Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add counts_to_addr and addr_to_counts conversion BIFs.

Browse source
This commit is contained in:
Jon Siwek 2012-02-09 15:32:57 -06:00
parent f945f3c518
commit 086f747bc1
3 changed files with 65 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

50
src/bro.bif
View file

@ -2070,6 +2070,56 @@ function is_v6_addr%(a: addr%): bool
# #
# =========================================================================== # ===========================================================================
## Converts a :bro:type:`addr` to a :bro:type:`index_vec`.
##
## a: The address to convert into a vector of counts.
##
## Returns: A vector containing the host-order address representation,
## four elements in size for IPv6 addresses, or one element for IPv4.
##
## .. bro:see:: counts_to_addr
function addr_to_counts%(a: addr%): index_vec
%{
VectorVal* rval = new VectorVal(new VectorType(base_type(TYPE_COUNT)));
const uint32* bytes;
int len = a->AsAddr()->GetBytes(&bytes);
for ( int i = 0; i < len; ++i )
rval->Assign(i, new Val(ntohl(bytes[i]), TYPE_COUNT), 0);
return rval;
%}
## Converts a :bro:type:`index_vec` to a :bro:type:`addr`.
##
## v: The vector containing host-order address IP address representation,
## one element for IPv4 addresses, four elements for IPv6 addresses.
##
## Returns: An IP address.
##
## .. bro:see:: addr_to_counts
function counts_to_addr%(v: index_vec%): addr
%{
if ( v->AsVector()->size() == 1 )
{
return new AddrVal(htonl((*v->AsVector())[0]->AsCount()));
}
else if ( v->AsVector()->size() == 4 )
{
uint32 bytes[4];
for ( int i = 0; i < 4; ++i )
bytes[i] = htonl((*v->AsVector())[i]->AsCount());
return new AddrVal(bytes);
}
else
{
builtin_error("invalid vector size", @ARG@[0]);
uint32 bytes[4];
memset(bytes, 0, sizeof(bytes));
return new AddrVal(bytes);
}
%}
## Converts a :bro:type:`string` to a :bro:type:`int`. ## Converts a :bro:type:`string` to a :bro:type:`int`.
## ##
## str: The :bro:type:`string` to convert. ## str: The :bro:type:`string` to convert.

4
testing/btest/Baseline/bifs.addr_count_conversion/output Normal file
View file

@ -0,0 +1,4 @@
[536939960, 2242052096, 35374, 57701172]
2001:db8:85a3::8a2e:370:7334
[16909060]
1.2.3.4

11
testing/btest/bifs/addr_count_conversion.bro Normal file
View file

@ -0,0 +1,11 @@
# @TEST-EXEC: bro %INPUT >output
# @TEST-EXEC: btest-diff output
global v: index_vec;
v = addr_to_counts(2001:0db8:85a3:0000:0000:8a2e:0370:7334);
print v;
print counts_to_addr(v);
v = addr_to_counts(1.2.3.4);
print v;
print counts_to_addr(v);