static int __bro_list_val_read(BroListVal *lv, BroConn *bc) { int i; uint32 ui; D_ENTER; if (! __bro_val_read((BroVal *) lv, bc)) D_RETURN_(FALSE); __bro_list_free(lv->list, (BroFunc) __bro_sobject_release); lv->list = NULL; if (! __bro_buf_read_char(bc->rx_buf, &lv->type_tag)) goto error_return; if (! __bro_buf_read_int(bc->rx_buf, &ui)) goto error_return; lv->len = (int) ui; for (i = 0; i < lv->len; i++) { BroVal *val; if (! (val = (BroVal *) __bro_sobject_unserialize(SER_IS_VAL, bc))) goto error_return; lv->list = __bro_list_append(lv->list, val); } D_RETURN_(TRUE); error_return: __bro_list_free(lv->list, (BroFunc) __bro_sobject_release); lv->list = NULL; D_RETURN_(FALSE); }
int __bro_id_read(BroID *id, BroConn *bc) { char opt; D_ENTER; if (! id || ! bc) D_RETURN_(FALSE); if (! __bro_object_read((BroObject *) id, bc)) D_RETURN_(FALSE); if (! __bro_buf_read_string(bc->rx_buf, &id->name)) D_RETURN_(FALSE); if (! __bro_buf_read_char(bc->rx_buf, &id->scope)) D_RETURN_(FALSE); if (! __bro_buf_read_char(bc->rx_buf, &id->is_export)) D_RETURN_(FALSE); if (! __bro_buf_read_int(bc->rx_buf, &id->is_const)) D_RETURN_(FALSE); if (! __bro_buf_read_int(bc->rx_buf, &id->is_enum_const)) D_RETURN_(FALSE); if (! __bro_buf_read_int(bc->rx_buf, &id->is_type)) D_RETURN_(FALSE); if (! __bro_buf_read_int(bc->rx_buf, &id->offset)) D_RETURN_(FALSE); if (! __bro_buf_read_char(bc->rx_buf, &id->infer_return_type)) D_RETURN_(FALSE); if (! __bro_buf_read_char(bc->rx_buf, &id->weak_ref)) D_RETURN_(FALSE); if (id->type) __bro_sobject_release((BroSObject*) id->type); if (! (id->type = (BroType *) __bro_sobject_unserialize(SER_IS_TYPE, bc))) D_RETURN_(FALSE); if (! __bro_buf_read_char(bc->rx_buf, &opt)) D_RETURN_(FALSE); if (opt) { if (id->attrs) __bro_sobject_release((BroSObject *) id->attrs); if (! (id->attrs = (BroAttrs *) __bro_sobject_unserialize(SER_ATTRIBUTES, bc))) D_RETURN_(FALSE); } if (! __bro_buf_read_char(bc->rx_buf, &opt)) D_RETURN_(FALSE); if (opt) { if (id->val) __bro_sobject_release((BroSObject *) id->val); if (! (id->val = (BroVal *) __bro_sobject_unserialize(SER_IS_VAL, bc))) D_RETURN_(FALSE); } D_RETURN_(TRUE); }
static int __bro_val_read(BroVal *val, BroConn *bc) { char opt; uint32 tmp; int i; D_ENTER; if (! val || !bc) D_RETURN_(FALSE); if (! __bro_object_read((BroObject *) val, bc)) D_RETURN_(FALSE); /* Read type */ if (val->val_type) { __bro_sobject_release((BroSObject *) val->val_type); val->val_type = NULL; } if (! (val->val_type = (BroType *) __bro_sobject_unserialize(SER_IS_TYPE, bc))) D_RETURN_(FALSE); D(("Type in val has type tags %i/%i\n", val->val_type->tag, val->val_type->internal_tag)); /* Read optional Attributes */ if (val->val_attrs) { __bro_sobject_release((BroSObject *) val->val_attrs); val->val_attrs = NULL; } if (! __bro_buf_read_char(bc->rx_buf, &opt)) D_RETURN_(FALSE); if (opt) { if (! (val->val_attrs = (BroRecordVal *) __bro_sobject_unserialize(SER_RECORD_VAL, bc))) D_RETURN_(FALSE); } switch (val->val_type->internal_tag) { case BRO_INTTYPE_INT: case BRO_INTTYPE_UNSIGNED: /* Hack for ports */ if (val->val_type->tag == BRO_TYPE_PORT) { uint64 tmp; if (! __bro_buf_read_int64(bc->rx_buf, &tmp)) D_RETURN_(FALSE); if ( (tmp & 0xf0000) == 0x10000 ) val->val_port.port_proto = IPPROTO_TCP; else if ( (tmp & 0xf0000) == 0x20000 ) val->val_port.port_proto = IPPROTO_UDP; else if ( (tmp & 0xf0000) == 0x30000 ) val->val_port.port_proto = IPPROTO_ICMP; val->val_port.port_num = (tmp & 0xFFFF); } else { if (! __bro_buf_read_int64(bc->rx_buf, &val->val_int64)) D_RETURN_(FALSE); } break; case BRO_INTTYPE_DOUBLE: if (! __bro_buf_read_double(bc->rx_buf, &val->val_double)) D_RETURN_(FALSE); break; case BRO_INTTYPE_STRING: if (! __bro_buf_read_string(bc->rx_buf, &val->val_str)) D_RETURN_(FALSE); break; case BRO_INTTYPE_IPADDR: if (! __bro_buf_read_int(bc->rx_buf, &tmp)) D_RETURN_(FALSE); if (tmp != 1 && tmp != 4) { D(("Bad IP addresses word length: %d.\n", tmp)); D_RETURN_(FALSE); } if ( tmp == 1 ) { if (! __bro_buf_read_int(bc->rx_buf, &tmp)) D_RETURN_(FALSE); __bro_util_fill_v4_addr(&val->val_addr, ntohl(tmp)); } else { for ( i = 0; i < tmp; ++i ) { if (! __bro_buf_read_int(bc->rx_buf, &val->val_addr.addr[i])) D_RETURN_(FALSE); val->val_addr.addr[i] = ntohl(val->val_addr.addr[i]); } } break; case BRO_INTTYPE_SUBNET: if (! __bro_buf_read_int(bc->rx_buf, &tmp)) D_RETURN_(FALSE); if (tmp != 1 && tmp != 4) { D(("Bad IP addresses word length: %d.\n", tmp)); D_RETURN_(FALSE); } if ( tmp == 1 ) { if (! __bro_buf_read_int(bc->rx_buf, &tmp)) D_RETURN_(FALSE); __bro_util_fill_v4_addr(&val->val_subnet.sn_net, ntohl(tmp)); } else { for ( i = 0; i < tmp; ++i ) { if (! __bro_buf_read_int(bc->rx_buf, &val->val_subnet.sn_net.addr[i])) D_RETURN_(FALSE); val->val_subnet.sn_net.addr[i] = ntohl(val->val_subnet.sn_net.addr[i]); } } if (! __bro_buf_read_int(bc->rx_buf, &val->val_subnet.sn_width)) D_RETURN_(FALSE); break; case BRO_INTTYPE_OTHER: /* See Val.cc around 165 -- these are handled by derived classes. * We only make sure here it's not functions and not files. */ if (val->val_type->tag != BRO_TYPE_FUNC && val->val_type->tag != BRO_TYPE_FILE) break; /* Otherwise fall through to warning. */ default: D(("Unsupported internal type tag: %i\n", val->val_type->internal_tag)); D_RETURN_(FALSE); } D_RETURN_(TRUE); }
static int __bro_record_val_read(BroRecordVal *rv, BroConn *bc) { char opt; uint32 i, len; BroVal *val; D_ENTER; if (! __bro_mutable_val_read((BroMutableVal *) rv, bc)) D_RETURN_(FALSE); /* Clean out old vals, if any */ __bro_record_free(rv->rec); if (! (rv->rec = __bro_record_new())) D_RETURN_(FALSE); /* Read in new vals */ if (! __bro_buf_read_int(bc->rx_buf, &len)) goto error_return; for (i = 0; i < len; i++) { const char *field_name; BroVal *rv_val = (BroVal *) rv; BroType *rv_type = rv_val->val_type; D(("Reading val %i/%i into record %p of val %p\n", i+1, len, rv->rec, rv)); if (! __bro_buf_read_char(bc->rx_buf, &opt)) goto error_return; if (opt) { if (! (val = (BroVal *) __bro_sobject_unserialize(SER_IS_VAL, bc))) { D(("WARNING -- unserializing record element failed.\n")); goto error_return; } } else { /* We need an empty val if none was given in order to maintain * a chain of vals nonetheless -- the missing type in this new * val indicates that it is an unassigned val. */ D(("WARNING -- unassigned val.\n")); if (! (val = __bro_val_new())) goto error_return; } __bro_record_add_val(rv->rec, val); if (! (field_name = __bro_record_type_get_nth_field((BroRecordType *) rv_type, i))) { D(("WARNING -- record type field %i has no name.\n", i)); goto error_return; } __bro_record_set_nth_name(rv->rec, i, field_name); } D_RETURN_(TRUE); error_return: __bro_record_free(rv->rec); rv->rec = NULL; D_RETURN_(FALSE); }
BroSObject * __bro_sobject_unserialize(uint16 type_id_wanted, BroConn *bc) { BroSObject *obj; char full_obj; uint32 perm_id; uint16 type_id; D_ENTER; if (! bc) D_RETURN_(NULL); /* Same special case for types as in __bro_sobject_serialize(). */ if ( (type_id_wanted & SER_TYPE_MASK) == SER_IS_TYPE) { D(("Unserializing a type, checking for name-only format.\n")); if (! __bro_buf_read_char(bc->rx_buf, &full_obj)) D_RETURN_(NULL); if (! full_obj) { BroString tmp; bro_string_init(&tmp); /* We only get the name. */ if (! __bro_buf_read_string(bc->rx_buf, &tmp)) D_RETURN_(FALSE); /* We don't really have a namespace in which we can now * look up the type, so there's not much we can do! */ D(("Received name-only type '%s', reporting failure.\n", bro_string_get_data(&tmp))); D_RETURN_(FALSE); } } if (! __bro_buf_read_char(bc->rx_buf, &full_obj)) D_RETURN_(NULL); if (! __bro_buf_read_int(bc->rx_buf, &perm_id)) D_RETURN_(NULL); if (! full_obj) { #ifdef BRO_DEBUG if (! (bc->conn_flags & BRO_CFLAG_CACHE)) D(("WARNING: no caching requested, yet peer sends cached data.\n")); #endif if (! (obj = __bro_ht_get(bc->io_cache, (void *) perm_id))) { D(("Cache inconsistency: cache should contain object %i\n", perm_id)); D_RETURN_(NULL); } __bro_sobject_ref(obj); D(("Returning object %i/%p from cache.\n", perm_id, obj)); D_RETURN_(obj); } if (! __bro_buf_read_short(bc->rx_buf, &type_id)) D_RETURN_(NULL); /* Now check if the stuff that's arriving is actually an * instance of the type we'd like to see -- we can only do * primitive checking for inherited types (when we want to * know that it's a type, say, but we cannot know what exact * kind of type) -- so we just check whether all the bits set * in both type id's match: */ if ((type_id_wanted & SER_TYPE_MASK) != (type_id & SER_TYPE_MASK)) { D(("Type mismatch in serialization: wanted %04x, got %04x.\n", type_id_wanted, type_id)); D_RETURN_(NULL); } if (! (obj = __bro_sobject_create(type_id))) D_RETURN_(NULL); /* Polymorphism: depending on the constructor of the object, * this call will start from the bottom of the hierarchy and * read members in step by step, so by the time we return * from this function the object is fully unserialized. */ if (! obj->read(obj, bc)) { D(("Reading object %i of type 0x%04x FAILED.\n", perm_id, type_id)); __bro_sobject_release(obj); D_RETURN_(NULL); } /* If we have asked the peer to use caching, * make sure the object is in the cache: */ if ( (bc->conn_flags & BRO_CFLAG_CACHE) && ! __bro_ht_get(bc->io_cache, (void *) perm_id)) { D(("Storing object %i in cache.\n", perm_id)); __bro_ht_add(bc->io_cache, (void *) perm_id, obj); obj->perm_id = perm_id; __bro_sobject_ref(obj); } D(("Object %i of type 0x%04x unserialized successfully.\n", perm_id, type_id)); D_RETURN_(obj); }