Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

ContentLine: Add GetDeliverStreamRemainingLength() accessor

Browse source 
Helper to get information from the ContentLine analyzer about
bytes still pending to be delivered. In certain cases this can
be a signal for weirdness.
This commit is contained in:
Arne Welzel 2024-01-18 18:42:42 +01:00
parent 7967ef993b
commit 2b9776adca
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/analyzer/protocol/tcp/ContentLine.h
View file

@ -47,6 +47,11 @@ public:
int64_t GetPlainDeliveryLength() const { return plain_delivery_length; }
bool IsPlainDelivery() { return is_plain; }
// Helper to check how many bytes are still in-flight for the
// current DeliverStream() invocation. This can be called
// by the parent during its DeliverStream() invocation.
int GetDeliverStreamRemainingLength() const { return deliver_stream_remaining_length; }
// Skip <length> bytes after this line.
// Can be used to skip HTTP data for performance considerations.
void SkipBytesAfterThisLine(int64_t length);
@ -107,6 +112,8 @@ protected:
// Whether to skip partial conns.
bool skip_partial;
int deliver_stream_remaining_length;
};
} // namespace zeek::analyzer::tcp