Commit graph

102 commits

Author SHA1 Message Date
Jon Siwek
c44cbe1feb Prefix #includes of .bif.h files with zeek/
This enables locating the headers within the install-tree using the
dirs provided by `zeek-config --include_dir`.

To enable locating these headers within the build-tree, this change also
creates a 'build/src/include/zeek -> ..' symlink.
2021-02-02 19:15:05 -08:00
Tim Wojtulewicz
5f09793ce1 Remove Plugin::HookCallFunction and fix tests related to it 2021-01-27 10:52:40 -07:00
Tim Wojtulewicz
0618be792f Remove all of the random single-file deprecations
These are the changes that don't require a ton of changes to other files outside
of the original removal.
2021-01-27 10:52:40 -07:00
Tim Wojtulewicz
7e9d89db0a Remove all fully-deprecated files 2021-01-27 10:52:40 -07:00
Jon Siwek
3605e04d83 Update minimum required CMake to 3.5
Also now uses CMake's ENABLE_EXPORTS target property for the zeek
executable to ensure symbols are visible to plugins.  Prior to CMake
3.4, the policy was to export symbols by default for certain platforms,
but later versions need either the explicit target property or policy.
2020-12-01 22:13:52 -08:00
Tim Wojtulewicz
e27008ef26 GH-1184: Add 'source' field to weird log denoting where the weird was reported 2020-12-01 09:34:37 -07:00
Robin Sommer
b780bc146f Fix use of deprecated functionality in test. 2020-11-24 17:00:20 +00:00
Robin Sommer
3ebfcdf0ae Add test creating multiple plugins with load dependencies.
If we load plugins purely alphabetically, the 1st Zeek run in the test
will success while the 2nd will fail.
2020-11-24 16:59:11 +00:00
Tim Wojtulewicz
c3cf36e135 GH-1221: Add unknown_protocols.log for logging packet analyzer lookup failures 2020-11-09 20:37:26 -07:00
Tim Wojtulewicz
cd06bf34c7 GH-1215: Remove dispatch_map from packet analysis, replace with BIF methods for registering dispatches 2020-11-02 19:03:25 +00:00
Jan Grashoefer
7ede4f48bd Simplify packet analyzer config. 2020-09-23 11:13:29 -07:00
Jan Grashoefer
d51252bb3f Extend packet analysis test. 2020-09-23 11:13:29 -07:00
Jan Grashoefer
38337d799b Improve packet analysis data flow. 2020-09-23 11:13:29 -07:00
Jan Grashoefer
90eb97876f Improve packet analyzer API. 2020-09-23 11:13:28 -07:00
Jan Grashoefer
6365fa6d80 Migrate all packet analyzers to new API. 2020-09-23 11:13:28 -07:00
Jan Grashoefer
96d0e11bb8 Move cur_pos from packet into packet manager loop. 2020-09-23 11:13:28 -07:00
Tim Wojtulewicz
c2500d03d6 Remove packet_analysis/Defines.h
- Replace uses of identifier_t with uint32_t
- Replace repeated usage of tuple type for Analysis results with type alias
2020-09-23 11:13:28 -07:00
Tim Wojtulewicz
bd6d3e0112 Remove enabled state from Components, ability to enable/disable from Manager 2020-09-23 11:13:28 -07:00
Tim Wojtulewicz
f39d6bb4c4 Use shared_ptr instead of raw pointers in packet_analysis for analyzers and dispatchers 2020-09-23 11:13:28 -07:00
Jan Grashoefer
e53ec46c23 Renamed LL-Analyzers to Packet Analyzers. 2020-09-23 11:13:28 -07:00
Peter Oettig
b2e6c9ac9a Initial implementation of Lower-Level analyzers 2020-09-23 11:13:25 -07:00
Tim Wojtulewicz
874e170341 Update plugin btests for namespace changes 2020-08-24 12:07:03 -07:00
Jon Siwek
ccf8e271a1 Adjust more btest timings 2020-08-11 11:26:22 -07:00
Jon Siwek
7967a5b0aa General btest cleanup
- Use `-b` most everywhere, it will save time.

- Start some intel tests upon the input file being fully read instead of
  at an arbitrary time.

- Improve termination condition for some sumstats/cluster tests.

- Filter uninteresting output from some supervisor tests.

