Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 19:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Adding support to de-capsulate tunnels.

Browse source 
Checkpoint.
Decapsulation happens after IP Defragmentation. The "identity" of the
enclosing tunnel (the "parent") is added to the connection record of the
child (tunneled) connection as an optional field $tunnel_parent.
This commit is contained in:
Gregor Maier 2011-08-03 14:12:47 -07:00
parent 6c806b0bce
commit 9c388a1809
10 changed files with 183 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/Sessions.h
View file

@ -28,6 +28,9 @@ class Discarder;
class SteppingStoneManager;
class PacketFilter;
class TunnelHandler;
class TunnelInfo;
class PacketSortElement;
struct SessionStats {
@ -144,7 +147,7 @@ protected:
friend class TimerMgrExpireTimer;
Connection* NewConn(HashKey* k, double t, const ConnID* id,
const u_char* data, int proto);
const u_char* data, int proto, TunnelInfo *tunnel_info);
// Check whether the tag of the current packet is consistent with
// the given connection. Returns:
@ -214,6 +217,8 @@ protected:
int num_packets_processed;
PacketProfiler* pkt_profiler;
TunnelHandler *tunnel_handler;
// We may use independent timer managers for different sets of related
// activity. The managers are identified by an unique tag.
typedef std::map<TimerMgr::Tag, TimerMgr*> TimerMgrMap;