Commit graph

47 commits

Author SHA1 Message Date
Tim Wojtulewicz
e7c6d51ae7 Move the functions and variables in Net.h to the zeek::net namespace. This includes moving network_time out of util.h. 2020-08-20 15:55:17 -07:00
Tim Wojtulewicz
be92bd536f Move iosource code to zeek namespaces 2020-08-20 15:55:17 -07:00
Tim Wojtulewicz
e3ee1860b8 Move Session code to namespaces 2020-07-31 16:25:54 -04:00
Tim Wojtulewicz
886fc102b8 Move DebugLogger to zeek namespaces 2020-07-31 16:23:34 -04:00
Tim Wojtulewicz
93948b4d19 Move all of the Packet-related classes to namespaces 2020-07-31 16:23:34 -04:00
Tim Wojtulewicz
bfab224d7c Move Reporter to zeek namespace 2020-07-31 16:22:41 -04:00
Jon Siwek
0db5c920f2 Deprecate names in BifConst, replace with zeek::BifConst
Some Val* types are also replaced with IntrusivePtr at the new location
2020-05-14 17:26:00 -07:00
Johanna Amann
876c803d75 Merge remote-tracking branch 'origin/topic/timw/776-using-statements'
* origin/topic/timw/776-using-statements:
  Remove 'using namespace std' from SerialTypes.h
  Remove other using statements from headers
  GH-776: Remove using statements added by PR 770

Includes small fixes in files that changed since the merge request was
made.

Also includes a few small indentation fixes.
2020-04-09 13:31:07 -07:00
Tim Wojtulewicz
cb01e098df iosource/threading/input/logging: Replace nulls with nullptr 2020-04-07 16:08:34 -07:00
Tim Wojtulewicz
d53c1454c0 Remove 'using namespace std' from SerialTypes.h
This unfortunately cuases a ton of flow-down changes because a lot of other
code was depending on that definition existing. This has a fairly large chance
to break builds of external plugins, considering how many internal ones it broke.
2020-04-07 15:59:59 -07:00
Max Kellermann
0db61f3094 include cleanup
The Zeek code base has very inconsistent #includes.  Many sources
included a few headers, and those headers included other headers, and
in the end, nearly everything is included everywhere, so missing
#includes were never noticed.  Another side effect was a lot of header
bloat which slows down the build.

First step to fix it: in each source file, its own header should be
included first to verify that each header's includes are correct, and
none is missing.

After adding the missing #includes, I replaced lots of #includes
inside headers with class forward declarations.  In most headers,
object pointers are never referenced, so declaring the function
prototypes with forward-declared classes is just fine.

This patch speeds up the build by 19%, because each compilation unit
gets smaller.  Here are the "time" numbers for a fresh build (with a
warm page cache but without ccache):

Before this patch:

 3144.94user 161.63system 3:02.87elapsed 1808%CPU (0avgtext+0avgdata 2168608maxresident)k
 760inputs+12008400outputs (1511major+57747204minor)pagefaults 0swaps

After this patch:

 2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
 72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps
2020-02-04 20:51:02 +01:00
Tim Wojtulewicz
edb87821da Increase timeout value for live interfaces without file descriptors 2020-02-03 07:34:27 -07:00
Tim Wojtulewicz
4751783d56 PktSrc iosource changes to match the new IOSource API 2020-01-31 10:13:09 -07:00
Tim Wojtulewicz
67fcc9b5af Mark safe_snprintf and safe_vsnprintf as deprecated, remove uses of them
safe_snprintf and safe_vsnprintf just exist to ensure that the resulting strings are always null-terminated. The documentation for snprintf/vsnprintf states that the output of those methods are always null-terminated, thus making the safe versions obsolete.
2020-01-02 15:36:39 -07:00
Tim Wojtulewicz
54752ef9a1 Deprecate the internal int/uint types in favor of the cstdint types they were based on 2019-08-12 13:50:07 -07:00
Jon Siwek
6ad7099f7e Merge remote-tracking branch 'origin/topic/robin/gh-239'
* origin/topic/robin/gh-239:
  Undo a change to btest.cfg from a recent commit
  Updating submodule.
  Fix zeek-wrapper
  Update for renaming BroControl to ZeekControl.
  Updating submodule.
  GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
2019-05-14 13:27:40 -07:00
Johanna Amann
dcd6454530 Remove RemoteSerializer and related code/types.
Also removes broccoli from the source tree.
2019-05-03 15:00:13 -07:00
Robin Sommer
789cb376fd GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
This also installs symlinks from "zeek" and "bro-config" to a wrapper
script that prints a deprecation warning.

