Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

build_inner_connection: Use the outer packet's timestamp

Browse source 
Don't construct the timeval based on run_state, just use the timestamp
of the outer packet to avoid the extra int/double conversions required.
This commit is contained in:
Arne Welzel 2023-11-01 10:15:35 +01:00
parent d08e347e5e
commit 0c19e6fc54
2 changed files with 3 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -164,11 +164,7 @@ std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index,
uint32_t consumed_len = outer_pkt->cap_len - inner_cap_len; uint32_t consumed_len = outer_pkt->cap_len - inner_cap_len;
uint32_t inner_wire_len = outer_pkt->len - consumed_len; uint32_t inner_wire_len = outer_pkt->len - consumed_len;
pkt_timeval ts; auto inner_pkt = std::make_unique<Packet>(link_type, &outer_pkt->ts, inner_cap_len, inner_wire_len, data);
ts.tv_sec = static_cast<time_t>(run_state::current_timestamp);
ts.tv_usec = static_cast<suseconds_t>((run_state::current_timestamp - static_cast<double>(ts.tv_sec)) * 1000000);
auto inner_pkt = std::make_unique<Packet>(link_type, &ts, inner_cap_len, inner_wire_len, data);
*encap_index = 0; *encap_index = 0;
if ( outer_pkt->session ) { if ( outer_pkt->session ) {

2
src/packet_analysis/protocol/iptunnel/IPTunnel.h
View file

@ -77,6 +77,8 @@ protected:
* The wire length (pkt->len) of the inner packet is computed based on the wire length * The wire length (pkt->len) of the inner packet is computed based on the wire length
* of the outer packet and the differences in capture lengths. * of the outer packet and the differences in capture lengths.
* *
* The inner packet's timestamp is set to the same value as the outer packet's timestamp.
*
* @param outer_pkt The packet containing the encapsulation. This packet should contain * @param outer_pkt The packet containing the encapsulation. This packet should contain
* @param encap_index A return value for the current index into the encapsulation stack. * @param encap_index A return value for the current index into the encapsulation stack.
* This is returned to allow analyzers to know what point in the stack they were operating * This is returned to allow analyzers to know what point in the stack they were operating