Commit graph

87 commits

Author SHA1 Message Date
Tim Wojtulewicz
e27008ef26 GH-1184: Add 'source' field to weird log denoting where the weird was reported 2020-12-01 09:34:37 -07:00
Tim Wojtulewicz
96d9115360 GH-1079: Use full paths starting with zeek/ when including files 2020-11-12 12:15:26 -07:00
Tim Wojtulewicz
cd06bf34c7 GH-1215: Remove dispatch_map from packet analysis, replace with BIF methods for registering dispatches 2020-11-02 19:03:25 +00:00
Jon Siwek
991bbc961d Merge remote-tracking branch 'origin/topic/robin/gh-623-sampling'
- Merge adjustments:
  - Minor whitespace/style tweaks
  - Fixed portability of the btest due to differences in `uniq -c`
    output format

* origin/topic/robin/gh-623-sampling:
  Extend weird sampling with option to track selected weirds globally.
2020-09-08 17:06:40 -07:00
Robin Sommer
5fa94973da Extend weird sampling with option to track selected weirds globally.
The new set "sampling_global_list" lists weirds to rate-limite
globally instead of per connection/flow.

Closes #623.
2020-09-07 07:31:22 +00:00
Tim Wojtulewicz
fe0c22c789 Base: Clean up explicit uses of namespaces in places where they're not necessary.
This commit covers all of the common and base classes.
2020-08-24 12:07:00 -07:00
Tim Wojtulewicz
0ac3fafe13 Move zeek::net namespace to zeek::run_state namespace.
This also moves all of the code from Net.{h,cc} to RunState.{h,cc} and marks Net.h as deprecated
2020-08-20 16:11:47 -07:00
Tim Wojtulewicz
01ce18894b Rename types in ZeekList.h to be consistent with the style guide 2020-08-20 16:11:47 -07:00
Tim Wojtulewicz
ddf48d7529 Move a few of the zeek::util methods and variables to zeek::util::detail 2020-08-20 16:11:44 -07:00
Tim Wojtulewicz
8d2d867a65 Move everything in util.h to zeek::util namespace.
This commit includes renaming a number of methods prefixed with bro_ to be prefixed with zeek_.
2020-08-20 16:00:33 -07:00
Tim Wojtulewicz
e7c6d51ae7 Move the functions and variables in Net.h to the zeek::net namespace. This includes moving network_time out of util.h. 2020-08-20 15:55:17 -07:00
Tim Wojtulewicz
a2a435360a Move all of the hashing classes/functions to zeek::detail namespace 2020-07-31 16:23:34 -04:00
Tim Wojtulewicz
45b5a98420 Move EventMgr, EventHandler, and EventRegistry code to zeek namespace. Rename mgr to event_mgr. 2020-07-31 16:23:32 -04:00
Tim Wojtulewicz
1c17700c48 Move Timer and PriorityQueue classes to namespaces 2020-07-31 16:23:02 -04:00
Tim Wojtulewicz
bfab224d7c Move Reporter to zeek namespace 2020-07-31 16:22:41 -04:00
Tim Wojtulewicz
25c0fc7ab2 Move IP Addr/Prefix/Header classes into namespaces 2020-07-31 16:22:04 -04:00
Tim Wojtulewicz
9400b863ea Move all base analyzer classes to zeek::analyzer namespace 2020-07-31 16:21:46 -04:00
Tim Wojtulewicz
40ecede4ea Move Location to zeek::detail and BroObj to zeek 2020-06-30 21:12:26 -07:00
Tim Wojtulewicz
464efbe66a Move Dictionary/PDict, List/PList, and Queue/PQueue to zeek namespace 2020-06-30 21:12:26 -07:00
Tim Wojtulewicz
64332ca22c Move all Val classes to the zeek namespaces 2020-06-30 20:48:09 -07:00
Tim Wojtulewicz
ec9eff0bd5 Use type aliases for IntrusivePtr definitions 2020-06-30 20:37:30 -07:00
Tim Wojtulewicz
9364e6a5b7 Move IntrusivePtr and utility methods to the zeek namespace 2020-06-30 20:19:12 -07:00
Jon Siwek
51e738a1c0 GH-998: Fix Reporter::conn_weird() to handle expired connections
This introduces a new sampling state-map for expired connections to fix
segfaults that previously occured when passing in a `connection` record
to `Reporter::conn_weird()` for which the internal `Connection` object
had already been expired and deleted.  This also introduces a new event
called `expired_conn_weird`, which is similar to `conn_weird`, except
the full `connection` record is no longer available, just the `conn_id`
and UID string.
2020-06-15 12:57:47 -07:00
Tim Wojtulewicz
cbdb8ee074 Expr: move all classes into zeek::detail 2020-06-03 15:16:18 -07:00
Jon Siwek
5b4313b593 Deprecate Val(double, TypeTag) ctor, add TimeVal/DoubleVal subclasses
This also updates all usages of the deprecated Val ctor to use
either IntervalVal, TimeVal, or DoubleVal ctors.  The reason for
doing away with the old constructor is that using it with TYPE_INTERVAL
isn't strictly correct since there exists a more specific subclass,
IntervalVal, with overriden ValDescribe() method that ought to be used
to print such values in a more descriptive way.
2020-06-02 23:33:40 -07:00
Jon Siwek
faa4738807 Deprecate file_analysis::File::GetVal(), replace with ToVal() 2020-05-22 12:27:37 -07:00
Jon Siwek
3f92df51b7 Improve TableVal HashKey management
* Deprecated ComputeHash() methods and replaced with MakeHashKey()
  which returns std::unique_ptr<HashKey>

* Deprecated RecoverIndex() and replaced with RecreateIndex()
  which takes HashKey& and returns IntrusivePtr.

* Updated the new TableVal Assign()/Remove() methods to take either
  std::unique_ptr<HashKey> or HashKey& as appropriate for clarity of
  ownership expectations.
2020-05-20 22:16:47 -07:00
Jon Siwek
4debad8caf Switch zeek:🆔:lookup to zeek:🆔:find
For parity with Scope since it now uses Find instead of Lookup
2020-05-14 18:00:18 -07:00
Jon Siwek
a5762c12cc Move various elements into ID.h and zeek::id namespace
* A handful of generic/useful/common global type pointers that used
  to be in NetVar.h

* Lookup functions that used to be Var.h
2020-05-14 17:24:20 -07:00
Jon Siwek
a83941d64d Deprecate internal_val() and internal_const_val()
Replaced with zeek::lookup_val() and zeek::lookup_const()
2020-05-14 17:23:19 -07:00
Jon Siwek
5f57ceb70a Switch ListVal to store IntrusivePtrs
* Deprecates ListVal::Index() methods and replaces with ListVal::Idx()

* Replaces ListVal::Vals() method with one that returns
  std::vector<IntrusivePtr<Val>> rather than val_list
2020-05-14 17:18:00 -07:00
Jon Siwek
d533212a6a Merge branch 'master' into topic/jsiwek/fuzzing 2020-04-28 17:25:32 -07:00
Jon Siwek
8f1b34b915 Add basic structure for fuzzing targets
General changes:

* Add -D/--deterministic command line option as
  convenience/alternative to -G/--load-seeds (i.e. no file needed, it just
  uses zero-initialized random seeds).  It also changes Broker data
  stores over to using deterministic timing rather than real time.

* Add option to make Reporter abort on runtime scripting errors
2020-04-23 12:51:25 -07:00
Jon Siwek
2a63e4a4a2 Deprecate BuildConnVal() methods and update usages to ConnVal()
The later being a new method that returns IntrusivePtr
2020-04-16 17:00:01 -07:00
Johanna Amann
876c803d75 Merge remote-tracking branch 'origin/topic/timw/776-using-statements'
* origin/topic/timw/776-using-statements:
  Remove 'using namespace std' from SerialTypes.h
  Remove other using statements from headers
  GH-776: Remove using statements added by PR 770

Includes small fixes in files that changed since the merge request was
made.

