Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 09:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Improve packet analysis data flow.

Browse source
This commit is contained in:
Jan Grashoefer 2020-08-31 20:28:06 +02:00 • committed by Tim Wojtulewicz
parent 90eb97876f
commit 38337d799b
43 changed files with 141 additions and 176 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/packet_analysis/protocol/mpls/MPLS.cc
View file

@ -9,8 +9,7 @@ MPLSAnalyzer::MPLSAnalyzer()
{
}
zeek::packet_analysis::AnalyzerResult MPLSAnalyzer::AnalyzePacket(size_t len,
const uint8_t* data, Packet* packet)
bool MPLSAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
{
// Skip the MPLS label stack.
bool end_of_stack = false;
@ -20,7 +19,7 @@ zeek::packet_analysis::AnalyzerResult MPLSAnalyzer::AnalyzePacket(size_t len,
if ( 4 >= len )
{
packet->Weird("truncated_link_header");
return AnalyzerResult::Failed;
return false;
}
end_of_stack = *(data + 2u) & 0x01;
@ -34,7 +33,7 @@ zeek::packet_analysis::AnalyzerResult MPLSAnalyzer::AnalyzePacket(size_t len,
if ( sizeof(struct ip) >= len )
{
packet->Weird("no_ip_in_mpls_payload");
return AnalyzerResult::Failed;
return false;
}
auto ip = (const struct ip*)data;
@ -47,9 +46,10 @@ zeek::packet_analysis::AnalyzerResult MPLSAnalyzer::AnalyzePacket(size_t len,
{
// Neither IPv4 nor IPv6.
packet->Weird("no_ip_in_mpls_payload");
return AnalyzerResult::Failed;
return false;
}
packet->hdr_size = (data - packet->data);
return AnalyzerResult::Terminate;
packet->session_analysis = true;
return true;
}