From a2922cdde96a413327f01fb04aa4d849dfb21353 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Thu, 24 Jul 2025 15:50:22 +0200
Subject: [PATCH] ID: Add conn_id_ctx

Seemed a bit unfortunate to use id::connection and id::conn_id, but
then do something different for conn_id_ctx.
---
 src/ID.cc                                              |  2 ++
 src/ID.h                                               |  1 +
 .../protocol/ip/conn_key/vlan_fivetuple/Factory.cc     | 10 ++++------
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/ID.cc b/src/ID.cc
index bd49d135bf..f666c86cf0 100644
--- a/src/ID.cc
+++ b/src/ID.cc
@@ -24,6 +24,7 @@
 namespace zeek {
 
 RecordTypePtr id::conn_id;
+RecordTypePtr id::conn_id_ctx;
 RecordTypePtr id::endpoint;
 RecordTypePtr id::connection;
 RecordTypePtr id::fa_file;
@@ -81,6 +82,7 @@ FuncPtr id::find_func(std::string_view name) {
 
 void id::detail::init_types() {
     conn_id = id::find_type<RecordType>("conn_id");
+    conn_id_ctx = id::find_type<RecordType>("conn_id_ctx");
     endpoint = id::find_type<RecordType>("endpoint");
     connection = id::find_type<RecordType>("connection");
     fa_file = id::find_type<RecordType>("fa_file");
diff --git a/src/ID.h b/src/ID.h
index b1cc83a383..41498df005 100644
--- a/src/ID.h
+++ b/src/ID.h
@@ -259,6 +259,7 @@ IntrusivePtr<T> find_const(std::string_view name) {
 FuncPtr find_func(std::string_view name);
 
 extern RecordTypePtr conn_id;
+extern RecordTypePtr conn_id_ctx;
 extern RecordTypePtr endpoint;
 extern RecordTypePtr connection;
 extern RecordTypePtr fa_file;
diff --git a/src/packet_analysis/protocol/ip/conn_key/vlan_fivetuple/Factory.cc b/src/packet_analysis/protocol/ip/conn_key/vlan_fivetuple/Factory.cc
index 7e243422a7..cf365e2eb3 100644
--- a/src/packet_analysis/protocol/ip/conn_key/vlan_fivetuple/Factory.cc
+++ b/src/packet_analysis/protocol/ip/conn_key/vlan_fivetuple/Factory.cc
@@ -54,18 +54,16 @@ protected:
     };
 
     std::pair<int, int> GetConnCtxFieldOffsets() {
-        static const auto& conn_id_ctx = zeek::id::find_type<zeek::RecordType>("conn_id_ctx");
-
         static int vlan_offset = -2;
         static int inner_vlan_offset = -2;
 
         if ( vlan_offset == -2 && inner_vlan_offset == -2 ) {
-            vlan_offset = conn_id_ctx->FieldOffset("vlan");
-            if ( vlan_offset < 0 || conn_id_ctx->GetFieldType(vlan_offset)->Tag() != TYPE_INT )
+            vlan_offset = id::conn_id_ctx->FieldOffset("vlan");
+            if ( vlan_offset < 0 || id::conn_id_ctx->GetFieldType(vlan_offset)->Tag() != TYPE_INT )
                 vlan_offset = -1;
 
-            inner_vlan_offset = conn_id_ctx->FieldOffset("inner_vlan");
-            if ( inner_vlan_offset < 0 || conn_id_ctx->GetFieldType(inner_vlan_offset)->Tag() != TYPE_INT )
+            inner_vlan_offset = id::conn_id_ctx->FieldOffset("inner_vlan");
+            if ( inner_vlan_offset < 0 || id::conn_id_ctx->GetFieldType(inner_vlan_offset)->Tag() != TYPE_INT )
                 inner_vlan_offset = -1;
         }