Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

IPBasedAnalyzer: Call TapPacket() when skipping

Browse source 
When skip_further_processing() is called, a TapAnalyzer should still see
the packets as skipped with SkipReason "skipping".
This commit is contained in:
Arne Welzel 2025-08-05 11:34:02 +02:00
parent dc904b2216
commit 4bc7f9532c
4 changed files with 38 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/packet_analysis/protocol/ip/IPBasedAnalyzer.cc
View file

@ -8,6 +8,7 @@
#include "zeek/analyzer/Manager.h"
#include "zeek/analyzer/protocol/pia/PIA.h"
#include "zeek/conn_key/Manager.h"
#include "zeek/packet_analysis/protocol/ip/SessionAdapter.h"
#include "zeek/packet_analysis/protocol/ip/conn_key/IPBasedConnKey.h"
#include "zeek/plugin/Manager.h"
#include "zeek/session/Manager.h"
@ -105,9 +106,11 @@ bool IPBasedAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pkt
run_state::current_timestamp = run_state::processing_start_time;
run_state::current_pkt = pkt;
// TODO: Does this actually mean anything?
if ( conn->GetSessionAdapter()->Skipping() )
const auto* adapter = conn->GetSessionAdapter();
if ( adapter->Skipping() ) {
adapter->TapPacket(pkt, PacketAction::Skip, SkipReason::SkipProcessing);
return true;
}
DeliverPacket(conn, run_state::processing_start_time, is_orig, len, pkt);

1
src/packet_analysis/protocol/ip/SessionAdapter.h
View file

@ -29,6 +29,7 @@ enum class SkipReason : uint8_t {
Unknown, ///< Placeholder if no other value fits.
BadChecksum, ///< The packet's checksum is invalid and ignore_checksums is false.
BadProtoHeader, ///< Something was off with the lengths or offsets in the protocol header.
SkipProcessing, ///< The session adapter's connection had skip_further_processing called on it.
};
/**