Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Reformat Zeek in Spicy style

Browse source 
This largely copies over Spicy's `.clang-format` configuration file. The
one place where we deviate is header include order since Zeek depends on
headers being included in a certain order.
This commit is contained in:
Benjamin Bannier 2023-10-10 21:13:34 +02:00
parent 7b8e7ed72c
commit f5a76c1aed
786 changed files with 131714 additions and 153609 deletions
Download patch file Download diff file Expand all files Collapse all files

136
src/RuleCondition.h
View file

@ -1,139 +1,115 @@
#pragma once
#include <sys/types.h> // for u_char
#include <cstdint> // for u_char
#include <cstdint> // for u_char
#include "zeek/util.h"
namespace zeek::detail
{
namespace zeek::detail {
class RuleEndpointState;
class Rule;
class ID;
// Base class for all rule conditions except patterns and "header".
class RuleCondition
{
class RuleCondition {
public:
RuleCondition() { }
virtual ~RuleCondition() { }
RuleCondition() {}
virtual ~RuleCondition() {}
virtual bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) = 0;
virtual bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) = 0;
virtual void PrintDebug() = 0;
};
virtual void PrintDebug() = 0;
};
enum RuleStateKind
{
RULE_STATE_ESTABLISHED = 1,
RULE_STATE_ORIG = 2,
RULE_STATE_RESP = 4,
RULE_STATE_STATELESS = 8
};
enum RuleStateKind { RULE_STATE_ESTABLISHED = 1, RULE_STATE_ORIG = 2, RULE_STATE_RESP = 4, RULE_STATE_STATELESS = 8 };
// Implements the "tcp-state" keyword.
class RuleConditionTCPState : public RuleCondition
{
class RuleConditionTCPState : public RuleCondition {
public:
explicit RuleConditionTCPState(int arg_tcpstates) { tcpstates = arg_tcpstates; }
explicit RuleConditionTCPState(int arg_tcpstates) { tcpstates = arg_tcpstates; }
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
void PrintDebug() override;
void PrintDebug() override;
private:
int tcpstates;
};
int tcpstates;
};
// Implements the "udp-state" keyword.
class RuleConditionUDPState : public RuleCondition
{
class RuleConditionUDPState : public RuleCondition {
public:
explicit RuleConditionUDPState(int arg_states) { states = arg_states; }
explicit RuleConditionUDPState(int arg_states) { states = arg_states; }
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
void PrintDebug() override;
void PrintDebug() override;
private:
int states;
};
int states;
};
// Implements "ip-options".
class RuleConditionIPOptions : public RuleCondition
{
class RuleConditionIPOptions : public RuleCondition {
public:
enum Options
{
OPT_LSRR = 1,
OPT_LSRRE = 2,
OPT_RR = 4,
OPT_SSRR = 8,
};
enum Options {
OPT_LSRR = 1,
OPT_LSRRE = 2,
OPT_RR = 4,
OPT_SSRR = 8,
};
explicit RuleConditionIPOptions(int arg_options) { options = arg_options; }
explicit RuleConditionIPOptions(int arg_options) { options = arg_options; }
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
void PrintDebug() override;
void PrintDebug() override;
private:
int options;
};
int options;
};
// Implements "same-ip".
class RuleConditionSameIP : public RuleCondition
{
class RuleConditionSameIP : public RuleCondition {
public:
RuleConditionSameIP() { }
RuleConditionSameIP() {}
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
void PrintDebug() override;
};
void PrintDebug() override;
};
// Implements "payload-size".
class RuleConditionPayloadSize : public RuleCondition
{
class RuleConditionPayloadSize : public RuleCondition {
public:
enum Comp
{
RULE_LE,
RULE_GE,
RULE_LT,
RULE_GT,
RULE_EQ,
RULE_NE
};
enum Comp { RULE_LE, RULE_GE, RULE_LT, RULE_GT, RULE_EQ, RULE_NE };
RuleConditionPayloadSize(uint32_t arg_val, Comp arg_comp)
{
val = arg_val;
comp = arg_comp;
}
RuleConditionPayloadSize(uint32_t arg_val, Comp arg_comp) {
val = arg_val;
comp = arg_comp;
}
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
void PrintDebug() override;
void PrintDebug() override;
private:
uint32_t val;
Comp comp;
};
uint32_t val;
Comp comp;
};
// Implements "eval" which evaluates the given Zeek identifier.
class RuleConditionEval : public RuleCondition
{
class RuleConditionEval : public RuleCondition {
public:
explicit RuleConditionEval(const char* func);
explicit RuleConditionEval(const char* func);
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
bool DoMatch(Rule* rule, RuleEndpointState* state, const u_char* data, int len) override;
void PrintDebug() override;
void PrintDebug() override;
private:
ID* id;
};
ID* id;
};
} // namespace zeek::detail
} // namespace zeek::detail