Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

tunnels: Add 'X' to history when reaching Tunnel::max_depth

Browse source
This commit is contained in:
Arne Welzel 2023-11-30 18:49:59 +01:00
parent ad9446d799
commit 7325bc945f
10 changed files with 51 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/packet_analysis/protocol/ayiya/AYIYA.cc
View file

@ -20,6 +20,7 @@ bool AYIYAAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packe
return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet);
return false;
}

1
src/packet_analysis/protocol/geneve/Geneve.cc
View file

@ -21,6 +21,7 @@ bool GeneveAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet);
return false;
}

1
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -23,6 +23,7 @@ bool IPTunnelAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
}
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet);
return false;
}

1
src/packet_analysis/protocol/teredo/Teredo.cc
View file

@ -148,6 +148,7 @@ bool TeredoAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Analyzer::Weird("exceeded_tunnel_max_depth", packet);
return false;
}

1
src/packet_analysis/protocol/vxlan/VXLAN.cc
View file

@ -21,6 +21,7 @@ bool VXLAN_Analyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pack
return false;
if ( packet->encap && packet->encap->Depth() >= BifConst::Tunnel::max_depth ) {
packet->session->CheckHistory(zeek::session::detail::HIST_UNKNOWN_PKT, 'X');
Weird("exceeded_tunnel_max_depth", packet);
return false;
}