Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Deprecate RecordVal::Assign(int, Val*)

Browse source 
And adapt all usages to the existing overload taking IntrusivePtr.
This commit is contained in:
Jon Siwek 2020-05-18 23:57:57 -07:00
parent d7ca63c1be
commit f3d160d034
38 changed files with 366 additions and 332 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -191,6 +191,9 @@ Deprecated Functionality
- ``FuncType::ArgTypes()`` is deprecated, use ``FuncType::ParamList()``. - ``FuncType::ArgTypes()`` is deprecated, use ``FuncType::ParamList()``.
- ``RecordVal::Assign(int, Val*)`` is deprecated, use the overload taking
``IntrusivePtr``.
Zeek 3.1.0 Zeek 3.1.0
========== ==========

6
src/CompHash.cc
View file

@ -900,7 +900,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
RecordType* rt = t->AsRecordType(); RecordType* rt = t->AsRecordType();
int num_fields = rt->NumFields(); int num_fields = rt->NumFields();
std::vector<Val*> values; std::vector<IntrusivePtr<Val>> values;
int i; int i;
for ( i = 0; i < num_fields; ++i ) for ( i = 0; i < num_fields; ++i )
{ {
@ -922,7 +922,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
break; break;
} }
values.push_back(v.release()); values.emplace_back(std::move(v));
} }
ASSERT(int(values.size()) == num_fields); ASSERT(int(values.size()) == num_fields);
@ -930,7 +930,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
auto rv = make_intrusive<RecordVal>(IntrusivePtr{NewRef{}, rt}); auto rv = make_intrusive<RecordVal>(IntrusivePtr{NewRef{}, rt});
for ( int i = 0; i < num_fields; ++i ) for ( int i = 0; i < num_fields; ++i )
rv->Assign(i, values[i]); rv->Assign(i, std::move(values[i]));
*pval = std::move(rv); *pval = std::move(rv);
kp1 = kp; kp1 = kp;

2
src/DNS_Mgr.cc
View file

@ -724,7 +724,7 @@ IntrusivePtr<Val> DNS_Mgr::BuildMappingVal(DNS_Mapping* dm)
r->Assign(3, val_mgr->Bool(dm->Valid())); r->Assign(3, val_mgr->Bool(dm->Valid()));
auto h = dm->Host(); auto h = dm->Host();
r->Assign(4, h ? h.release() : new StringVal("<none>")); r->Assign(4, h ? std::move(h) : make_intrusive<StringVal>("<none>"));
r->Assign(5, dm->AddrsSet()); r->Assign(5, dm->AddrsSet());
return r; return r;

5
src/Type.cc
View file

@ -809,9 +809,6 @@ IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
if ( rv ) if ( rv )
fv = rv->Lookup(i); fv = rv->Lookup(i);
if ( fv )
::Ref(fv);
bool logged = (fd->attrs && fd->FindAttr(ATTR_LOG) != nullptr); bool logged = (fd->attrs && fd->FindAttr(ATTR_LOG) != nullptr);
auto nr = make_intrusive<RecordVal>(record_field); auto nr = make_intrusive<RecordVal>(record_field);
@ -819,7 +816,7 @@ IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
string s = container_type_name(ft.get()); string s = container_type_name(ft.get());
nr->Assign(0, make_intrusive<StringVal>(s)); nr->Assign(0, make_intrusive<StringVal>(s));
nr->Assign(1, val_mgr->Bool(logged)); nr->Assign(1, val_mgr->Bool(logged));
nr->Assign(2, fv); nr->Assign(2, {NewRef{}, fv});
nr->Assign(3, FieldDefault(i)); nr->Assign(3, FieldDefault(i));
Val* field_name = new StringVal(FieldName(i)); Val* field_name = new StringVal(FieldName(i));
rval->Assign(field_name, std::move(nr)); rval->Assign(field_name, std::move(nr));

22
src/Val.h
View file

@ -945,8 +945,30 @@ public:
IntrusivePtr<Val> SizeVal() const override; IntrusivePtr<Val> SizeVal() const override;
/**
* Assign a value to a record field.
* @param field The field index to assign.
* @param new_val The value to assign.
*/
void Assign(int field, IntrusivePtr<Val> new_val); void Assign(int field, IntrusivePtr<Val> new_val);
/**
* Assign a value of type @c T to a record field, as constructed from
* the provided arguments.
* @param field The field index to assign.
* @param args A variable number of arguments to pass to constructor of
* type @c T.
*/
template <class T, class... Ts>
void Assign(int field, Ts&&... args)
{ Assign(field, make_intrusive<T>(std::forward<Ts>(args)...)); }
[[deprecated("Remove in v4.1. Assign an IntrusivePtr instead.")]]
void Assign(int field, Val* new_val); void Assign(int field, Val* new_val);
// Note: the following nullptr method can also go upon removing the above.
void Assign(int field, std::nullptr_t)
{ Assign(field, IntrusivePtr<Val>{}); }
Val* Lookup(int field) const; // Does not Ref() value. Val* Lookup(int field) const; // Does not Ref() value.
IntrusivePtr<Val> LookupWithDefault(int field) const; IntrusivePtr<Val> LookupWithDefault(int field) const;

8
src/analyzer/protocol/dhcp/dhcp-options.pac
View file

@ -625,11 +625,11 @@ refine casetype OptionValue += {
refine flow DHCP_Flow += { refine flow DHCP_Flow += {
function process_client_id_option(v: OptionValue): bool function process_client_id_option(v: OptionValue): bool
%{ %{
RecordVal* client_id = new RecordVal(zeek::BifType::Record::DHCP::ClientID); auto client_id = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientID);
client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype})); client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype}));
client_id->Assign(1, make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length()))); client_id->Assign(1, make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length())));
${context.flow}->options->Assign(19, client_id); ${context.flow}->options->Assign(19, std::move(client_id));
return true; return true;
%} %}
@ -685,14 +685,14 @@ refine casetype OptionValue += {
refine flow DHCP_Flow += { refine flow DHCP_Flow += {
function process_client_fqdn_option(v: OptionValue): bool function process_client_fqdn_option(v: OptionValue): bool
%{ %{
RecordVal* client_fqdn = new RecordVal(zeek::BifType::Record::DHCP::ClientFQDN); auto client_fqdn = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientFQDN);
client_fqdn->Assign(0, val_mgr->Count(${v.client_fqdn.flags})); client_fqdn->Assign(0, val_mgr->Count(${v.client_fqdn.flags}));
client_fqdn->Assign(1, val_mgr->Count(${v.client_fqdn.rcode1})); client_fqdn->Assign(1, val_mgr->Count(${v.client_fqdn.rcode1}));
client_fqdn->Assign(2, val_mgr->Count(${v.client_fqdn.rcode2})); client_fqdn->Assign(2, val_mgr->Count(${v.client_fqdn.rcode2}));
const char* domain_name = reinterpret_cast<const char*>(${v.client_fqdn.domain_name}.begin()); const char* domain_name = reinterpret_cast<const char*>(${v.client_fqdn.domain_name}.begin());
client_fqdn->Assign(3, make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name)); client_fqdn->Assign(3, make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name));
${context.flow}->options->Assign(21, client_fqdn); ${context.flow}->options->Assign(21, std::move(client_fqdn));
return true; return true;
%} %}

48
src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
View file

@ -83,9 +83,9 @@ static IntrusivePtr<Val> BuildTraceType(const InformationElement* ie)
return val_mgr->Count(ie->trace_type()->value()); return val_mgr->Count(ie->trace_type()->value());
} }
Val* BuildEndUserAddr(const InformationElement* ie) IntrusivePtr<Val> BuildEndUserAddr(const InformationElement* ie)
{ {
RecordVal* ev = new RecordVal(zeek::BifType::Record::gtp_end_user_addr); auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_end_user_addr);
ev->Assign(0, val_mgr->Count(ie->end_user_addr()->pdp_type_org())); ev->Assign(0, val_mgr->Count(ie->end_user_addr()->pdp_type_org()));
ev->Assign(1, val_mgr->Count(ie->end_user_addr()->pdp_type_num())); ev->Assign(1, val_mgr->Count(ie->end_user_addr()->pdp_type_num()));
@ -114,23 +114,23 @@ Val* BuildEndUserAddr(const InformationElement* ie)
return ev; return ev;
} }
Val* BuildAccessPointName(const InformationElement* ie) IntrusivePtr<Val> BuildAccessPointName(const InformationElement* ie)
{ {
BroString* bs = new BroString((const u_char*) ie->ap_name()->value().data(), BroString* bs = new BroString((const u_char*) ie->ap_name()->value().data(),
ie->ap_name()->value().length(), false); ie->ap_name()->value().length(), false);
return new StringVal(bs); return make_intrusive<StringVal>(bs);
} }
Val* BuildProtoConfigOptions(const InformationElement* ie) IntrusivePtr<Val> BuildProtoConfigOptions(const InformationElement* ie)
{ {
const u_char* d = (const u_char*) ie->proto_config_opts()->value().data(); const u_char* d = (const u_char*) ie->proto_config_opts()->value().data();
int len = ie->proto_config_opts()->value().length(); int len = ie->proto_config_opts()->value().length();
return new StringVal(new BroString(d, len, false)); return make_intrusive<StringVal>(new BroString(d, len, false));
} }
Val* BuildGSN_Addr(const InformationElement* ie) IntrusivePtr<Val> BuildGSN_Addr(const InformationElement* ie)
{ {
RecordVal* ev = new RecordVal(zeek::BifType::Record::gtp_gsn_addr); auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_gsn_addr);
int len = ie->gsn_addr()->value().length(); int len = ie->gsn_addr()->value().length();
const uint8* d = ie->gsn_addr()->value().data(); const uint8* d = ie->gsn_addr()->value().data();
@ -147,16 +147,16 @@ Val* BuildGSN_Addr(const InformationElement* ie)
return ev; return ev;
} }
Val* BuildMSISDN(const InformationElement* ie) IntrusivePtr<Val> BuildMSISDN(const InformationElement* ie)
{ {
const u_char* d = (const u_char*) ie->msisdn()->value().data(); const u_char* d = (const u_char*) ie->msisdn()->value().data();
int len = ie->msisdn()->value().length(); int len = ie->msisdn()->value().length();
return new StringVal(new BroString(d, len, false)); return make_intrusive<StringVal>(new BroString(d, len, false));
} }
Val* BuildQoS_Profile(const InformationElement* ie) IntrusivePtr<Val> BuildQoS_Profile(const InformationElement* ie)
{ {
RecordVal* ev = new RecordVal(zeek::BifType::Record::gtp_qos_profile); auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_qos_profile);
const u_char* d = (const u_char*) ie->qos_profile()->data().data(); const u_char* d = (const u_char*) ie->qos_profile()->data().data();
int len = ie->qos_profile()->data().length(); int len = ie->qos_profile()->data().length();
@ -167,30 +167,30 @@ Val* BuildQoS_Profile(const InformationElement* ie)
return ev; return ev;
} }
Val* BuildTrafficFlowTemplate(const InformationElement* ie) IntrusivePtr<Val> BuildTrafficFlowTemplate(const InformationElement* ie)
{ {
const uint8* d = ie->traffic_flow_template()->value().data(); const uint8* d = ie->traffic_flow_template()->value().data();
int len = ie->traffic_flow_template()->value().length(); int len = ie->traffic_flow_template()->value().length();
return new StringVal(new BroString((const u_char*) d, len, false)); return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
} }
Val* BuildTriggerID(const InformationElement* ie) IntrusivePtr<Val> BuildTriggerID(const InformationElement* ie)
{ {
const uint8* d = ie->trigger_id()->value().data(); const uint8* d = ie->trigger_id()->value().data();
int len = ie->trigger_id()->value().length(); int len = ie->trigger_id()->value().length();
return new StringVal(new BroString((const u_char*) d, len, false)); return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
} }
Val* BuildOMC_ID(const InformationElement* ie) IntrusivePtr<Val> BuildOMC_ID(const InformationElement* ie)
{ {
const uint8* d = ie->omc_id()->value().data(); const uint8* d = ie->omc_id()->value().data();
int len = ie->omc_id()->value().length(); int len = ie->omc_id()->value().length();
return new StringVal(new BroString((const u_char*) d, len, false)); return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
} }
Val* BuildPrivateExt(const InformationElement* ie) IntrusivePtr<Val> BuildPrivateExt(const InformationElement* ie)
{ {
RecordVal* ev = new RecordVal(zeek::BifType::Record::gtp_private_extension); auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_private_extension);
const uint8* d = ie->private_ext()->value().data(); const uint8* d = ie->private_ext()->value().data();
int len = ie->private_ext()->value().length(); int len = ie->private_ext()->value().length();
@ -216,16 +216,16 @@ static IntrusivePtr<Val> BuildChargingID(const InformationElement* ie)
return val_mgr->Count(ie->charging_id()->value());; return val_mgr->Count(ie->charging_id()->value());;
} }
Val* BuildChargingGatewayAddr(const InformationElement* ie) IntrusivePtr<Val> BuildChargingGatewayAddr(const InformationElement* ie)
{ {
const uint8* d = ie->charging_gateway_addr()->value().data(); const uint8* d = ie->charging_gateway_addr()->value().data();
int len = ie->charging_gateway_addr()->value().length(); int len = ie->charging_gateway_addr()->value().length();
if ( len == 4 ) if ( len == 4 )
return new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network)); return make_intrusive<AddrVal>(IPAddr(IPv4, (const uint32*) d, IPAddr::Network));
else if ( len == 16 ) else if ( len == 16 )
return new AddrVal(IPAddr(IPv6, (const uint32*) d, IPAddr::Network)); return make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32*) d, IPAddr::Network));
else else
return 0; return nullptr;
} }
static IntrusivePtr<Val> BuildTeardownInd(const InformationElement* ie) static IntrusivePtr<Val> BuildTeardownInd(const InformationElement* ie)

