expr;
 using ExprPtr = IntrusivePtr<Expr>;
 
-enum AttrTag {
+enum AttrTag : uint8_t {
     ATTR_OPTIONAL,
     ATTR_DEFAULT,
     ATTR_DEFAULT_INSERT, // insert default value on failed lookups

src/Conn.h

@@ -42,7 +42,7 @@ namespace packet_analysis::IP {
 class SessionAdapter;
 }
 
-enum ConnEventToFlag {
+enum ConnEventToFlag : uint8_t {
     NUL_IN_LINE,
     SINGULAR_CR,
     SINGULAR_LF,

src/DNS_Mgr.h

@@ -54,7 +54,7 @@ class DNS_Mapping;
 using DNS_MappingPtr = std::shared_ptr<DNS_Mapping>;
 class DNS_Request;
 
-enum DNS_MgrMode {
+enum DNS_MgrMode : uint8_t {
     DNS_PRIME,   // used to prime the cache
     DNS_FORCE,   // internal error if cache miss
     DNS_DEFAULT, // lookup names as they're requested

src/DbgBreakpoint.h

@@ -12,9 +12,9 @@ namespace zeek::detail {
 class Stmt;
 class ParseLocationRec;
 
-enum BreakCode { BC_NO_HIT, BC_HIT, BC_HIT_AND_DELETE };
+enum BreakCode : uint8_t { BC_NO_HIT, BC_HIT, BC_HIT_AND_DELETE };
 class DbgBreakpoint {
-    enum Kind { BP_STMT = 0, BP_FUNC, BP_LINE, BP_TIME };
+    enum Kind : uint8_t { BP_STMT = 0, BP_FUNC, BP_LINE, BP_TIME };
 
 public:
     DbgBreakpoint();

src/Debug.h

@@ -35,7 +35,7 @@ class DbgWatch;
 class DbgDisplay;
 
 // This needs to be defined before we do the includes that come after it.
-enum ParseLocationRecType { PLR_UNKNOWN, PLR_FILE_AND_LINE, PLR_FUNCTION };
+enum ParseLocationRecType : uint8_t { PLR_UNKNOWN, PLR_FILE_AND_LINE, PLR_FUNCTION };
 class ParseLocationRec {
 public:
     ParseLocationRecType type;

src/DebugLogger.h

@@ -7,6 +7,7 @@
 
 #ifdef DEBUG
 
+#include <cstdint>
 #include <cstdio>
 #include <set>
 #include <string>
@@ -35,7 +36,7 @@ class Plugin;
 // To add a new debugging stream, add a constant here as well as
 // an entry to DebugLogger::streams in DebugLogger.cc.
 
-enum DebugStream {
+enum DebugStream : uint8_t {
     DBG_SERIAL,          // Serialization
     DBG_RULES,           // Signature matching
     DBG_STRING,          // String code

src/Desc.h

@@ -18,12 +18,12 @@ class IPPrefix;
 class File;
 class Type;
 
-enum DescType {
+enum DescType : uint8_t {
     DESC_READABLE,
     DESC_BINARY,
 };
 
-enum DescStyle {
+enum DescStyle : uint8_t {
     STANDARD_STYLE,
     RAW_STYLE,
 };

src/Dict.h

@@ -30,7 +30,7 @@ namespace zeek {
 template<typename T>
 class Dictionary;
 
-enum DictOrder { ORDERED, UNORDERED };
+enum DictOrder : uint8_t { ORDERED, UNORDERED };
 
 // A dict_delete_func that just calls delete.
 extern void generic_delete_func(void*);

src/EventRegistry.h

@@ -18,7 +18,7 @@
 namespace zeek {
 
 // The different kinds of event groups that exist.
-enum class EventGroupKind {
+enum class EventGroupKind : uint8_t {
     Attribute,
     Module,
 };

src/Expr.h

@@ -33,7 +33,7 @@ using ScopePtr = IntrusivePtr<Scope>;
 using ScriptFuncPtr = IntrusivePtr<ScriptFunc>;
 using FunctionIngredientsPtr = std::shared_ptr<FunctionIngredients>;
 
-enum ExprTag : int {
+enum ExprTag : int8_t {
     EXPR_ANY = -1,
     EXPR_NAME,
     EXPR_CONST,

src/Func.h

@@ -57,7 +57,7 @@ class Func : public Obj {
 public:
     static inline const FuncPtr nil;
 
-    enum Kind { SCRIPT_FUNC, BUILTIN_FUNC };
+    enum Kind : uint8_t { SCRIPT_FUNC, BUILTIN_FUNC };
 
     explicit Func(Kind arg_kind) : kind(arg_kind) {}
 

src/Hash.h

@@ -213,7 +213,7 @@ private:
     friend ValPtr BifFunc::md5_hmac_bif(zeek::detail::Frame* frame, const Args*);
 };
 
-enum HashKeyTag { HASH_KEY_INT, HASH_KEY_DOUBLE, HASH_KEY_STRING };
+enum HashKeyTag : uint8_t { HASH_KEY_INT, HASH_KEY_DOUBLE, HASH_KEY_STRING };
 
 constexpr int NUM_HASH_KEYS = HASH_KEY_STRING + 1;
 

src/ID.h

@@ -38,14 +38,14 @@ class Attributes;
 class Expr;
 using ExprPtr = IntrusivePtr<Expr>;
 
-enum InitClass {
+enum InitClass : uint8_t {
     INIT_NONE,
     INIT_FULL,
     INIT_EXTRA,
     INIT_REMOVE,
     INIT_SKIP,
 };
-enum IDScope { SCOPE_FUNCTION, SCOPE_MODULE, SCOPE_GLOBAL };
+enum IDScope : uint8_t { SCOPE_FUNCTION, SCOPE_MODULE, SCOPE_GLOBAL };
 
 class ID;
 using IDPtr = IntrusivePtr<ID>;

src/IPAddr.h

@@ -72,7 +72,7 @@ public:
     /**
      * Byte order.
      */
-    enum ByteOrder { Host, Network };
+    enum ByteOrder : uint8_t { Host, Network };
 
