Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Move IP and IP tunnel code from Sessions into packet analyzers

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-09-23 16:17:06 -07:00
parent 69da2d7b1d
commit 1cf251d1ca
53 changed files with 1226 additions and 907 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/iosource/Packet.h
View file

@ -2,10 +2,11 @@
#include "zeek-config.h"
#include <string>
#include <stdint.h>
#include <sys/types.h> // for u_char
#include <string>
#include <map>
#include <any>
#if defined(__OpenBSD__)
#include <net/bpf.h>
@ -18,6 +19,7 @@ ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek);
ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek);
ZEEK_FORWARD_DECLARE_NAMESPACED(RecordVal, zeek);
ZEEK_FORWARD_DECLARE_NAMESPACED(IP_Hdr, zeek);
ZEEK_FORWARD_DECLARE_NAMESPACED(EncapsulationStack, zeek);
namespace zeek {
@ -207,19 +209,18 @@ public:
*/
bool l3_checksummed;
/**
* Indicates whether the packet should be processed by zeek's
* session analysis in NetSessions.
*/
bool session_analysis;
/**
* Indicates whether this packet should be recorded.
*/
mutable bool dump_packet;
// Wrapper to generate a packet-level weird. Has to be public for packet analyzers to use it.
void Weird(const char* name);
/**
* Key/value store for use by the packet analyzers to pass information between them.
*/
std::map<std::string, std::any> key_store;
// Wrapper to generate a packet-level weird. Has to be public for llanalyzers to use it.
void Weird(const char* name, const EncapsulationStack* encap = nullptr);
private:
// Renders an MAC address into its ASCII representation.