- Test for `notice_policy.log` is no longer needed.
2020-08-11 11:26:22 -07:00
Johanna Amann
22b401f52f Merge remote-tracking branch 'origin/topic/johanna/1095-just-get-rid-of-it'
* origin/topic/johanna/1095-just-get-rid-of-it:
  Re-add TYPE_COUNTER without function and deprecation marker.
  Completely remove all traces of the COUNTER type.
2020-08-03 10:44:43 -07:00
Tim Wojtulewicz
45b5a98420 Move EventMgr, EventHandler, and EventRegistry code to zeek namespace. Rename mgr to event_mgr. 2020-07-31 16:23:32 -04:00
Johanna Amann
417a6eb1e9 Completely remove all traces of the COUNTER type.
Relates to GH-1095
2020-07-30 12:11:05 -07:00
Tim Wojtulewicz
ebc073ba92 Merge remote-tracking branch 'origin/topic/jsiwek/gh-1076-fix-random'
* origin/topic/jsiwek/gh-1076-fix-random:
  Deprecate bro_srandom(), replace with zeek::seed_random().
  Add zeek::max_random() & fix misuse of RAND_MAX w/ zeek::random_number()
  Deprecate bro_random(), replace with zeek::random_number()
  Deprecate bro_prng(), replace with zeek::prng()
  GH-1076: Fix bro_srandom() to replace 0 seeds with 1
  GH-1076: Fix bro_prng() implementation
  GH-1076: Fix use of getrandom()
2020-07-23 13:02:46 -07:00
Jon Siwek
d486af06b1 Add zeek::max_random() & fix misuse of RAND_MAX w/ zeek::random_number()
In deterministic mode, RAND_MAX is not related to the result of
zeek::random_number() (formerly bro_random()), but some logic was
using RAND_MAX as indication of the possible range of values.  The
new zeek::max_random() will give the correct upper-bound regardless
of whether deterministic-mode is used.
2020-07-22 14:01:33 -07:00
Jon Siwek
bde38893ce Deprecate bro_random(), replace with zeek::random_number()
Avoiding the use of zeek::random() due to potential for confusion
with random().
2020-07-22 14:01:33 -07:00
Jon Siwek
9642feeaf2 GH-1068: Add zeek symlink to allow "zeek/Foo.h" include style
Also changes `zeek-config --include_dir` to now output
`$prefix/include:$prefix/include/zeek` instead of only
`$prefix/include/zeek`
2020-07-20 17:54:09 -07:00
Jon Siwek
7f2aae1721 GH-1062: fix integer conversion errors related to Tag subtypes 2020-07-14 15:55:28 -07:00
Tim Wojtulewicz
9364e6a5b7 Move IntrusivePtr and utility methods to the zeek namespace 2020-06-30 20:19:12 -07:00
Jon Siwek
d4f3cad7d1 Merge remote-tracking branch 'origin/topic/timw/266-namespaces'
Merge adjustments:

- Preserved original `base_type_no_ref` argument type as ::TypeTag
- Removed superfluous #pragma guard around deprecated TableVal ctor
- Clarify NEWS regarding MetaHook{Pre,Post} deprecations
- Simplify some `::zeek::` qualifications to just `zeek::`
- Prefixed FORWARD_DECLARE_NAMESPACED macro with ZEEK_