     /**
      * Constructs the unspecified IPv6 address (all 128 bits zeroed).

src/List.h

@@ -30,7 +30,7 @@
 
 namespace zeek {
 
-enum class ListOrder : int { ORDERED, UNORDERED };
+enum class ListOrder : uint8_t { ORDERED, UNORDERED };
 
 template<typename T, ListOrder Order = ListOrder::ORDERED>
 class List {

src/RE.h

@@ -46,7 +46,7 @@ using MatchPos = uint64_t;
 using AcceptingMatchSet = std::map<AcceptIdx, MatchPos>;
 using string_list = name_list;
 
-enum match_type { MATCH_ANYWHERE, MATCH_EXACTLY };
+enum match_type : uint8_t { MATCH_ANYWHERE, MATCH_EXACTLY };
 
 // A "specific" RE matcher will match one type of pattern: either
 // MATCH_ANYWHERE or MATCH_EXACTLY.

src/Reassem.h

@@ -14,7 +14,7 @@ namespace zeek {
 
 // Whenever subclassing the Reassembler class
 // you should add to this for known subclasses.
-enum ReassemblerType {
+enum ReassemblerType : uint8_t {
     REASSEM_UNKNOWN,
     REASSEM_TCP,
     REASSEM_FRAG,

src/Reporter.h

@@ -304,15 +304,15 @@ private:
     bool PermitFlowWeird(const char* name, const IPAddr& o, const IPAddr& r);
     bool PermitExpiredConnWeird(const char* name, const RecordVal& conn_id);
 
-    enum class PermitWeird { Allow, Deny, Unknown };
+    enum class PermitWeird : uint8_t { Allow, Deny, Unknown };
     PermitWeird CheckGlobalWeirdLists(const char* name);
 
     bool EmitToStderr(bool flag);
 
     int errors;
+    int in_error_handler;
     bool via_events;
     bool syslog_open;
-    int in_error_handler;
     bool info_to_stderr;
     bool warnings_to_stderr;
     bool errors_to_stderr;

src/Rule.h

@@ -36,7 +36,7 @@ public:
     const char* ID() const { return id; }
     unsigned int Index() const { return idx; }
 
-    enum PatternType {
+    enum PatternType : uint8_t {
         FILE_MAGIC,
         PAYLOAD,
         HTTP_REQUEST,

src/RuleCondition.h

@@ -22,7 +22,12 @@ public:
     virtual void PrintDebug() = 0;
 };
 
-enum RuleStateKind { RULE_STATE_ESTABLISHED = 1, RULE_STATE_ORIG = 2, RULE_STATE_RESP = 4, RULE_STATE_STATELESS = 8 };
+enum RuleStateKind : uint8_t {
+    RULE_STATE_ESTABLISHED = 1,
+    RULE_STATE_ORIG = 2,
+    RULE_STATE_RESP = 4,
+    RULE_STATE_STATELESS = 8
+};
 
 // Implements the "tcp-state" keyword.
 class RuleConditionTCPState : public RuleCondition {
@@ -53,7 +58,7 @@ private:
 // Implements "ip-options".
 class RuleConditionIPOptions : public RuleCondition {
 public:
-    enum Options {
+    enum Options : uint8_t {
         OPT_LSRR = 1,
         OPT_LSRRE = 2,
         OPT_RR = 4,
@@ -83,7 +88,7 @@ public:
 // Implements "payload-size".
 class RuleConditionPayloadSize : public RuleCondition {
 public:
-    enum Comp { RULE_LE, RULE_GE, RULE_LT, RULE_GT, RULE_EQ, RULE_NE };
+    enum Comp : uint8_t { RULE_LE, RULE_GE, RULE_LT, RULE_GT, RULE_EQ, RULE_NE };
 
     RuleConditionPayloadSize(uint32_t arg_val, Comp arg_comp) {
         val = arg_val;

src/RuleMatcher.h

@@ -3,6 +3,7 @@
 #pragma once
 
 #include <sys/types.h> // for u_char
+#include <cstdint>
 #include <functional>
 #include <map>
 #include <set>
@@ -78,8 +79,8 @@ extern uint32_t id_to_uint(const char* id);
 class RuleHdrTest {
 public:
     // Note: Adapt RuleHdrTest::PrintDebug() when changing these enums.
-    enum Comp { LE, GE, LT, GT, EQ, NE };
+    enum Comp : uint8_t { LE, GE, LT, GT, EQ, NE };
-    enum Prot { NOPROT, IP, IPv6, ICMP, ICMPv6, TCP, UDP, NEXT, IPSrc, IPDst };
+    enum Prot : uint8_t { NOPROT, IP, IPv6, ICMP, ICMPv6, TCP, UDP, NEXT, IPSrc, IPDst };
 
     RuleHdrTest(Prot arg_prot, uint32_t arg_offset, uint32_t arg_size, Comp arg_comp, maskedvalue_list* arg_vals);
     RuleHdrTest(Prot arg_prot, Comp arg_comp, std::vector<IPPrefix> arg_v);

src/SmithWaterman.h

@@ -106,7 +106,7 @@ private:
 // We support two modes of operation: finding a single optimal alignment,
 // and repeated alignments.
 //
-enum SWVariant {
+enum SWVariant : uint8_t {
     SW_SINGLE = 0,   // return a single, optimum alignment
     SW_MULTIPLE = 1, // find repeated, non-overlapping alignments
 };

src/StmtEnums.h

@@ -2,10 +2,12 @@
 
 #pragma once
 
+#include <cstdint>
+
 namespace zeek::detail {
 
 // These are in a separate file to break circular dependences
-enum StmtTag {
+enum StmtTag : uint8_t {
     STMT_ALARM, // Does no longer exist but kept to create enums consistent.
     STMT_PRINT,
     STMT_EVENT,
@@ -33,7 +35,7 @@ enum StmtTag {
 #define NUM_STMTS (int(STMT_STD_FUNCTION) + 1)
 };
 
