Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Migrate ARP analyzer to use IntrusivePtr

Browse source
This commit is contained in:
Jon Siwek 2020-05-05 19:23:54 -07:00
parent 61b75ddd02
commit ad6dbada71
2 changed files with 17 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/analyzer/protocol/arp/ARP.cc
View file

@ -192,10 +192,10 @@ void ARP_Analyzer::BadARP(const struct arp_pkthdr* hdr, const char* msg)
return; return;
mgr.Enqueue(bad_arp, mgr.Enqueue(bad_arp,
IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_spa(hdr))}, ConstructAddrVal(ar_spa(hdr)),
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_sha(hdr))}, EthAddrToStr((const u_char*) ar_sha(hdr)),
IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_tpa(hdr))}, ConstructAddrVal(ar_tpa(hdr)),
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_tha(hdr))}, EthAddrToStr((const u_char*) ar_tha(hdr)),
make_intrusive<StringVal>(msg) make_intrusive<StringVal>(msg)
); );
} }
@ -214,25 +214,25 @@ void ARP_Analyzer::RREvent(EventHandlerPtr e,
return; return;
mgr.Enqueue(e, mgr.Enqueue(e,
IntrusivePtr{AdoptRef{}, EthAddrToStr(src)}, EthAddrToStr(src),
IntrusivePtr{AdoptRef{}, EthAddrToStr(dst)}, EthAddrToStr(dst),
IntrusivePtr{AdoptRef{}, ConstructAddrVal(spa)}, ConstructAddrVal(spa),
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) sha)}, EthAddrToStr((const u_char*) sha),
IntrusivePtr{AdoptRef{}, ConstructAddrVal(tpa)}, ConstructAddrVal(tpa),
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) tha)} EthAddrToStr((const u_char*) tha)
); );
} }
AddrVal* ARP_Analyzer::ConstructAddrVal(const void* addr) IntrusivePtr<AddrVal> ARP_Analyzer::ConstructAddrVal(const void* addr)
{ {
// ### For now, we only handle IPv4 addresses. // ### For now, we only handle IPv4 addresses.
return new AddrVal(*(const uint32_t*) addr); return make_intrusive<AddrVal>(*(const uint32_t*) addr);
} }
StringVal* ARP_Analyzer::EthAddrToStr(const u_char* addr) IntrusivePtr<StringVal> ARP_Analyzer::EthAddrToStr(const u_char* addr)
{ {
char buf[1024]; char buf[1024];
snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x", snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
return new StringVal(buf); return make_intrusive<StringVal>(buf);
} }

6
src/analyzer/protocol/arp/ARP.h
View file

@ -45,10 +45,10 @@ public:
const char* tpa, const char* tha); const char* tpa, const char* tha);
protected: protected:
AddrVal* ConstructAddrVal(const void* addr); IntrusivePtr<AddrVal> ConstructAddrVal(const void* addr);
StringVal* EthAddrToStr(const u_char* addr); IntrusivePtr<StringVal> EthAddrToStr(const u_char* addr);
void BadARP(const struct arp_pkthdr* hdr, const char* string); void BadARP(const struct arp_pkthdr* hdr, const char* string);
void Corrupted(const char* string); void Corrupted(const char* string);
}; };
} } // namespace analyzer::* } } // namespace analyzer::*