42
src/analyzer/protocol/krb/krb-analyzer.pac
View file

@ -1,14 +1,14 @@
%header{ %header{
RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts); IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts);
RecordVal* proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer); IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer);
bool proc_error_arguments(RecordVal* rv, const std::vector<KRB_ERROR_Arg*>* args, int64 error_code); bool proc_error_arguments(RecordVal* rv, const std::vector<KRB_ERROR_Arg*>* args, int64 error_code);
%} %}
%code{ %code{
RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts) IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts)
{ {
RecordVal* rv = new RecordVal(zeek::BifType::Record::KRB::KDC_Options); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Options);
rv->Assign(0, val_mgr->Bool(opts->forwardable())); rv->Assign(0, val_mgr->Bool(opts->forwardable()));
rv->Assign(1, val_mgr->Bool(opts->forwarded())); rv->Assign(1, val_mgr->Bool(opts->forwarded()));
@ -27,12 +27,12 @@ RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts)
return rv; return rv;
} }
RecordVal* proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer) IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer)
{ {
RecordVal* rv = new RecordVal(zeek::BifType::Record::KRB::KDC_Request); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Request);
rv->Assign(0, asn1_integer_to_val(msg->pvno()->data(), TYPE_COUNT)); rv->Assign(0, {AdoptRef{}, asn1_integer_to_val(msg->pvno()->data(), TYPE_COUNT)});
rv->Assign(1, asn1_integer_to_val(msg->msg_type()->data(), TYPE_COUNT)); rv->Assign(1, {AdoptRef{}, asn1_integer_to_val(msg->msg_type()->data(), TYPE_COUNT)});
if ( msg->padata()->has_padata() ) if ( msg->padata()->has_padata() )
rv->Assign(2, proc_padata(msg->padata()->padata()->padata(), bro_analyzer, false)); rv->Assign(2, proc_padata(msg->padata()->padata()->padata(), bro_analyzer, false));
@ -64,7 +64,7 @@ RecordVal* proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_an
rv->Assign(9, GetTimeFromAsn1(element->data()->rtime(), 0)); rv->Assign(9, GetTimeFromAsn1(element->data()->rtime(), 0));
break; break;
case 7: case 7:
rv->Assign(10, asn1_integer_to_val(element->data()->nonce(), TYPE_COUNT)); rv->Assign(10, {AdoptRef{}, asn1_integer_to_val(element->data()->nonce(), TYPE_COUNT)});
break; break;
case 8: case 8:
if ( element->data()->etype()->data()->size() ) if ( element->data()->etype()->data()->size() )
@ -132,10 +132,10 @@ bool proc_error_arguments(RecordVal* rv, const std::vector<KRB_ERROR_Arg*>* args
switch ( (*args)[i]->seq_meta()->index() ) switch ( (*args)[i]->seq_meta()->index() )
{ {
case 0: case 0:
rv->Assign(0, asn1_integer_to_val((*args)[i]->args()->pvno(), TYPE_COUNT)); rv->Assign(0, {AdoptRef{}, asn1_integer_to_val((*args)[i]->args()->pvno(), TYPE_COUNT)});
break; break;
case 1: case 1:
rv->Assign(1, asn1_integer_to_val((*args)[i]->args()->msg_type(), TYPE_COUNT)); rv->Assign(1, {AdoptRef{}, asn1_integer_to_val((*args)[i]->args()->msg_type(), TYPE_COUNT)});
break; break;
// ctime/stime handled above // ctime/stime handled above
case 7: case 7:
@ -179,8 +179,8 @@ refine connection KRB_Conn += {
if ( ! krb_as_request ) if ( ! krb_as_request )
return false; return false;
RecordVal* rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer()); auto rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer());
zeek::BifEvent::enqueue_krb_as_request(bro_analyzer(), bro_analyzer()->Conn(), {AdoptRef{}, rv}); zeek::BifEvent::enqueue_krb_as_request(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv));
return true; return true;
} }
@ -189,8 +189,8 @@ refine connection KRB_Conn += {
if ( ! krb_tgs_request ) if ( ! krb_tgs_request )
return false; return false;
RecordVal* rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer()); auto rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer());
zeek::BifEvent::enqueue_krb_tgs_request(bro_analyzer(), bro_analyzer()->Conn(), {AdoptRef{}, rv}); zeek::BifEvent::enqueue_krb_tgs_request(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv));
return true; return true;
} }
@ -205,8 +205,8 @@ refine connection KRB_Conn += {
{ {
auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Response); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Response);
rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, TYPE_COUNT)); rv->Assign(0, {AdoptRef{}, asn1_integer_to_val(${msg.pvno.data}, TYPE_COUNT)});
rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, TYPE_COUNT)); rv->Assign(1, {AdoptRef{}, asn1_integer_to_val(${msg.msg_type.data}, TYPE_COUNT)});
if ( ${msg.padata.has_padata} ) if ( ${msg.padata.has_padata} )
rv->Assign(2, proc_padata(${msg.padata.padata.padata}, bro_analyzer(), false)); rv->Assign(2, proc_padata(${msg.padata.padata.padata}, bro_analyzer(), false));
@ -246,7 +246,7 @@ refine connection KRB_Conn += {
{ {
auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Error_Msg); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Error_Msg);
proc_error_arguments(rv.get(), ${msg.args1}, 0); proc_error_arguments(rv.get(), ${msg.args1}, 0);
rv->Assign(4, asn1_integer_to_val(${msg.error_code}, TYPE_COUNT)); rv->Assign(4, {AdoptRef{}, asn1_integer_to_val(${msg.error_code}, TYPE_COUNT)});
proc_error_arguments(rv.get(), ${msg.args2}, binary_to_int64(${msg.error_code.encoding.content})); proc_error_arguments(rv.get(), ${msg.args2}, binary_to_int64(${msg.error_code.encoding.content}));
zeek::BifEvent::enqueue_krb_error(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv)); zeek::BifEvent::enqueue_krb_error(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv));
} }
@ -291,8 +291,8 @@ refine connection KRB_Conn += {
{ {
auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::SAFE_Msg); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::SAFE_Msg);
rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, TYPE_COUNT)); rv->Assign(0, {AdoptRef{}, asn1_integer_to_val(${msg.pvno.data}, TYPE_COUNT)});
rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, TYPE_COUNT)); rv->Assign(1, {AdoptRef{}, asn1_integer_to_val(${msg.msg_type.data}, TYPE_COUNT)});
uint timestamp_i = 0; uint timestamp_i = 0;
int64 timestamp_usecs = 0; int64 timestamp_usecs = 0;
@ -325,7 +325,7 @@ refine connection KRB_Conn += {
rv->Assign(3, to_stringval(${msg.safe_body.args[i].args.user_data.encoding.content})); rv->Assign(3, to_stringval(${msg.safe_body.args[i].args.user_data.encoding.content}));
break; break;
case 3: case 3:
rv->Assign(5, asn1_integer_to_val(${msg.safe_body.args[i].args.seq_number}, TYPE_COUNT)); rv->Assign(5, {AdoptRef{}, asn1_integer_to_val(${msg.safe_body.args[i].args.seq_number}, TYPE_COUNT)});
break; break;
case 4: case 4:
rv->Assign(6, proc_host_address(bro_analyzer(), ${msg.safe_body.args[i].args.sender_addr})); rv->Assign(6, proc_host_address(bro_analyzer(), ${msg.safe_body.args[i].args.sender_addr}));

8
src/analyzer/protocol/krb/krb-padata.pac
View file

@ -7,16 +7,16 @@
%} %}
%header{ %header{
VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error); IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error);
%} %}
%code{ %code{
VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error) IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error)
{ {
auto vv = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Type_Value_Vector")); auto vv = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Type_Value_Vector"));
if ( ! data->data()->has_padata() ) if ( ! data->data()->has_padata() )
return vv.release(); return vv;
for ( uint i = 0; i < data->data()->padata_elems()->size(); ++i) for ( uint i = 0; i < data->data()->padata_elems()->size(); ++i)
{ {
@ -119,7 +119,7 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
} }
} }
} }
return vv.release(); return vv;
} }
%} %}

30
src/analyzer/protocol/krb/krb-types.pac
View file

@ -3,10 +3,10 @@
%header{ %header{
IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname); IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname);
VectorVal* proc_cipher_list(const Array* list); IntrusivePtr<VectorVal> proc_cipher_list(const Array* list);
VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list); IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list);
RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr); IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr);
IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list); IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list);
IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket); IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket);
@ -25,15 +25,15 @@ IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname)
return make_intrusive<StringVal>("unknown"); return make_intrusive<StringVal>("unknown");
} }
VectorVal* proc_cipher_list(const Array* list) IntrusivePtr<VectorVal> proc_cipher_list(const Array* list)
{ {
auto ciphers = make_intrusive<VectorVal>(zeek::id::index_vec); auto ciphers = make_intrusive<VectorVal>(zeek::id::index_vec);
for ( uint i = 0; i < list->data()->size(); ++i ) for ( uint i = 0; i < list->data()->size(); ++i )
ciphers->Assign(ciphers->Size(), asn1_integer_to_val((*list->data())[i], TYPE_COUNT)); ciphers->Assign(ciphers->Size(), {AdoptRef{}, asn1_integer_to_val((*list->data())[i], TYPE_COUNT)});
return ciphers.release(); return ciphers;
} }
VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list) IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list)
{ {
auto addrs = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Host_Address_Vector")); auto addrs = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Host_Address_Vector"));
@ -42,12 +42,12 @@ VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses*
addrs->Assign(addrs->Size(), proc_host_address(a, (*list->addresses())[i])); addrs->Assign(addrs->Size(), proc_host_address(a, (*list->addresses())[i]));
} }
return addrs.release(); return addrs;
} }
RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr) IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
{ {
RecordVal* rv = new RecordVal(zeek::BifType::Record::KRB::Host_Address); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Host_Address);
const auto& addr_bytes = addr->address()->data()->content(); const auto& addr_bytes = addr->address()->data()->content();
switch ( binary_to_int64(addr->addr_type()->encoding()->content()) ) switch ( binary_to_int64(addr->addr_type()->encoding()->content()) )
@ -85,10 +85,10 @@ RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
break; break;
} }
RecordVal* unk = new RecordVal(zeek::BifType::Record::KRB::Type_Value); auto unk = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
unk->Assign(0, asn1_integer_to_val(addr->addr_type(), TYPE_COUNT)); unk->Assign(0, {AdoptRef{}, asn1_integer_to_val(addr->addr_type(), TYPE_COUNT)});
unk->Assign(1, to_stringval(addr_bytes)); unk->Assign(1, to_stringval(addr_bytes));
rv->Assign(2, unk); rv->Assign(2, std::move(unk));
return rv; return rv;
} }
@ -109,10 +109,10 @@ IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket)
{ {
auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Ticket); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Ticket);
rv->Assign(0, asn1_integer_to_val(ticket->tkt_vno()->data(), TYPE_COUNT)); rv->Assign(0, {AdoptRef{}, asn1_integer_to_val(ticket->tkt_vno()->data(), TYPE_COUNT)});
rv->Assign(1, to_stringval(ticket->realm()->data()->content())); rv->Assign(1, to_stringval(ticket->realm()->data()->content()));
rv->Assign(2, GetStringFromPrincipalName(ticket->sname())); rv->Assign(2, GetStringFromPrincipalName(ticket->sname()));
rv->Assign(3, asn1_integer_to_val(ticket->enc_part()->data()->etype()->data(), TYPE_COUNT)); rv->Assign(3, {AdoptRef{}, asn1_integer_to_val(ticket->enc_part()->data()->etype()->data(), TYPE_COUNT)});
rv->Assign(4, to_stringval(ticket->enc_part()->data()->ciphertext()->encoding()->content())); rv->Assign(4, to_stringval(ticket->enc_part()->data()->ciphertext()->encoding()->content()));
return rv; return rv;

8
src/analyzer/protocol/mqtt/commands/publish.pac
View file

@ -27,8 +27,8 @@ refine flow MQTT_Flow += {
m->Assign(0, val_mgr->Bool(${msg.dup})); m->Assign(0, val_mgr->Bool(${msg.dup}));
m->Assign(1, val_mgr->Count(${msg.qos})); m->Assign(1, val_mgr->Count(${msg.qos}));
m->Assign(2, val_mgr->Bool(${msg.retain})); m->Assign(2, val_mgr->Bool(${msg.retain}));
m->Assign(3, new StringVal(${msg.topic.str}.length(), m->Assign<StringVal>(3, ${msg.topic.str}.length(),
reinterpret_cast<const char*>(${msg.topic.str}.begin()))); reinterpret_cast<const char*>(${msg.topic.str}.begin()));
auto len = ${msg.payload}.length(); auto len = ${msg.payload}.length();
static auto max_payload_size = zeek::id::find("MQTT::max_payload_size"); static auto max_payload_size = zeek::id::find("MQTT::max_payload_size");
@ -37,8 +37,8 @@ refine flow MQTT_Flow += {
if ( len > static_cast<int>(max) ) if ( len > static_cast<int>(max) )
len = max; len = max;
m->Assign(4, new StringVal(len, m->Assign<StringVal>(4, len,
reinterpret_cast<const char*>(${msg.payload}.begin()))); reinterpret_cast<const char*>(${msg.payload}.begin()));
m->Assign(5, val_mgr->Count(${msg.payload}.length())); m->Assign(5, val_mgr->Count(${msg.payload}.length()));

6
src/analyzer/protocol/mqtt/commands/subscribe.pac
View file

@ -24,11 +24,11 @@ refine flow MQTT_Flow += {
for ( auto topic: *${msg.topics} ) for ( auto topic: *${msg.topics} )
{ {
auto subscribe_topic = new StringVal(${topic.name.str}.length(), auto subscribe_topic = make_intrusive<StringVal>(${topic.name.str}.length(),
reinterpret_cast<const char*>(${topic.name.str}.begin())); reinterpret_cast<const char*>(${topic.name.str}.begin()));
auto qos = val_mgr->Count(${topic.requested_QoS}); auto qos = val_mgr->Count(${topic.requested_QoS});
topics->Assign(topics->Size(), subscribe_topic); topics->Assign(topics->Size(), std::move(subscribe_topic));
qos_levels->Assign(qos_levels->Size(), qos); qos_levels->Assign(qos_levels->Size(), std::move(qos));
} }
zeek::BifEvent::enqueue_mqtt_subscribe(connection()->bro_analyzer(), zeek::BifEvent::enqueue_mqtt_subscribe(connection()->bro_analyzer(),

4
src/analyzer/protocol/mqtt/commands/unsubscribe.pac
View file

@ -18,9 +18,9 @@ refine flow MQTT_Flow += {
for ( auto topic: *${msg.topics} ) for ( auto topic: *${msg.topics} )
{ {
auto unsubscribe_topic = new StringVal(${topic.str}.length(), auto unsubscribe_topic = make_intrusive<StringVal>(${topic.str}.length(),
reinterpret_cast<const char*>(${topic.str}.begin())); reinterpret_cast<const char*>(${topic.str}.begin()));
topics->Assign(topics->Size(), unsubscribe_topic); topics->Assign(topics->Size(), std::move(unsubscribe_topic));
} }
zeek::BifEvent::enqueue_mqtt_unsubscribe(connection()->bro_analyzer(), zeek::BifEvent::enqueue_mqtt_unsubscribe(connection()->bro_analyzer(),

87
src/analyzer/protocol/ntlm/ntlm-analyzer.pac
View file

@ -1,29 +1,65 @@
%header{
IntrusivePtr<Val> filetime2brotime(uint64_t ts);
IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val);
IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val);
%}
refine connection NTLM_Conn += { %code{
// This is replicated from the SMB analyzer. :(
# This is replicated from the SMB analyzer. :( IntrusivePtr<Val> filetime2brotime(uint64_t ts)
function filetime2brotime(ts: uint64): Val {
%{
double secs = (ts / 10000000.0); double secs = (ts / 10000000.0);
// Bro can't support times back to the 1600's // Bro can't support times back to the 1600's
// so we subtract a lot of seconds. // so we subtract a lot of seconds.
Val* bro_ts = new Val(secs - 11644473600.0, TYPE_TIME); auto bro_ts = make_intrusive<Val>(secs - 11644473600.0, TYPE_TIME);
return bro_ts; return bro_ts;
%} }
function build_version_record(val: NTLM_Version): BroVal IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val)
%{ {
RecordVal* result = new RecordVal(zeek::BifType::Record::NTLM::Version); auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Version);
result->Assign(0, val_mgr->Count(${val.major_version})); result->Assign(0, val_mgr->Count(${val.major_version}));
result->Assign(1, val_mgr->Count(${val.minor_version})); result->Assign(1, val_mgr->Count(${val.minor_version}));
result->Assign(2, val_mgr->Count(${val.build_number})); result->Assign(2, val_mgr->Count(${val.build_number}));
result->Assign(3, val_mgr->Count(${val.ntlm_revision})); result->Assign(3, val_mgr->Count(${val.ntlm_revision}));
return result; return result;
}
IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val)
{
auto flags = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::NegotiateFlags);
flags->Assign(0, val_mgr->Bool(${val.negotiate_56}));
flags->Assign(1, val_mgr->Bool(${val.negotiate_key_exch}));
flags->Assign(2, val_mgr->Bool(${val.negotiate_128}));
flags->Assign(3, val_mgr->Bool(${val.negotiate_version}));
flags->Assign(4, val_mgr->Bool(${val.negotiate_target_info}));
flags->Assign(5, val_mgr->Bool(${val.request_non_nt_session_key}));
flags->Assign(6, val_mgr->Bool(${val.negotiate_identify}));
flags->Assign(7, val_mgr->Bool(${val.negotiate_extended_sessionsecurity}));
flags->Assign(8, val_mgr->Bool(${val.target_type_server}));
flags->Assign(9, val_mgr->Bool(${val.target_type_domain}));
flags->Assign(10, val_mgr->Bool(${val.negotiate_always_sign}));
flags->Assign(11, val_mgr->Bool(${val.negotiate_oem_workstation_supplied}));
flags->Assign(12, val_mgr->Bool(${val.negotiate_oem_domain_supplied}));
flags->Assign(13, val_mgr->Bool(${val.negotiate_anonymous_connection}));
flags->Assign(14, val_mgr->Bool(${val.negotiate_ntlm}));
flags->Assign(15, val_mgr->Bool(${val.negotiate_lm_key}));
flags->Assign(16, val_mgr->Bool(${val.negotiate_datagram}));
flags->Assign(17, val_mgr->Bool(${val.negotiate_seal}));
flags->Assign(18, val_mgr->Bool(${val.negotiate_sign}));
flags->Assign(19, val_mgr->Bool(${val.request_target}));
flags->Assign(20, val_mgr->Bool(${val.negotiate_oem}));
flags->Assign(21, val_mgr->Bool(${val.negotiate_unicode}));
return flags;
}
%} %}
refine connection NTLM_Conn += {
function build_av_record(val: NTLM_AV_Pair_Sequence, len: uint16): BroVal function build_av_record(val: NTLM_AV_Pair_Sequence, len: uint16): BroVal
%{ %{
RecordVal* result = new RecordVal(zeek::BifType::Record::NTLM::AVs); RecordVal* result = new RecordVal(zeek::BifType::Record::NTLM::AVs);
@ -76,35 +112,6 @@ refine connection NTLM_Conn += {
return result; return result;
%} %}
function build_negotiate_flag_record(val: NTLM_Negotiate_Flags): BroVal
%{
RecordVal* flags = new RecordVal(zeek::BifType::Record::NTLM::NegotiateFlags);
flags->Assign(0, val_mgr->Bool(${val.negotiate_56}));
flags->Assign(1, val_mgr->Bool(${val.negotiate_key_exch}));
flags->Assign(2, val_mgr->Bool(${val.negotiate_128}));
flags->Assign(3, val_mgr->Bool(${val.negotiate_version}));
flags->Assign(4, val_mgr->Bool(${val.negotiate_target_info}));
flags->Assign(5, val_mgr->Bool(${val.request_non_nt_session_key}));
flags->Assign(6, val_mgr->Bool(${val.negotiate_identify}));
flags->Assign(7, val_mgr->Bool(${val.negotiate_extended_sessionsecurity}));
flags->Assign(8, val_mgr->Bool(${val.target_type_server}));
flags->Assign(9, val_mgr->Bool(${val.target_type_domain}));
flags->Assign(10, val_mgr->Bool(${val.negotiate_always_sign}));
flags->Assign(11, val_mgr->Bool(${val.negotiate_oem_workstation_supplied}));
flags->Assign(12, val_mgr->Bool(${val.negotiate_oem_domain_supplied}));
flags->Assign(13, val_mgr->Bool(${val.negotiate_anonymous_connection}));
flags->Assign(14, val_mgr->Bool(${val.negotiate_ntlm}));
flags->Assign(15, val_mgr->Bool(${val.negotiate_lm_key}));
flags->Assign(16, val_mgr->Bool(${val.negotiate_datagram}));
flags->Assign(17, val_mgr->Bool(${val.negotiate_seal}));
flags->Assign(18, val_mgr->Bool(${val.negotiate_sign}));
flags->Assign(19, val_mgr->Bool(${val.request_target}));
flags->Assign(20, val_mgr->Bool(${val.negotiate_oem}));
flags->Assign(21, val_mgr->Bool(${val.negotiate_unicode}));
return flags;
%}
function proc_ntlm_negotiate(val: NTLM_Negotiate): bool function proc_ntlm_negotiate(val: NTLM_Negotiate): bool
%{ %{
if ( ! ntlm_negotiate ) if ( ! ntlm_negotiate )
@ -144,7 +151,7 @@ refine connection NTLM_Conn += {
result->Assign(2, build_version_record(${val.version})); result->Assign(2, build_version_record(${val.version}));
if ( ${val}->has_target_info() ) if ( ${val}->has_target_info() )
result->Assign(3, build_av_record(${val.target_info}, ${val.target_info_fields.length})); result->Assign(3, {AdoptRef{}, build_av_record(${val.target_info}, ${val.target_info_fields.length})});
zeek::BifEvent::enqueue_ntlm_challenge(bro_analyzer(), zeek::BifEvent::enqueue_ntlm_challenge(bro_analyzer(),
bro_analyzer()->Conn(), bro_analyzer()->Conn(),

