Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Working on TODOs.

Browse source 
- Introducing analyzer::<protocol> namespaces.
- Moving protocol-specific events out of events.bif into analyzer/protocol/<protocol>/events.bif
- Moving ARP over (even though it's not an actual analyzer).
- Moving NetFlow over (even though it's not an actual analyzer).
- Moving MIME over (even though it's not an actual analyzer).
This commit is contained in:
Robin Sommer 2013-04-18 14:39:32 -07:00
parent dfc4cb0881
commit 5dc630f722
210 changed files with 7080 additions and 6608 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/protocols/ssh/SSH.cc
View file

@ -9,15 +9,19 @@
#include "Event.h"
#include "analyzer/protocols/tcp/ContentLine.h"
#include "events.bif.h"
using namespace analyzer::ssh;
SSH_Analyzer::SSH_Analyzer(Connection* c)
: TCP_ApplicationAnalyzer("SSH", c)
: tcp::TCP_ApplicationAnalyzer("SSH", c)
{
orig = new ContentLine_Analyzer(c, true);
orig = new tcp::ContentLine_Analyzer(c, true);
orig->SetSkipPartial(true);
orig->SetCRLFAsEOL(LF_as_EOL);
AddSupportAnalyzer(orig);
resp = new ContentLine_Analyzer(c, false);
resp = new tcp::ContentLine_Analyzer(c, false);
resp->SetSkipPartial(true);
resp->SetCRLFAsEOL(LF_as_EOL);
AddSupportAnalyzer(resp);
@ -25,7 +29,7 @@ SSH_Analyzer::SSH_Analyzer(Connection* c)
void SSH_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig)
{
TCP_ApplicationAnalyzer::DeliverStream(length, data, is_orig);
tcp::TCP_ApplicationAnalyzer::DeliverStream(length, data, is_orig);
// We're all done processing this endpoint - flag it as such,
// before we even determine whether we have any event generation
@ -38,7 +42,7 @@ void SSH_Analyzer::DeliverStream(int length, const u_char* data, bool is_orig)
if ( TCP() )
{
// Don't try to parse version if there has already been a gap.
TCP_Endpoint* endp = is_orig ? TCP()->Orig() : TCP()->Resp();
tcp::TCP_Endpoint* endp = is_orig ? TCP()->Orig() : TCP()->Resp();
if ( endp->HadGap() )
return;
}