Commit graph

65 commits

Author SHA1 Message Date
Tim Wojtulewicz
40ecede4ea Move Location to zeek::detail and BroObj to zeek 2020-06-30 21:12:26 -07:00
Tim Wojtulewicz
d6f1ea16ac Move Func and associated classes into zeek::detail namespace 2020-06-30 20:51:58 -07:00
Tim Wojtulewicz
937a462e70 Move Frame and Scope to zeek::detail namespace 2020-06-30 20:51:53 -07:00
Tim Wojtulewicz
64332ca22c Move all Val classes to the zeek namespaces 2020-06-30 20:48:09 -07:00
Tim Wojtulewicz
ec9eff0bd5 Use type aliases for IntrusivePtr definitions 2020-06-30 20:37:30 -07:00
Tim Wojtulewicz
9364e6a5b7 Move IntrusivePtr and utility methods to the zeek namespace 2020-06-30 20:19:12 -07:00
Jon Siwek
4668378d91 Merge remote-tracking branch 'origin/topic/timw/1032-namespaced-enums'
Merge adjustments:
- Added back in deprecation tag for base_type_no_ref()
- Added back the deprecated plugin::hook_name() function

* origin/topic/timw/1032-namespaced-enums:
  Deprecate plugin::HookType and plugin::component::Type in a different way
  Deprecate init_class and IDScope in another way.
  Deprecate TypeTag and friends in a different way
  Deprecate attr_tag in a different way, rename to AttrTag
2020-06-30 16:55:36 -07:00
Tim Wojtulewicz
b1b1ec5171 Deprecate plugin::HookType and plugin::component::Type in a different way 2020-06-30 13:38:39 -07:00
Jon Siwek
d4f3cad7d1 Merge remote-tracking branch 'origin/topic/timw/266-namespaces'
Merge adjustments:

- Preserved original `base_type_no_ref` argument type as ::TypeTag
- Removed superfluous #pragma guard around deprecated TableVal ctor
- Clarify NEWS regarding MetaHook{Pre,Post} deprecations
- Simplify some `::zeek::` qualifications to just `zeek::`
- Prefixed FORWARD_DECLARE_NAMESPACED macro with ZEEK_

* origin/topic/timw/266-namespaces:
  Disable some deprecation diagnostics for GCC
  Rename BroType to Type
  Update NEWS
  Review cleanup
  Move Type types to zeek namespace
  Move Flare/Pipe from the bro namespace to zeek::detail
  Move Attr to the zeek::detail namespace
  Move Trigger into the zeek::detail namespace
  Move ID to the zeek::detail namespace
  Move Anon.h into zeek::detail namespace
  Mark all of the aliased classes in plugin/Plugin.h deprecated, and fix all of the plugins that were using them
  Move all of the base plugin classes into the zeek::plugin namespace
  Expr: move all classes into zeek::detail
  Stmt: move Stmt classes into zeek::detail namespace
  Add utility macro for creating namespaced aliases for classes
2020-06-11 23:20:51 -07:00
Tim Wojtulewicz
149e3b3c32 Disable some deprecation diagnostics for GCC
Clang automatically disables deprecation warnings for types used within
already-deprecated contexts, such as if you use a deprecated type inside
of a method that's beeen marked as deprecated. GCC doesn't have this
feature so it spews a lot more warnings. These functions are now wrapped
in pragmas that disable the warnings for the usage.
2020-06-11 15:43:11 -07:00
Tim Wojtulewicz
7a5dae4354 Mark all of the aliased classes in plugin/Plugin.h deprecated, and fix all of the plugins that were using them 2020-06-03 15:16:18 -07:00
Tim Wojtulewicz
e77e8c4b7b Move all of the base plugin classes into the zeek::plugin namespace 2020-06-03 15:16:18 -07:00
Jon Siwek
272db640aa Deprecate Plugin::HookCallFunction(), replace with HookFunctionCall()
This also changes the argument type of Func::operator() to zeek::Args*
to allow plugins to be able to alter function arguments in place as
was previously documented.
2020-05-22 21:01:38 -07:00
Jon Siwek
4e1ac4e124 Use vector<IntrusivePtr<Val>> for Func::Call and Event queuing args
This change may break BIFs that use @ARGS@, @ARG@, or @ARGC@ since their
types have changed.
2020-03-24 16:50:18 -07:00
Max Kellermann
0db61f3094 include cleanup
The Zeek code base has very inconsistent #includes.  Many sources
included a few headers, and those headers included other headers, and
in the end, nearly everything is included everywhere, so missing
#includes were never noticed.  Another side effect was a lot of header
bloat which slows down the build.

