mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
Moving my todos over to the tracker ticket.
This commit is contained in:
parent
1acb9fd91d
commit
19cf93be69
5 changed files with 2 additions and 23 deletions
|
@ -18,8 +18,6 @@ export {
|
|||
## A tunnel connection has closed.
|
||||
CLOSE,
|
||||
## No new connections over a tunnel happened in the past day.
|
||||
## TODO-Jon: Where is the "past day" coming from? Should be an
|
||||
## option.
|
||||
EXPIRE,
|
||||
};
|
||||
|
||||
|
@ -72,7 +70,6 @@ export {
|
|||
|
||||
## Currently active tunnels. That is, tunnels for which new, encapsulated
|
||||
## connections have been seen in the last day.
|
||||
## TODO-Jon: Do we we need the &synchronized here?
|
||||
global active: table[conn_id] of Info = table() &synchronized &read_expire=24hrs &expire_func=expire;
|
||||
}
|
||||
|
||||
|
@ -132,12 +129,6 @@ event new_connection(c: connection) &priority=5
|
|||
|
||||
event tunnel_changed(c: connection, e: EncapsulatingConnVector) &priority=5
|
||||
{
|
||||
## TODO-Jon: Not sure I understand this. Shouldn't c$tunnel already be
|
||||
## registered? And what if a layer goes way, does that need to be
|
||||
## removed here? Or is that done separately?
|
||||
##
|
||||
## Also, conn/main.bro has a tunnel_changed handler at the same
|
||||
## priority that *sets* c$tunnel. That's seems undefine behaviour.
|
||||
if ( c?$tunnel )
|
||||
register_all(c$tunnel);
|
||||
|
||||
|
|
|
@ -217,9 +217,7 @@ public:
|
|||
|
||||
// Return whether the analyzer previously called ProtocolConfirmation()
|
||||
// at least once before.
|
||||
//
|
||||
// TODO-Jon: Why virtual?
|
||||
virtual bool ProtocolConfirmed() const
|
||||
bool ProtocolConfirmed() const
|
||||
{ return protocol_confirmed; }
|
||||
|
||||
// Report that we found a significant protocol violation which might
|
||||
|
|
|
@ -546,7 +546,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr,
|
|||
Weird("truncated_inner_IP", ip_hdr, encapsulation);
|
||||
|
||||
else if ( result > 0 )
|
||||
Weird("inner_IP_payload_mismatch", ip_hdr, encapsulation);
|
||||
Weird("inner_IP_payload_length_mismatch", ip_hdr, encapsulation);
|
||||
|
||||
if ( result != 0 )
|
||||
{
|
||||
|
@ -706,7 +706,6 @@ void NetSessions::DoNextInnerPacket(double t, const struct pcap_pkthdr* hdr,
|
|||
if ( hdr )
|
||||
fake_hdr.ts = hdr->ts;
|
||||
else
|
||||
// TODO-Jon: use network_time?
|
||||
fake_hdr.ts.tv_sec = fake_hdr.ts.tv_usec = 0;
|
||||
|
||||
const u_char* pkt = 0;
|
||||
|
|
|
@ -114,9 +114,6 @@ protected:
|
|||
/**
|
||||
* Abstracts an arbitrary amount of nested tunneling.
|
||||
*/
|
||||
|
||||
// TODO-Jon: Rename EncapsulationChain or EncapsulationStack? I'd prefer to
|
||||
// have notion in there that this covers multiple levels of encapsulations.
|
||||
class Encapsulation {
|
||||
public:
|
||||
Encapsulation() : conns(0)
|
||||
|
@ -130,11 +127,6 @@ public:
|
|||
conns = 0;
|
||||
}
|
||||
|
||||
// TODO-Jon: I don't like the ptr-version of the ctor. When reading
|
||||
// the code using that, I can't tell what it does with the pointer
|
||||
// (i.e., that it deep-copied the object). Can we use just the
|
||||
// reference version above? That may mean more "if ( not null )" at
|
||||
// the caller end though.
|
||||
Encapsulation(const Encapsulation* other)
|
||||
{
|
||||
if ( other && other->conns )
|
||||
|
|
|
@ -146,7 +146,6 @@ event new_connection%(c: connection%);
|
|||
## or from the outer encapsulation changing. Note that the connection's
|
||||
## *tunnel* field is NOT automatically assigned to the new encapsulation value
|
||||
## internally after this event is raised.
|
||||
## TODO-Jon: I'm not sure what the last sentence is supposed to tell me?
|
||||
##
|
||||
## c: The connection whose tunnel/encapsulation changed.
|
||||
##
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue