mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 17:18:20 +00:00
9b0d525728
Conceptually, a TCP-based application analyzer should not need any knowledge about the underlying TCP analysis; it's supposed to just process its reassembled input stream as it's handed over. But our analyzers break that assumption at a few places because sometimes knowledge about the TCP state of the connection can be helpful for heuristics. This is fine as long as there actually *is* a TCP parent analyzer available. Sometimes, however, there isn't: if the payload stream is encapsulated inside another application-layer protocol, the semantic link to TCP is broken. And if the outer connection is even UDP, then we don't have a TCP analyzer at all. We didn't handle this situation well so far. Most analyzers needing TCP state would just crash if there's no TCP analyzer (in debug mode with an `assert`, in release mode with a null pointer deref ...). Only HTTP did the right thing already: check if TCP is available and adapt accordingly. We know extend that check to all other analyzers as well: all accesses to `TCP()` are guarded, with reasonable defaults if not available. It's actually a pretty small change overall, which is evidence for how little this layering violation actually matters. The existing behavior is what's causing https://github.com/corelight/zeek-spicy-openvpn/issues/3. |
||
|---|---|---|
| .. | ||
| binpac-flowbuffer-frame-length-plugin | ||
| doctest-plugin | ||
| file-plugin | ||
| func-hook-plugin | ||
| hooks-plugin | ||
| logging-hooks-plugin | ||
| packet-protocol-plugin | ||
| pktdumper-plugin | ||
| pktsrc-plugin | ||
| plugin-load-dependency | ||
| plugin-load-file-extended | ||
| plugin-nopatchversion-plugin | ||
| plugin-withpatchversion-plugin | ||
| protocol-plugin | ||
| reader-plugin | ||
| reporter-hook-plugin | ||
| unprocessed-packet-hook-plugin | ||
| writer-plugin | ||
| .clang-format | ||
| bifs-and-scripts-install.sh | ||
| bifs-and-scripts.sh | ||
| binpac-flowbuffer-frame-length.zeek | ||
| doctest-disabled.zeek | ||
| doctest-supported.zeek | ||
| doctest-unsupported.zeek | ||
| file.zeek | ||
| func-hook.zeek | ||
| hooks.zeek | ||
| init-plugin.zeek | ||
| logging-hooks.zeek | ||
| packet-protocol.zeek | ||
| pktdumper.zeek | ||
| pktsrc.zeek | ||
| plugin-load-dependency.zeek | ||
| plugin-load-file-extended.zeek | ||
| plugin-nopatchversion.zeek | ||
| plugin-withpatchversion.zeek | ||
| protocol.zeek | ||
| reader.zeek | ||
| reporter-hook.zeek | ||
| unprocessed-packet-hook.zeek | ||
| writer.zeek | ||