Commit graph

121 commits

Author SHA1 Message Date
Tim Wojtulewicz
a2a435360a Move all of the hashing classes/functions to zeek::detail namespace 2020-07-31 16:23:34 -04:00
Tim Wojtulewicz
45b5a98420 Move EventMgr, EventHandler, and EventRegistry code to zeek namespace. Rename mgr to event_mgr. 2020-07-31 16:23:32 -04:00
Tim Wojtulewicz
bfab224d7c Move Reporter to zeek namespace 2020-07-31 16:22:41 -04:00
Tim Wojtulewicz
382812298d Move all of the rule matching code to zeek::detail 2020-07-31 16:22:04 -04:00
Tim Wojtulewicz
9400b863ea Move all base analyzer classes to zeek::analyzer namespace 2020-07-31 16:21:46 -04:00
Tim Wojtulewicz
736a3f53d4 Rename BroString to zeek::String 2020-07-02 16:15:01 -07:00
Tim Wojtulewicz
86fdf0eaa9 Mark global val_mgr as deprecated and fix uses of it to use namespaced version 2020-07-02 16:15:00 -07:00
Tim Wojtulewicz
58c6e10b62 Move BroString to zeek namespace 2020-06-30 21:12:26 -07:00
Tim Wojtulewicz
64332ca22c Move all Val classes to the zeek namespaces 2020-06-30 20:48:09 -07:00
Tim Wojtulewicz
ec9eff0bd5 Use type aliases for IntrusivePtr definitions 2020-06-30 20:37:30 -07:00
Tim Wojtulewicz
9364e6a5b7 Move IntrusivePtr and utility methods to the zeek namespace 2020-06-30 20:19:12 -07:00
Tim Wojtulewicz
ed13972924 Move Type types to zeek namespace 2020-06-09 17:20:45 -07:00
Jon Siwek
b1042e2824 Port remaining file analysis API to use IntrusivePtr 2020-05-22 16:32:40 -07:00
Jon Siwek
57a6069cd1 Deprecate file analyzer construction methods taking raw RecordVal*
Replaced with versions that instead take IntrusivePtr
2020-05-22 16:13:15 -07:00
Jon Siwek
27c3c207e4 Change file_analysis::File::GetID() to return const-ref 2020-05-22 00:22:17 -07:00
Jon Siwek
85a0ddd62d Deprecate TableVal::Lookup(), replace with Find()/FindOrDefault() 2020-05-20 18:00:50 -07:00
Jon Siwek
4debad8caf Switch zeek:🆔:lookup to zeek:🆔:find
For parity with Scope since it now uses Find instead of Lookup
2020-05-14 18:00:18 -07:00
Jon Siwek
a5762c12cc Move various elements into ID.h and zeek::id namespace
* A handful of generic/useful/common global type pointers that used
  to be in NetVar.h

* Lookup functions that used to be Var.h
2020-05-14 17:24:20 -07:00
Jon Siwek
9210d443d3 Trim the list of "global type pointers" from NetVar.h further
Most of them are deprecated now, with usage sites now doing the lookup
themselves.
2020-05-14 17:23:20 -07:00
Jon Siwek
c0986f0739 Deprecate global type pointers in NetVar.h
There's analogous IntrusivePtrs in zeek::vars
2020-05-14 17:23:20 -07:00
Jon Siwek
d4dba40727 Deprecate VectorVal(VectorType*) ctora
Adds a new one taking an IntrusivePtr.
2020-05-14 17:23:20 -07:00
Jon Siwek
a83941d64d Deprecate internal_val() and internal_const_val()
Replaced with zeek::lookup_val() and zeek::lookup_const()
2020-05-14 17:23:19 -07:00
Jon Siwek
1abed4fd4c Migrate Tag classes to use IntrusivePtr
Deprecates various methods that previously took raw pointers
2020-05-14 17:18:00 -07:00
Johanna Amann
04ed125941 Merge remote-tracking branch 'origin/master' into topic/johanna/hash-unification 2020-05-06 23:18:33 +00:00
Johanna Amann
3bce313b12 Switch file UID hashing from md5 to highwayhash.
This commit switches UID hashing from md5 to a highway hash. It also
moves the salt value out of the file plugin - and makes it
installation-specific instead - it is moved to the global namespace.

There now are digest hash functions to make "static"
installation-specific hashes that are stable over workers available to
everyone; hashes can be 64, 128 or 256 bits in size.

Due to the fact that we switch the file hashing algorithm, all file
hashes change.

The underlyigng algorithm that is used for hashing is highwayhash-128,
which is significantly faster than md5.
2020-04-30 10:20:09 -07:00
Jon Siwek
2a63e4a4a2 Deprecate BuildConnVal() methods and update usages to ConnVal()
The later being a new method that returns IntrusivePtr
2020-04-16 17:00:01 -07:00
Jon Siwek
094d6de979 Update all BIFs to return IntrusivePtr instead of Val* 2020-04-16 17:00:01 -07:00
Jon Siwek
93f4c5871b Update deprecated ValManager::GetCount usages 2020-04-16 16:46:36 -07:00
Jon Siwek
0ddac4abcf Update deprecated ValManager::GetInt usages 2020-04-16 16:44:35 -07:00
Jon Siwek
d9edd855da Update deprecated ValManager::GetBool usages 2020-04-16 16:44:33 -07:00
Johanna Amann
876c803d75 Merge remote-tracking branch 'origin/topic/timw/776-using-statements'
* origin/topic/timw/776-using-statements:
  Remove 'using namespace std' from SerialTypes.h
  Remove other using statements from headers
  GH-776: Remove using statements added by PR 770

Includes small fixes in files that changed since the merge request was
made.