55
src/analyzer/protocol/ntp/ntp-analyzer.pac
View file

@ -8,34 +8,33 @@
%} %}
%header{ %header{
Val* proc_ntp_short(const NTP_Short_Time* t); IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t);
Val* proc_ntp_timestamp(const NTP_Time* t); IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t);
IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm);
IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm);
IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7);
%} %}
%code{ %code{
Val* proc_ntp_short(const NTP_Short_Time* t) IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t)
{ {
if ( t->seconds() == 0 && t->fractions() == 0 ) if ( t->seconds() == 0 && t->fractions() == 0 )
return new Val(0.0, TYPE_INTERVAL); return make_intrusive<Val>(0.0, TYPE_INTERVAL);
return new Val(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL); return make_intrusive<Val>(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL);
} }
Val* proc_ntp_timestamp(const NTP_Time* t) IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t)
{ {
if ( t->seconds() == 0 && t->fractions() == 0) if ( t->seconds() == 0 && t->fractions() == 0)
return new Val(0.0, TYPE_TIME); return make_intrusive<Val>(0.0, TYPE_TIME);
return new Val(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32, TYPE_TIME); return make_intrusive<Val>(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32, TYPE_TIME);
} }
%}
// This builds the standard msg record
refine flow NTP_Flow += { IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm)
{
# This builds the standard msg record auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::StandardMessage);
function BuildNTPStdMsg(nsm: NTP_std_msg): BroVal
%{
RecordVal* rv = new RecordVal(zeek::BifType::Record::NTP::StandardMessage);
rv->Assign(0, val_mgr->Count(${nsm.stratum})); rv->Assign(0, val_mgr->Count(${nsm.stratum}));
rv->Assign(1, make_intrusive<Val>(pow(2, ${nsm.poll}), TYPE_INTERVAL)); rv->Assign(1, make_intrusive<Val>(pow(2, ${nsm.poll}), TYPE_INTERVAL));
@ -83,12 +82,12 @@ refine flow NTP_Flow += {
} }
return rv; return rv;
%} }
# This builds the control msg record // This builds the control msg record
function BuildNTPControlMsg(ncm: NTP_control_msg): BroVal IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm)
%{ {
RecordVal* rv = new RecordVal(zeek::BifType::Record::NTP::ControlMessage); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::ControlMessage);
rv->Assign(0, val_mgr->Count(${ncm.OpCode})); rv->Assign(0, val_mgr->Count(${ncm.OpCode}));
rv->Assign(1, val_mgr->Bool(${ncm.R})); rv->Assign(1, val_mgr->Bool(${ncm.R}));
@ -108,12 +107,12 @@ refine flow NTP_Flow += {
} }
return rv; return rv;
%} }
# This builds the mode7 msg record // This builds the mode7 msg record
function BuildNTPMode7Msg(m7: NTP_mode7_msg): BroVal IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7)
%{ {
RecordVal* rv = new RecordVal(zeek::BifType::Record::NTP::Mode7Message); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::Mode7Message);
rv->Assign(0, val_mgr->Count(${m7.request_code})); rv->Assign(0, val_mgr->Count(${m7.request_code}));
rv->Assign(1, val_mgr->Bool(${m7.auth_bit})); rv->Assign(1, val_mgr->Bool(${m7.auth_bit}));
@ -125,9 +124,13 @@ refine flow NTP_Flow += {
rv->Assign(5, to_stringval(${m7.data})); rv->Assign(5, to_stringval(${m7.data}));
return rv; return rv;
}
%} %}
refine flow NTP_Flow += {
function proc_ntp_message(msg: NTP_PDU): bool function proc_ntp_message(msg: NTP_PDU): bool
%{ %{
connection()->bro_analyzer()->ProtocolConfirmation(); connection()->bro_analyzer()->ProtocolConfirmation();

4
src/analyzer/protocol/radius/radius-analyzer.pac
View file

@ -14,7 +14,7 @@ refine flow RADIUS_Flow += {
if ( ${msg.attributes}->size() ) if ( ${msg.attributes}->size() )
{ {
TableVal* attributes = new TableVal(zeek::BifType::Table::RADIUS::Attributes); auto attributes = make_intrusive<TableVal>(zeek::BifType::Table::RADIUS::Attributes);
for ( uint i = 0; i < ${msg.attributes}->size(); ++i ) for ( uint i = 0; i < ${msg.attributes}->size(); ++i )
{ {
@ -38,7 +38,7 @@ refine flow RADIUS_Flow += {
} }
} }
result->Assign(3, attributes); result->Assign(3, std::move(attributes));
} }
zeek::BifEvent::enqueue_radius_message(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), std::move(result)); zeek::BifEvent::enqueue_radius_message(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), std::move(result));

