Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add "encap_hdr_size" option back in.

Browse source 
The "tunnel_port" and "parse_udp_tunnels" options are still gone
as those did not work entirely (e.g. IPv6 support and misnaming
of tunnel_port/udp_tunnel_port).
This commit is contained in:
Jon Siwek 2012-06-18 12:48:03 -05:00
parent f3b3e73eba
commit 2ba3f5420b
4 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/init-bare.bro
View file

@ -915,6 +915,10 @@ const frag_timeout = 0.0 sec &redef;
## to be potentially copied and buffered.
const packet_sort_window = 0 usecs &redef;
## If positive, indicates the encapsulation header size that should
## be skipped. This applies to all packets.
const encap_hdr_size = 0 &redef;
## Whether to use the ``ConnSize`` analyzer to count the number of packets and
## IP-level bytes transfered by each endpoint. If true, these values are returned
## in the connection's :bro:see:`endpoint` record value.

4
src/NetVar.cc
View file

@ -30,6 +30,8 @@ int partial_connection_ok;
int tcp_SYN_ack_ok;
int tcp_match_undelivered;
int encap_hdr_size;
double frag_timeout;
double tcp_SYN_timeout;
@ -323,6 +325,8 @@ void init_net_var()
tcp_SYN_ack_ok = opt_internal_int("tcp_SYN_ack_ok");
tcp_match_undelivered = opt_internal_int("tcp_match_undelivered");
encap_hdr_size = opt_internal_int("encap_hdr_size");
frag_timeout = opt_internal_double("frag_timeout");
tcp_SYN_timeout = opt_internal_double("tcp_SYN_timeout");

2
src/NetVar.h
View file

@ -33,6 +33,8 @@ extern int partial_connection_ok;
extern int tcp_SYN_ack_ok;
extern int tcp_match_undelivered;
extern int encap_hdr_size;
extern double frag_timeout;
extern double tcp_SYN_timeout;

4
src/Sessions.cc
View file

@ -158,6 +158,10 @@ void NetSessions::DispatchPacket(double t, const struct pcap_pkthdr* hdr,
ip_data = pkt + hdr_size + (ip_hdr->ip_hl << 2);
}
if ( encap_hdr_size > 0 && ip_data )
// Blanket encapsulation
hdr_size += encap_hdr_size;
if ( src_ps->FilterType() == TYPE_FILTER_NORMAL )
NextPacket(t, hdr, pkt, hdr_size, pkt_elem);
else