Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix handling of session analysis.

Browse source 
This reverts commit 0e51be18ac59d7a176f18780f1f8df85561449b9.
This commit is contained in:
Jan Grashoefer 2020-09-23 15:46:11 +02:00 • committed by Tim Wojtulewicz
parent 6a0bd63756
commit 1658b8dc84
3 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/Sessions.cc
View file

@ -174,9 +174,7 @@ void NetSessions::NextPacket(double t, const Packet* pkt)
DoNextPacket(t, pkt, &ip_hdr, nullptr); DoNextPacket(t, pkt, &ip_hdr, nullptr);
} }
// Check that it wasn't set to L3_ARP here, or there's a bunch of extra weirds else
// that get reported.
else if ( pkt->l3_proto != L3_ARP)
{ {
Weird("unknown_packet_type", pkt); Weird("unknown_packet_type", pkt);
return; return;
@ -340,7 +338,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
// last if present. // last if present.
if ( ip_hdr->LastHeader() == IPPROTO_MOBILITY ) if ( ip_hdr->LastHeader() == IPPROTO_MOBILITY )
{ {
dump_this_packet = true; pkt->dump_packet = true;
if ( ! ignore_checksums && mobility_header_checksum(ip_hdr) != 0xffff ) if ( ! ignore_checksums && mobility_header_checksum(ip_hdr) != 0xffff )
{ {

3
src/iosource/Packet.cc
View file

@ -45,6 +45,9 @@ void Packet::Init(int arg_link_type, pkt_timeval *arg_ts, uint32_t arg_caplen,
else else
data = arg_data; data = arg_data;
session_analysis = false;
dump_packet = false;
time = ts.tv_sec + double(ts.tv_usec) / 1e6; time = ts.tv_sec + double(ts.tv_usec) / 1e6;
hdr_size = 0; hdr_size = 0;
eth_type = 0; eth_type = 0;

4
src/iosource/Packet.h
View file

@ -212,12 +212,12 @@ public:
* Indicates whether the packet should be processed by zeek's * Indicates whether the packet should be processed by zeek's
* session analysis in NetSessions. * session analysis in NetSessions.
*/ */
bool session_analysis = false; bool session_analysis;
/** /**
* Indicates whether this packet should be recorded. * Indicates whether this packet should be recorded.
*/ */
mutable bool dump_packet = false; mutable bool dump_packet;
// Wrapper to generate a packet-level weird. Has to be public for packet analyzers to use it. // Wrapper to generate a packet-level weird. Has to be public for packet analyzers to use it.
void Weird(const char* name); void Weird(const char* name);