Commit graph

55 commits

Author SHA1 Message Date
Robin Sommer
eccbbb4476 Merge remote-tracking branch 'origin/topic/robin/gh-1179-plugin-loading'
* origin/topic/robin/gh-1179-plugin-loading:
  Retry loading plugins on failure to resolve to dependencies.
  Fix use of deprecated functionality in test.
  When attempting to activate a plugin, load dynamic libraries first.
  Add test creating multiple plugins with load dependencies.
2020-12-01 14:51:49 +00:00
Robin Sommer
fe45f5335a Retry loading plugins on failure to resolve to dependencies.
Closes #1179.
2020-11-25 15:07:32 +00:00
Tim Wojtulewicz
96d9115360 GH-1079: Use full paths starting with zeek/ when including files 2020-11-12 12:15:26 -07:00
Tim Wojtulewicz
fe0c22c789 Base: Clean up explicit uses of namespaces in places where they're not necessary.
This commit covers all of the common and base classes.
2020-08-24 12:07:00 -07:00
Tim Wojtulewicz
01ce18894b Rename types in ZeekList.h to be consistent with the style guide 2020-08-20 16:11:47 -07:00
Tim Wojtulewicz
4b61d60e80 Fix indentation of namespaced aliases 2020-08-20 16:11:46 -07:00
Tim Wojtulewicz
81c70df62c Move __RegisterBif from zeek::detail::plugin to zeek::plugin::detail 2020-08-20 16:11:46 -07:00
Tim Wojtulewicz
834b76f94f Restore globally-namespaced plugin_mgr variable, move zeek::plugin::plugin_mgr to zeek::plugin_mgr 2020-07-31 16:22:04 -04:00
Tim Wojtulewicz
02cef05f93 Rename BroObj to Obj 2020-07-02 16:15:01 -07:00
Tim Wojtulewicz
a2bc42dd93 Move Func up to zeek namespace, rename BroFunc to ScriptFunc 2020-07-02 16:15:01 -07:00
Tim Wojtulewicz
40ecede4ea Move Location to zeek::detail and BroObj to zeek 2020-06-30 21:12:26 -07:00
Tim Wojtulewicz
d6f1ea16ac Move Func and associated classes into zeek::detail namespace 2020-06-30 20:51:58 -07:00
Tim Wojtulewicz
937a462e70 Move Frame and Scope to zeek::detail namespace 2020-06-30 20:51:53 -07:00
Tim Wojtulewicz
ec9eff0bd5 Use type aliases for IntrusivePtr definitions 2020-06-30 20:37:30 -07:00
Tim Wojtulewicz
9364e6a5b7 Move IntrusivePtr and utility methods to the zeek namespace 2020-06-30 20:19:12 -07:00
Tim Wojtulewicz
b1b1ec5171 Deprecate plugin::HookType and plugin::component::Type in a different way 2020-06-30 13:38:39 -07:00
Jon Siwek
d4f3cad7d1 Merge remote-tracking branch 'origin/topic/timw/266-namespaces'
Merge adjustments:

- Preserved original `base_type_no_ref` argument type as ::TypeTag
- Removed superfluous #pragma guard around deprecated TableVal ctor
- Clarify NEWS regarding MetaHook{Pre,Post} deprecations
- Simplify some `::zeek::` qualifications to just `zeek::`
- Prefixed FORWARD_DECLARE_NAMESPACED macro with ZEEK_