Also includes a few small indentation fixes.
2020-04-09 13:31:07 -07:00
Tim Wojtulewicz
393b8353cb file_analysis: Replace nulls with nullptr 2020-04-07 16:08:34 -07:00
Tim Wojtulewicz
d53c1454c0 Remove 'using namespace std' from SerialTypes.h
This unfortunately cuases a ton of flow-down changes because a lot of other
code was depending on that definition existing. This has a fairly large chance
to break builds of external plugins, considering how many internal ones it broke.
2020-04-07 15:59:59 -07:00
Jon Siwek
6980f63a91 Deprecate EventMgr::QueueEventFast() and update usages to Enqueue() 2020-03-25 16:09:33 -07:00
Max Kellermann
ba35ebec4c Type: return IntrusivePtr 2020-03-06 09:06:38 +01:00
Max Kellermann
0a6ddfb6b5 Val: add TableVal::Assign() overload with IntrusivePtr
Prepare the transition to IntrusivePtr for various callers.
2020-03-06 09:06:38 +01:00
Max Kellermann
0cf5799ca6 file_analysis: include cleanup 2020-02-13 10:12:03 +01:00
Tim Wojtulewicz
5a237d3a3f Use const-references in lots of places (preformance-unnecessary-value-param) 2020-02-11 14:11:18 -08:00
Max Kellermann
0db61f3094 include cleanup
The Zeek code base has very inconsistent #includes.  Many sources
included a few headers, and those headers included other headers, and
in the end, nearly everything is included everywhere, so missing
#includes were never noticed.  Another side effect was a lot of header
bloat which slows down the build.

First step to fix it: in each source file, its own header should be
included first to verify that each header's includes are correct, and
none is missing.

After adding the missing #includes, I replaced lots of #includes
inside headers with class forward declarations.  In most headers,
object pointers are never referenced, so declaring the function
prototypes with forward-declared classes is just fine.

This patch speeds up the build by 19%, because each compilation unit
gets smaller.  Here are the "time" numbers for a fresh build (with a
warm page cache but without ccache):

Before this patch:

 3144.94user 161.63system 3:02.87elapsed 1808%CPU (0avgtext+0avgdata 2168608maxresident)k
 760inputs+12008400outputs (1511major+57747204minor)pagefaults 0swaps

After this patch:

 2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
 72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps
2020-02-04 20:51:02 +01:00
Jon Siwek
47235b57a6 Merge remote-tracking branch 'origin/topic/timw/deprecate-int-types'
* origin/topic/timw/deprecate-int-types:
  Deprecate the internal int/uint types in favor of the cstdint types they were based on

Merge adjustments:
  * A bpf type mistakenly got replaced (inside an unlikely #ifdef)
  * Did a few substitutions that got missed (likely due to
    pre-processing out of DEBUG macros)
2019-08-14 15:49:24 -07:00
Jon Siwek
87f85ecca1 Cleanups related to PDict -> std::map replacements 2019-08-13 19:57:42 -07:00
Tim Wojtulewicz
e6558d1f19 Remove other simple uses of PDict 2019-08-13 19:57:42 -07:00
Tim Wojtulewicz
54752ef9a1 Deprecate the internal int/uint types in favor of the cstdint types they were based on 2019-08-12 13:50:07 -07:00
Jon Siwek
b6862c5c59 Add methods to queue events without handler existence check
Added ConnectionEventFast() and QueueEventFast() methods to avoid
redundant event handler existence checks.

It's common practice for caller to already check for event handler
existence before doing all the work of constructing the arguments, so
it's desirable to not have to check for existence again.

E.g. going through ConnectionEvent() means 3 existence checks:
one you do yourself before calling it, one in ConnectionEvent(), and then
another in QueueEvent().

The existence check itself can be more than a few operations sometimes
as it needs to check a few flags that determine if it's enabled, has
a local body, or has any remote receivers in the old comm. system or
has been flagged as something to publish in the new comm. system.
2019-04-11 20:30:25 -07:00
Jon Siwek
8bc65f09ec Cleanup/improve PList usage and Event API
Majority of PLists are now created as automatic/stack objects,
rather than on heap and initialized either with the known-capacity
reserved upfront or directly from an initializer_list (so there's no
wasted slack in the memory that gets allocated for lists containing
a fixed/known number of elements).

Added versions of the ConnectionEvent/QueueEvent methods that take
a val_list by value.

Added a move ctor/assign-operator to Plists to allow passing them
around without having to copy the underlying array of pointers.
2019-04-11 20:30:25 -07:00
Johanna Amann
ffa6756255 Merge branch 'master' of https://github.com/rbclark/bro into topic/johanna/md5-fips
* 'master' of https://github.com/rbclark/bro:
  Tell OpenSSL that MD5 is not used for security in order to allow bro to work properly on a FIPS system
2019-01-18 15:34:06 -08:00
Robert Clark
a72e9a8126
Tell OpenSSL that MD5 is not used for security in order to allow bro to work properly on a FIPS system 2019-01-11 16:09:42 -05:00
Jon Siwek
2982765128 Pre-allocate and re-use Vals for bool, int, count, enum and empty string 2019-01-09 18:29:23 -06:00
Jon Siwek
05b10fe2e7 BIT-1544: allow NULs in file analysis handles 2018-08-15 18:03:02 -05:00
Johanna Amann
41285abea5 Make nearly all bool operators explicit.
These are a bit dangerous because the casting can happen in quite
unexpected circumstances and lead to undesirable comparison results.
2018-01-18 14:02:03 -08:00