-enum StmtFlowType {
+enum StmtFlowType : uint8_t {
     FLOW_NEXT,       // continue on to next statement
     FLOW_LOOP,       // go to top of loop
     FLOW_BREAK,      // break out of loop

src/TraverseTypes.h

@@ -2,11 +2,13 @@
 
 #pragma once
 
+#include <cstdint>
+
 namespace zeek::detail {
 
 class TraversalCallback;
 
-enum TraversalCode {
+enum TraversalCode : uint8_t {
     TC_CONTINUE = 0,
     TC_ABORTALL = 1,
     TC_ABORTSTMT = 2,

src/Type.h

@@ -59,7 +59,7 @@ public:
 } // namespace detail
 
 // Zeek types.
-enum TypeTag {
+enum TypeTag : uint8_t {
     TYPE_VOID,     // 0
     TYPE_BOOL,     // 1
     TYPE_INT,      // 2
@@ -91,9 +91,9 @@ extern const char* type_name(TypeTag t);
 
 constexpr bool is_network_order(TypeTag tag) noexcept { return tag == TYPE_PORT; }
 
-enum FunctionFlavor { FUNC_FLAVOR_FUNCTION, FUNC_FLAVOR_EVENT, FUNC_FLAVOR_HOOK };
+enum FunctionFlavor : uint8_t { FUNC_FLAVOR_FUNCTION, FUNC_FLAVOR_EVENT, FUNC_FLAVOR_HOOK };
 
-enum InternalTypeTag : uint16_t {
+enum InternalTypeTag : uint8_t {
     TYPE_INTERNAL_VOID,
     TYPE_INTERNAL_INT,
     TYPE_INTERNAL_UNSIGNED,

src/Val.h

@@ -1056,7 +1056,7 @@ protected:
     double CallExpireFunc(ListValPtr idx);
 
     // Enum for the different kinds of changes an &on_change handler can see
-    enum OnChangeType { ELEMENT_NEW, ELEMENT_CHANGED, ELEMENT_REMOVED, ELEMENT_EXPIRED };
+    enum OnChangeType : uint8_t { ELEMENT_NEW, ELEMENT_CHANGED, ELEMENT_REMOVED, ELEMENT_EXPIRED };
 
     // Calls &change_func.
     void CallChangeFunc(const ValPtr& index, const ValPtr& old_value, OnChangeType tpe);

src/Var.h

@@ -22,7 +22,7 @@ class Stmt;
 using StmtPtr = IntrusivePtr<Stmt>;
 using ScopePtr = IntrusivePtr<Scope>;
 
-enum DeclType {
+enum DeclType : uint8_t {
     VAR_REGULAR,
     VAR_CONST,
     VAR_REDEF,

src/ZeekString.h

@@ -3,6 +3,7 @@
 #pragma once
 
 #include <sys/types.h>
+#include <cstdint>
 #include <iosfwd>
 #include <string>
 #include <string_view>
@@ -103,7 +104,7 @@ public:
      */
     std::string_view ToStdStringView() const;
 
-    enum render_style {
+    enum render_style : uint8_t {
         ESC_NONE = 0,
         ESC_ESC = (1 << 1),  // '\' -> "\\"
         ESC_QUOT = (1 << 2), // '"' -> "\"", ''' -> "\'"

src/analyzer/protocol/bittorrent/BitTorrentTracker.h

@@ -20,7 +20,7 @@ namespace analyzer::bittorrent {
 
 namespace detail {
 
-enum BTT_States {
+enum BTT_States : uint8_t {
     BTT_REQ_GET,
     BTT_REQ_HEADER,
     BTT_REQ_DONE,
@@ -32,9 +32,15 @@ enum BTT_States {
 };
 
 // "benc" = Bencode ("Bee-Encode"), per http://en.wikipedia.org/wiki/Bencode
-enum BTT_BencTypes { BENC_TYPE_INT = 0, BENC_TYPE_STR = 1, BENC_TYPE_DIR = 2, BENC_TYPE_LIST = 3, BENC_TYPE_NONE = 10 };
+enum BTT_BencTypes : uint8_t {
+    BENC_TYPE_INT = 0,
+    BENC_TYPE_STR = 1,
+    BENC_TYPE_DIR = 2,
+    BENC_TYPE_LIST = 3,
+    BENC_TYPE_NONE = 10
+};
 
-enum BTT_BencStates {
+enum BTT_BencStates : uint8_t {
     BENC_STATE_EMPTY,
     BENC_STATE_INT1,
     BENC_STATE_INT2,

src/analyzer/protocol/dns/DNS.h

@@ -7,7 +7,7 @@
 namespace zeek::analyzer::dns {
 namespace detail {
 
-enum DNS_Opcode {
+enum DNS_Opcode : uint8_t {
     DNS_OP_QUERY = 0,  ///< standard query
     DNS_OP_IQUERY = 1, ///< reverse query
 
@@ -22,16 +22,17 @@ enum DNS_Opcode {
     NETBIOS_REFRESH = 8,
 };
 
-enum DNS_Code {
+enum DNS_Code : uint16_t {
     DNS_CODE_OK = 0,           ///< no error
     DNS_CODE_FORMAT_ERR = 1,   ///< format error
     DNS_CODE_SERVER_FAIL = 2,  ///< server failure
     DNS_CODE_NAME_ERR = 3,     ///< no such domain
     DNS_CODE_NOT_IMPL = 4,     ///< not implemented
     DNS_CODE_REFUSED = 5,      ///< refused
+    DNS_CODE_RESERVED = 65535, ///< Force clang-tidy to accept this enum being 16 bits
 };
 
-enum RR_Type {
+enum RR_Type : uint16_t {
     TYPE_A = 1,      ///< host address
     TYPE_NS = 2,     ///< authoritative name server
     TYPE_CNAME = 5,  ///< canonical name
@@ -80,10 +81,13 @@ enum RR_Type {
     TYPE_BINDS = 65534, ///< Bind9's Private Type Rec for signaling state of signing process
 };
 
