Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Store the ip header in the packet after processing, reuse other places

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-09-30 20:30:27 -07:00
parent 7d2c35174f
commit 665d0d9814
5 changed files with 51 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

35
src/iosource/Packet.cc
View file

@ -5,6 +5,7 @@
#include "iosource/Manager.h"
#include "packet_analysis/Manager.h"
#include "Var.h"
#include "TunnelEncapsulation.h"
extern "C" {
#include <pcap.h>
@ -61,6 +62,16 @@ void Packet::Init(int arg_link_type, pkt_timeval *arg_ts, uint32_t arg_caplen,
l3_proto = L3_UNKNOWN;
l3_checksummed = false;
delete encap;
encap = nullptr;
delete ip_hdr;
ip_hdr = nullptr;
proto = -1;
tunnel_type = BifEnum::Tunnel::IP;
gre_version = -1;
gre_link_type = DLT_RAW;
if ( data )
{
// From here we assume that layer 2 is valid. If the packet analysis fails,
@ -69,6 +80,14 @@ void Packet::Init(int arg_link_type, pkt_timeval *arg_ts, uint32_t arg_caplen,
}
}
Packet::~Packet()
{
if ( copy )
delete [] data;
delete ip_hdr;
}
const IP_Hdr Packet::IP() const
{
return IP_Hdr((struct ip *) (data + hdr_size), false);
@ -141,18 +160,10 @@ RecordValPtr Packet::ToRawPktHdrVal() const
pkt_hdr->Assign(0, std::move(l2_hdr));
if ( l3_proto == L3_IPV4 )
{
IP_Hdr ip_hdr((const struct ip*)(data + hdr_size), false);
return ip_hdr.ToPktHdrVal(std::move(pkt_hdr), 1);
}
else if ( l3_proto == L3_IPV6 )
{
IP_Hdr ip6_hdr((const struct ip6_hdr*)(data + hdr_size), false, cap_len);
return ip6_hdr.ToPktHdrVal(std::move(pkt_hdr), 1);
}
if ( l3_proto == L3_IPV4 || l3_proto == L3_IPV6 )
// Packet analysis will have stored the IP header in the packet, so we can use
// that to build the output.
return ip_hdr->ToPktHdrVal(std::move(pkt_hdr), 1);
else
return pkt_hdr;
}