Commit graph

13 commits

Author SHA1 Message Date
Tim Wojtulewicz
70c2397f69 Plugins: Clean up explicit uses of namespaces in places where they're not necessary.
This commit covers all of the plugin classes.
2020-08-24 12:07:03 -07:00
Tim Wojtulewicz
4b61d60e80 Fix indentation of namespaced aliases 2020-08-20 16:11:46 -07:00
Tim Wojtulewicz
914ffcadae Move arp, tcp, udp, pia, and stepping stone analyzers 2020-08-20 15:55:17 -07:00
Tim Wojtulewicz
7fefdd97af Move Conn and related types to zeek namespace 2020-07-31 16:25:54 -04:00
Tim Wojtulewicz
0f8f53808e Use bools instead of single-bit bitfields in Ident and TCP protocol analyzers 2020-01-07 12:07:58 -07:00
Dominik Charousset
c1f3fe7829 Switch from header guards to pragma once 2019-09-17 14:10:30 +02:00
Tim Wojtulewicz
54752ef9a1 Deprecate the internal int/uint types in favor of the cstdint types they were based on 2019-08-12 13:50:07 -07:00
Johanna Amann
6d612ced3d Mark one-parameter constructors as explicit & use override where possible
This commit marks (hopefully) ever one-parameter constructor as explicit.

It also uses override in (hopefully) all circumstances where a virtual
method is overridden.

There are a very few other minor changes - most of them were necessary
to get everything to compile (like one additional constructor). In one
case I changed an implicit operation to an explicit string conversion -
I think the automatically chosen conversion was much more convoluted.

This took longer than I want to admit but not as long as I feared :)
2018-03-27 07:17:32 -07:00
Robin Sommer
25c6a777a1 Merge remote-tracking branch 'origin/topic/jazoff/contentline-limit'
Changed '>' to '>=' in new length check.

* origin/topic/jazoff/contentline-limit:
  add a max_line_length flag to ContentLine_Analyzer
2017-11-17 14:56:50 -08:00
Justin Azoff
43b2b9806e add a max_line_length flag to ContentLine_Analyzer
In ContentLine_Analyzer, prevent excessively long lines being assembled.
The line length will default to just under 16MB, but can be overriden on
a per-analyzer basis.  This is done for the finger,ident, and irc
analyzers.
2017-11-03 16:25:26 -04:00
Jon Siwek
d5513a0757 Improve multipart HTTP/MIME entity file analysis.
Singular CR or LF characters in multipart body content are no longer
converted to a full CRLF (thus corrupting the file) and it also no
longer considers the CRLF before the multipart boundary as part of the
content.

Addresses BIT-1235.
2014-08-26 17:54:41 -05:00
Jon Siwek
2b3c2bd394 Fix reassembly of data w/ sizes beyond 32-bit capacities (BIT-348).
The main change is that reassembly code (e.g. for TCP) now uses
int64/uint64 (signedness is situational) data types in place of int
types in order to support delivering data to analyzers that pass 2GB
thresholds.  There's also changes in logic that accompany the change in
data types, e.g. to fix TCP sequence space arithmetic inconsistencies.

Another significant change is in the Analyzer API: the *Packet and
*Undelivered methods now use a uint64 in place of an int for the
relative sequence space offset parameter.
2014-04-09 13:03:24 -05:00
Robin Sommer
4bc2ba60c9 Rename analyzer/protocols -> analyzer/protocol 2013-04-19 15:50:57 -07:00
Renamed from src/analyzer/protocols/tcp/ContentLine.h (Browse further)