* origin/topic/timw/266-namespaces:
  Disable some deprecation diagnostics for GCC
  Rename BroType to Type
  Update NEWS
  Review cleanup
  Move Type types to zeek namespace
  Move Flare/Pipe from the bro namespace to zeek::detail
  Move Attr to the zeek::detail namespace
  Move Trigger into the zeek::detail namespace
  Move ID to the zeek::detail namespace
  Move Anon.h into zeek::detail namespace
  Mark all of the aliased classes in plugin/Plugin.h deprecated, and fix all of the plugins that were using them
  Move all of the base plugin classes into the zeek::plugin namespace
  Expr: move all classes into zeek::detail
  Stmt: move Stmt classes into zeek::detail namespace
  Add utility macro for creating namespaced aliases for classes
2020-06-11 23:20:51 -07:00
Tim Wojtulewicz
ed13972924 Move Type types to zeek namespace 2020-06-09 17:20:45 -07:00
Jon Siwek
23ad81400b Rename aux/ to auxil/
Since "aux" is not an allowed file/dir name on Windows.
2020-06-04 15:18:44 -07:00
Tim Wojtulewicz
7a5dae4354 Mark all of the aliased classes in plugin/Plugin.h deprecated, and fix all of the plugins that were using them 2020-06-03 15:16:18 -07:00
Jon Siwek
272db640aa Deprecate Plugin::HookCallFunction(), replace with HookFunctionCall()
This also changes the argument type of Func::operator() to zeek::Args*
to allow plugins to be able to alter function arguments in place as
was previously documented.
2020-05-22 21:01:38 -07:00
Jon Siwek
7843416e51 Use zeek::BifEvent:: for enqueue_ functions instead of BifEvent:: 2020-05-14 17:27:42 -07:00
Jon Siwek
81517bd703 Update deprecated BifEvent::generate_* usages 2020-04-17 18:42:58 -07:00
Tim Wojtulewicz
d53c1454c0 Remove 'using namespace std' from SerialTypes.h
This unfortunately cuases a ton of flow-down changes because a lot of other
code was depending on that definition existing. This has a fairly large chance
to break builds of external plugins, considering how many internal ones it broke.
2020-04-07 15:59:59 -07:00
Tim Wojtulewicz
85c6c2b9ee Merge remote-tracking branch 'origin/topic/jsiwek/runtime-exception-leak-cleanup'
* origin/topic/jsiwek/runtime-exception-leak-cleanup:
  Func::DescribeDebug: move a NumFields() call out of loop
  Use const-ref parameter for zeek::val_list_to_args()
  Fix missing IntrusivePtr.h include and ambiguous ODesc::Add call
  Remove TimerMgr arg from event queuing/scheduling methods
  Deprecate Analyzer::ConnectionEvent()
  Deprecate file_analysis::File::FileEvent methods using val_list args
  Deprecate Connection::ConnectionEvent methods
  Deprecate EventMgr::QueueEventFast() and update usages to Enqueue()
  Deprecate EventMgr::QueueEvent() and update usages to Enqueue()
  Deprecate Func::Call(val_list*, ...)
  Use vector<IntrusivePtr<Val>> for Func::Call and Event queuing args
  Fix memory leak in Zeek when-statement bodies with runtime errors
  Change TableVal::RecoverIndex() to return IntrusivePtr
  Use IntrusivePtr in TableVal::CallExpireFunc
  Fix memory leak when runtime error occurs in a Zeek for-loop
  Enable leak checks for btests that produce runtime exceptions
2020-03-27 11:49:45 -07:00
Jon Siwek
98d94ec785 Enable leak checks for btests that produce runtime exceptions
These were previously reporting leaks due to various allocations not
getting cleaned up during the stack unwind, but at the current state of
the transition toward IntrusivePtr usage, theses tests no longer leak.
2020-03-23 21:51:12 -07:00
Jon Siwek
7e57f0788c Add test case for binpac flowbuffer frame length parsing bug 2020-03-19 22:09:23 -07:00
Max Kellermann
0db61f3094 include cleanup
The Zeek code base has very inconsistent #includes.  Many sources
included a few headers, and those headers included other headers, and
in the end, nearly everything is included everywhere, so missing
#includes were never noticed.  Another side effect was a lot of header
bloat which slows down the build.

First step to fix it: in each source file, its own header should be
included first to verify that each header's includes are correct, and
none is missing.

After adding the missing #includes, I replaced lots of #includes
inside headers with class forward declarations.  In most headers,
object pointers are never referenced, so declaring the function
prototypes with forward-declared classes is just fine.

This patch speeds up the build by 19%, because each compilation unit
gets smaller.  Here are the "time" numbers for a fresh build (with a
warm page cache but without ccache):

Before this patch:

 3144.94user 161.63system 3:02.87elapsed 1808%CPU (0avgtext+0avgdata 2168608maxresident)k
 760inputs+12008400outputs (1511major+57747204minor)pagefaults 0swaps

After this patch:

 2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
 72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps
2020-02-04 20:51:02 +01:00
Robin Sommer
4eeabd5210 Remove test for legacy plugin.
We no longer support creating new plugins using the old naming
scheme.
2020-01-29 12:08:10 +00:00
Jon Siwek
1f3ec434a8 Extend ASAN_OPTIONS in btests instead of overwrite 2020-01-08 21:04:18 -08:00
Jon Siwek
0fe2a14d98 Disable LeakSanitizer for btests that have known leaks
E.g. ones that throw interpreter exceptions,  as those are currently
known to potentially cause leaks.  Fixing the underlying leaks involves
the larger task of more IntrusivePtr usage.

Reference cycles may also cause leaks.
2020-01-02 12:05:49 -08:00
Dominik Charousset
c1f3fe7829 Switch from header guards to pragma once 2019-09-17 14:10:30 +02:00
Jon Siwek
c6378c56e2 Update plugin unit tests to use --zeek-dist 2019-06-06 20:02:47 -07:00