Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add some missing bits when flipping endpoints.

Browse source 
Couple places missed flipping state.
This commit is contained in:
Robin Sommer 2022-11-08 13:25:20 +01:00
parent 62a52be314
commit 0ef709ae7c
No known key found for this signature in database
GPG key ID: D8187293B3FFE5D0
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/analyzer/Analyzer.h
View file

@ -860,6 +860,12 @@ public:
*/ */
void ForwardUndelivered(uint64_t seq, int len, bool orig) override; void ForwardUndelivered(uint64_t seq, int len, bool orig) override;
/**
* Signals that Zeek has flipped the direction of the connection, meaning
* that originator and responder state need to be swapped.
*/
void FlipRoles() override { orig = ! orig; }
protected: protected:
friend class Analyzer; friend class Analyzer;

3
src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
View file

@ -1162,6 +1162,9 @@ void TCPSessionAdapter::FlipRoles()
orig = tmp_ep; orig = tmp_ep;
orig->is_orig = ! orig->is_orig; orig->is_orig = ! orig->is_orig;
resp->is_orig = ! resp->is_orig; resp->is_orig = ! resp->is_orig;
first_packet_seen = ((first_packet_seen & ORIG) ? RESP : 0) |
((first_packet_seen & RESP) ? ORIG : 0);
is_partial = 0; // resetting, it may be re-established later
} }
void TCPSessionAdapter::UpdateConnVal(RecordVal* conn_val) void TCPSessionAdapter::UpdateConnVal(RecordVal* conn_val)