* origin/topic/timw/266-namespaces:
  Disable some deprecation diagnostics for GCC
  Rename BroType to Type
  Update NEWS
  Review cleanup
  Move Type types to zeek namespace
  Move Flare/Pipe from the bro namespace to zeek::detail
  Move Attr to the zeek::detail namespace
  Move Trigger into the zeek::detail namespace
  Move ID to the zeek::detail namespace
  Move Anon.h into zeek::detail namespace
  Mark all of the aliased classes in plugin/Plugin.h deprecated, and fix all of the plugins that were using them
  Move all of the base plugin classes into the zeek::plugin namespace
  Expr: move all classes into zeek::detail
  Stmt: move Stmt classes into zeek::detail namespace
  Add utility macro for creating namespaced aliases for classes
2020-06-11 23:20:51 -07:00
Tim Wojtulewicz
149e3b3c32 Disable some deprecation diagnostics for GCC
Clang automatically disables deprecation warnings for types used within
already-deprecated contexts, such as if you use a deprecated type inside
of a method that's beeen marked as deprecated. GCC doesn't have this
feature so it spews a lot more warnings. These functions are now wrapped
in pragmas that disable the warnings for the usage.
2020-06-11 15:43:11 -07:00
Tim Wojtulewicz
e77e8c4b7b Move all of the base plugin classes into the zeek::plugin namespace 2020-06-03 15:16:18 -07:00
Jon Siwek
272db640aa Deprecate Plugin::HookCallFunction(), replace with HookFunctionCall()
This also changes the argument type of Func::operator() to zeek::Args*
to allow plugins to be able to alter function arguments in place as
was previously documented.
2020-05-22 21:01:38 -07:00
Jon Siwek
46c5dea733 Switch plugin::Manager::HookCallFunction() to return IntrusivePtr
The plugin::Plugin side of things is not (yet) changed.
2020-05-22 17:48:35 -07:00
Johanna Amann
876c803d75 Merge remote-tracking branch 'origin/topic/timw/776-using-statements'
* origin/topic/timw/776-using-statements:
  Remove 'using namespace std' from SerialTypes.h
  Remove other using statements from headers
  GH-776: Remove using statements added by PR 770

Includes small fixes in files that changed since the merge request was
made.

Also includes a few small indentation fixes.
2020-04-09 13:31:07 -07:00
Tim Wojtulewicz
41c3256faa plugin/probabilistic/zeekygen: Replace nulls with nullptr 2020-04-07 16:08:34 -07:00
Tim Wojtulewicz
d53c1454c0 Remove 'using namespace std' from SerialTypes.h
This unfortunately cuases a ton of flow-down changes because a lot of other
code was depending on that definition existing. This has a fairly large chance
to break builds of external plugins, considering how many internal ones it broke.
2020-04-07 15:59:59 -07:00
Jon Siwek
4e1ac4e124 Use vector<IntrusivePtr<Val>> for Func::Call and Event queuing args
This change may break BIFs that use @ARGS@, @ARG@, or @ARGC@ since their
types have changed.
2020-03-24 16:50:18 -07:00
Max Kellermann
298fd125ae plugin/Manager: migrate to std::string_view 2020-02-07 10:56:14 +01:00
Dominik Charousset
c1f3fe7829 Switch from header guards to pragma once 2019-09-17 14:10:30 +02:00
Daniel Thayer
1a74516db1 Rename all BRO-prefixed environment variables
For backward compatibility when reading values, we first check
the ZEEK-prefixed value, and if not set, then check the corresponding
BRO-prefixed value.
2019-05-22 00:12:31 -05:00
Jon Siwek
787b1e6bf2 Merge branch 'topic/corelight/reporter-hook' of https://github.com/corelight/bro
* 'topic/corelight/reporter-hook' of https://github.com/corelight/bro:
  Add reporter hook.
2017-11-21 12:28:52 -06:00
Johanna Amann
b852437126 Add reporter hook.
The hook being added is:

bool HookReporter(const std::string& prefix, const EventHandlerPtr event,
                  const Connection* conn, const val_list* addl, bool location,
                  const Location* location1, const Location* location2,
                  bool time, const std::string& buffer) override;

This hook gives access to basically all information that is available in
the function in Reporter.cc that performs the logging. The hook is
called each time when anything passes through the reporter in the cases
in which an event usually would be called. This includes weirds. The
hook can return false to prevent the normal reporter events from being
raised.
2017-11-16 13:02:12 -08:00
Johanna Amann
91dcefe104 Fix and extend behavior of HookLoadFile
This commit fixes and extends the behavior of HookLoadFile. Before this
change, HookLoadFile appended ".bro" to each path that was @loaded, even
if the path specified directory names. Furthermore it only gave the path
of the file as it was specified in the Bro script without revealing the
final path of the file that it was going to load.