The btests pass, but this is still WIP. broctl renaming is still
missing.

#239
2019-05-01 21:43:45 +00:00
Robin Sommer
fe7e1ee7f0 Merge topic/actor-system throug a squashed commit. 2018-05-18 22:39:23 +00:00
Robin Sommer
420bef58aa Fixing a CMake dependency issue for the pcap bifs.
ninja said:

    ninja: warning: multiple rules generate
    scripts/base/bif/const.bif.bro. builds involving this target will
    not be correct; continuing anyway [-w dupbuild=warn]

Looks like there's a larger problem here involving *.bif of the same
name at different locations of the source tree. For now, I'ved fixed
this one by merging src/iosource/pcap/{const,functions}.bif into
pcap.bif.
2016-08-01 09:20:54 -07:00
Johanna Amann
44b3ece440 Fix coverity error (uninitialized variable) 2016-06-06 13:19:17 -07:00
Robin Sommer
3581ead0d9 Ignoring packets with negative timestamps.
These used to stall Bro. Addresses BIT-1562 and BIT-1443.
2016-05-23 13:22:22 -07:00
Vitaly Repin
cd2ec7c495 Unknown data link type error message printed out props.link_type instead of arg_props.link_type. It lead to the meaningless and misleading output (E.g.: 'unknown data link type 0xffffffff') 2016-04-28 11:10:52 +03:00
Robin Sommer
c22a6f67d2 Use better data structure for storing BPF filters. 2015-11-23 19:55:02 -08:00
Robin Sommer
36b5a4db08 Merge branch 'master' of https://github.com/knielander/bro
I reworked this a bit:

    - Moved the globals into a new Pcap::* namespace, and renamed them
      slightly.

    - Moved the definitions of the globals into pcap/const.bif.

    - Also moved the existing 'snaplen' into Pcap::* and removed
      SnapLen() from the PktSrc API (it's really a pcap thing).

    - Likewise moved the existing functions precompile_pcap_filter,
      install_pcap_filter, and pcap_error, into Pcap::*.

    - Did some more refactoring for the pcap code.

* 'master' of https://github.com/knielander/bro:
  Refactored patch (removed options, less ambiguous name)
  Allow Bro to run in fanout mode.
  Allow libpcap buffer size to be set manually.
  Allow Bro to run in fanout mode.
  Allowed libpcap buffer size to be set via configuration.
2015-08-30 22:09:32 -07:00
Kris Nielander
d8c9b7255e Allow Bro to run in fanout mode. 2015-08-09 22:45:23 +02:00
Kris Nielander
f5429ee794 Allow libpcap buffer size to be set manually. 2015-08-09 22:45:09 +02:00
Robin Sommer
3957091e1b Renaming config.h to bro-config.h.
A couple times now I had this conflicting with files of the same name
in other projects.
2015-07-28 11:57:04 -07:00
Robin Sommer
c72d191ab5 Refactoring L2 parsing code to reside in the Packet class.
That way it can be reused more easily. This also avoid having to
change the serialization structure for packets, which is a problem as
external sources of packets (via Broccoli) wouldn't have the new
attributes available to send.

Also moving Packet.{h,cc} and Layer2.{h,cc} into iosource/, and
removing header size from properties that packet sources have to
provide, as we can now compute that easily from the link type.

