Skip to content

Topic/christian/extensible conntuples#61

Open
ckreibich wants to merge 9 commits intomasterfrom
topic/christian/extensible-conntuples
Open

Topic/christian/extensible conntuples#61
ckreibich wants to merge 9 commits intomasterfrom
topic/christian/extensible-conntuples

Conversation

@ckreibich
Copy link
Owner

No description provided.

ConnKey factories are intermediaries that encapsulate the details of how to
instantiate ConnKeys, which codify the hash input for connection lookups.
The InitTuple() implementation here is a placeholder for a fuller one following
later, when we do away with the need for ConnTuple.
This touches quite a few places, but each just swaps out existing
APIs and/or zeek::detail::ConnKey instances.
The new key-based Connection constructor replaces the former, and the new
ConnKey class tree replaces the latter.
@ckreibich ckreibich force-pushed the topic/christian/extensible-conntuples branch from 0d1584a to 7ee9b24 Compare June 14, 2025 02:55
Given IP-aware ConnKeys, ConnTuples aren't really required any more. ConnTuple
had two benefits:

- It preserved the original src/dst orientation from the packet headers it was
based on, which IPBasedConnKey now tracks and provides accessor methods for.

- In IPBasedAnalyzer::AnalyzePacket() its instance survived past the std:move()
of the key into NewConn(), which we sidestep by keeping the original src address
and port around until we need after the connection is obtained.
@ckreibich ckreibich force-pushed the topic/christian/extensible-conntuples branch from 7ee9b24 to 965729a Compare June 14, 2025 03:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant