Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Migrate ARP analyzer to use IntrusivePtr

Browse source
This commit is contained in:
Jon Siwek 2020-05-05 19:23:54 -07:00
parent 61b75ddd02
commit ad6dbada71
2 changed files with 17 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/analyzer/protocol/arp/ARP.cc
View file

@ -192,10 +192,10 @@ void ARP_Analyzer::BadARP(const struct arp_pkthdr* hdr, const char* msg)
return;
mgr.Enqueue(bad_arp,
IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_spa(hdr))},
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_sha(hdr))},
IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_tpa(hdr))},
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_tha(hdr))},
ConstructAddrVal(ar_spa(hdr)),
EthAddrToStr((const u_char*) ar_sha(hdr)),
ConstructAddrVal(ar_tpa(hdr)),
EthAddrToStr((const u_char*) ar_tha(hdr)),
make_intrusive<StringVal>(msg)
);
}
@ -214,25 +214,25 @@ void ARP_Analyzer::RREvent(EventHandlerPtr e,
return;
mgr.Enqueue(e,
IntrusivePtr{AdoptRef{}, EthAddrToStr(src)},
IntrusivePtr{AdoptRef{}, EthAddrToStr(dst)},
IntrusivePtr{AdoptRef{}, ConstructAddrVal(spa)},
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) sha)},
IntrusivePtr{AdoptRef{}, ConstructAddrVal(tpa)},
IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) tha)}
EthAddrToStr(src),
EthAddrToStr(dst),
ConstructAddrVal(spa),
EthAddrToStr((const u_char*) sha),
ConstructAddrVal(tpa),
EthAddrToStr((const u_char*) tha)
);
}
AddrVal* ARP_Analyzer::ConstructAddrVal(const void* addr)
IntrusivePtr<AddrVal> ARP_Analyzer::ConstructAddrVal(const void* addr)
{
// ### For now, we only handle IPv4 addresses.
return new AddrVal(*(const uint32_t*) addr);
return make_intrusive<AddrVal>(*(const uint32_t*) addr);
}
StringVal* ARP_Analyzer::EthAddrToStr(const u_char* addr)
IntrusivePtr<StringVal> ARP_Analyzer::EthAddrToStr(const u_char* addr)
{
char buf[1024];
snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
return new StringVal(buf);
return make_intrusive<StringVal>(buf);
}

4
src/analyzer/protocol/arp/ARP.h
View file

@ -45,8 +45,8 @@ public:
const char* tpa, const char* tha);
protected:
AddrVal* ConstructAddrVal(const void* addr);
StringVal* EthAddrToStr(const u_char* addr);
IntrusivePtr<AddrVal> ConstructAddrVal(const void* addr);
IntrusivePtr<StringVal> EthAddrToStr(const u_char* addr);
void BadARP(const struct arp_pkthdr* hdr, const char* string);
void Corrupted(const char* string);
};