Also includes a few small indentation fixes.
2020-04-09 13:31:07 -07:00
Johanna Amann
a3a38f0849 Merge remote-tracking branch 'origin/topic/timw/nullptr'
* origin/topic/timw/nullptr:
  The remaining nulls
  plugin/probabilistic/zeekygen: Replace nulls with nullptr
  file_analysis: Replace nulls with nullptr
  analyzer: Replace nulls with nullptr
  iosource/threading/input/logging: Replace nulls with nullptr
2020-04-09 08:59:53 -07:00
Tim Wojtulewicz
0a47588d0b The remaining nulls 2020-04-07 16:08:34 -07:00
Tim Wojtulewicz
d53c1454c0 Remove 'using namespace std' from SerialTypes.h
This unfortunately cuases a ton of flow-down changes because a lot of other
code was depending on that definition existing. This has a fairly large chance
to break builds of external plugins, considering how many internal ones it broke.
2020-04-07 15:59:59 -07:00
Tim Wojtulewicz
c2375fc88d Mark all timers as final 2020-04-03 15:20:19 -04:00
Tim Wojtulewicz
fd5e15b116 The Great Embooleanating
A large number of functions had return values and/or arguments changed
to use ``bool`` types instead of ``int``.
2020-03-31 06:41:54 +00:00
Jon Siwek
de47a50dde Deprecate Connection::ConnectionEvent methods
And update usages to Connection::EnqueueEvent
2020-03-25 18:39:56 -07:00
Jon Siwek
6980f63a91 Deprecate EventMgr::QueueEventFast() and update usages to Enqueue() 2020-03-25 16:09:33 -07:00
Jon Siwek
b045ce4bb3 Change TableVal::RecoverIndex() to return IntrusivePtr 2020-03-23 22:01:03 -07:00
Max Kellermann
0cf5799ca6 file_analysis: include cleanup 2020-02-13 10:12:03 +01:00
Tim Wojtulewicz
d23b15c08f Use std::move in a few places instead of copying a pass-by-value argument (performance-unnecessary-value-param) 2020-02-11 14:11:22 -08:00
Max Kellermann
0db61f3094 include cleanup
The Zeek code base has very inconsistent #includes.  Many sources
included a few headers, and those headers included other headers, and
in the end, nearly everything is included everywhere, so missing
#includes were never noticed.  Another side effect was a lot of header
bloat which slows down the build.

First step to fix it: in each source file, its own header should be
included first to verify that each header's includes are correct, and
none is missing.

After adding the missing #includes, I replaced lots of #includes
inside headers with class forward declarations.  In most headers,
object pointers are never referenced, so declaring the function
prototypes with forward-declared classes is just fine.

This patch speeds up the build by 19%, because each compilation unit
gets smaller.  Here are the "time" numbers for a fresh build (with a
warm page cache but without ccache):

Before this patch:

 3144.94user 161.63system 3:02.87elapsed 1808%CPU (0avgtext+0avgdata 2168608maxresident)k
 760inputs+12008400outputs (1511major+57747204minor)pagefaults 0swaps

After this patch:

 2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
 72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps
2020-02-04 20:51:02 +01:00
Tim Wojtulewicz
67fcc9b5af Mark safe_snprintf and safe_vsnprintf as deprecated, remove uses of them
safe_snprintf and safe_vsnprintf just exist to ensure that the resulting strings are always null-terminated. The documentation for snprintf/vsnprintf states that the output of those methods are always null-terminated, thus making the safe versions obsolete.
2020-01-02 15:36:39 -07:00
Jon Siwek
2d7c926291 GH-545: add "addl" parameter to flow_weird and net_weird events 2019-08-20 22:45:22 -04:00
Jon Siwek
41882263db Use _exit() in Reporter::FatalError
Using exit() here may generally not work well since:

* That will result in calling global destructors

* We have global state that we potentially modify at run-time and
  are in the middle of modiying at the time the FatalError occurs.
  E.g. out-of-memory is one situation where it's likely we could
  call the dtor of an object in which operation on it's internal
  state is no longer consistent/safe.
2019-08-12 14:13:46 -07:00
Tim Wojtulewicz
6144f459e1 Mark List::append/insert deprecated in favor of push_back/push_front for consistency with Queue 2019-07-22 09:47:43 -07:00