Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Moving my todos over to the tracker ticket.

Browse source
This commit is contained in:
Robin Sommer 2012-06-15 14:45:07 -07:00
parent 1acb9fd91d
commit 19cf93be69
5 changed files with 2 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/frameworks/tunnels/main.bro
View file

@ -18,8 +18,6 @@ export {
## A tunnel connection has closed. ## A tunnel connection has closed.
CLOSE, CLOSE,
## No new connections over a tunnel happened in the past day. ## No new connections over a tunnel happened in the past day.
## TODO-Jon: Where is the "past day" coming from? Should be an
## option.
EXPIRE, EXPIRE,
}; };
@ -72,7 +70,6 @@ export {
## Currently active tunnels. That is, tunnels for which new, encapsulated ## Currently active tunnels. That is, tunnels for which new, encapsulated
## connections have been seen in the last day. ## connections have been seen in the last day.
## TODO-Jon: Do we we need the &synchronized here?
global active: table[conn_id] of Info = table() &synchronized &read_expire=24hrs &expire_func=expire; global active: table[conn_id] of Info = table() &synchronized &read_expire=24hrs &expire_func=expire;
} }
@ -132,12 +129,6 @@ event new_connection(c: connection) &priority=5
event tunnel_changed(c: connection, e: EncapsulatingConnVector) &priority=5 event tunnel_changed(c: connection, e: EncapsulatingConnVector) &priority=5
{ {
## TODO-Jon: Not sure I understand this. Shouldn't c$tunnel already be
## registered? And what if a layer goes way, does that need to be
## removed here? Or is that done separately?
##
## Also, conn/main.bro has a tunnel_changed handler at the same
## priority that *sets* c$tunnel. That's seems undefine behaviour.
if ( c?$tunnel ) if ( c?$tunnel )
register_all(c$tunnel); register_all(c$tunnel);

4
src/Analyzer.h
View file

@ -217,9 +217,7 @@ public:
// Return whether the analyzer previously called ProtocolConfirmation() // Return whether the analyzer previously called ProtocolConfirmation()
// at least once before. // at least once before.
// bool ProtocolConfirmed() const
// TODO-Jon: Why virtual?
virtual bool ProtocolConfirmed() const
{ return protocol_confirmed; } { return protocol_confirmed; }
// Report that we found a significant protocol violation which might // Report that we found a significant protocol violation which might

3
src/Sessions.cc
View file

@ -546,7 +546,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr,
Weird("truncated_inner_IP", ip_hdr, encapsulation); Weird("truncated_inner_IP", ip_hdr, encapsulation);
else if ( result > 0 ) else if ( result > 0 )
Weird("inner_IP_payload_mismatch", ip_hdr, encapsulation); Weird("inner_IP_payload_length_mismatch", ip_hdr, encapsulation);
if ( result != 0 ) if ( result != 0 )
{ {
@ -706,7 +706,6 @@ void NetSessions::DoNextInnerPacket(double t, const struct pcap_pkthdr* hdr,
if ( hdr ) if ( hdr )
fake_hdr.ts = hdr->ts; fake_hdr.ts = hdr->ts;
else else
// TODO-Jon: use network_time?
fake_hdr.ts.tv_sec = fake_hdr.ts.tv_usec = 0; fake_hdr.ts.tv_sec = fake_hdr.ts.tv_usec = 0;
const u_char* pkt = 0; const u_char* pkt = 0;

8
src/TunnelEncapsulation.h
View file

@ -114,9 +114,6 @@ protected:
/** /**
* Abstracts an arbitrary amount of nested tunneling. * Abstracts an arbitrary amount of nested tunneling.
*/ */
// TODO-Jon: Rename EncapsulationChain or EncapsulationStack? I'd prefer to
// have notion in there that this covers multiple levels of encapsulations.
class Encapsulation { class Encapsulation {
public: public:
Encapsulation() : conns(0) Encapsulation() : conns(0)
@ -130,11 +127,6 @@ public:
conns = 0; conns = 0;
} }
// TODO-Jon: I don't like the ptr-version of the ctor. When reading
// the code using that, I can't tell what it does with the pointer
// (i.e., that it deep-copied the object). Can we use just the
// reference version above? That may mean more "if ( not null )" at
// the caller end though.
Encapsulation(const Encapsulation* other) Encapsulation(const Encapsulation* other)
{ {
if ( other && other->conns ) if ( other && other->conns )

1
src/event.bif
View file

@ -146,7 +146,6 @@ event new_connection%(c: connection%);
## or from the outer encapsulation changing. Note that the connection's ## or from the outer encapsulation changing. Note that the connection's
## *tunnel* field is NOT automatically assigned to the new encapsulation value ## *tunnel* field is NOT automatically assigned to the new encapsulation value
## internally after this event is raised. ## internally after this event is raised.
## TODO-Jon: I'm not sure what the last sentence is supposed to tell me?
## ##
## c: The connection whose tunnel/encapsulation changed. ## c: The connection whose tunnel/encapsulation changed.
## ##