Plus some more cleanup.
2015-07-20 16:21:34 -07:00
Robin Sommer
64a478dbd5 Determining final L3 layer protocol right inside PktSrc. 2015-07-17 21:44:42 -07:00
Robin Sommer
86440e44fc Adding more cross-checks for IP.
This prevents a few more packets from reaching raw_events(), see
baseline update for the corresponding test.
2015-07-17 13:59:12 -07:00
Robin Sommer
fe3579f1b4 Merge branch 'topic/rework-packets' of https://github.com/jsbarber/bro
* 'topic/rework-packets' of https://github.com/jsbarber/bro:
  One more tinker to Packet -- ensure no uninitialized values
  Packet::IP()-created IP_Hdr should not free
  Make enums work for non-C++11 config
  Refactor to make bro use a common Packet object. Do a better job of parsing layer 2 and keeping track of layer 3 proto. Add support for raw packet event, including Layer2 headers.

Conflicts:
	aux/plugins
2015-07-17 12:56:04 -07:00
Robin Sommer
476a5dbc34 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1408'
BIT-1408 #merged

* origin/topic/jsiwek/bit-1408:
  BIT-1408: improve I/O loop and Broker IOSource.
2015-06-04 14:46:30 -07:00
Jon Siwek
58ea1ff458 BIT-1408: improve I/O loop and Broker IOSource. 2015-06-03 08:25:49 -05:00
Jeff Barber
30fdc37479 Refactor to make bro use a common Packet object.
Do a better job of parsing layer 2 and keeping track of layer 3 proto.
Add support for raw packet event, including Layer2 headers.
2015-05-29 10:37:39 -04:00
Robin Sommer
d29679484d Removing dependency on PCAP_NETMASK_UNKNOWN to compile with libpcap <
1.1.1.
2015-02-20 13:49:58 -08:00
Jon Siwek
dec96234e3 Fix some minor Coverity Scan complaints. 2014-10-30 13:26:34 -05:00
Jon Siwek
31b7e984d1 Fix packet sources being treated as idle when a packet is available.
Addresses BIT-1266.
2014-10-02 12:16:33 -05:00
Jon Siwek
59c54a0fc6 Add a simple FD_Set wrapper/helper class. 2014-09-09 16:28:04 -05:00
Jon Siwek
cf66bd8b69 Merge branch 'master' into topic/jsiwek/improve_comm_loop
Conflicts:
	src/CMakeLists.txt
	src/FlowSrc.cc
	src/FlowSrc.h
	src/IOSource.h
	src/PktSrc.cc
	src/PktSrc.h
	src/iosource/Manager.cc
2014-09-09 14:19:43 -05:00
Robin Sommer
5c6dfb2408 Fixing link-layer handling.
Something had gotten mixed up here.
2014-09-06 12:31:25 -07:00
Robin Sommer
4a66a8e341 Bugfixes and test updates. 2014-09-05 18:20:23 -07:00
Robin Sommer
569853444f A set of smaller API tweaks, and polishing. 2014-09-03 12:45:38 -07:00
Robin Sommer
3e669daa05 Interface tweaks for PktSrc, plus docs for PktSrc and PktDumper. 2014-08-28 00:52:36 -04:00
Robin Sommer
5f817513d0 A set of various fixes and smaller API tweaks, plus tests.
Also moving PCAP-related bifs to iosource/pcap.bif.
2014-08-24 19:55:26 -07:00
Robin Sommer
ce9f16490c Moving some of the BPF filtering code into base class.
This will allow packet sources that don't support BPF natively to
emulate the filtering via libpcap.
2014-08-22 17:50:03 -07:00
Robin Sommer
caa55ad352 Moving Pkt{Src,Dumper} a directory level up.
Also renaming PktSourceComponent to PktSrcComponent.
2014-08-22 16:46:15 -07:00
Renamed from src/iosource/pktsrc/PktSrc.cc (Browse further)