This patch changes this behavior - in addition to giving the unmodified
path given in the @load command, the hook now returns the resolved path
of the file or directory it is going to load (if found). The hook is
furthermore raises for @load-sigs and @load-plugin; a enum specifies the
kind of load that is happening.
2017-11-16 12:31:27 -08:00
Jon Siwek
874d2b9fb0 Merge branch 'topic/corelight/logging-hooks' of https://github.com/corelight/bro
* 'topic/corelight/logging-hooks' of https://github.com/corelight/bro:
  Plugin: Add hooks for log init and writing.
2017-05-04 11:44:43 -05:00
Johanna Amann
684ea8aa37 Plugin: Add hooks for log init and writing.
The two hooks being added are:

void HookLogInit(const std::string& writer, const std::string& instantiating_filter, bool local, bool remote, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields);

which is called when a writer is being instantiated and contains
information about the fields being logged, as well as

bool HookLogWrite(const std::string& writer, const std::string& filter, const logging::WriterBackend::WriterInfo& info, int num_fields, const threading::Field* const* fields, threading::Value** vals);

which is called for each log line being written by each writer. It
contains all the data being written. The data can be changed in the
function call and lines can be prevented from being written.

This commit also fixes a few small problems with plugin hooks itself,
and extends the tests that were already there, besides introducing tests
for the added functionality.
2017-04-24 14:02:05 -07:00
Robin Sommer
8acf995361 Fixing Broxygen indexing confusion for plugins.
Because plugins register their script directories with the BROPATH,
Broxygen stripped them out from plugin script paths it was indexing.
That then led to multiple plugins ending up with the same script
paths, triggering warnings about duplicates.

I fixed this by checking if a script comes out of a plugin. If so, it
gets an artifcial index prefix "<plugin-name>:", followed by the
script's relative path inside the plugin's top-level directory. For
example, "/opt/bro/lib/bro/plugins/Bro_Netmap/scripts/init.bro" now
turns into "Bro::Netmap:scripts/init.bro" for Broxygen purposes
(whereas it used to be just "init.bro").

Addresses BIT-1663.

(Can't think of a good way to add a test for this unfortunately.)
2016-09-29 16:18:53 -07:00
Robin Sommer
c91792b762 Merge branch 'topic/jswaro/feature/HookAddToAnalyzer-tcprs-support' of https://github.com/jswaro/bro
Making two changes here:

    - Renaming the hook to SetupAnalyzerTree.

    - Reverting the reversal of the script load order. Instead, I'm
      adding an additional script that Bro looks for to load first,
      "__preload__.bro". Also extending the plugin docs to cover this.

    - Increasing plugin API version, as I suppose adding a new virtual
      function may invalidate binary compatibility.

* 'topic/jswaro/feature/HookAddToAnalyzer-tcprs-support' of https://github.com/jswaro/bro:
  Add hook 'HookAddToAnalyzerTree' to support TCPRS plugin
2015-08-10 15:05:48 -07:00
James Swaro
85fd1c9fa7 Add hook 'HookAddToAnalyzerTree' to support TCPRS plugin
This commit introduces a new hook, HookAddToAnalyzerTree, which
allows plugins to add a new analyzer to the analyzer tree during
analyzer tree creation. This hook is necessary to support the
TCPRS plugin.

Additionally, the order in which the scripts were loaded has been
changed to address a problem with undefined variable errors due
to load order issues.

Signed-off-by: James Swaro <james.swaro@gmail.com>
2015-07-26 13:32:24 -05:00
Robin Sommer
6fa03abdbc Merge remote-tracking branch 'origin/topic/gilbert/plugin-api-tweak'
* origin/topic/gilbert/plugin-api-tweak:
  Updating plugin.hooks baseline so that test succeeds
  Revert spacing change that shouldn't have been included with the previous changeset ... should fix all of the plugin tests save hooks, which needs to be updated.
  More small fixes
  Small fixes
  Incremental
  Re-updating plugin.hooks test to include new argument output (after merge).
  Fixing logic errors in HandlePluginResult
  Updating tests and tweaking HookArgument to include Frame support.
  Incremental commit: implementing a wrapper for the Val class.
  Reverting change to const status of network_time.  Also, see FIXME: in Func.cc / HandlePluginResult ...
  Tweaks to result handling to make things a little more sane.
  Plugin API: minor change (adding parent frame) to support calling methods from hook.  Also declare network time update argument to be const because good practice.