-#define DNS_CLASS_IN 1
+enum DNS_Class : uint16_t {
-#define DNS_CLASS_ANY 255
+    DNS_CLASS_IN = 1,
+    DNS_CLASS_ANY = 255,
+    DNS_CLASS_RESERVED = 65535, ///< Force clang-tidy to accept this enum being 16 bits
+};
 
-enum DNS_AnswerType {
+enum DNS_AnswerType : uint8_t {
     DNS_QUESTION,
     DNS_ANSWER,
     DNS_AUTHORITY,
@@ -92,7 +96,7 @@ enum DNS_AnswerType {
 
 // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
 // DNS EDNS0 Option Codes (OPT)
-enum EDNS_OPT_Type {
+enum EDNS_OPT_Type : uint16_t {
     TYPE_LLQ = 1,          ///< https://www.iana.org/go/draft-sekar-dns-llq-06
     TYPE_UL = 2,           ///< http://files.dns-sd.org/draft-sekar-dns-ul.txt
     TYPE_NSID = 3,         ///< RFC5001
@@ -112,7 +116,7 @@ enum EDNS_OPT_Type {
     TYPE_DEVICE_ID = 26946 ///< https://docs.umbrella.com/developer/networkdevices-api/identifying-dns-traffic2
 };
 
-enum DNSSEC_Algo {
+enum DNSSEC_Algo : uint8_t {
     reserved0 = 0,
     RSA_MD5 = 1,        ///<	[RFC2537]  NOT RECOMMENDED
     Diffie_Hellman = 2, ///< [RFC2539]
@@ -134,7 +138,7 @@ enum DNSSEC_Algo {
     reserved255 = 255,
 };
 
-enum DNSSEC_Digest {
+enum DNSSEC_Digest : uint8_t {
     reserved = 0,
     SHA1 = 1, ///< [RFC3110]  MANDATORY
     SHA256 = 2,
@@ -144,7 +148,7 @@ enum DNSSEC_Digest {
 
 ///< all keys are defined in RFC draft
 ///< https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-07#section-14.3.2
-enum SVCPARAM_Key {
+enum SVCPARAM_Key : uint8_t {
     mandatory = 0,
     alpn = 1,
     no_default_alpn = 2,
@@ -392,7 +396,7 @@ protected:
     bool is_netbios;
 };
 
-enum TCP_DNS_state {
+enum TCP_DNS_state : uint8_t {
     DNS_LEN_HI,         ///< looking for the high-order byte of the length
     DNS_LEN_LO,         ///< looking for the low-order byte of the length
     DNS_MESSAGE_BUFFER, ///< building up the message in the buffer

src/analyzer/protocol/http/HTTP.h

@@ -15,7 +15,7 @@
 
 namespace zeek::analyzer::http {
 
-enum CHUNKED_TRANSFER_STATE {
+enum CHUNKED_TRANSFER_STATE : uint8_t {
     NON_CHUNKED_TRANSFER,
     BEFORE_CHUNK,
     EXPECT_CHUNK_SIZE,
@@ -59,7 +59,7 @@ protected:
     int expect_body;
     int64_t body_length;
     int64_t header_length;
-    enum { IDENTITY, GZIP, COMPRESS, DEFLATE } encoding;
+    enum : uint8_t { IDENTITY, GZIP, COMPRESS, DEFLATE } encoding;
     analyzer::zip::ZIP_Analyzer* zip;
     bool deliver_body;
     bool is_partial_content;
@@ -81,7 +81,7 @@ protected:
     void SubmitAllHeaders() override;
 };
 
-enum {
+enum : uint8_t {
     HTTP_BODY_NOT_EXPECTED,
     HTTP_BODY_EXPECTED,
     HTTP_BODY_MAYBE,

src/analyzer/protocol/irc/IRC.h

@@ -16,11 +16,11 @@ namespace irc {
  * \brief Main class for analyzing IRC traffic.
  */
 class IRC_Analyzer final : public analyzer::tcp::TCP_ApplicationAnalyzer {
-    enum {
+    enum : uint8_t {
         WAIT_FOR_REGISTRATION,
         REGISTERED,
     };
-    enum {
+    enum : uint8_t {
         NO_ZIP,
         ACCEPT_ZIP,
         ZIP_LOADED,

src/analyzer/protocol/login/Login.h

@@ -6,7 +6,7 @@
 
 namespace zeek::analyzer::login {
 
-enum login_state {
+enum login_state : uint8_t {
     LOGIN_STATE_AUTHENTICATE, // trying to authenticate
     LOGIN_STATE_LOGGED_IN,    // successful authentication
     LOGIN_STATE_SKIP,         // skip any further processing

src/analyzer/protocol/login/RSH.h

@@ -9,7 +9,7 @@ namespace zeek::analyzer::login {
 
 class Rsh_Analyzer;
 
-enum rsh_state {
+enum rsh_state : uint8_t {
     RSH_FIRST_NULL,       // waiting to see first NUL
     RSH_CLIENT_USER_NAME, // scanning client user name up to NUL
     RSH_SERVER_USER_NAME, // scanning server user name up to NUL

src/analyzer/protocol/login/Rlogin.h

@@ -9,7 +9,7 @@ namespace zeek::analyzer::login {
 
 class Rlogin_Analyzer;
 
-enum rlogin_state {
+enum rlogin_state : uint8_t {
     RLOGIN_FIRST_NULL,       // waiting to see first NUL
     RLOGIN_CLIENT_USER_NAME, // scanning client user name up to NUL
     RLOGIN_SERVER_USER_NAME, // scanning server user name up to NUL

src/analyzer/protocol/mime/MIME.h

@@ -35,14 +35,14 @@ namespace analyzer::mime {
 #define CR '\015'
 #define LF '\012'
 
-enum MIME_CONTENT_TYPE {
+enum MIME_CONTENT_TYPE : uint8_t {
     CONTENT_TYPE_MULTIPART,
     CONTENT_TYPE_MESSAGE,
     CONTENT_TYPE_TEXT,
     CONTENT_TYPE_OTHER, // image | audio | video | application | <other>
 };
 
-enum MIME_EVENT_TYPE {
+enum MIME_EVENT_TYPE : uint8_t {
     MIME_EVENT_ILLEGAL_FORMAT,
     MIME_EVENT_ILLEGAL_ENCODING,
     MIME_EVENT_CONTENT_GAP,

src/analyzer/protocol/netbios/NetbiosSSN.h

@@ -7,7 +7,7 @@
 namespace zeek::analyzer::netbios_ssn {
 namespace detail {
 
-enum NetbiosSSN_Opcode {
+enum NetbiosSSN_Opcode : uint8_t {
     NETBIOS_SSN_MSG = 0x0,
     NETBIOS_DGM_DIRECT_UNIQUE = 0x10,
     NETBIOS_DGM_DIRECT_GROUP = 0x11,
@@ -59,7 +59,7 @@ struct NetbiosDGM_RawMsgHdr {
     uint16_t offset;
 };
 
-enum NetbiosSSN_State {
+enum NetbiosSSN_State : uint8_t {
     NETBIOS_SSN_TYPE,   // looking for type field
     NETBIOS_SSN_FLAGS,  // looking for flag field
     NETBIOS_SSN_LEN_HI, // looking for high-order byte of length

src/analyzer/protocol/pia/PIA.h

@@ -73,7 +73,7 @@ protected:
     void PIA_DeliverPacket(int len, const u_char* data, bool is_orig, uint64_t seq, const IP_Hdr* ip, int caplen,
                            bool clear_state);
 
-    enum State { INIT, BUFFERING, MATCHING_ONLY, SKIPPING } state;
+    enum State : uint8_t { INIT, BUFFERING, MATCHING_ONLY, SKIPPING } state;
 
     // Buffers one chunk of data.  Used both for packet payload (incl.
     // sequence numbers for TCP) and chunks of a reassembled stream.

src/analyzer/protocol/pop3/POP3.h

@@ -19,11 +19,11 @@
 namespace zeek::analyzer::pop3 {
 namespace detail {
 
-enum POP3_Cmd {
+enum POP3_Cmd : uint8_t {
 #include "POP3_cmd.def"
 };
 
-enum POP3_MasterState {
+enum POP3_MasterState : uint8_t {
     POP3_START,
     POP3_AUTHORIZATION,
     POP3_TRANSACTION,
@@ -31,7 +31,7 @@ enum POP3_MasterState {
     POP3_FINISHED,
 };
 
-enum POP3_State {
+enum POP3_State : uint8_t {
     START,
     USER,
     PASS,
@@ -57,7 +57,7 @@ enum POP3_State {
     END,
 };
 
-enum POP3_SubState {
+enum POP3_SubState : uint8_t {
     POP3_OK,
     POP3_WOK,
 };

src/analyzer/protocol/rdp/rdpeudp-analyzer.pac

@@ -1,12 +1,12 @@
 refine connection RDPEUDP_Conn += {
 	%member{
-		enum RDPEUDP_STATE {
+		enum RDPEUDP_STATE : uint8_t {
 			NEED_SYN	= 0x1,
 			NEED_SYNACK	= 0x2,
 			NED_ACK		= 0x3,
 			ESTABLISHED	= 0x4,
 		};
-		enum RDPUDP_VERSION_INFO_FLAG {
+		enum RDPUDP_VERSION_INFO_FLAG : uint16_t {
 			RDPUDP_PROTOCOL_VERSION_1 = 0x0001,
 			RDPUDP_PROTOCOL_VERSION_2 = 0x0002,
 			RDPUDP_PROTOCOL_VERSION_3 = 0x0101

src/analyzer/protocol/rfb/rfb-analyzer.pac

@@ -69,7 +69,7 @@ refine flow RFB_Flow += {
 
 refine connection RFB_Conn += {
 	%member{
-		enum ServerState {
+		enum ServerState : uint8_t {
 			SERVER_VERSION            =  0,
 			SERVER_AUTH_TYPE          =  1,
 			SERVER_AUTH_TYPE37        =  2,
@@ -84,7 +84,7 @@ refine connection RFB_Conn += {
 			SERVER_INVALID            =100,
 		};
 
-		enum ClientState {
+		enum ClientState : uint8_t {
 			CLIENT_VERSION           =  0,
 			CLIENT_AUTH_SELECTION    =  1,
 			CLIENT_AUTH_VNC_RESPONSE =  2,

src/analyzer/protocol/rpc/RPC.h

@@ -7,17 +7,17 @@
 namespace zeek::analyzer::rpc {
 namespace detail {
 
-enum {
+enum : uint8_t {
     RPC_CALL = 0,
     RPC_REPLY = 1,
 };
 
-enum {
+enum : uint8_t {
     RPC_MSG_ACCEPTED = 0,
     RPC_MSG_DENIED = 1,
 };
 
-enum {
+enum : uint8_t {
     RPC_SUCCESS = 0,
     RPC_PROG_UNAVAIL = 1,
     RPC_PROG_MISMATCH = 2,
@@ -26,12 +26,12 @@ enum {
     RPC_SYSTEM_ERR = 5,
 };
 
-enum {
+enum : uint8_t {
     RPC_MISMATCH = 0,
     RPC_AUTH_ERROR = 1,
 };
 
-enum {
+enum : uint8_t {
     RPC_AUTH_BADCRED = 1,
     RPC_AUTH_REJECTEDCRED = 2,
     RPC_AUTH_BADVERF = 3,
@@ -39,7 +39,7 @@ enum {
     RPC_AUTH_TOOWEAK = 5,
 };
 
-enum {
+enum : uint8_t {
     RPC_AUTH_NULL = 0,
     RPC_AUTH_UNIX = 1,
     RPC_AUTH_SHORT = 2,
@@ -196,14 +196,14 @@ public:
     ~Contents_RPC() override = default;
 
 protected:
-    enum state_t {
+    enum state_t : uint8_t {
         WAIT_FOR_MESSAGE,
         WAIT_FOR_MARKER,
         WAIT_FOR_DATA,
         WAIT_FOR_LAST_DATA,
     };
 
