Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

IPTunnel: Compute inner wire length based on cap_len differences.

Browse source
This commit is contained in:
Arne Welzel 2023-05-24 16:31:08 +02:00
parent 18a30a7a53
commit 5654f81dee
2 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -172,17 +172,25 @@ bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, ui
std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index,
std::shared_ptr<EncapsulationStack> encap_stack,
uint32_t len, const u_char* data, int link_type,
BifEnum::Tunnel::Type tunnel_type,
uint32_t inner_cap_len, const u_char* data,
int link_type, BifEnum::Tunnel::Type tunnel_type,
const Tag& analyzer_tag)
{
auto inner_pkt = std::make_unique<Packet>();
assert(outer_pkt->cap_len >= inner_cap_len);
assert(outer_pkt->len >= outer_pkt->cap_len - inner_cap_len);
// Compute the wire length of the inner packet based on the wire length of
// the outer and the difference in cap len's.
uint32_t consumed_len = outer_pkt->cap_len - inner_cap_len;
uint32_t inner_wire_len = outer_pkt->len - consumed_len;
pkt_timeval ts;
ts.tv_sec = static_cast<time_t>(run_state::current_timestamp);
ts.tv_usec = static_cast<suseconds_t>(
(run_state::current_timestamp - static_cast<double>(ts.tv_sec)) * 1000000);
inner_pkt->Init(link_type, &ts, len, len, data);
inner_pkt->Init(link_type, &ts, inner_cap_len, inner_wire_len, data);
*encap_index = 0;
if ( outer_pkt->session )

4
src/packet_analysis/protocol/iptunnel/IPTunnel.h
View file

@ -99,8 +99,8 @@ protected:
*/
extern std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index,
std::shared_ptr<EncapsulationStack> encap_stack,
uint32_t len, const u_char* data, int link_type,
BifEnum::Tunnel::Type tunnel_type,
uint32_t inner_cap_len, const u_char* data,
int link_type, BifEnum::Tunnel::Type tunnel_type,
const Tag& analyzer_tag);
namespace detail