Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 05:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Refactor to make bro use a common Packet object.

Browse source 
Do a better job of parsing layer 2 and keeping track of layer 3 proto.
Add support for raw packet event, including Layer2 headers.
This commit is contained in:
Jeff Barber 2015-05-22 16:43:03 -04:00
parent 2b1cd66f17
commit 30fdc37479
34 changed files with 677 additions and 429 deletions
Download patch file Download diff file Expand all files Collapse all files

58
src/Serializer.h
View file

@ -378,64 +378,6 @@ protected:
};
// A link-layer packet.
//
// Eventually we should use something like this consistently throughout Bro,
// replacing the current packet arguments in functions like *::NextPacket().
// Before doing this, though, we should consider provisioning for packet
// formats other than just libpcap by designing a more abstract interface.
//
// Note that for serialization we don't use much of the support provided by
// the serialization framework. Serialize/Unserialize do all the work by
// themselves. In particular, Packets aren't derived from SerialObj. They are
// completely seperate and self-contained entities, and we don't need any of
// the sophisticated features like object caching.
class Packet {
public:
// Argument is whether we should delete associatd memory upon
// destruction.
Packet(TimerMgr::Tag arg_tag, bool arg_free = false)
{
time = 0.0;
hdr = 0;
pkt = 0;
hdr_size = 0;
free = arg_free;
tag = arg_tag;
link_type = 0;
}
~Packet()
{
if ( free )
{
delete hdr;
delete [] pkt;
}
}
const IP_Hdr IP() const
{ return IP_Hdr((struct ip *) (pkt + hdr_size), true); }
void Describe(ODesc* d) const;
bool Serialize(SerialInfo* info) const;
static Packet* Unserialize(UnserialInfo* info);
const struct pcap_pkthdr* hdr;
const u_char* pkt;
TimerMgr::Tag tag;
uint32 link_type;
double time;
int hdr_size;
private:
bool free;
};
extern FileSerializer* event_serializer;
extern FileSerializer* state_serializer;