Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Default tunnel_type in iosource::Packet to NONE

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-04-14 09:17:01 -07:00 • committed by Tim Wojtulewicz
parent e856e953b8
commit 1e6cc76c83
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/iosource/Packet.cc
View file

@ -67,7 +67,7 @@ void Packet::Init(int arg_link_type, pkt_timeval* arg_ts, uint32_t arg_caplen, u
ip_hdr.reset(); ip_hdr.reset();
proto = -1; proto = -1;
tunnel_type = BifEnum::Tunnel::IP; tunnel_type = BifEnum::Tunnel::NONE;
gre_version = -1; gre_version = -1;
gre_link_type = DLT_RAW; gre_link_type = DLT_RAW;

2
src/iosource/Packet.h
View file

@ -250,7 +250,7 @@ public:
* the type of tunnel. It is used to pass the tunnel type between the * the type of tunnel. It is used to pass the tunnel type between the
* packet analyzers during analysis. * packet analyzers during analysis.
*/ */
BifEnum::Tunnel::Type tunnel_type = BifEnum::Tunnel::IP; BifEnum::Tunnel::Type tunnel_type = BifEnum::Tunnel::NONE;
/** /**
* If the packet contains a GRE tunnel, this field will contain the * If the packet contains a GRE tunnel, this field will contain the

7
src/packet_analysis/protocol/ip/IP.cc
View file

@ -2,6 +2,8 @@
#include "zeek/packet_analysis/protocol/ip/IP.h" #include "zeek/packet_analysis/protocol/ip/IP.h"
#include <netinet/in.h>
#include "zeek/Discard.h" #include "zeek/Discard.h"
#include "zeek/Event.h" #include "zeek/Event.h"
#include "zeek/Frag.h" #include "zeek/Frag.h"
@ -269,6 +271,11 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
return false; return false;
} }
// If the next protocol is a tunneled type, set the tunnel_type field in the packet to IP
// so that it gets handled correctly.
if ( proto == IPPROTO_IPV4 || proto == IPPROTO_IPV6 )
packet->tunnel_type = BifEnum::Tunnel::IP;
switch ( proto ) switch ( proto )
{ {
case IPPROTO_NONE: case IPPROTO_NONE: