Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Change packet analyzer identifiers to be 64-bit

Browse source
This commit is contained in:
Tim Wojtulewicz 2025-03-24 15:19:33 -07:00
parent 33d7e5a7bf
commit e5d628548b
4 changed files with 19 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/packet_analysis/Analyzer.cc
View file

@ -53,12 +53,12 @@ bool Analyzer::IsAnalyzer(const char* name) {
return packet_mgr->GetComponentName(tag) == name;
}
const AnalyzerPtr& Analyzer::Lookup(uint32_t identifier) const { return dispatcher.Lookup(identifier); }
const AnalyzerPtr& Analyzer::Lookup(uint64_t identifier) const { return dispatcher.Lookup(identifier); }
// Find the next inner analyzer using identifier or via DetectProtocol(),
// otherwise return the default analyzer.
const AnalyzerPtr& Analyzer::FindInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet,
uint32_t identifier) const {
uint64_t identifier) const {
const auto& identifier_based_analyzer = Lookup(identifier);
if ( identifier_based_analyzer )
return identifier_based_analyzer;
@ -92,11 +92,11 @@ const AnalyzerPtr& Analyzer::DetectInnerAnalyzer(size_t len, const uint8_t* data
return nil;
}
bool Analyzer::ForwardPacket(size_t len, const uint8_t* data, Packet* packet, uint32_t identifier) const {
bool Analyzer::ForwardPacket(size_t len, const uint8_t* data, Packet* packet, uint64_t identifier) const {
const auto& inner_analyzer = FindInnerAnalyzer(len, data, packet, identifier);
if ( ! inner_analyzer ) {
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s failed, could not find analyzer for identifier %#x.",
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s failed, could not find analyzer for identifier %#" PRIx64 ".",
GetAnalyzerName(), identifier);
if ( report_unknown_protocols )
@ -106,12 +106,12 @@ bool Analyzer::ForwardPacket(size_t len, const uint8_t* data, Packet* packet, ui
}
if ( ! inner_analyzer->IsEnabled() ) {
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s found disabled next layer analyzer %s for identifier %#x",
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s found disabled next layer analyzer %s for identifier %#" PRIx64,
GetAnalyzerName(), inner_analyzer->GetAnalyzerName(), identifier);
return false;
}
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s succeeded, next layer identifier is %#x.", GetAnalyzerName(),
DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s succeeded, next layer identifier is %#" PRIx64 ".", GetAnalyzerName(),
identifier);
packet_mgr->TrackAnalyzer(inner_analyzer.get(), len, data);
@ -141,7 +141,7 @@ void Analyzer::DumpDebug() const {
#endif
}
void Analyzer::RegisterProtocol(uint32_t identifier, AnalyzerPtr child) {
void Analyzer::RegisterProtocol(uint64_t identifier, AnalyzerPtr child) {
if ( run_state::detail::zeek_init_done )
reporter->FatalError("Packet protocols cannot be registered after zeek_init has finished.");

8
src/packet_analysis/Analyzer.h
View file

@ -108,7 +108,7 @@ public:
* @param child The analyzer that will be called for the new protocol during
* forwarding.
*/
void RegisterProtocol(uint32_t identifier, AnalyzerPtr child);
void RegisterProtocol(uint64_t identifier, AnalyzerPtr child);
/**
* Registers an analyzer to use for protocol detection if identifier
@ -202,7 +202,7 @@ protected:
* @return The analyzer registered for the given identifier. Returns a
* nullptr if no analyzer is registered.
*/
const AnalyzerPtr& Lookup(uint32_t identifier) const;
const AnalyzerPtr& Lookup(uint64_t identifier) const;
/**
* Returns an analyzer based on a script-land definition.
@ -238,7 +238,7 @@ protected:
*
* @return false if the analysis failed, else true.
*/
bool ForwardPacket(size_t len, const uint8_t* data, Packet* packet, uint32_t identifier) const;
bool ForwardPacket(size_t len, const uint8_t* data, Packet* packet, uint64_t identifier) const;
/**
* Triggers default analysis of the encapsulated packet if the default analyzer
@ -266,7 +266,7 @@ private:
const zeek::Tag& arg_tag);
// Internal helpers to find an appropriate next inner analyzer.
const AnalyzerPtr& FindInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet, uint32_t identifier) const;
const AnalyzerPtr& FindInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet, uint64_t identifier) const;
const AnalyzerPtr& FindInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet) const;
const AnalyzerPtr& DetectInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet) const;

