Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Use shared_ptr for encapsulation data instead of raw pointer

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-10-12 13:15:52 -07:00
parent a7d4364334
commit 41dcd0cde0
16 changed files with 103 additions and 115 deletions
Download patch file Download diff file Expand all files Collapse all files

24
src/packet_analysis/protocol/gre/GRE.cc
View file

@ -42,8 +42,6 @@ GREAnalyzer::GREAnalyzer()
bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
{
EncapsulationStack* encapsulation = packet->encap;
if ( ! packet->ip_hdr )
{
reporter->InternalError("GREAnalyzer: ip_hdr not found in packet keystore");
@ -54,7 +52,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
if ( ! BifConst::Tunnel::enable_gre )
{
sessions->Weird("GRE_tunnel", ip_hdr, encapsulation);
sessions->Weird("GRE_tunnel", ip_hdr, packet->encap);
return false;
}
@ -72,7 +70,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
if ( gre_version != 0 && gre_version != 1 )
{
sessions->Weird("unknown_gre_version", ip_hdr, encapsulation,
sessions->Weird("unknown_gre_version", ip_hdr, packet->encap,
util::fmt("%d", gre_version));
return false;
}
@ -90,7 +88,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
}
else
{
sessions->Weird("truncated_GRE", ip_hdr, encapsulation);
sessions->Weird("truncated_GRE", ip_hdr, packet->encap);
return false;
}
}
@ -107,7 +105,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
}
else
{
sessions->Weird("truncated_GRE", ip_hdr, encapsulation);
sessions->Weird("truncated_GRE", ip_hdr, packet->encap);
return false;
}
}
@ -130,7 +128,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
erspan_len += 8;
else
{
sessions->Weird("truncated_GRE", ip_hdr, encapsulation);
sessions->Weird("truncated_GRE", ip_hdr, packet->encap);
return false;
}
}
@ -139,7 +137,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
}
else
{
sessions->Weird("truncated_GRE", ip_hdr, encapsulation);
sessions->Weird("truncated_GRE", ip_hdr, packet->encap);
return false;
}
}
@ -150,7 +148,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
if ( proto_typ != 0x880b )
{
// Enhanced GRE payload must be PPP.
sessions->Weird("egre_protocol_type", ip_hdr, encapsulation,
sessions->Weird("egre_protocol_type", ip_hdr, packet->encap,
util::fmt("%d", proto_typ));
return false;
}
@ -161,20 +159,20 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
// RFC 2784 deprecates the variable length routing field
// specified by RFC 1701. It could be parsed here, but easiest
// to just skip for now.
sessions->Weird("gre_routing", ip_hdr, encapsulation);
sessions->Weird("gre_routing", ip_hdr, packet->encap);
return false;
}
if ( flags_ver & 0x0078 )
{
// Expect last 4 bits of flags are reserved, undefined.
sessions->Weird("unknown_gre_flags", ip_hdr, encapsulation);
sessions->Weird("unknown_gre_flags", ip_hdr, packet->encap);
return false;
}
if ( len < gre_len + ppp_len + eth_len + erspan_len )
{
sessions->Weird("truncated_GRE", ip_hdr, encapsulation);
sessions->Weird("truncated_GRE", ip_hdr, packet->encap);
return false;
}
@ -184,7 +182,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
if ( ppp_proto != 0x0021 && ppp_proto != 0x0057 )
{
sessions->Weird("non_ip_packet_in_encap", ip_hdr, encapsulation);
sessions->Weird("non_ip_packet_in_encap", ip_hdr, packet->encap);
return false;
}