mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
d5fd29edcd
While we support initializing records via coercion from an expression
list, e.g.,
local x: X = [$x1=1, $x2=2];
this can sometimes obscure the code to readers, e.g., when assigning to
value declared and typed elsewhere. The language runtime has a similar
overhead since instead of just constructing a known type it needs to
check at runtime that the coercion from the expression list is valid;
this can be slower than just writing the readible code in the first
place, see #4559.
With this patch we use explicit construction, e.g.,
local x = X($x1=1, $x2=2);
34 lines
1.2 KiB
Text
34 lines
1.2 KiB
Text
##! This script handles core generated connection related "weird" events to
|
|
##! push weird information about connections into the weird framework.
|
|
##! For live operational deployments, this can frequently cause load issues
|
|
##! due to large numbers of these events and quite possibly shouldn't be
|
|
##! loaded.
|
|
|
|
@load base/frameworks/notice
|
|
|
|
module Conn;
|
|
|
|
export {
|
|
redef enum Notice::Type += {
|
|
## Possible evasion; usually just chud.
|
|
Retransmission_Inconsistency,
|
|
## Data has sequence hole; perhaps due to filtering.
|
|
Content_Gap,
|
|
};
|
|
}
|
|
|
|
event rexmit_inconsistency(c: connection, t1: string, t2: string, tcp_flags: string)
|
|
{
|
|
NOTICE(Notice::Info($note=Retransmission_Inconsistency,
|
|
$conn=c,
|
|
$msg=fmt("%s rexmit inconsistency (%s) (%s) [%s]",
|
|
id_string(c$id), t1, t2, tcp_flags),
|
|
$identifier=fmt("%s", c$id)));
|
|
}
|
|
|
|
event content_gap(c: connection, is_orig: bool, seq: count, length: count)
|
|
{
|
|
NOTICE(Notice::Info($note=Content_Gap, $conn=c,
|
|
$msg=fmt("%s content gap (%s %d/%d)",
|
|
id_string(c$id), is_orig ? ">" : "<", seq, length)));
|
|
}
|