-    enum resync_state_t {
+    enum resync_state_t : uint8_t {
         NEED_RESYNC,
         RESYNC_WAIT_FOR_MSG_START,
         RESYNC_WAIT_FOR_FULL_MSG,

src/analyzer/protocol/smtp/BDAT.h

@@ -42,7 +42,7 @@ struct BDATCmd parse_bdat_arg(int length, const char* arg);
  *
  * Helper class to avoid true/false parameters.
  */
-enum class ChunkType {
+enum class ChunkType : uint8_t {
     None,
     Intermediate,
     Last,

src/analyzer/protocol/smtp/SMTP.h

@@ -16,12 +16,12 @@ namespace detail {
 
 class SMTP_BDAT_Analyzer;
 
-enum SMTP_Cmd {
+enum SMTP_Cmd : uint8_t {
 #include "SMTP_cmd.def"
 };
 
 // State is updated on every SMTP reply.
-enum SMTP_State {
+enum SMTP_State : uint8_t {
     SMTP_CONNECTED,     // 0: before the opening message
     SMTP_INITIATED,     // 1: after opening message 220, EHLO/HELO expected
     SMTP_NOT_AVAILABLE, // 2: after opening message 554, etc.

src/analyzer/protocol/tcp/TCP_Endpoint.h

@@ -18,7 +18,7 @@ namespace analyzer::tcp {
 
 class TCP_Reassembler;
 
-enum EndpointState {
+enum EndpointState : uint8_t {
     TCP_ENDPOINT_INACTIVE,     // no SYN (or other packets) seen for this side
     TCP_ENDPOINT_SYN_SENT,     // SYN seen, but no ack
     TCP_ENDPOINT_SYN_ACK_SENT, // SYN ack seen, no initial SYN

src/analyzer/protocol/tcp/TCP_Reassembler.h

@@ -22,7 +22,7 @@ namespace tcp {
 
 class TCP_Reassembler final : public Reassembler {
 public:
-    enum Type {
+    enum Type : uint8_t {
         Direct,  // deliver to destination analyzer itself
         Forward, // forward to destination analyzer's children
     };

src/analyzer/protocol/zip/ZIP.h

@@ -10,7 +10,7 @@ namespace zeek::analyzer::zip {
 
 class ZIP_Analyzer final : public analyzer::tcp::TCP_SupportAnalyzer {
 public:
-    enum Method { GZIP, DEFLATE };
+    enum Method : uint8_t { GZIP, DEFLATE };
 
     ZIP_Analyzer(Connection* conn, bool orig, Method method = GZIP);
     ~ZIP_Analyzer() override;
@@ -20,7 +20,7 @@ public:
     void DeliverStream(int len, const u_char* data, bool orig) override;
 
 protected:
-    enum { NONE, ZIP_OK, ZIP_FAIL };
+    enum : uint8_t { NONE, ZIP_OK, ZIP_FAIL };
     z_stream* zip;
     int zip_status;
     Method method;

src/broker/Manager.h

@@ -90,7 +90,7 @@ struct Stats {
 class Manager : public zeek::cluster::Backend, public iosource::IOSource {
 public:
     /** Broker protocol to expect on a listening port. */
-    enum class BrokerProtocol {
+    enum class BrokerProtocol : uint8_t {
         Native,   /**< Broker's native binary protocol */
         WebSocket /** Broker's WebSocket protocol for external clients. */
     };

src/cluster/Backend.h

@@ -247,7 +247,7 @@ public:
     /**
      * Status codes for callbacks.
      */
-    enum class CallbackStatus {
+    enum class CallbackStatus : uint8_t {
         Success,
         Error,
         NotImplemented,

src/digest.h

@@ -38,7 +38,7 @@ namespace zeek::detail {
 
 // if you add something here, note that you might have to make sure that the
 // static_out member in calculate_digest is still long enough.
-enum HashAlgorithm { Hash_MD5, Hash_SHA1, Hash_SHA224, Hash_SHA256, Hash_SHA384, Hash_SHA512 };
+enum HashAlgorithm : uint8_t { Hash_MD5, Hash_SHA1, Hash_SHA224, Hash_SHA256, Hash_SHA384, Hash_SHA512 };
 
 inline const char* digest_print(const u_char* digest, size_t n) {
     static char buf[ZEEK_DIGEST_PRINT_LENGTH];

src/input/Manager.h

@@ -247,7 +247,7 @@ private:
     void Warning(const Stream* i, const char* fmt, ...) const __attribute__((format(printf, 3, 4)));
     void Error(const Stream* i, const char* fmt, ...) const __attribute__((format(printf, 3, 4)));
 
-    enum class ErrorType { INFO, WARNING, ERROR };
+    enum class ErrorType : uint8_t { INFO, WARNING, ERROR };
     void ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, const char* fmt, ...) const
         __attribute__((format(printf, 5, 6)));
     void ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, const char* fmt, va_list ap) const
@@ -256,7 +256,7 @@ private:
     Stream* FindStream(const std::string& name) const;
     Stream* FindStream(ReaderFrontend* reader) const;
 
-    enum StreamType { TABLE_STREAM, EVENT_STREAM, ANALYSIS_STREAM };
+    enum StreamType : uint8_t { TABLE_STREAM, EVENT_STREAM, ANALYSIS_STREAM };
 
     std::map<ReaderFrontend*, Stream*> readers;
 

src/input/ReaderBackend.h

@@ -16,7 +16,7 @@ class ReaderFrontend;
 /**
  * The modes a reader can be in.
  */
-enum ReaderMode {
+enum ReaderMode : uint8_t {
     /**
      * Manual refresh reader mode. The reader will read the file once,
      * and send all read data back to the manager. After that, no automatic

src/input/readers/raw/Raw.h

@@ -78,7 +78,14 @@ private:
     int pipes[6] = {-1};
     pid_t childpid;
 
