Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Migrate all packet analyzers to new API.

Browse source
This commit is contained in:
Jan Grashoefer 2020-08-24 17:34:42 +02:00 • committed by Tim Wojtulewicz
parent cbdaa53f85
commit 6365fa6d80
34 changed files with 135 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/packet_analysis/protocol/nflog/NFLog.cc
View file

@ -10,7 +10,7 @@ NFLogAnalyzer::NFLogAnalyzer()
{
}
zeek::packet_analysis::AnalysisResultTuple NFLogAnalyzer::Analyze(Packet* packet, const uint8_t*& data) {
zeek::packet_analysis::AnalyzerResult NFLogAnalyzer::Analyze(Packet* packet, const uint8_t*& data) {
auto end_of_data = packet->GetEndOfData();
// See https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html
@ -20,7 +20,7 @@ zeek::packet_analysis::AnalysisResultTuple NFLogAnalyzer::Analyze(Packet* packet
if ( version != 0 )
{
packet->Weird("unknown_nflog_version");
return { AnalyzerResult::Failed, 0 };
return AnalyzerResult::Failed;
}
// Skip to TLVs.
@ -34,7 +34,7 @@ zeek::packet_analysis::AnalysisResultTuple NFLogAnalyzer::Analyze(Packet* packet
if ( data + 4 >= end_of_data )
{
packet->Weird("nflog_no_pcap_payload");
return { AnalyzerResult::Failed, 0 };
return AnalyzerResult::Failed;
}
// TLV Type and Length values are specified in host byte order
@ -61,7 +61,7 @@ zeek::packet_analysis::AnalysisResultTuple NFLogAnalyzer::Analyze(Packet* packet
if ( tlv_len < 4 )
{
packet->Weird("nflog_bad_tlv_len");
return { AnalyzerResult::Failed, 0 };
return AnalyzerResult::Failed;
}
else
{
@ -75,5 +75,5 @@ zeek::packet_analysis::AnalysisResultTuple NFLogAnalyzer::Analyze(Packet* packet
}
}
return { AnalyzerResult::Continue, protocol };
return AnalyzeInnerPacket(packet, data, protocol);
}