mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
b3f1f45082
Internally, all BROv6 preprocessor switches were removed and addr/subnet representations wrapped in the new IPAddr/IPPrefix classes. Some script-layer changes of note: - dns_AAAA_reply event signature changed: the string representation of an IPv6 addr is easily derived from the addr value, it doesn't need to be another parameter. This event also now generated directly by the DNS analyzer instead of being "faked" into a dns_A_reply event. - removed addr_to_count BIF. It used to return the host-order count representation of IPv4 addresses only. To make it more generic, we might later add a BIF to return a vector of counts in order to support IPv6. - changed the result of enclosing addr variables in vertical pipes (e.g. |my_addr|) to return the bit-width of the address type which is 128 for IPv6 and 32 for IPv4. It used to function the same way as addr_to_count mentioned above. - remove bro_has_ipv6 BIF
84 lines
1.9 KiB
C++
84 lines
1.9 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#ifndef reassem_h
|
|
#define reassem_h
|
|
|
|
#include "Obj.h"
|
|
#include "IPAddr.h"
|
|
|
|
class DataBlock {
|
|
public:
|
|
DataBlock(const u_char* data, int size, int seq,
|
|
DataBlock* prev, DataBlock* next);
|
|
|
|
~DataBlock();
|
|
|
|
int Size() const { return upper - seq; }
|
|
|
|
DataBlock* next; // next block with higher seq #
|
|
DataBlock* prev; // previous block with lower seq #
|
|
int seq, upper;
|
|
u_char* block;
|
|
};
|
|
|
|
|
|
enum ReassemblerType { REASSEM_IP, REASSEM_TCP };
|
|
|
|
class Reassembler : public BroObj {
|
|
public:
|
|
Reassembler(int init_seq, const IPAddr& ip_addr,
|
|
ReassemblerType arg_type);
|
|
virtual ~Reassembler();
|
|
|
|
void NewBlock(double t, int seq, int len, const u_char* data);
|
|
|
|
// Throws away all blocks up to seq. Returns number of bytes
|
|
// if not all in-sequence, 0 if they were.
|
|
int TrimToSeq(int seq);
|
|
|
|
// Delete all held blocks.
|
|
void ClearBlocks();
|
|
|
|
int HasBlocks() const { return blocks != 0; }
|
|
int LastReassemSeq() const { return last_reassem_seq; }
|
|
|
|
int TotalSize() const; // number of bytes buffered up
|
|
|
|
void Describe(ODesc* d) const;
|
|
|
|
bool Serialize(SerialInfo* info) const;
|
|
static Reassembler* Unserialize(UnserialInfo* info);
|
|
|
|
// Sum over all data buffered in some reassembler.
|
|
static unsigned int TotalMemoryAllocation() { return total_size; }
|
|
|
|
protected:
|
|
Reassembler() { }
|
|
|
|
DECLARE_ABSTRACT_SERIAL(Reassembler);
|
|
|
|
friend class DataBlock;
|
|
|
|
virtual void Undelivered(int up_to_seq);
|
|
|
|
virtual void BlockInserted(DataBlock* b) = 0;
|
|
virtual void Overlap(const u_char* b1, const u_char* b2, int n) = 0;
|
|
|
|
DataBlock* AddAndCheck(DataBlock* b, int seq,
|
|
int upper, const u_char* data);
|
|
|
|
DataBlock* blocks;
|
|
DataBlock* last_block;
|
|
int last_reassem_seq;
|
|
int trim_seq; // how far we've trimmed
|
|
|
|
static unsigned int total_size;
|
|
};
|
|
|
|
inline DataBlock::~DataBlock()
|
|
{
|
|
Reassembler::total_size -= pad_size(upper - seq) + padded_sizeof(DataBlock);
|
|
delete [] block;
|
|
}
|
|
|
|
#endif
|