Commit graph

22 commits

Author SHA1 Message Date
Tim Wojtulewicz
4ad08172d0 Remove obsolete ZEEK_FORWARD_DECLARE_NAMESPACED macros 2021-02-24 14:35:44 -07:00
Tim Wojtulewicz
96d9115360 GH-1079: Use full paths starting with zeek/ when including files 2020-11-12 12:15:26 -07:00
Tim Wojtulewicz
fe0c22c789 Base: Clean up explicit uses of namespaces in places where they're not necessary.
This commit covers all of the common and base classes.
2020-08-24 12:07:00 -07:00
Tim Wojtulewicz
046eb58b75 Merge remote-tracking branch 'origin/topic/timw/266-namespaces-part4'
* origin/topic/timw/266-namespaces-part4: (34 commits)
  Add missing namespace to usage of get_exe_path in fuzzer
  Rename methods in RunState to remove 'net' from their names
  Move zeek::net namespace to zeek::run_state namespace.
  Move ScannedFile class and associated globals into ScannedFile.h and out of Net.h and scan.l
  Rename types in ZeekList.h to be consistent with the style guide
  Move NetVar from zeek to zeek::detail namespace
  Remove PRI_PTR_COMPAT macros
  Fix indentation of namespaced aliases
  Move zeek-setup code into namespaces
  Move ZeekList types to zeek namespace
  Move __RegisterBif from zeek::detail::plugin to zeek::plugin::detail
  Remove unimplemented zeek_magic_path/bro_magic_path method
  Move all plugin classes into zeek::plugin::detail namespaces
  Rename BroList.h to ZeekList.h
  Move a few smaller files to zeek namespaces
  Tag the end of some namespaces for consistency
  Move a few of the zeek::util methods and variables to zeek::util::detail
  Move zeekygen code to zeek::zeekygen::detail namespace
  Mark zeek::util::pad_size as constexpr, which provides a small performance improvement
  Move everything in util.h to zeek::util namespace.
  ...
2020-08-21 08:37:38 -07:00
Tim Wojtulewicz
14408235b8 Move file_analysis code to zeek namespaces 2020-08-20 15:55:17 -07:00
Tim Wojtulewicz
117f243f18 Mark FileAssembler destructor as default, remove implementation 2020-08-19 15:26:32 -07:00
Tim Wojtulewicz
f597e925aa Remove a few protected or private no-op constructors 2020-08-19 15:19:01 -07:00
Tim Wojtulewicz
0355d13099 Move reassembler code to namespaces 2020-07-31 16:25:54 -04:00
Tim Wojtulewicz
393b8353cb file_analysis: Replace nulls with nullptr 2020-04-07 16:08:34 -07:00
Jon Siwek
1253a61340 Simplify reassembly code using DataBlockList::LastBlock() 2019-09-24 10:26:09 -07:00
Jon Siwek
69d1620374 Use DataBlock value instead of pointer in reassembly map 2019-09-13 14:17:41 -07:00
Jon Siwek
e1e779e90b Remove linked list from reassembly data structures
Everything, including iteration is now done via an std::map
2019-09-13 13:57:32 -07:00
Jon Siwek
b19c8fad7a Reorganize reassembly data structures
Started by factoring some details into a new DataBlockList class to at
least make it more clear where modifications occur.  More abstractions
likely to happen later as I experiment with alternate data structures
aimed at improving worse-case scenarios.
2019-09-11 16:25:34 -07:00
Tim Wojtulewicz
54752ef9a1 Deprecate the internal int/uint types in favor of the cstdint types they were based on 2019-08-12 13:50:07 -07:00
Johanna Amann
474efe9e69 Remove value serialization.
Note - this compiles, but you cannot run Bro anymore - it crashes
immediately with a 0-pointer access. The reason behind it is that the
required clone functionality does not work anymore.
2019-05-09 11:54:38 -07:00
Seth Hall
2b0a28686a Cleaned up stats collection.
- Removed the gap_report event.  It wasn't used anymore
   and functionally no more capable that scheduling events
   and using the get_gap_summary bif.

 - Added functionality to Dictionaries to count cumulative
   numbers of inserts performed.  This is further used to
   measure the total number of connections of various types.
   Previously only the number of active connections was
   available.

 - The Reassembler base class now tracks active reassembly
   size for all subclasses (File/TCP/Frag & unknown).

 - Improvements to the stats.log.  Mostly, more information.
2016-01-04 00:55:52 -05:00
Robin Sommer
f51dc5cbb8 Fixing (harmless) Coverity warning. 2015-01-17 08:07:18 -08:00
Jon Siwek
cbbe7b52dc Review/fix/change file reassembly functionality.
- Re-arrange how some fa_file fields (e.g. source, connection info, mime
  type) get updated/set for consistency.

- Add more robust mechanisms for flushing the reassembly buffer.
  The goal being to report all gaps and deliveries to file analyzers
  regardless of the state of the reassembly buffer at the time it has to
  be flushed.
2014-12-16 14:05:15 -06:00
Seth Hall
cafd35e746 Updates the files event api and brings file reassembly up to master. 2014-09-26 00:40:37 -04:00
Seth Hall
fb0a658a7c Merge remote-tracking branch 'origin/master' into topic/seth/files-tracking
Conflicts:
	src/Reassem.cc
	src/Reassem.h
	src/analyzer/protocol/tcp/TCP_Reassembler.cc
	testing/btest/Baseline/scripts.base.frameworks.file-analysis.bifs.set_timeout_interval/bro..stdout
	testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/b.out
	testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/c.out
	testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/files.log
2014-05-17 02:12:52 -04:00
Seth Hall
38dbba7622 More file reassembly work.
- The reassembly behavior can be modified per-file by enabling or
   disabling the reassembler and/or modifying the size of the reassembly
   buffer.

 - Changed the file extraction analyzer to use the stream to avoid
   issues with the chunk based approach not immediately triggering
   the file_new event due to mime-type detection delay.  Early chunks
   frequently ended up lost before.

 - Generally things are working now and I'd consider this in testing.
2014-01-05 04:58:01 -05:00
Seth Hall
0b78f444a1 Initial commit of file reassembly. 2013-12-20 00:05:08 -05:00