Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Ascii formatter: do not complain about port text.

Browse source 
The ascii formatter already was happy to read ports in the form
"42/tcp"; however it emitted a warning message for each line.

This patch fixes this and adds a bit more testing for the existing
behavior.
This commit is contained in:
Johanna Amann 2018-08-10 11:23:33 -07:00
parent 116079a9ad
commit 26ea1999ec
7 changed files with 88 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/threading/formatters/Ascii.cc
View file

@ -261,8 +261,10 @@ threading::Value* Ascii::ParseValue(const string& s, const string& name, TypeTag
break;
case TYPE_PORT:
{
val->val.port_val.proto = TRANSPORT_UNKNOWN;
pos = s.find('/');
string numberpart;
if ( pos != std::string::npos && s.length() > pos + 1 )
{
auto proto = s.substr(pos+1);
@ -272,10 +274,22 @@ threading::Value* Ascii::ParseValue(const string& s, const string& name, TypeTag
val->val.port_val.proto = TRANSPORT_UDP;
else if ( strtolower(proto) == "icmp" )
val->val.port_val.proto = TRANSPORT_ICMP;
else if ( strtolower(proto) == "unknown" )
val->val.port_val.proto = TRANSPORT_UNKNOWN;
else
GetThread()->Warning(GetThread()->Fmt("Port '%s' contained unknown protocol '%s'", s.c_str(), proto.c_str()));
}
// make the string end at the position of "/";
if ( pos != std::string::npos && pos > 0 )
{
numberpart = s.substr(0, pos);
start = numberpart.c_str();
}
val->val.port_val.port = strtoull(start, &end, 10);
if ( CheckNumberError(start, end) )
goto parse_error;
}
break;
case TYPE_SUBNET: