Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Finishing tunnel decapsulation support in C++ core.

Browse source 
Policy script is next.
This commit is contained in:
Gregor Maier 2011-08-07 09:49:41 -07:00
parent 8910cd2dca
commit 5ed3ec2f38
3 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
policy/bro.init
View file

@ -86,7 +86,7 @@ export {
type parent_t: record {
cid: conn_id;
tunnel_type: tunneltype_t;
};
} &log;
} # end export
module GLOBAL;

1
src/Sessions.cc
View file

@ -135,7 +135,6 @@ NetSessions::NetSessions()
tunnel_handler = new TunnelHandler(this);
else
tunnel_handler = 0;
printf("tunnel_handler: %p\n", tunnel_handler);
}
NetSessions::~NetSessions()

18
src/TunnelHandler.cc
View file

@ -18,10 +18,22 @@
TunnelHandler::TunnelHandler(NetSessions *arg_s)
{
s = arg_s;
PortVal *pv = 0;
TableVal *udp_tunnel_ports = BifConst::Tunnel::udp_tunnel_ports->AsTableVal();
// Find UDP ports we want to analyze. Store them in an array for faster
// lookup.
for (int i=0; i< 65536; i++)
udp_ports[i] = 0;
udp_ports[3544] = 1;
udp_ports[5072] = 1;
{
Unref(pv);
pv = new PortVal(i, TRANSPORT_UDP);
if (udp_tunnel_ports->Lookup(pv, false))
{
udp_ports[i] = 1;
}
else
udp_ports[i] = 0;
}
Unref(pv);
}
TunnelInfo* TunnelHandler::DecapsulateTunnel(const IP_Hdr *ip_hdr, int len, int caplen,