Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add utility function for tunnel analyzers to setup encapsulation

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-08-26 11:27:23 -07:00
parent f93c5a6942
commit 7bffd2eccd
2 changed files with 57 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/packet_analysis/protocol/iptunnel/IPTunnel.cc
View file

@ -4,6 +4,7 @@
#include <pcap.h> // For DLT_ constants
#include "zeek/Conn.h"
#include "zeek/IP.h"
#include "zeek/RunState.h"
#include "zeek/TunnelEncapsulation.h"
@ -170,6 +171,37 @@ bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, ui
return return_val;
}
std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index,
std::shared_ptr<EncapsulationStack> encap_stack,
uint32_t len, const u_char* data, int link_type,
BifEnum::Tunnel::Type tunnel_type,
const Tag& analyzer_tag)
{
auto inner_pkt = std::make_unique<Packet>();
pkt_timeval ts;
ts.tv_sec = static_cast<time_t>(run_state::current_timestamp);
ts.tv_usec = static_cast<suseconds_t>(
(run_state::current_timestamp - static_cast<double>(ts.tv_sec)) * 1000000);
inner_pkt->Init(link_type, &ts, len, len, data);
*encap_index = 0;
if ( outer_pkt->session )
{
EncapsulatingConn inner(static_cast<Connection*>(outer_pkt->session), tunnel_type);
if ( ! outer_pkt->encap )
outer_pkt->encap = encap_stack != nullptr ? encap_stack
: std::make_shared<EncapsulationStack>();
outer_pkt->encap->Add(inner);
inner_pkt->encap = outer_pkt->encap;
*encap_index = outer_pkt->encap->Depth();
}
return inner_pkt;
}
namespace detail
{

25
src/packet_analysis/protocol/iptunnel/IPTunnel.h
View file

@ -78,6 +78,31 @@ protected:
IPTunnelMap ip_tunnels;
};
/**
* Utility function for packet analyzers for encapsulation/tunnel protocols. This
* builds a new packet object containing the encapsulated/tunneled packet, as well
* as adding to the associated encapsulation stack for the tunnel.
*
* @param outer_pkt The packet containing the encapsulation. This packet should contain
* @param encap_index A return value for the current index into the encapsulation stack.
* This is returned to allow analzyers to know what point in the stack they were operating
* on as the packet analysis chain unwinds as it returns.
* @param encap_stack Tracks the encapsulations as the new encapsulations are discovered
* in the inner packets.
* @param len The byte length of the packet data containing in the inner packet.
* @param data A pointer to the first byte of the inner packet.
* @param link_type The link type (DLT_*) for the outer packet. If not known, DLT_RAW can
* be passed for this value.
* @param tunnel_type The type of tunnel the inner packet is stored in.
* @param analyzer_tag The tag for the analyzer calling this method.
* return A new packet object describing the encapsulated packet and data.
*/
extern std::unique_ptr<Packet> build_inner_packet(Packet* outer_pkt, int* encap_index,
std::shared_ptr<EncapsulationStack> encap_stack,
uint32_t len, const u_char* data, int link_type,
BifEnum::Tunnel::Type tunnel_type,
const Tag& analyzer_tag);
namespace detail
{