First step to fix it: in each source file, its own header should be
included first to verify that each header's includes are correct, and
none is missing.

After adding the missing #includes, I replaced lots of #includes
inside headers with class forward declarations.  In most headers,
object pointers are never referenced, so declaring the function
prototypes with forward-declared classes is just fine.

This patch speeds up the build by 19%, because each compilation unit
gets smaller.  Here are the "time" numbers for a fresh build (with a
warm page cache but without ccache):

Before this patch:

 3144.94user 161.63system 3:02.87elapsed 1808%CPU (0avgtext+0avgdata 2168608maxresident)k
 760inputs+12008400outputs (1511major+57747204minor)pagefaults 0swaps

After this patch:

 2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
 72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps
2020-02-04 20:51:02 +01:00
Dominik Charousset
c1f3fe7829 Switch from header guards to pragma once 2019-09-17 14:10:30 +02:00
Jon Siwek
dfed213f31 Deprecate functions with "bro" in them.
* "bro_is_terminating" is now "zeek_is_terminating"

* "bro_version" is now "zeek_version"

The old function names still exist for now, but are deprecated.
2019-06-05 16:18:57 -07:00
Robin Sommer
789cb376fd GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
This also installs symlinks from "zeek" and "bro-config" to a wrapper
script that prints a deprecation warning.

The btests pass, but this is still WIP. broctl renaming is still
missing.

#239
2019-05-01 21:43:45 +00:00
Jon Siwek
92739c1b44 Merge branch 'issues/152' of https://github.com/JonZeolla/bro into dev/2.7
* 'issues/152' of https://github.com/JonZeolla/bro:
  Bro plugins should support a patch version (x.y.z)
2018-10-03 14:32:10 -05:00
Jon Zeolla
615ff78282 Bro plugins should support a patch version (x.y.z) 2018-09-30 20:30:22 -04:00
Johanna Amann
41285abea5 Make nearly all bool operators explicit.
These are a bit dangerous because the casting can happen in quite
unexpected circumstances and lead to undesirable comparison results.
2018-01-18 14:02:03 -08:00
Jon Siwek
787b1e6bf2 Merge branch 'topic/corelight/reporter-hook' of https://github.com/corelight/bro
* 'topic/corelight/reporter-hook' of https://github.com/corelight/bro:
  Add reporter hook.
2017-11-21 12:28:52 -06:00
Johanna Amann
b852437126 Add reporter hook.
The hook being added is:

bool HookReporter(const std::string& prefix, const EventHandlerPtr event,
                  const Connection* conn, const val_list* addl, bool location,
                  const Location* location1, const Location* location2,
                  bool time, const std::string& buffer) override;

This hook gives access to basically all information that is available in
the function in Reporter.cc that performs the logging. The hook is
called each time when anything passes through the reporter in the cases
in which an event usually would be called. This includes weirds. The
hook can return false to prevent the normal reporter events from being
raised.
2017-11-16 13:02:12 -08:00
Johanna Amann
91dcefe104 Fix and extend behavior of HookLoadFile
This commit fixes and extends the behavior of HookLoadFile. Before this
change, HookLoadFile appended ".bro" to each path that was @loaded, even
if the path specified directory names. Furthermore it only gave the path
of the file as it was specified in the Bro script without revealing the
final path of the file that it was going to load.

This patch changes this behavior - in addition to giving the unmodified
path given in the @load command, the hook now returns the resolved path
of the file or directory it is going to load (if found). The hook is
furthermore raises for @load-sigs and @load-plugin; a enum specifies the
kind of load that is happening.
2017-11-16 12:31:27 -08:00
Johanna Amann
089f87d8da Merge remote-tracking branch 'origin/topic/robin/plugin-version-check'
I added another small change - since we are inlining Configure(), we can
just set bro_plugin directly to BRO_PLUGIN_BRO_VERSION in
src/plugin/Plugin.h, instead of depending on the plugin to do it. This
also means we do not need to change init-plugin in bro-aux at this
moment.

BIT-1828 #closed

* origin/topic/robin/plugin-version-check:
  Adding plugin API number into versioned function name, and removing old runtime API version check.
  Extend plugin infrastructure to catch Bro version mismatches at link time.
2017-07-25 16:14:49 -07:00
Robin Sommer
78f8ff432f Adding plugin API number into versioned function name, and removing
old runtime API version check.
2017-07-21 13:25:56 -07:00
Robin Sommer
8ae30d8aac Extend plugin infrastructure to catch Bro version mismatches at link
time.

