Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Another tunneling checkpoint.

Browse source 
- AYIYA works.
  - AYIYA analyzed connections are still labelled wrong in conn.log (logged as syslog)
- Some clean up for left over code.
- Small refactoring to pass packets back from analyzers to core.
- $uid is now optional in conn logs since ip-in-ip tunnel parent's
  won't have an actual connection.
This commit is contained in:
Seth Hall 2012-04-24 01:05:35 -04:00
parent ae96314196
commit 2a79fe95ec
12 changed files with 53 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

27
src/AYIYA.h
View file

@ -1,9 +1,6 @@
#ifndef AYIYA_h
#define AYIYA_h
#include "UDP.h"
#include "TCP.h"
#include "ayiya_pac.h"
class AYIYA_Analyzer : public Analyzer {
@ -19,7 +16,7 @@ public:
{ return new AYIYA_Analyzer(conn); }
static bool Available()
{ return true; }
{ return BifConst::Tunnel::decapsulate_ip; }
protected:
friend class AnalyzerTimer;
@ -30,26 +27,4 @@ protected:
binpac::AYIYA::AYIYA_Conn* interp;
};
// #include "Syslog_tcp_pac.h"
//
//class Syslog_TCP_Analyzer_binpac : public TCP_ApplicationAnalyzer {
//public:
// Syslog_TCP_Analyzer_binpac(Connection* conn);
// virtual ~Syslog_TCP_Analyzer_binpac();
//
// virtual void Done();
// virtual void DeliverStream(int len, const u_char* data, bool orig);
// virtual void Undelivered(int seq, int len, bool orig);
// virtual void EndpointEOF(TCP_Reassembler* endp);
//
// static Analyzer* InstantiateAnalyzer(Connection* conn)
// { return new Syslog_TCP_Analyzer_binpac(conn); }
//
// static bool Available()
// { return (Syslog_request || Syslog_full_request) && FLAGS_use_binpac; }
//
//protected:
// binpac::Syslog_on_TCP::Syslog_TCP_Conn* interp;
//};
//
#endif