Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Set original/outer packet flags to reflect inner packet results

Browse source 
Propagate inner packet flags such as 'processed', 'dump_packet', 'dump_size'
to outer packet for packets involving tunneled data.
This commit is contained in:
mnhsrj 2025-02-12 09:43:44 -05:00
parent b7b31ebce5
commit 0257b6cd32
No known key found for this signature in database
GPG key ID: 4FFE3815FE3CC260
3 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/iosource/Packet.cc
View file

@ -46,6 +46,7 @@ void Packet::Init(int arg_link_type, pkt_timeval* arg_ts, uint32_t arg_caplen, u
data = arg_data; data = arg_data;
dump_packet = false; dump_packet = false;
dump_size = 0;
time = ts.tv_sec + double(ts.tv_usec) / 1e6; time = ts.tv_sec + double(ts.tv_usec) / 1e6;
eth_type = 0; eth_type = 0;

14
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -78,7 +78,7 @@ bool IPTunnelAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
/** /**
* Handles a packet that contains an IP header directly after the tunnel header. * Handles a packet that contains an IP header directly after the tunnel header.
*/ */
bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, const std::shared_ptr<IP_Hdr>& inner, bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, Packet* pkt, const std::shared_ptr<IP_Hdr>& inner,
std::shared_ptr<EncapsulationStack> prev, std::shared_ptr<EncapsulationStack> prev,
const EncapsulatingConn& ec) { const EncapsulatingConn& ec) {
uint32_t caplen, len; uint32_t caplen, len;
@ -113,13 +113,18 @@ bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, co
// Forward the packet back to the IP analyzer. // Forward the packet back to the IP analyzer.
bool return_val = ForwardPacket(len, data, &p); bool return_val = ForwardPacket(len, data, &p);
// Propagate the flags from fake inner packet to outer packet
pkt->processed = p.processed;
pkt->dump_packet = p.dump_packet;
pkt->dump_size = ( p.dump_size > 0 ) ? static_cast<int>(data - pkt->data) + p.dump_size : p.dump_size;
return return_val; return return_val;
} }
/** /**
* Handles a packet that contains a physical-layer header after the tunnel header. * Handles a packet that contains a physical-layer header after the tunnel header.
*/ */
bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, uint32_t caplen, uint32_t len, bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, Packet* pkt, uint32_t caplen, uint32_t len,
const u_char* data, int link_type, const u_char* data, int link_type,
std::shared_ptr<EncapsulationStack> prev, std::shared_ptr<EncapsulationStack> prev,
const EncapsulatingConn& ec) { const EncapsulatingConn& ec) {
@ -145,6 +150,11 @@ bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, ui
// to the packet manager. // to the packet manager.
bool return_val = packet_mgr->ProcessInnerPacket(&p); bool return_val = packet_mgr->ProcessInnerPacket(&p);
// Propagate the flags from fake inner packet to outer packet
pkt->processed = p.processed;
pkt->dump_packet = p.dump_packet;
pkt->dump_size = ( p.dump_size > 0 ) ? static_cast<int>(data - pkt->data) + p.dump_size : p.dump_size;
return return_val; return return_val;
} }

4
src/packet_analysis/protocol/iptunnel/IPTunnel.h
View file

@ -37,7 +37,7 @@ public:
* the most-recently found depth of encapsulation. * the most-recently found depth of encapsulation.
* @param ec The most-recently found depth of encapsulation. * @param ec The most-recently found depth of encapsulation.
*/ */
bool ProcessEncapsulatedPacket(double t, const Packet* pkt, const std::shared_ptr<IP_Hdr>& inner, bool ProcessEncapsulatedPacket(double t, Packet* pkt, const std::shared_ptr<IP_Hdr>& inner,
std::shared_ptr<EncapsulationStack> prev, const EncapsulatingConn& ec); std::shared_ptr<EncapsulationStack> prev, const EncapsulatingConn& ec);
/** /**
@ -56,7 +56,7 @@ public:
* including the most-recently found depth of encapsulation. * including the most-recently found depth of encapsulation.
* @param ec The most-recently found depth of encapsulation. * @param ec The most-recently found depth of encapsulation.
*/ */
bool ProcessEncapsulatedPacket(double t, const Packet* pkt, uint32_t caplen, uint32_t len, const u_char* data, bool ProcessEncapsulatedPacket(double t, Packet* pkt, uint32_t caplen, uint32_t len, const u_char* data,
int link_type, std::shared_ptr<EncapsulationStack> prev, int link_type, std::shared_ptr<EncapsulationStack> prev,
const EncapsulatingConn& ec); const EncapsulatingConn& ec);