BIT-1270 #merged

Conflicts:
	testing/btest/Baseline/plugins.hooks/output
2015-03-02 18:17:52 -08:00
Gilbert Clark
7eadcad674 Merge branch 'master' into topic/gilbert/plugin-api-tweak
Conflicts:
	testing/btest/Baseline/plugins.api-version-mismatch/output
	testing/btest/Baseline/plugins.hooks/output
	testing/btest/plugins/api-version-mismatch.sh
2014-11-24 16:21:23 -05:00
Gilbert Clark
d639488d36 Incremental commit: implementing a wrapper for the Val class.
Just a checkpoint: need to add / update tests to make sure things work as expected.  Should build / pass core btests, though.
2014-09-27 08:03:30 -04:00
Gilbert Clark
8d04f58eda Reverting change to const status of network_time. Also, see FIXME: in Func.cc / HandlePluginResult ... 2014-09-19 21:55:47 -04:00
Gilbert Clark
2446a942e0 Plugin API: minor change (adding parent frame) to support calling methods from hook. Also declare network time update argument to be const because good practice. 2014-09-04 20:41:44 -04:00
Jon Siwek
69b1ba653d Minor adjustments to plugin code/docs.
Mostly whitespace/typos.
Moved some Plugin methods out from public access.
2014-07-30 16:48:23 -05:00
Robin Sommer
9616cd8e61 Further polishing and cleanup in preparation for merge. 2014-07-12 18:12:09 -07:00
Robin Sommer
48c6b934f4 Plugin fixes for FreeBSD. 2014-06-19 13:22:52 -07:00
Robin Sommer
60cf0ddf26 Polishing, mostly documentation updates. 2014-06-17 11:50:23 -07:00
Robin Sommer
551950c438 Adding environment variable BRO_PLUGIN_ACTIVATE that unconditionally
activates plugins.

Plugins are specified with a comma-separated list of names.
2014-05-29 18:15:18 -07:00
Robin Sommer
421120e12c Extending plugin interface.
This is for feature parity with the older interface, and remains
experimental for now.
2014-05-15 15:36:48 -07:00
Robin Sommer
ee75958951 Adding meta hooks.
This is mainly an experiment to see if this makes sense. I'm not very
fond of the arguments being wrapped into a discriminating union, but I
like it better than other alternatives at least.

The new code is untested.
2014-01-22 14:29:22 -08:00
Robin Sommer
ea01a1be30 Reworking plugin interface to not rely on macros.
The Plugin.cc file is now just a standard class, with the interface
changed a bit to make it more easy to write. However, there're still
some conventions that one must follow to make everything work (like
using the right namespace structure).

This commit also includes the option to compile built-in plugins
dynamically instead of statically by adding
SET(BRO_PLUGIN_BUILD_DYNAMIC TRUE) to their CMake config. This hasn't
been tested much yet, and I'm still undecided if it's somethign we
would want to do by default--but we could now if wanted. :)

Also some minor other cleanup of plugin APIs and built infrastructure.

All tested on MacOS only currently.
2014-01-20 13:39:11 -08:00
Robin Sommer
a80dd10215 Updates of the dynamic plugin code.
Includes:

    - Cleanup of the plugin API, in particular generally changing
      const char* to std::string

    - Renaming environment variable BRO_PLUGINS to BRO_PLUGIN_PATH,
      defaulting to <prefix>/lib/bro/plugins

    - Reworking how dynamic plugins are searched and activated. See
      doc/devel/plugins.rst for details.

    - New @load-plugin directive to explicitly activate a plugin

    - Support for Darwin. (Linux untested right now)

    - The init-plugin updates come with support for "make test", "make
      sdist", and "make bdist" (see how-to).

    - Test updates.

Notes: The new hook mechanism, which allows plugins to hook into Bro's
core a well-defined points, is still essentially untested.
2013-12-16 11:57:56 -08:00