-    enum IoChannels { stdout_in = 0, stdout_out = 1, stdin_in = 2, stdin_out = 3, stderr_in = 4, stderr_out = 5 };
+    enum IoChannels : uint8_t {
+        stdout_in = 0,
+        stdout_out = 1,
+        stdin_in = 2,
+        stdin_out = 3,
+        stderr_in = 4,
+        stderr_out = 5
+    };
 
     static const int block_size;
 };

src/iosource/Component.h

@@ -53,7 +53,7 @@ public:
     /**
      * Type of input a packet source supports.
      */
-    enum InputType {
+    enum InputType : uint8_t {
         LIVE,  ///< Live input.
         TRACE, ///< Offline input from trace file.
         BOTH   ///< Live input as well as offline.

src/iosource/IOSource.h

@@ -2,6 +2,8 @@
 
 #pragma once
 
+#include <cstdint>
+
 namespace zeek::iosource {
 
 /**
@@ -10,7 +12,7 @@ namespace zeek::iosource {
  */
 class IOSource {
 public:
-    enum ProcessFlags { READ = 0x01, WRITE = 0x02 };
+    enum ProcessFlags : uint8_t { READ = 0x01, WRITE = 0x02 };
 
     /**
      * Constructor.

src/iosource/Packet.h

@@ -38,7 +38,7 @@ using RecordValPtr = IntrusivePtr<RecordVal>;
  * This enum is sized as an int32_t to make the Packet structure align
  * correctly.
  */
-enum Layer3Proto : int32_t {
+enum Layer3Proto : int8_t {
     L3_UNKNOWN = -1, /// Layer 3 type could not be determined.
     L3_IPV4 = 1,     /// Layer 3 is IPv4.
     L3_IPV6 = 2,     /// Layer 3 is IPv6.
@@ -148,11 +148,6 @@ public:
     uint32_t cap_len;             /// Captured packet length
     uint32_t link_type;           /// pcap link_type (DLT_EN10MB, DLT_RAW, etc)
 
-    /**
-     * Layer 3 protocol identified (if any).
-     */
-    Layer3Proto l3_proto;
-
     /**
      * If layer 2 is Ethernet, innermost ethertype field.
      */
@@ -168,6 +163,11 @@ public:
      */
     uint32_t inner_vlan = 0;
 
+    /**
+     * Layer 3 protocol identified (if any).
+     */
+    Layer3Proto l3_proto;
+
     /**
      * If this packet is related to a connection, this flag denotes whether
      * this packet is from the originator of the connection.

src/logging/Manager.h

@@ -405,7 +405,7 @@ private:
     /**
      * Helper enum for CreateWriterForFilter to avoid bool params.
      */
-    enum class WriterOrigin {
+    enum class WriterOrigin : uint8_t {
         REMOTE,
         LOCAL,
     };
@@ -434,7 +434,7 @@ private:
     bool CheckFilterWriterConflict(const WriterInfo* winfo, const Filter* filter);
 
     // Verdict of a PolicyHook.
-    enum class PolicyVerdict {
+    enum class PolicyVerdict : uint8_t {
         PASS,
         VETO,
     };

src/make_dbg_constants.py

@@ -39,7 +39,7 @@ enum_str = f"""
 // This file was automatically generated from {inputfile}
 // DO NOT EDIT.
 //
-enum DebugCmd {{
+enum DebugCmd : uint8_t {{
 """
 
 init_str = f"""

src/net_util.h

@@ -125,7 +125,7 @@ enum TransportProto : uint8_t {
 
 extern const char* transport_proto_string(TransportProto proto);
 
-enum IPFamily { IPv4, IPv6 };
+enum IPFamily : uint8_t { IPv4, IPv6 };
 
 namespace zeek {
 

src/packet_analysis/protocol/ip/IP.h

@@ -29,7 +29,12 @@ private:
     zeek::detail::Discarder* discarder = nullptr;
 };
 
-enum class ParseResult { Ok = 0, CaplenTooSmall = -1, BadProtocol = -2, CaplenTooLarge = 1 };
+enum class ParseResult : int8_t {
+    CaplenTooSmall = -1,
+    BadProtocol = -2,
+    Ok = 0,
+    CaplenTooLarge = 1,
+};
 
 /**
  * Returns a wrapper IP_Hdr object if \a pkt appears to be a valid IPv4

src/plugin/Component.h

@@ -23,7 +23,7 @@ namespace component {
 /**
  * Component types.
  */
-enum Type {
+enum Type : uint8_t {
     READER,             /// An input reader (not currently used).
     WRITER,             /// A logging writer (not currently used).
     ANALYZER,           /// A protocol analyzer.

src/plugin/Plugin.h

@@ -70,7 +70,7 @@ class Plugin;
  * Hook types that a plugin may define. Each label maps to the corresponding
  * virtual method in \a Plugin.
  */
-enum HookType {
+enum HookType : uint8_t {
     // Note: when changing this table, update hook_name() in Plugin.cc.
     HOOK_LOAD_FILE,           //< Activates Plugin::HookLoadFile().
     HOOK_LOAD_FILE_EXT,       //< Activates Plugin::HookLoadFileExtended().
@@ -192,7 +192,13 @@ public:
     /**
      * Type of the item.
      */
-    enum Type { FUNCTION = 1, EVENT = 2, CONSTANT = 3, GLOBAL = 4, TYPE = 5 };
+    enum Type : uint8_t {
+        FUNCTION = 1,
+        EVENT = 2,
+        CONSTANT = 3,
+        GLOBAL = 4,
+        TYPE = 5,
+    };
 
     /**
      * Constructor.
@@ -242,7 +248,7 @@ public:
     /**
      * Type of the argument.
      */
-    enum Type {
+    enum Type : uint8_t {
         BOOL,
         DOUBLE,
         EVENT,
@@ -669,7 +675,7 @@ public:
     /**
      * The different types of @loads supported by HookLoadFile.
      */
-    enum LoadType { SCRIPT, SIGNATURES, PLUGIN };
+    enum LoadType : uint8_t { SCRIPT, SIGNATURES, PLUGIN };
 
     /**
      * Constructor.

