Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

IPTunnel: Compute inner wire length based on cap_len differences.

Browse source
This commit is contained in:
Arne Welzel 2023-05-24 16:31:08 +02:00
parent 18a30a7a53
commit 5654f81dee
2 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -172,17 +172,25 @@ bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, ui
std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index, std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index,
std::shared_ptr<EncapsulationStack> encap_stack, std::shared_ptr<EncapsulationStack> encap_stack,
uint32_t len, const u_char* data, int link_type, uint32_t inner_cap_len, const u_char* data,
BifEnum::Tunnel::Type tunnel_type, int link_type, BifEnum::Tunnel::Type tunnel_type,
const Tag& analyzer_tag) const Tag& analyzer_tag)
{ {
auto inner_pkt = std::make_unique<Packet>(); auto inner_pkt = std::make_unique<Packet>();
assert(outer_pkt->cap_len >= inner_cap_len);
assert(outer_pkt->len >= outer_pkt->cap_len - inner_cap_len);
// Compute the wire length of the inner packet based on the wire length of
// the outer and the difference in cap len's.
uint32_t consumed_len = outer_pkt->cap_len - inner_cap_len;
uint32_t inner_wire_len = outer_pkt->len - consumed_len;
pkt_timeval ts; pkt_timeval ts;
ts.tv_sec = static_cast<time_t>(run_state::current_timestamp); ts.tv_sec = static_cast<time_t>(run_state::current_timestamp);
ts.tv_usec = static_cast<suseconds_t>( ts.tv_usec = static_cast<suseconds_t>(
(run_state::current_timestamp - static_cast<double>(ts.tv_sec)) * 1000000); (run_state::current_timestamp - static_cast<double>(ts.tv_sec)) * 1000000);
inner_pkt->Init(link_type, &ts, len, len, data); inner_pkt->Init(link_type, &ts, inner_cap_len, inner_wire_len, data);
*encap_index = 0; *encap_index = 0;
if ( outer_pkt->session ) if ( outer_pkt->session )

4
src/packet_analysis/protocol/iptunnel/IPTunnel.h
View file

@ -99,8 +99,8 @@ protected:
*/ */
extern std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index, extern std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index,
std::shared_ptr<EncapsulationStack> encap_stack, std::shared_ptr<EncapsulationStack> encap_stack,
uint32_t len, const u_char* data, int link_type, uint32_t inner_cap_len, const u_char* data,
BifEnum::Tunnel::Type tunnel_type, int link_type, BifEnum::Tunnel::Type tunnel_type,
const Tag& analyzer_tag); const Tag& analyzer_tag);
namespace detail namespace detail