Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 00:58:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Minor fix in UDP to avoid duplicating tunnels

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-08-26 09:54:05 -07:00
parent 1dede6dd70
commit 5f58ce8a5d
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/packet_analysis/protocol/udp/UDP.cc
View file

@ -211,8 +211,11 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
adapter->Event(udp_reply);
}
// Send the packet back into the packet analysis framework.
ForwardPacket(len, data, pkt);
// Send the packet back into the packet analysis framework. We only check the response
// port here because the orig/resp should have already swapped around based on
// likely_server_ports. This also prevents us from processing things twice if protocol
// detection has to be used.
ForwardPacket(len, data, pkt, ntohs(c->RespPort()));
// Also try sending it into session analysis.
if ( remaining >= len )