Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add conn.log entries for connections with unhandled IP protocols

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-09-10 15:13:11 +02:00
parent a96515a2e8
commit 35ec9733c0
422 changed files with 97715 additions and 97282 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/TunnelEncapsulation.h
View file

@ -46,6 +46,7 @@ public:
src_port(0),
dst_port(0),
proto(TRANSPORT_UNKNOWN),
proto_id(255),
type(t),
uid(UID(detail::bits_per_uid)) {}
@ -70,6 +71,7 @@ public:
src_port(other.src_port),
dst_port(other.dst_port),
proto(other.proto),
proto_id(other.proto_id),
type(other.type),
uid(other.uid) {}
@ -85,6 +87,7 @@ public:
src_port = other.src_port;
dst_port = other.dst_port;
proto = other.proto;
proto_id = other.proto_id;
type = other.type;
uid = other.uid;
ip_hdr = other.ip_hdr;
@ -106,7 +109,7 @@ public:
if ( ec1.type == BifEnum::Tunnel::IP || ec1.type == BifEnum::Tunnel::GRE )
// Reversing endpoints is still same tunnel.
return ec1.uid == ec2.uid && ec1.proto == ec2.proto &&
return ec1.uid == ec2.uid && ec1.proto == ec2.proto && ec1.proto_id == ec2.proto_id &&
((ec1.src_addr == ec2.src_addr && ec1.dst_addr == ec2.dst_addr) ||
(ec1.src_addr == ec2.dst_addr && ec1.dst_addr == ec2.src_addr));
@ -114,11 +117,13 @@ public:
// Reversing endpoints is still same tunnel, destination port is
// always the same.
return ec1.dst_port == ec2.dst_port && ec1.uid == ec2.uid && ec1.proto == ec2.proto &&
ec1.proto_id == ec2.proto_id &&
((ec1.src_addr == ec2.src_addr && ec1.dst_addr == ec2.dst_addr) ||
(ec1.src_addr == ec2.dst_addr && ec1.dst_addr == ec2.src_addr));
return ec1.src_addr == ec2.src_addr && ec1.dst_addr == ec2.dst_addr && ec1.src_port == ec2.src_port &&
ec1.dst_port == ec2.dst_port && ec1.uid == ec2.uid && ec1.proto == ec2.proto;
ec1.dst_port == ec2.dst_port && ec1.uid == ec2.uid && ec1.proto == ec2.proto &&
ec1.proto_id == ec2.proto_id;
}
friend bool operator!=(const EncapsulatingConn& ec1, const EncapsulatingConn& ec2) { return ! (ec1 == ec2); }
@ -132,6 +137,7 @@ protected:
uint16_t src_port;
uint16_t dst_port;
TransportProto proto;
uint8_t proto_id;
BifEnum::Tunnel::Type type;
UID uid;
};