People keep running into the problem that they upgrade Bro but forget
to recompile their plugins--which can lead to crashes. While the
plugins' API version was supposed to catch this, it's not reliable as
that check may come too late. This change takes a different tack: We
compile a C function into the Bro binary that has Bro's version number
encoded into its name. A plugin can then reference that function. If
the Bro version changes, the function goes away and the plugin won't
load anymore.

I've integrated that function reference into the plugin skeleton code
so that new plugins get it automatically (unless explicitly removed).
I couldn't see a way to do it transparently for already existing
plugins unfortunately.

The version number used for the function name is slightly normalized
to skip any git revision postfixes (i.e., "2.5-xxx" is always treated
as "2.5-git") so that one doesn't need to recompile all plugins after
every master commit. That seems good enough, usually people run into
this when upgrading to a new release.

If one loads an old plugin into a new Bro, the error message looks
like this:

    $ bro -NN Demo::Foo
    fatal error in /home/robin/bro/master/scripts/base/init-bare.bro, line 1:
    cannot load plugin library /home/robin/tmp/p/build//lib/Demo-Foo.linux-x86_64.so:
    /home/robin/tmp/p/build//lib/Demo-Foo.linux-x86_64.so: undefined symbol: bro_version_2_5_git_debug

Not the prettiest, but better than a crash!

TODO: I'm still unsure if we should remove the plugin API version
altogetger now. This link-time check should catch everything the API
version does, except for master commits.
2017-07-07 15:58:05 -07:00
Jon Siwek
874d2b9fb0 Merge branch 'topic/corelight/logging-hooks' of https://github.com/corelight/bro
* 'topic/corelight/logging-hooks' of https://github.com/corelight/bro:
  Plugin: Add hooks for log init and writing.
2017-05-04 11:44:43 -05:00
Johanna Amann
684ea8aa37 Plugin: Add hooks for log init and writing.
The two hooks being added are:

void HookLogInit(const std::string& writer, const std::string& instantiating_filter, bool local, bool remote, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields);

which is called when a writer is being instantiated and contains
information about the fields being logged, as well as

bool HookLogWrite(const std::string& writer, const std::string& filter, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields, threading::Value** vals);

which is called for each log line being written by each writer. It
contains all the data being written. The data can be changed in the
function call and lines can be prevented from being written.

This commit also fixes a few small problems with plugin hooks itself,
and extends the tests that were already there, besides introducing tests
for the added functionality.
2017-04-24 14:02:05 -07:00
Johanna Amann
5b76366199 Plugin: add/fix documentation for HookSetupAnalyzerTree 2017-02-23 15:00:27 -08:00
Johanna Amann
fb3bc05df5 Merge remote-tracking branch 'origin/topic/johanna/component-initialization-order'
* origin/topic/johanna/component-initialization-order:
  Make tags generated during component initialization stable.
2016-08-11 21:50:53 -07:00
Johanna Amann
65d977f278 Make tags generated during component initialization stable.
The order in which the plugin initializers are executed is compiler
dependent. With this change, Tags will always be generated in
alphabetical ordering, not in compiler-dependent order.
2016-08-11 19:48:53 -07:00
Robin Sommer
c91792b762 Merge branch 'topic/jswaro/feature/HookAddToAnalyzer-tcprs-support' of https://github.com/jswaro/bro
Making two changes here:

    - Renaming the hook to SetupAnalyzerTree.

    - Reverting the reversal of the script load order. Instead, I'm
      adding an additional script that Bro looks for to load first,
      "__preload__.bro". Also extending the plugin docs to cover this.

    - Increasing plugin API version, as I suppose adding a new virtual
      function may invalidate binary compatibility.

* 'topic/jswaro/feature/HookAddToAnalyzer-tcprs-support' of https://github.com/jswaro/bro:
  Add hook 'HookAddToAnalyzerTree' to support TCPRS plugin
2015-08-10 15:05:48 -07:00
Robin Sommer
3957091e1b Renaming config.h to bro-config.h.
A couple times now I had this conflicting with files of the same name
in other projects.
2015-07-28 11:57:04 -07:00
James Swaro
85fd1c9fa7 Add hook 'HookAddToAnalyzerTree' to support TCPRS plugin
This commit introduces a new hook, HookAddToAnalyzerTree, which
allows plugins to add a new analyzer to the analyzer tree during
analyzer tree creation. This hook is necessary to support the
TCPRS plugin.

Additionally, the order in which the scripts were loaded has been
changed to address a problem with undefined variable errors due
to load order issues.

Signed-off-by: James Swaro <james.swaro@gmail.com>
2015-07-26 13:32:24 -05:00
Robin Sommer
10b61b1d16 Increasing plugin API version.
The layer 2 updates introduced some API changes.
2015-07-22 06:53:20 -07:00
Robin Sommer
6fa03abdbc Merge remote-tracking branch 'origin/topic/gilbert/plugin-api-tweak'
* origin/topic/gilbert/plugin-api-tweak:
  Updating plugin.hooks baseline so that test succeeds
  Revert spacing change that shouldn't have been included with the previous changeset ... should fix all of the plugin tests save hooks, which needs to be updated.
  More small fixes
  Small fixes
  Incremental
  Re-updating plugin.hooks test to include new argument output (after merge).
  Fixing logic errors in HandlePluginResult
  Updating tests and tweaking HookArgument to include Frame support.
  Incremental commit: implementing a wrapper for the Val class.
  Reverting change to const status of network_time.  Also, see FIXME: in Func.cc / HandlePluginResult ...
  Tweaks to result handling to make things a little more sane.
  Plugin API: minor change (adding parent frame) to support calling methods from hook.  Also declare network time update argument to be const because good practice.

BIT-1270 #merged

Conflicts:
	testing/btest/Baseline/plugins.hooks/output
2015-03-02 18:17:52 -08:00
Gilbert Clark
7eadcad674 Merge branch 'master' into topic/gilbert/plugin-api-tweak
Conflicts:
	testing/btest/Baseline/plugins.api-version-mismatch/output
	testing/btest/Baseline/plugins.hooks/output
	testing/btest/plugins/api-version-mismatch.sh
2014-11-24 16:21:23 -05:00
Gilbert Clark
6055b56f5c Incremental 2014-11-24 14:28:17 -05:00
Gilbert Clark
70c7258dfa Updating tests and tweaking HookArgument to include Frame support.
* Add frame support to HookArgument, since it's a new argument to HookCallFunction
* Fix test in api-version-mismatch to remove absolute paths from output
* Update test plugin to use new HookCallFunction interface
2014-10-02 19:23:59 -04:00
Gilbert Clark
0104d7147d Merging master into branch.
Merge branch 'master' into topic/gilbert/plugin-api-tweak
2014-10-01 21:19:02 -04:00
Gilbert Clark
d639488d36 Incremental commit: implementing a wrapper for the Val class.
Just a checkpoint: need to add / update tests to make sure things work as expected.  Should build / pass core btests, though.
2014-09-27 08:03:30 -04:00
Gilbert Clark
8d04f58eda Reverting change to const status of network_time. Also, see FIXME: in Func.cc / HandlePluginResult ... 2014-09-19 21:55:47 -04:00
Gilbert Clark
2446a942e0 Plugin API: minor change (adding parent frame) to support calling methods from hook. Also declare network time update argument to be const because good practice. 2014-09-04 20:41:44 -04:00
Robin Sommer
caa55ad352 Moving Pkt{Src,Dumper} a directory level up.
Also renaming PktSourceComponent to PktSrcComponent.
2014-08-22 16:46:15 -07:00
Robin Sommer
bf6dd2e9ca Merge remote-tracking branch 'origin/master' into topic/robin/pktsrc
Conflicts:
	configure
	src/CMakeLists.txt
	src/Net.cc
	src/PacketSort.cc
	src/PacketSort.h
	src/RemoteSerializer.cc
	src/Sessions.cc
	src/Sessions.h
2014-08-22 15:41:42 -07:00
Robin Sommer
382b946098 Adding missing check that a plugin's API version matches what Bro defines. 2014-07-31 10:09:03 -07:00
Jon Siwek
69b1ba653d Minor adjustments to plugin code/docs.
Mostly whitespace/typos.
Moved some Plugin methods out from public access.
2014-07-30 16:48:23 -05:00
Robin Sommer
60cf0ddf26 Polishing, mostly documentation updates. 2014-06-17 11:50:23 -07:00
Robin Sommer
d88b333353 A number of smaller API extensions to provide plugins with access to
information.
2014-05-29 18:15:14 -07:00