Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Make tunnels always identifiable by UID, tunnel.log now gets populated.

Browse source 
conn.log now sets a field indicating all the parent tunnel UIDs over
which a connection operated and cross reference the UIDs found in
the tunnel.log.

Also some renaming of tunnel related types at the scripting layer.
This commit is contained in:
Jon Siwek 2012-04-26 12:29:59 -05:00
parent ad55331258
commit b8e1604ab5
22 changed files with 224 additions and 213 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/Conn.h
View file

@ -23,7 +23,6 @@ class RuleHdrTest;
class Specific_RE_Matcher;
class TransportLayerAnalyzer;
class RuleEndpointState;
class TunnelParent;
typedef enum {
NUL_IN_LINE,
@ -56,7 +55,14 @@ public:
const Encapsulation& arg_encap);
virtual ~Connection();
void CheckEncapsulation(const Encapsulation& arg_encap);
void CheckEncapsulation(const Encapsulation& arg_encap)
{
if ( encapsulation != arg_encap )
{
Event(tunnel_changed, 0, arg_encap.GetVectorVal());
encapsulation = arg_encap;
}
}
// Invoked when connection is about to be removed. Use Ref(this)
// inside Done to keep the connection object around (though it'll
@ -245,6 +251,8 @@ public:
void SetTransport(TransportProto arg_proto) { proto = arg_proto; }
void SetUID(uint64 arg_uid) { uid = arg_uid; }
uint64 GetUID() const { return uid; }
const Encapsulation& GetEncapsulation() const
{ return encapsulation; }