96
src/analyzer/protocol/snmp/snmp-analyzer.pac
View file

@ -8,13 +8,13 @@
%} %}
%header{ %header{
AddrVal* network_address_to_val(const ASN1Encoding* na); IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na);
AddrVal* network_address_to_val(const NetworkAddress* na); IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na);
Val* asn1_obj_to_val(const ASN1Encoding* obj); IntrusivePtr<Val> asn1_obj_to_val(const ASN1Encoding* obj);
IntrusivePtr<RecordVal> build_hdr(const Header* header); IntrusivePtr<RecordVal> build_hdr(const Header* header);
RecordVal* build_hdrV3(const Header* header); IntrusivePtr<RecordVal> build_hdrV3(const Header* header);
VectorVal* build_bindings(const VarBindList* vbl); IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl);
IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu); IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu);
IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu); IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu);
IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu); IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu);
@ -22,12 +22,12 @@ IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu);
%code{ %code{
AddrVal* network_address_to_val(const NetworkAddress* na) IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na)
{ {
return network_address_to_val(na->encoding()); return network_address_to_val(na->encoding());
} }
AddrVal* network_address_to_val(const ASN1Encoding* na) IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na)
{ {
bytestring const& bs = na->content(); bytestring const& bs = na->content();
@ -35,16 +35,16 @@ AddrVal* network_address_to_val(const ASN1Encoding* na)
// but standards don't seem to currently make any provisions for IPv6, // but standards don't seem to currently make any provisions for IPv6,
// so ignore anything that can't be IPv4. // so ignore anything that can't be IPv4.
if ( bs.length() != 4 ) if ( bs.length() != 4 )
return new AddrVal(IPAddr()); return make_intrusive<AddrVal>(IPAddr());
const u_char* data = reinterpret_cast<const u_char*>(bs.data()); const u_char* data = reinterpret_cast<const u_char*>(bs.data());
uint32 network_order = extract_uint32(data); uint32 network_order = extract_uint32(data);
return new AddrVal(ntohl(network_order)); return make_intrusive<AddrVal>(ntohl(network_order));
} }
Val* asn1_obj_to_val(const ASN1Encoding* obj) IntrusivePtr<Val> asn1_obj_to_val(const ASN1Encoding* obj)
{ {
RecordVal* rval = new RecordVal(zeek::BifType::Record::SNMP::ObjectValue); IntrusivePtr<RecordVal> rval = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ObjectValue);
uint8 tag = obj->meta()->tag(); uint8 tag = obj->meta()->tag();
rval->Assign(0, val_mgr->Count(tag)); rval->Assign(0, val_mgr->Count(tag));
@ -57,18 +57,18 @@ Val* asn1_obj_to_val(const ASN1Encoding* obj)
break; break;
case ASN1_OBJECT_IDENTIFIER_TAG: case ASN1_OBJECT_IDENTIFIER_TAG:
rval->Assign(1, asn1_oid_to_val(obj)); rval->Assign(1, {AdoptRef{}, asn1_oid_to_val(obj)});
break; break;
case ASN1_INTEGER_TAG: case ASN1_INTEGER_TAG:
rval->Assign(2, asn1_integer_to_val(obj, TYPE_INT)); rval->Assign(2, {AdoptRef{}, asn1_integer_to_val(obj, TYPE_INT)});
break; break;
case APP_COUNTER32_TAG: case APP_COUNTER32_TAG:
case APP_UNSIGNED32_TAG: case APP_UNSIGNED32_TAG:
case APP_TIMETICKS_TAG: case APP_TIMETICKS_TAG:
case APP_COUNTER64_TAG: case APP_COUNTER64_TAG:
rval->Assign(3, asn1_integer_to_val(obj, TYPE_COUNT)); rval->Assign(3, {AdoptRef{}, asn1_integer_to_val(obj, TYPE_COUNT)});
break; break;
case APP_IPADDRESS_TAG: case APP_IPADDRESS_TAG:
@ -78,16 +78,16 @@ Val* asn1_obj_to_val(const ASN1Encoding* obj)
case ASN1_OCTET_STRING_TAG: case ASN1_OCTET_STRING_TAG:
case APP_OPAQUE_TAG: case APP_OPAQUE_TAG:
default: default:
rval->Assign(5, asn1_octet_string_to_val(obj)); rval->Assign(5, {AdoptRef{}, asn1_octet_string_to_val(obj)});
break; break;
} }
return rval; return rval;
} }
Val* time_ticks_to_val(const TimeTicks* tt) IntrusivePtr<Val> time_ticks_to_val(const TimeTicks* tt)
{ {
return asn1_integer_to_val(tt->asn1_integer(), TYPE_COUNT); return {AdoptRef{}, asn1_integer_to_val(tt->asn1_integer(), TYPE_COUNT)};
} }
IntrusivePtr<RecordVal> build_hdr(const Header* header) IntrusivePtr<RecordVal> build_hdr(const Header* header)
@ -98,17 +98,17 @@ IntrusivePtr<RecordVal> build_hdr(const Header* header)
switch ( header->version() ) { switch ( header->version() ) {
case SNMPV1_TAG: case SNMPV1_TAG:
{ {
RecordVal* v1 = new RecordVal(zeek::BifType::Record::SNMP::HeaderV1); auto v1 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV1);
v1->Assign(0, asn1_octet_string_to_val(header->v1()->community())); v1->Assign(0, {AdoptRef{}, asn1_octet_string_to_val(header->v1()->community())});
rv->Assign(1, v1); rv->Assign(1, std::move(v1));
} }
break; break;
case SNMPV2_TAG: case SNMPV2_TAG:
{ {
RecordVal* v2 = new RecordVal(zeek::BifType::Record::SNMP::HeaderV2); auto v2 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV2);
v2->Assign(0, asn1_octet_string_to_val(header->v2()->community())); v2->Assign(0, {AdoptRef{}, asn1_octet_string_to_val(header->v2()->community())});
rv->Assign(2, v2); rv->Assign(2, std::move(v2));
} }
break; break;
@ -122,59 +122,57 @@ IntrusivePtr<RecordVal> build_hdr(const Header* header)
return rv; return rv;
} }
RecordVal* build_hdrV3(const Header* header) IntrusivePtr<RecordVal> build_hdrV3(const Header* header)
{ {
RecordVal* v3 = new RecordVal(zeek::BifType::Record::SNMP::HeaderV3); auto v3 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV3);
const v3Header* v3hdr = header->v3(); const v3Header* v3hdr = header->v3();
const v3HeaderData* global_data = v3hdr->global_data(); const v3HeaderData* global_data = v3hdr->global_data();
bytestring const& flags = global_data->flags()->encoding()->content(); bytestring const& flags = global_data->flags()->encoding()->content();
uint8 flags_byte = flags.length() > 0 ? flags[0] : 0; uint8 flags_byte = flags.length() > 0 ? flags[0] : 0;
v3->Assign(0, asn1_integer_to_val(global_data->id(), TYPE_COUNT)); v3->Assign(0, {AdoptRef{}, asn1_integer_to_val(global_data->id(), TYPE_COUNT)});
v3->Assign(1, asn1_integer_to_val(global_data->max_size(), v3->Assign(1, {AdoptRef{}, asn1_integer_to_val(global_data->max_size(), TYPE_COUNT)});
TYPE_COUNT));
v3->Assign(2, val_mgr->Count(flags_byte)); v3->Assign(2, val_mgr->Count(flags_byte));
v3->Assign(3, val_mgr->Bool(flags_byte & 0x01)); v3->Assign(3, val_mgr->Bool(flags_byte & 0x01));
v3->Assign(4, val_mgr->Bool(flags_byte & 0x02)); v3->Assign(4, val_mgr->Bool(flags_byte & 0x02));
v3->Assign(5, val_mgr->Bool(flags_byte & 0x04)); v3->Assign(5, val_mgr->Bool(flags_byte & 0x04));
v3->Assign(6, asn1_integer_to_val(global_data->security_model(), v3->Assign(6, {AdoptRef{}, asn1_integer_to_val(global_data->security_model(), TYPE_COUNT)});
TYPE_COUNT)); v3->Assign(7, {AdoptRef{}, asn1_octet_string_to_val(v3hdr->security_parameters())});
v3->Assign(7, asn1_octet_string_to_val(v3hdr->security_parameters()));
if ( v3hdr->next()->tag() == ASN1_SEQUENCE_TAG ) if ( v3hdr->next()->tag() == ASN1_SEQUENCE_TAG )
{ {
const v3ScopedPDU* spdu = v3hdr->plaintext_pdu(); const v3ScopedPDU* spdu = v3hdr->plaintext_pdu();
RecordVal* rv = new RecordVal(zeek::BifType::Record::SNMP::ScopedPDU_Context); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ScopedPDU_Context);
rv->Assign(0, asn1_octet_string_to_val(spdu->context_engine_id())); rv->Assign(0, {AdoptRef{}, asn1_octet_string_to_val(spdu->context_engine_id())});
rv->Assign(1, asn1_octet_string_to_val(spdu->context_name())); rv->Assign(1, {AdoptRef{}, asn1_octet_string_to_val(spdu->context_name())});
v3->Assign(8, rv); v3->Assign(8, std::move(rv));
} }
return v3; return v3;
} }
VectorVal* build_bindings(const VarBindList* vbl) IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl)
{ {
auto vv = make_intrusive<VectorVal>(zeek::BifType::Vector::SNMP::Bindings); auto vv = make_intrusive<VectorVal>(zeek::BifType::Vector::SNMP::Bindings);
for ( size_t i = 0; i < vbl->bindings()->size(); ++i ) for ( size_t i = 0; i < vbl->bindings()->size(); ++i )
{ {
VarBind* vb = (*vbl->bindings())[i]; VarBind* vb = (*vbl->bindings())[i];
RecordVal* binding = new RecordVal(zeek::BifType::Record::SNMP::Binding); auto binding = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::Binding);
binding->Assign(0, asn1_oid_to_val(vb->name()->oid())); binding->Assign(0, {AdoptRef{}, asn1_oid_to_val(vb->name()->oid())});
binding->Assign(1, asn1_obj_to_val(vb->value()->encoding())); binding->Assign(1, asn1_obj_to_val(vb->value()->encoding()));
vv->Assign(i, binding); vv->Assign(i, std::move(binding));
} }
return vv.release(); return vv;
} }
IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu) IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu)
{ {
auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::PDU); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::PDU);
rv->Assign(0, asn1_integer_to_val(pdu->request_id(), TYPE_INT)); rv->Assign(0, {AdoptRef{}, asn1_integer_to_val(pdu->request_id(), TYPE_INT)});
rv->Assign(1, asn1_integer_to_val(pdu->error_status(), TYPE_INT)); rv->Assign(1, {AdoptRef{}, asn1_integer_to_val(pdu->error_status(), TYPE_INT)});
rv->Assign(2, asn1_integer_to_val(pdu->error_index(), TYPE_INT)); rv->Assign(2, {AdoptRef{}, asn1_integer_to_val(pdu->error_index(), TYPE_INT)});
rv->Assign(3, build_bindings(pdu->var_bindings())); rv->Assign(3, build_bindings(pdu->var_bindings()));
return rv; return rv;
} }
@ -182,10 +180,10 @@ IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu)
IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu) IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu)
{ {
auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::TrapPDU); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::TrapPDU);
rv->Assign(0, asn1_oid_to_val(pdu->enterprise())); rv->Assign(0, {AdoptRef{}, asn1_oid_to_val(pdu->enterprise())});
rv->Assign(1, network_address_to_val(pdu->agent_addr())); rv->Assign(1, network_address_to_val(pdu->agent_addr()));
rv->Assign(2, asn1_integer_to_val(pdu->generic_trap(), TYPE_INT)); rv->Assign(2, {AdoptRef{}, asn1_integer_to_val(pdu->generic_trap(), TYPE_INT)});
rv->Assign(3, asn1_integer_to_val(pdu->specific_trap(), TYPE_INT)); rv->Assign(3, {AdoptRef{}, asn1_integer_to_val(pdu->specific_trap(), TYPE_INT)});
rv->Assign(4, time_ticks_to_val(pdu->time_stamp())); rv->Assign(4, time_ticks_to_val(pdu->time_stamp()));
rv->Assign(5, build_bindings(pdu->var_bindings())); rv->Assign(5, build_bindings(pdu->var_bindings()));
return rv; return rv;
@ -194,9 +192,9 @@ IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu)
IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu) IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu)
{ {
auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::BulkPDU); auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::BulkPDU);
rv->Assign(0, asn1_integer_to_val(pdu->request_id(), TYPE_INT)); rv->Assign(0, {AdoptRef{}, asn1_integer_to_val(pdu->request_id(), TYPE_INT)});
rv->Assign(1, asn1_integer_to_val(pdu->non_repeaters(), TYPE_COUNT)); rv->Assign(1, {AdoptRef{}, asn1_integer_to_val(pdu->non_repeaters(), TYPE_COUNT)});
rv->Assign(2, asn1_integer_to_val(pdu->max_repititions(), TYPE_COUNT)); rv->Assign(2, {AdoptRef{}, asn1_integer_to_val(pdu->max_repititions(), TYPE_COUNT)});
rv->Assign(3, build_bindings(pdu->var_bindings())); rv->Assign(3, build_bindings(pdu->var_bindings()));
return rv; return rv;
} }