src/probabilistic/BloomFilter.h

@@ -20,7 +20,7 @@ class CounterVector;
 }
 
 /** Types of derived BloomFilter classes. */
-enum BloomFilterType { Basic, Counting };
+enum BloomFilterType : uint8_t { Basic, Counting };
 
 /**
  * The abstract base class for Bloom filters.

src/probabilistic/Hasher.h

@@ -15,7 +15,7 @@ class BrokerDataView;
 namespace zeek::probabilistic::detail {
 
 /** Types of derived Hasher classes. */
-enum HasherType { Default, Double };
+enum HasherType : uint8_t { Default, Double };
 
 /**
  * Abstract base class for hashers. A hasher creates a family of hash

src/script_opt/CPP/AttrExprType.h

@@ -4,9 +4,11 @@
 
 #pragma once
 
+#include <cstdint>
+
 namespace zeek::detail {
 
-enum AttrExprType {
+enum AttrExprType : uint8_t {
     AE_NONE,   // attribute doesn't have an expression
     AE_CONST,  // easy expression - a constant (ConstExpr)
     AE_NAME,   // easy - a global (NameExpr)

src/script_opt/CPP/Exprs.h

@@ -16,7 +16,10 @@
 // values, the end goal is to have the value in (1) native form, (2) instead
 // in ValPtr form, or (3) whichever is more convenient to generate (sometimes
 // used when the caller knows that the value is non-native).
-enum GenType {
+
+#include <cstdint>
+
+enum GenType : uint8_t {
     GEN_NATIVE,
     GEN_VAL_PTR,
     GEN_DONT_CARE,

src/script_opt/Expr.h

@@ -234,7 +234,7 @@ protected:
 
 class ScriptOptBuiltinExpr : public Expr {
 public:
-    enum SOBuiltInTag {
+    enum SOBuiltInTag : uint8_t {
         MINIMUM,
         MAXIMUM,
         HAS_ELEMENTS,

src/script_opt/ProfileFunc.h

@@ -314,7 +314,7 @@ public:
     //	CONSTRUCTION - relevant for constructing/coercing a record
     //	READ - relevant for reading a table element
     //	WRITE - relevant for modifying a table element
-    enum AccessType { NONE, CALL, CONSTRUCTION, READ, WRITE };
+    enum AccessType : uint8_t { NONE, CALL, CONSTRUCTION, READ, WRITE };
 
     SideEffectsOp(AccessType at = NONE, const Type* t = nullptr) : access(at), type(t) {}
 

src/script_opt/ZAM/BuiltIn.h

@@ -132,7 +132,7 @@ public:
 // values assigned to them reflecting the bit-pattern of the arguments from
 // left (most significant) to right (least), with a 1-bit encoding Constant,
 // 0-bit for Variable.
-enum BiFArgsType {
+enum BiFArgsType : uint8_t {
     VV = 0x0,
     VC = 0x1,
     CV = 0x2,

src/script_opt/ZAM/ZInstAux.h

@@ -93,7 +93,7 @@ private:
     bool is_managed = false;
 };
 
-enum ControlFlowType {
+enum ControlFlowType : uint8_t {
     CFT_IF,
     CFT_BLOCK_END,
     CFT_ELSE,

src/script_opt/ZAM/ZOp.h

@@ -4,6 +4,7 @@
 
 #pragma once
 
+#include <cstdint>
 #include <string>
 #include <unordered_map>
 #include <vector>
@@ -11,7 +12,7 @@
 namespace zeek::detail {
 
 // Opcodes associated with ZAM instructions.
-enum ZOp {
+enum ZOp : uint16_t {
 #include "zeek/ZAM-OpsDefs.h"
     OP_NOP,
 };
@@ -25,7 +26,7 @@ enum ZOp {
 // I1/I2/I3/I4: the instruction's integer value, used directly (not as a slot)
 // FRAME: a slot in the (interpreter) Frame object
 // X: no operands
-enum ZAMOpType {
+enum ZAMOpType : uint8_t {
     OP_X,
     OP_C,
     OP_V,
@@ -56,7 +57,7 @@ enum ZAMOpType {
 };
 
 // Possible "flavors" for an operator's first slot.
-enum ZAMOp1Flavor {
+enum ZAMOp1Flavor : uint8_t {
     OP1_READ,       // the slot is read, not modified
     OP1_WRITE,      // the slot is modified, not read - the most common
     OP1_READ_WRITE, // the slot is both read and then modified, e.g. "++"

src/session/Session.h

@@ -30,7 +30,7 @@ constexpr uint32_t HIST_UNKNOWN_PKT = 0x400; // Initially for exceeded_tunnel_ma
 class Session;
 using timer_func = void (Session::*)(double t);
 
-enum class AnalyzerConfirmationState { UNKNOWN, VIOLATED, CONFIRMED };
+enum class AnalyzerConfirmationState : uint8_t { UNKNOWN, VIOLATED, CONFIRMED };
 
 class Session : public Obj {
 public:

src/spicy/cookie.h

@@ -171,7 +171,7 @@ struct Cookie {
         bool confirmed = false;   // valid only for protocol analyzers;
     } cache;
 
-    enum Tag { Protocol, File, Packet };
+    enum Tag : uint8_t { Protocol, File, Packet };
 
     /** Returns the type of cookie currently stored. */
     Tag tag() const {

src/spicy/runtime-support.h

@@ -141,7 +141,7 @@ void register_spicy_module_end();
 
 
 /** Identifies a Zeek-side type. */
-enum class ZeekTypeTag : uint64_t {
+enum class ZeekTypeTag : uint8_t {
     Addr,
     Any,
     Bool,

src/threading/formatters/JSON.h

@@ -18,7 +18,7 @@ namespace zeek::threading::formatter {
  */
 class JSON : public Formatter {
 public:
-    enum TimeFormat {
+    enum TimeFormat : uint8_t {
         TS_EPOCH,          // Doubles that represents seconds from the UNIX epoch.
         TS_ISO8601,        // ISO 8601 defined human readable timestamp format.
         TS_MILLIS,         // Signed milliseconds from the UNIX epoch.  Some consumers need this (e.g.,