8
src/packet_analysis/Dispatcher.cc
View file

@ -12,7 +12,7 @@ namespace zeek::packet_analysis::detail {
Dispatcher::~Dispatcher() { FreeValues(); }
void Dispatcher::Register(uint32_t identifier, AnalyzerPtr analyzer) {
void Dispatcher::Register(uint64_t identifier, AnalyzerPtr analyzer) {
// If the table has size 1 and the entry is nullptr, there was nothing added yet. Just add it.
if ( table.size() == 1 && table[0] == nullptr ) {
table[0] = std::move(analyzer);
@ -27,7 +27,7 @@ void Dispatcher::Register(uint32_t identifier, AnalyzerPtr analyzer) {
}
else if ( identifier < lowest_identifier ) {
// Lower than the lowest registered identifier. Shift up by lowerBound - identifier
uint32_t distance = lowest_identifier - identifier;
uint64_t distance = lowest_identifier - identifier;
table.resize(table.size() + distance, nullptr);
// Shift values
@ -48,7 +48,7 @@ void Dispatcher::Register(uint32_t identifier, AnalyzerPtr analyzer) {
table[index] = std::move(analyzer);
}
const AnalyzerPtr& Dispatcher::Lookup(uint32_t identifier) const {
const AnalyzerPtr& Dispatcher::Lookup(uint64_t identifier) const {
int64_t index = identifier - lowest_identifier;
if ( index >= 0 && index < static_cast<int64_t>(table.size()) )
return table[index];
@ -75,7 +75,7 @@ void Dispatcher::DumpDebug() const {
DBG_LOG(DBG_PACKET_ANALYSIS, "Dispatcher elements (used/total): %lu/%lu", Count(), table.size());
for ( size_t i = 0; i < table.size(); i++ ) {
if ( table[i] != nullptr )
DBG_LOG(DBG_PACKET_ANALYSIS, "%#8lx => %s", i + lowest_identifier, table[i]->GetAnalyzerName());
DBG_LOG(DBG_PACKET_ANALYSIS, "%#8" PRIx64 " => %s", i + lowest_identifier, table[i]->GetAnalyzerName());
}
#endif
}

8
src/packet_analysis/Dispatcher.h
View file

@ -28,7 +28,7 @@ public:
* @param identifier The identifier.
* @param analyzer The analyzer to register.
*/
void Register(uint32_t identifier, AnalyzerPtr analyzer);
void Register(uint64_t identifier, AnalyzerPtr analyzer);
/**
* Looks up the analyzer for an identifier.
@ -37,7 +37,7 @@ public:
* @return The analyzer registered for the given identifier. Returns a
* nullptr if no analyzer is registered.
*/
const AnalyzerPtr& Lookup(uint32_t identifier) const;
const AnalyzerPtr& Lookup(uint64_t identifier) const;
/**
* Returns the number of registered analyzers.
@ -56,12 +56,12 @@ public:
void DumpDebug() const;
private:
uint32_t lowest_identifier = 0;
uint64_t lowest_identifier = 0;
std::vector<AnalyzerPtr> table;
void FreeValues();
inline uint32_t GetHighestIdentifier() const { return lowest_identifier + table.size() - 1; }
inline uint64_t GetHighestIdentifier() const { return lowest_identifier + table.size() - 1; }
};
} // namespace detail