22
src/analyzer/protocol/ssh/ssh-analyzer.pac
View file

@ -5,14 +5,14 @@
%} %}
%header{ %header{
VectorVal* name_list_to_vector(const bytestring& nl); IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl);
%} %}
%code{ %code{
// Copied from IRC_Analyzer::SplitWords // Copied from IRC_Analyzer::SplitWords
VectorVal* name_list_to_vector(const bytestring& nl) IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl)
{ {
VectorVal* vv = new VectorVal(zeek::id::string_vec); auto vv = make_intrusive<VectorVal>(zeek::id::string_vec);
string name_list = std_str(nl); string name_list = std_str(nl);
if ( name_list.size() < 1 ) if ( name_list.size() < 1 )
@ -74,30 +74,30 @@ refine flow SSH_Flow += {
result->Assign(0, name_list_to_vector(${msg.kex_algorithms.val})); result->Assign(0, name_list_to_vector(${msg.kex_algorithms.val}));
result->Assign(1, name_list_to_vector(${msg.server_host_key_algorithms.val})); result->Assign(1, name_list_to_vector(${msg.server_host_key_algorithms.val}));
RecordVal* encryption_algs = new RecordVal(zeek::BifType::Record::SSH::Algorithm_Prefs); auto encryption_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
encryption_algs->Assign(0, name_list_to_vector(${msg.encryption_algorithms_client_to_server.val})); encryption_algs->Assign(0, name_list_to_vector(${msg.encryption_algorithms_client_to_server.val}));
encryption_algs->Assign(1, name_list_to_vector(${msg.encryption_algorithms_server_to_client.val})); encryption_algs->Assign(1, name_list_to_vector(${msg.encryption_algorithms_server_to_client.val}));
result->Assign(2, encryption_algs); result->Assign(2, std::move(encryption_algs));
RecordVal* mac_algs = new RecordVal(zeek::BifType::Record::SSH::Algorithm_Prefs); auto mac_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
mac_algs->Assign(0, name_list_to_vector(${msg.mac_algorithms_client_to_server.val})); mac_algs->Assign(0, name_list_to_vector(${msg.mac_algorithms_client_to_server.val}));
mac_algs->Assign(1, name_list_to_vector(${msg.mac_algorithms_server_to_client.val})); mac_algs->Assign(1, name_list_to_vector(${msg.mac_algorithms_server_to_client.val}));
result->Assign(3, mac_algs); result->Assign(3, std::move(mac_algs));
RecordVal* compression_algs = new RecordVal(zeek::BifType::Record::SSH::Algorithm_Prefs); auto compression_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
compression_algs->Assign(0, name_list_to_vector(${msg.compression_algorithms_client_to_server.val})); compression_algs->Assign(0, name_list_to_vector(${msg.compression_algorithms_client_to_server.val}));
compression_algs->Assign(1, name_list_to_vector(${msg.compression_algorithms_server_to_client.val})); compression_algs->Assign(1, name_list_to_vector(${msg.compression_algorithms_server_to_client.val}));
result->Assign(4, compression_algs); result->Assign(4, std::move(compression_algs));
if ( ${msg.languages_client_to_server.len} || ${msg.languages_server_to_client.len} ) if ( ${msg.languages_client_to_server.len} || ${msg.languages_server_to_client.len} )
{ {
RecordVal* languages = new RecordVal(zeek::BifType::Record::SSH::Algorithm_Prefs); auto languages = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
if ( ${msg.languages_client_to_server.len} ) if ( ${msg.languages_client_to_server.len} )
languages->Assign(0, name_list_to_vector(${msg.languages_client_to_server.val})); languages->Assign(0, name_list_to_vector(${msg.languages_client_to_server.val}));
if ( ${msg.languages_server_to_client.len} ) if ( ${msg.languages_server_to_client.len} )
languages->Assign(1, name_list_to_vector(${msg.languages_server_to_client.val})); languages->Assign(1, name_list_to_vector(${msg.languages_server_to_client.val}));
result->Assign(5, languages); result->Assign(5, std::move(languages));
} }

10
src/analyzer/protocol/ssh/ssh-protocol.pac
View file

@ -393,8 +393,8 @@ refine connection SSH_Conn += {
else if ( kex_orig_ == orig ) else if ( kex_orig_ == orig )
return false; return false;
VectorVal* client_list = name_list_to_vector(orig ? algs : kex_algs_cache_); auto client_list = name_list_to_vector(orig ? algs : kex_algs_cache_);
VectorVal* server_list = name_list_to_vector(orig ? kex_algs_cache_ : algs); auto server_list = name_list_to_vector(orig ? kex_algs_cache_ : algs);
for ( unsigned int i = 0; i < client_list->Size(); ++i ) for ( unsigned int i = 0; i < client_list->Size(); ++i )
{ {
@ -406,9 +406,6 @@ refine connection SSH_Conn += {
kex_algorithm_.init((const uint8 *) client_list->Lookup(i)->AsStringVal()->Bytes(), kex_algorithm_.init((const uint8 *) client_list->Lookup(i)->AsStringVal()->Bytes(),
client_list->Lookup(i)->AsStringVal()->Len()); client_list->Lookup(i)->AsStringVal()->Len());
Unref(client_list);
Unref(server_list);
// UNTESTED // UNTESTED
if ( update_kex_state_if_equal("rsa1024-sha1", KEX_RSA) ) if ( update_kex_state_if_equal("rsa1024-sha1", KEX_RSA) )
return true; return true;
@ -452,9 +449,6 @@ refine connection SSH_Conn += {
} }
} }
Unref(client_list);
Unref(server_list);
return true; return true;
%} %}

8
src/analyzer/protocol/teredo/Teredo.cc
View file

@ -106,7 +106,7 @@ IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
if ( auth ) if ( auth )
{ {
RecordVal* teredo_auth = new RecordVal(teredo_auth_type); auto teredo_auth = make_intrusive<RecordVal>(teredo_auth_type);
uint8_t id_len = *((uint8_t*)(auth + 2)); uint8_t id_len = *((uint8_t*)(auth + 2));
uint8_t au_len = *((uint8_t*)(auth + 3)); uint8_t au_len = *((uint8_t*)(auth + 3));
uint64_t nonce = ntohll(*((uint64_t*)(auth + 4 + id_len + au_len))); uint64_t nonce = ntohll(*((uint64_t*)(auth + 4 + id_len + au_len)));
@ -117,17 +117,17 @@ IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
new BroString(auth + 4 + id_len, au_len, true))); new BroString(auth + 4 + id_len, au_len, true)));
teredo_auth->Assign(2, val_mgr->Count(nonce)); teredo_auth->Assign(2, val_mgr->Count(nonce));
teredo_auth->Assign(3, val_mgr->Count(conf)); teredo_auth->Assign(3, val_mgr->Count(conf));
teredo_hdr->Assign(0, teredo_auth); teredo_hdr->Assign(0, std::move(teredo_auth));
} }
if ( origin_indication ) if ( origin_indication )
{ {
RecordVal* teredo_origin = new RecordVal(teredo_origin_type); auto teredo_origin = make_intrusive<RecordVal>(teredo_origin_type);
uint16_t port = ntohs(*((uint16_t*)(origin_indication + 2))) ^ 0xFFFF; uint16_t port = ntohs(*((uint16_t*)(origin_indication + 2))) ^ 0xFFFF;
uint32_t addr = ntohl(*((uint32_t*)(origin_indication + 4))) ^ 0xFFFFFFFF; uint32_t addr = ntohl(*((uint32_t*)(origin_indication + 4))) ^ 0xFFFFFFFF;
teredo_origin->Assign(0, val_mgr->Port(port, TRANSPORT_UDP)); teredo_origin->Assign(0, val_mgr->Port(port, TRANSPORT_UDP));
teredo_origin->Assign(1, make_intrusive<AddrVal>(htonl(addr))); teredo_origin->Assign(1, make_intrusive<AddrVal>(htonl(addr)));
teredo_hdr->Assign(1, teredo_origin); teredo_hdr->Assign(1, std::move(teredo_origin));
} }
teredo_hdr->Assign(2, inner->ToPktHdrVal()); teredo_hdr->Assign(2, inner->ToPktHdrVal());

4
src/broker/Store.cc
View file

@ -7,7 +7,7 @@ namespace bro_broker {
IntrusivePtr<OpaqueType> opaque_of_store_handle; IntrusivePtr<OpaqueType> opaque_of_store_handle;
EnumVal* query_status(bool success) IntrusivePtr<EnumVal> query_status(bool success)
{ {
static EnumType* store_query_status = nullptr; static EnumType* store_query_status = nullptr;
static int success_val; static int success_val;
@ -21,7 +21,7 @@ EnumVal* query_status(bool success)
} }
auto rval = store_query_status->GetVal(success ? success_val : failure_val); auto rval = store_query_status->GetVal(success ? success_val : failure_val);
return rval.release(); return rval;
} }
void StoreHandleVal::ValDescribe(ODesc* d) const void StoreHandleVal::ValDescribe(ODesc* d) const

2
src/broker/Store.h
View file

@ -18,7 +18,7 @@ extern IntrusivePtr<OpaqueType> opaque_of_store_handle;
* @param success whether the query status should be set to success or failure. * @param success whether the query status should be set to success or failure.
* @return a Broker::QueryStatus value. * @return a Broker::QueryStatus value.
*/ */
EnumVal* query_status(bool success); IntrusivePtr<EnumVal> query_status(bool success);
/** /**
* @return a Broker::QueryResult value that has a Broker::QueryStatus indicating * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating

8
src/broker/comm.bif
View file

@ -103,8 +103,8 @@ function Broker::__peers%(%): PeerInfos
const auto& ei = zeek::id::find_type<RecordType>("Broker::EndpointInfo"); const auto& ei = zeek::id::find_type<RecordType>("Broker::EndpointInfo");
const auto& ni = zeek::id::find_type<RecordType>("Broker::NetworkInfo"); const auto& ni = zeek::id::find_type<RecordType>("Broker::NetworkInfo");
auto peer_info = new RecordVal(pi); auto peer_info = new RecordVal(pi);
auto endpoint_info = new RecordVal(ei); auto endpoint_info = make_intrusive<RecordVal>(ei);
auto network_info = new RecordVal(ni); auto network_info = make_intrusive<RecordVal>(ni);
auto n = p.peer.network; auto n = p.peer.network;
if ( n ) if ( n )
@ -119,10 +119,10 @@ function Broker::__peers%(%): PeerInfos
} }
endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(p.peer.node))); endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(p.peer.node)));
endpoint_info->Assign(1, network_info); endpoint_info->Assign(1, std::move(network_info));
auto ps = (BifEnum::Broker::PeerStatus)p.status; auto ps = (BifEnum::Broker::PeerStatus)p.status;
peer_info->Assign(0, endpoint_info); peer_info->Assign(0, std::move(endpoint_info));
peer_info->Assign(1, zeek::BifType::Enum::Broker::PeerStatus->GetVal(ps)); peer_info->Assign(1, zeek::BifType::Enum::Broker::PeerStatus->GetVal(ps));
rval->Assign(i, peer_info); rval->Assign(i, peer_info);

4
src/broker/data.bif
View file

@ -301,8 +301,8 @@ function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%):
%{ %{
auto ti = static_cast<bro_broker::TableIterator*>(it); auto ti = static_cast<bro_broker::TableIterator*>(it);
auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::TableItem); auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::TableItem);
auto key_val = new RecordVal(zeek::BifType::Record::Broker::Data); auto key_val = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
auto val_val = new RecordVal(zeek::BifType::Record::Broker::Data); auto val_val = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
rval->Assign(0, key_val); rval->Assign(0, key_val);
rval->Assign(1, val_val); rval->Assign(1, val_val);

