mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 21:18:20 +00:00
e4b620673b
- The logic for fragment handling has been rewritten and should be correct now. - There are now tunables for fragment handling overflow situations. - DCE_RPC::max_cmd_reassembly and DCE_RPC::max_frag_data - They result in weirds and analyzer removal. - Memory leak fixed by unique_ptr auto cleanup. - DCE_RPC is now intolerate of content gaps and will stop analyzing traffic if content gaps happen (like most other analyzers currently).
38 lines
994 B
C++
38 lines
994 B
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#ifndef ANALYZER_PROTOCOL_DCE_RPC_DCE_RPC_H
|
|
#define ANALYZER_PROTOCOL_DCE_RPC_DCE_RPC_H
|
|
|
|
#include "NetVar.h"
|
|
#include "analyzer/protocol/tcp/TCP.h"
|
|
#include "analyzer/protocol/dce-rpc/events.bif.h"
|
|
#include "IPAddr.h"
|
|
|
|
#include "dce_rpc_pac.h"
|
|
|
|
namespace analyzer { namespace dce_rpc {
|
|
|
|
class DCE_RPC_Analyzer : public tcp::TCP_ApplicationAnalyzer {
|
|
public:
|
|
DCE_RPC_Analyzer(Connection* conn);
|
|
~DCE_RPC_Analyzer();
|
|
|
|
void Done() override;
|
|
void DeliverStream(int len, const u_char* data, bool orig) override;
|
|
void Undelivered(uint64 seq, int len, bool orig) override;
|
|
void EndpointEOF(bool is_orig) override;
|
|
|
|
bool SetFileID(uint64 fid_in)
|
|
{ interp->set_file_id(fid_in); return true; }
|
|
|
|
static analyzer::Analyzer* Instantiate(Connection* conn)
|
|
{ return new DCE_RPC_Analyzer(conn); }
|
|
|
|
protected:
|
|
bool had_gap;
|
|
binpac::DCE_RPC::DCE_RPC_Conn* interp;
|
|
};
|
|
|
|
} } // namespace analyzer::*
|
|
|
|
#endif /* dce_rpc_h */
|