Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Conn: Improve packing, drop bitfields and boolenize

Browse source 
There's a few holes in Conn, particularly now that TransportProto has
become a uint8_t. Pack things a bit more neatly.
This commit is contained in:
Arne Welzel 2025-09-29 15:13:05 +02:00
parent 4a15328ba9
commit 3d364030fb
2 changed files with 14 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/Conn.cc
View file

@ -43,8 +43,8 @@ Connection::Connection(zeek::IPBasedConnKeyPtr k, double t, uint32_t flow, const
orig_flow_label = flow; orig_flow_label = flow;
resp_flow_label = 0; resp_flow_label = 0;
saw_first_orig_packet = 1; saw_first_orig_packet = true;
saw_first_resp_packet = 0; saw_first_resp_packet = false;
if ( pkt->l2_src ) if ( pkt->l2_src )
memcpy(orig_l2_addr, pkt->l2_src, sizeof(orig_l2_addr)); memcpy(orig_l2_addr, pkt->l2_src, sizeof(orig_l2_addr));
@ -59,11 +59,11 @@ Connection::Connection(zeek::IPBasedConnKeyPtr k, double t, uint32_t flow, const
vlan = pkt->vlan; vlan = pkt->vlan;
inner_vlan = pkt->inner_vlan; inner_vlan = pkt->inner_vlan;
weird = 0; weird = false;
suppress_event = 0; suppress_event = 0;
finished = 0; finished = false;
adapter = nullptr; adapter = nullptr;
primary_PIA = nullptr; primary_PIA = nullptr;
@ -119,7 +119,7 @@ void Connection::CheckEncapsulation(const std::shared_ptr<EncapsulationStack>& a
} }
void Connection::Done() { void Connection::Done() {
finished = 1; finished = true;
if ( adapter ) { if ( adapter ) {
if ( ConnTransport() == TRANSPORT_TCP ) { if ( ConnTransport() == TRANSPORT_TCP ) {
@ -273,7 +273,7 @@ void Connection::RemovalEvent() {
} }
void Connection::Weird(const char* name, const char* addl, const char* source) { void Connection::Weird(const char* name, const char* addl, const char* source) {
weird = 1; weird = true;
reporter->Weird(this, name, addl ? addl : "", source ? source : ""); reporter->Weird(this, name, addl ? addl : "", source ? source : "");
} }
@ -395,9 +395,9 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label) {
} }
if ( is_orig ) if ( is_orig )
saw_first_orig_packet = 1; saw_first_orig_packet = true;
else else
saw_first_resp_packet = 1; saw_first_resp_packet = true;
} }
bool Connection::PermitWeird(const char* name, uint64_t threshold, uint64_t rate, double duration) { bool Connection::PermitWeird(const char* name, uint64_t threshold, uint64_t rate, double duration) {

10
src/Conn.h
View file

@ -200,7 +200,6 @@ private:
IPAddr orig_addr; IPAddr orig_addr;
IPAddr resp_addr; IPAddr resp_addr;
uint32_t orig_port, resp_port; // in network order uint32_t orig_port, resp_port; // in network order
TransportProto proto;
uint32_t orig_flow_label, resp_flow_label; // most recent IPv6 flow labels uint32_t orig_flow_label, resp_flow_label; // most recent IPv6 flow labels
uint32_t vlan, inner_vlan; // VLAN this connection traverses, if available uint32_t vlan, inner_vlan; // VLAN this connection traverses, if available
u_char orig_l2_addr[Packet::L2_ADDR_LEN]; // Link-layer originator address, if available u_char orig_l2_addr[Packet::L2_ADDR_LEN]; // Link-layer originator address, if available
@ -208,13 +207,14 @@ private:
int suppress_event; // suppress certain events to once per conn. int suppress_event; // suppress certain events to once per conn.
RecordValPtr conn_val; RecordValPtr conn_val;
std::shared_ptr<EncapsulationStack> encapsulation; // tunnels std::shared_ptr<EncapsulationStack> encapsulation; // tunnels
uint8_t tunnel_changes = 0;
IPBasedConnKeyPtr key; IPBasedConnKeyPtr key;
unsigned int weird : 1; TransportProto proto;
unsigned int finished : 1; uint8_t tunnel_changes = 0;
unsigned int saw_first_orig_packet : 1, saw_first_resp_packet : 1; bool weird;
bool finished;
bool saw_first_orig_packet, saw_first_resp_packet;
packet_analysis::IP::SessionAdapter* adapter; packet_analysis::IP::SessionAdapter* adapter;
analyzer::pia::PIA* primary_PIA; analyzer::pia::PIA* primary_PIA;