17
src/file_analysis/File.cc
View file

@ -21,13 +21,13 @@
using namespace file_analysis; using namespace file_analysis;
static Val* empty_connection_table() static IntrusivePtr<Val> empty_connection_table()
{ {
auto tbl_index = make_intrusive<TypeList>(zeek::id::conn_id); auto tbl_index = make_intrusive<TypeList>(zeek::id::conn_id);
tbl_index->Append(zeek::id::conn_id); tbl_index->Append(zeek::id::conn_id);
auto tbl_type = make_intrusive<TableType>(std::move(tbl_index), auto tbl_type = make_intrusive<TableType>(std::move(tbl_index),
zeek::id::connection); zeek::id::connection);
return new TableVal(std::move(tbl_type)); return make_intrusive<TableVal>(std::move(tbl_type));
} }
static IntrusivePtr<RecordVal> get_conn_id_val(const Connection* conn) static IntrusivePtr<RecordVal> get_conn_id_val(const Connection* conn)
@ -133,8 +133,9 @@ bool File::UpdateConnectionFields(Connection* conn, bool is_orig)
if ( ! conns ) if ( ! conns )
{ {
conns = empty_connection_table(); auto ect = empty_connection_table();
val->Assign(conns_idx, conns); conns = ect.get();
val->Assign(conns_idx, std::move(ect));
} }
auto idx = get_conn_id_val(conn); auto idx = get_conn_id_val(conn);
@ -315,8 +316,8 @@ void File::InferMetadata()
return; return;
BroString* bs = concatenate(bof_buffer.chunks); BroString* bs = concatenate(bof_buffer.chunks);
bof_buffer_val = new StringVal(bs); val->Assign<StringVal>(bof_buffer_idx, bs);
val->Assign(bof_buffer_idx, bof_buffer_val); bof_buffer_val = val->Lookup(bof_buffer_idx);
} }
if ( ! FileEventAvailable(file_sniff) ) if ( ! FileEventAvailable(file_sniff) )
@ -332,8 +333,8 @@ void File::InferMetadata()
if ( ! matches.empty() ) if ( ! matches.empty() )
{ {
meta->Assign(meta_mime_type_idx, meta->Assign<StringVal>(meta_mime_type_idx,
new StringVal(*(matches.begin()->second.begin()))); *(matches.begin()->second.begin()));
meta->Assign(meta_mime_types_idx, meta->Assign(meta_mime_types_idx,
file_analysis::GenMIMEMatchesVal(matches)); file_analysis::GenMIMEMatchesVal(matches));
} }

24
src/file_analysis/analyzer/pe/pe-analyzer.pac
View file

@ -5,28 +5,26 @@
%} %}
%header{ %header{
VectorVal* process_rvas(const RVAS* rvas); IntrusivePtr<VectorVal> process_rvas(const RVAS* rvas);
IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len);
%} %}
%code{ %code{
VectorVal* process_rvas(const RVAS* rva_table) IntrusivePtr<VectorVal> process_rvas(const RVAS* rva_table)
{ {
auto rvas = make_intrusive<VectorVal>(zeek::id::index_vec); auto rvas = make_intrusive<VectorVal>(zeek::id::index_vec);
for ( uint16 i=0; i < rva_table->rvas()->size(); ++i ) for ( uint16 i=0; i < rva_table->rvas()->size(); ++i )
rvas->Assign(i, val_mgr->Count((*rva_table->rvas())[i]->size())); rvas->Assign(i, val_mgr->Count((*rva_table->rvas())[i]->size()));
return rvas.release(); return rvas;
} }
%}
IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len)
refine flow File += { {
function characteristics_to_bro(c: uint32, len: uint8): TableVal
%{
uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF; uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF;
TableVal* char_set = new TableVal(zeek::id::count_set); auto char_set = make_intrusive<TableVal>(zeek::id::count_set);
for ( uint16 i=0; i < len; ++i ) for ( uint16 i=0; i < len; ++i )
{ {
if ( ((c >> i) & 0x1) == 1 ) if ( ((c >> i) & 0x1) == 1 )
@ -35,9 +33,15 @@ refine flow File += {
char_set->Assign(ch.get(), 0); char_set->Assign(ch.get(), 0);
} }
} }
return char_set; return char_set;
}
%} %}
refine flow File += {
function proc_dos_header(h: DOS_Header): bool function proc_dos_header(h: DOS_Header): bool
%{ %{
if ( pe_dos_header ) if ( pe_dos_header )

63
src/file_analysis/analyzer/unified2/unified2-analyzer.pac
View file

@ -7,9 +7,43 @@
#include "IPAddr.h" #include "IPAddr.h"
%} %}
%code{
IntrusivePtr<AddrVal> binpac::Unified2::Flow::unified2_addr_to_bro_addr(std::vector<uint32_t>* a)
{
if ( a->size() == 1 )
{
return make_intrusive<AddrVal>(IPAddr(IPv4, &(a->at(0)), IPAddr::Host));
}
else if ( a->size() == 4 )
{
uint32 tmp[4] = { a->at(0), a->at(1), a->at(2), a->at(3) };
return make_intrusive<AddrVal>(IPAddr(IPv6, tmp, IPAddr::Host));
}
else
{
// Should never reach here.
return make_intrusive<AddrVal>(1);
}
}
IntrusivePtr<Val> binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p)
{
TransportProto proto = TRANSPORT_UNKNOWN;
switch ( p ) {
case 1: proto = TRANSPORT_ICMP; break;
case 6: proto = TRANSPORT_TCP; break;
case 17: proto = TRANSPORT_UDP; break;
}
return val_mgr->Port(n, proto);
}
%}
refine flow Flow += { refine flow Flow += {
%member{ %member{
IntrusivePtr<AddrVal> unified2_addr_to_bro_addr(std::vector<uint32_t>* a);
IntrusivePtr<Val> to_port(uint16_t n, uint8_t p);
%} %}
%init{ %init{
@ -27,35 +61,6 @@ refine flow Flow += {
return t; return t;
%} %}
function unified2_addr_to_bro_addr(a: uint32[]): AddrVal
%{
if ( a->size() == 1 )
{
return new AddrVal(IPAddr(IPv4, &(a->at(0)), IPAddr::Host));
}
else if ( a->size() == 4 )
{
uint32 tmp[4] = { a->at(0), a->at(1), a->at(2), a->at(3) };
return new AddrVal(IPAddr(IPv6, tmp, IPAddr::Host));
}
else
{
// Should never reach here.
return new AddrVal(1);
}
%}
function to_port(n: uint16, p: uint8): Val
%{
TransportProto proto = TRANSPORT_UNKNOWN;
switch ( p ) {
case 1: proto = TRANSPORT_ICMP; break;
case 6: proto = TRANSPORT_TCP; break;
case 17: proto = TRANSPORT_UDP; break;
}
return val_mgr->Port(n, proto)->Ref();
%}
#function proc_record(rec: Record) : bool #function proc_record(rec: Record) : bool
# %{ # %{

24
src/file_analysis/analyzer/x509/X509.cc
View file

@ -336,10 +336,10 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
return; return;
} }
VectorVal* names = nullptr; IntrusivePtr<VectorVal> names;
VectorVal* emails = nullptr; IntrusivePtr<VectorVal> emails;
VectorVal* uris = nullptr; IntrusivePtr<VectorVal> uris;
VectorVal* ips = nullptr; IntrusivePtr<VectorVal> ips;
bool otherfields = false; bool otherfields = false;
@ -367,21 +367,21 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
{ {
case GEN_DNS: case GEN_DNS:
if ( names == nullptr ) if ( names == nullptr )
names = new VectorVal(zeek::id::string_vec); names = make_intrusive<VectorVal>(zeek::id::string_vec);
names->Assign(names->Size(), bs); names->Assign(names->Size(), bs);
break; break;
case GEN_URI: case GEN_URI:
if ( uris == nullptr ) if ( uris == nullptr )
uris = new VectorVal(zeek::id::string_vec); uris = make_intrusive<VectorVal>(zeek::id::string_vec);
uris->Assign(uris->Size(), bs); uris->Assign(uris->Size(), bs);
break; break;
case GEN_EMAIL: case GEN_EMAIL:
if ( emails == nullptr ) if ( emails == nullptr )
emails = new VectorVal(zeek::id::string_vec); emails = make_intrusive<VectorVal>(zeek::id::string_vec);
emails->Assign(emails->Size(), bs); emails->Assign(emails->Size(), bs);
break; break;
@ -391,7 +391,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
else if ( gen->type == GEN_IPADD ) else if ( gen->type == GEN_IPADD )
{ {
if ( ips == nullptr ) if ( ips == nullptr )
ips = new VectorVal(zeek::id::find_type<VectorType>("addr_vec")); ips = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("addr_vec"));
uint32_t* addr = (uint32_t*) gen->d.ip->data; uint32_t* addr = (uint32_t*) gen->d.ip->data;
@ -439,13 +439,13 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
GENERAL_NAMES_free(altname); GENERAL_NAMES_free(altname);
} }
StringVal* file_analysis::X509::KeyCurve(EVP_PKEY *key) IntrusivePtr<StringVal> file_analysis::X509::KeyCurve(EVP_PKEY* key)
{ {
assert(key != NULL); assert(key != nullptr);
#ifdef OPENSSL_NO_EC #ifdef OPENSSL_NO_EC
// well, we do not have EC-Support... // well, we do not have EC-Support...
return NULL; return nullptr;
#else #else
if ( EVP_PKEY_base_id(key) != EVP_PKEY_EC ) if ( EVP_PKEY_base_id(key) != EVP_PKEY_EC )
{ {
@ -468,7 +468,7 @@ StringVal* file_analysis::X509::KeyCurve(EVP_PKEY *key)
if ( curve_name == nullptr ) if ( curve_name == nullptr )
return nullptr; return nullptr;
return new StringVal(curve_name); return make_intrusive<StringVal>(curve_name);
#endif #endif
} }

2
src/file_analysis/analyzer/x509/X509.h
View file

@ -136,7 +136,7 @@ private:
std::string cert_data; std::string cert_data;
// Helpers for ParseCertificate. // Helpers for ParseCertificate.
static StringVal* KeyCurve(EVP_PKEY *key); static IntrusivePtr<StringVal> KeyCurve(EVP_PKEY* key);
static unsigned int KeyLength(EVP_PKEY *key); static unsigned int KeyLength(EVP_PKEY *key);
/** X509 stores associated with global script-layer values */ /** X509 stores associated with global script-layer values */
inline static std::map<Val*, X509_STORE*> x509_stores = std::map<Val*, X509_STORE*>(); inline static std::map<Val*, X509_STORE*> x509_stores = std::map<Val*, X509_STORE*>();

10
src/file_analysis/analyzer/x509/functions.bif
View file

@ -11,14 +11,14 @@
#include <openssl/err.h> #include <openssl/err.h>
// construct an error record // construct an error record
IntrusivePtr<RecordVal> x509_result_record(uint64_t num, const char* reason, Val* chainVector = nullptr) static IntrusivePtr<RecordVal> x509_result_record(uint64_t num, const char* reason, IntrusivePtr<Val> chainVector = nullptr)
{ {
auto rrecord = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Result); auto rrecord = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Result);
rrecord->Assign(0, val_mgr->Int(num)); rrecord->Assign(0, val_mgr->Int(num));
rrecord->Assign(1, make_intrusive<StringVal>(reason)); rrecord->Assign(1, make_intrusive<StringVal>(reason));
if ( chainVector ) if ( chainVector )
rrecord->Assign(2, chainVector); rrecord->Assign(2, std::move(chainVector));
return rrecord; return rrecord;
} }
@ -542,7 +542,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
int result = X509_verify_cert(csc); int result = X509_verify_cert(csc);
VectorVal* chainVector = nullptr; IntrusivePtr<VectorVal> chainVector;
if ( result == 1 ) // we have a valid chain. try to get it... if ( result == 1 ) // we have a valid chain. try to get it...
{ {
@ -556,7 +556,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
} }
int num_certs = sk_X509_num(chain); int num_certs = sk_X509_num(chain);
chainVector = new VectorVal(zeek::id::find_type<VectorType>("x509_opaque_vector")); chainVector = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("x509_opaque_vector"));
for ( int i = 0; i < num_certs; i++ ) for ( int i = 0; i < num_certs; i++ )
{ {
@ -578,7 +578,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
x509_verify_chainerror: x509_verify_chainerror:
auto rrecord = x509_result_record(X509_STORE_CTX_get_error(csc), X509_verify_cert_error_string(X509_STORE_CTX_get_error(csc)), chainVector); auto rrecord = x509_result_record(X509_STORE_CTX_get_error(csc), X509_verify_cert_error_string(X509_STORE_CTX_get_error(csc)), std::move(chainVector));
X509_STORE_CTX_cleanup(csc); X509_STORE_CTX_cleanup(csc);
X509_STORE_CTX_free(csc); X509_STORE_CTX_free(csc);

4
src/input/Manager.cc
View file

@ -1908,7 +1908,7 @@ RecordVal* Manager::ListValToRecordVal(ListVal* list, RecordType *request_type,
(*position)++; (*position)++;
} }
rec->Assign(i, fieldVal->Ref()); rec->Assign(i, {NewRef{}, fieldVal});
} }
return rec; return rec;
@ -1945,7 +1945,7 @@ RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const *v
} }
if ( fieldVal ) if ( fieldVal )
rec->Assign(i, fieldVal); rec->Assign(i, {AdoptRef{}, fieldVal});
} }
return rec; return rec;

8
src/iosource/Packet.cc
View file

@ -597,7 +597,7 @@ IntrusivePtr<RecordVal> Packet::ToRawPktHdrVal() const
static auto raw_pkt_hdr_type = zeek::id::find_type<RecordType>("raw_pkt_hdr"); static auto raw_pkt_hdr_type = zeek::id::find_type<RecordType>("raw_pkt_hdr");
static auto l2_hdr_type = zeek::id::find_type<RecordType>("l2_hdr"); static auto l2_hdr_type = zeek::id::find_type<RecordType>("l2_hdr");
auto pkt_hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type); auto pkt_hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
RecordVal* l2_hdr = new RecordVal(l2_hdr_type); auto l2_hdr = make_intrusive<RecordVal>(l2_hdr_type);
bool is_ethernet = link_type == DLT_EN10MB; bool is_ethernet = link_type == DLT_EN10MB;
@ -651,7 +651,7 @@ IntrusivePtr<RecordVal> Packet::ToRawPktHdrVal() const
l2_hdr->Assign(8, zeek::BifType::Enum::layer3_proto->GetVal(l3)); l2_hdr->Assign(8, zeek::BifType::Enum::layer3_proto->GetVal(l3));
pkt_hdr->Assign(0, l2_hdr); pkt_hdr->Assign(0, std::move(l2_hdr));
if ( l3_proto == L3_IPV4 ) if ( l3_proto == L3_IPV4 )
{ {
@ -674,12 +674,12 @@ RecordVal* Packet::BuildPktHdrVal() const
return ToRawPktHdrVal().release(); return ToRawPktHdrVal().release();
} }
Val *Packet::FmtEUI48(const u_char *mac) const IntrusivePtr<Val> Packet::FmtEUI48(const u_char* mac) const
{ {
char buf[20]; char buf[20];
snprintf(buf, sizeof buf, "%02x:%02x:%02x:%02x:%02x:%02x", snprintf(buf, sizeof buf, "%02x:%02x:%02x:%02x:%02x:%02x",
mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
return new StringVal(buf); return make_intrusive<StringVal>(buf);
} }
void Packet::Describe(ODesc* d) const void Packet::Describe(ODesc* d) const

2
src/iosource/Packet.h
View file

@ -225,7 +225,7 @@ private:
void Weird(const char* name); void Weird(const char* name);
// Renders an MAC address into its ASCII representation. // Renders an MAC address into its ASCII representation.
Val* FmtEUI48(const u_char *mac) const; IntrusivePtr<Val> FmtEUI48(const u_char* mac) const;
// True if we need to delete associated packet memory upon // True if we need to delete associated packet memory upon
// destruction. // destruction.

2
src/logging/Manager.cc
View file

@ -1515,7 +1515,7 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
// Create the RotationInfo record. // Create the RotationInfo record.
auto info = make_intrusive<RecordVal>(zeek::BifType::Record::Log::RotationInfo); auto info = make_intrusive<RecordVal>(zeek::BifType::Record::Log::RotationInfo);
info->Assign(0, winfo->type->Ref()); info->Assign(0, {NewRef{}, winfo->type});
info->Assign(1, make_intrusive<StringVal>(new_name)); info->Assign(1, make_intrusive<StringVal>(new_name));
info->Assign(2, make_intrusive<StringVal>(winfo->writer->Info().path)); info->Assign(2, make_intrusive<StringVal>(winfo->writer->Info().path));
info->Assign(3, make_intrusive<Val>(open, TYPE_TIME)); info->Assign(3, make_intrusive<Val>(open, TYPE_TIME));

6
src/supervisor/Supervisor.cc
View file

@ -1131,8 +1131,8 @@ IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
rval->Assign(rt->FieldOffset("scripts"), std::move(scripts_val)); rval->Assign(rt->FieldOffset("scripts"), std::move(scripts_val));
const auto& tt = rt->GetFieldType("cluster"); auto tt = rt->GetFieldType<TableType>("cluster");
auto cluster_val = new TableVal({NewRef{}, tt->AsTableType()}); auto cluster_val = make_intrusive<TableVal>(std::move(tt));
rval->Assign(rt->FieldOffset("cluster"), cluster_val); rval->Assign(rt->FieldOffset("cluster"), cluster_val);
for ( const auto& e : cluster ) for ( const auto& e : cluster )
@ -1316,7 +1316,7 @@ IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
{ {
auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status); auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status);
const auto& tt = zeek::BifType::Record::Supervisor::Status->GetFieldType("nodes"); const auto& tt = zeek::BifType::Record::Supervisor::Status->GetFieldType("nodes");
auto node_table_val = new TableVal(cast_intrusive<TableType>(tt)); auto node_table_val = make_intrusive<TableVal>(cast_intrusive<TableType>(tt));
rval->Assign(0, node_table_val); rval->Assign(0, node_table_val);
if ( node_name.empty() ) if ( node_name.empty() )

2
src/supervisor/supervisor.bif
View file

@ -86,7 +86,7 @@ function Supervisor::__node%(%): Supervisor::NodeConfig
builtin_error("not a supervised process"); builtin_error("not a supervised process");
const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig; const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig;
auto rval = make_intrusive<RecordVal>(rt); auto rval = make_intrusive<RecordVal>(rt);
rval->Assign(rt->FieldOffset("name"), new StringVal("<invalid>")); rval->Assign<StringVal>(rt->FieldOffset("name"), "<invalid>");
return rval; return rval;
} }

8
src/util.cc
View file

@ -1857,10 +1857,10 @@ FILE* rotate_file(const char* name, RecordVal* rotate_info)
// Init rotate_info. // Init rotate_info.
if ( rotate_info ) if ( rotate_info )
{ {
rotate_info->Assign(0, new StringVal(name)); rotate_info->Assign<StringVal>(0, name);
rotate_info->Assign(1, new StringVal(newname)); rotate_info->Assign<StringVal>(1, newname);
rotate_info->Assign(2, new Val(network_time, TYPE_TIME)); rotate_info->Assign<Val>(2, network_time, TYPE_TIME);
rotate_info->Assign(3, new Val(network_time, TYPE_TIME)); rotate_info->Assign<Val>(3, network_time, TYPE_TIME);
} }
return newf; return newf;

12
src/zeek.bif
View file

@ -3864,7 +3864,7 @@ static bool mmdb_lookup_asn(const IPAddr& addr, MMDB_lookup_result_s& result)
return mmdb_lookup(addr, result, true); return mmdb_lookup(addr, result, true);
} }
static Val* mmdb_getvalue(MMDB_entry_data_s* entry_data, int status, static IntrusivePtr<Val> mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
int data_type ) int data_type )
{ {
switch (status) switch (status)
@ -3875,16 +3875,16 @@ static Val* mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
switch (data_type) switch (data_type)
{ {
case MMDB_DATA_TYPE_UTF8_STRING: case MMDB_DATA_TYPE_UTF8_STRING:
return new StringVal(entry_data->data_size, return make_intrusive<StringVal>(entry_data->data_size,
entry_data->utf8_string); entry_data->utf8_string);
break; break;
case MMDB_DATA_TYPE_DOUBLE: case MMDB_DATA_TYPE_DOUBLE:
return new Val(entry_data->double_value, TYPE_DOUBLE); return make_intrusive<Val>(entry_data->double_value, TYPE_DOUBLE);
break; break;
case MMDB_DATA_TYPE_UINT32: case MMDB_DATA_TYPE_UINT32:
return val_mgr->Count(entry_data->uint32).release(); return val_mgr->Count(entry_data->uint32);
default: default:
break; break;
@ -4111,8 +4111,8 @@ function lookup_asn%(a: addr%) : count
// Get Autonomous System Number // Get Autonomous System Number
status = MMDB_get_value(&result.entry, &entry_data, status = MMDB_get_value(&result.entry, &entry_data,
"autonomous_system_number", nullptr); "autonomous_system_number", nullptr);
Val* asn = mmdb_getvalue(&entry_data, status, MMDB_DATA_TYPE_UINT32); auto asn = mmdb_getvalue(&entry_data, status, MMDB_DATA_TYPE_UINT32);
return asn == nullptr ? val_mgr->Count(0) : IntrusivePtr<Val>{AdoptRef{}, asn}; return asn == nullptr ? val_mgr->Count(0) : asn;
} }
#else // not USE_GEOIP #else // not USE_GEOIP