From a7b1161c124084d79ed87f7168ee332c835f8a3a Mon Sep 17 00:00:00 2001 From: Johanna Amann Date: Mon, 10 Apr 2017 11:37:43 -0700 Subject: [PATCH] Threading Types: add a bit of documentation to subnet type. This explains how the length field is currently handled when exchanging data in both directions. --- src/threading/SerialTypes.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/threading/SerialTypes.h b/src/threading/SerialTypes.h index e056f6c170..af3f92d416 100644 --- a/src/threading/SerialTypes.h +++ b/src/threading/SerialTypes.h @@ -98,7 +98,7 @@ struct Value { typedef set_t vec_t; struct port_t { bro_uint_t port; TransportProto proto; }; - struct addr_t { + struct addr_t { IPFamily family; union { struct in_addr in4; @@ -106,6 +106,13 @@ struct Value { } in; }; + // A small note for handling subnet values: Subnet values emitted from + // the logging framework will always have a length that is based on the + // internal IPv6 representation (so you have to substract 96 from it to + // get the correct value for IPv4). + // However, the Input framework expects the "normal" length for an IPv4 + // address (so do not add 96 to it), because the underlying constructors + // for the SubNet type want it like this. struct subnet_t { addr_t prefix; uint8_t length; }; /**