mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
2b3c2bd394
The main change is that reassembly code (e.g. for TCP) now uses int64/uint64 (signedness is situational) data types in place of int types in order to support delivering data to analyzers that pass 2GB thresholds. There's also changes in logic that accompany the change in data types, e.g. to fix TCP sequence space arithmetic inconsistencies. Another significant change is in the Analyzer API: the *Packet and *Undelivered methods now use a uint64 in place of an int for the relative sequence space offset parameter.
65 lines
1.3 KiB
C++
65 lines
1.3 KiB
C++
|
|
#include "SSL.h"
|
|
#include "analyzer/protocol/tcp/TCP_Reassembler.h"
|
|
#include "Reporter.h"
|
|
#include "util.h"
|
|
|
|
#include "events.bif.h"
|
|
|
|
using namespace analyzer::ssl;
|
|
|
|
SSL_Analyzer::SSL_Analyzer(Connection* c)
|
|
: tcp::TCP_ApplicationAnalyzer("SSL", c)
|
|
{
|
|
interp = new binpac::SSL::SSL_Conn(this);
|
|
had_gap = false;
|
|
}
|
|
|
|
SSL_Analyzer::~SSL_Analyzer()
|
|
{
|
|
delete interp;
|
|
}
|
|
|
|
void SSL_Analyzer::Done()
|
|
{
|
|
tcp::TCP_ApplicationAnalyzer::Done();
|
|
|
|
interp->FlowEOF(true);
|
|
interp->FlowEOF(false);
|
|
}
|
|
|
|
void SSL_Analyzer::EndpointEOF(bool is_orig)
|
|
{
|
|
tcp::TCP_ApplicationAnalyzer::EndpointEOF(is_orig);
|
|
interp->FlowEOF(is_orig);
|
|
}
|
|
|
|
void SSL_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
|
|
{
|
|
tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, orig);
|
|
|
|
assert(TCP());
|
|
if ( TCP()->IsPartial() )
|
|
return;
|
|
|
|
if ( had_gap )
|
|
// If only one side had a content gap, we could still try to
|
|
// deliver data to the other side if the script layer can handle this.
|
|
return;
|
|
|
|
try
|
|
{
|
|
interp->NewData(orig, data, data + len);
|
|
}
|
|
catch ( const binpac::Exception& e )
|
|
{
|
|
ProtocolViolation(fmt("Binpac exception: %s", e.c_msg()));
|
|
}
|
|
}
|
|
|
|
void SSL_Analyzer::Undelivered(uint64 seq, int len, bool orig)
|
|
{
|
|
tcp::TCP_ApplicationAnalyzer::Undelivered(seq, len, orig);
|
|
had_gap = true;
|
|
interp->NewGap(orig, len);
|
|
}
|