diff --git a/src/RunState.cc b/src/RunState.cc index 43ca01aee6..edd7684b44 100644 --- a/src/RunState.cc +++ b/src/RunState.cc @@ -421,14 +421,19 @@ double check_pseudo_time(const Packet* pkt) return current_pseudo; } +iosource::PktSrc* current_packet_source() + { + return dynamic_cast(current_iosrc); + } + } // namespace detail -extern double current_packet_timestamp() +double current_packet_timestamp() { return detail::current_pseudo; } -extern double current_packet_wallclock() +double current_packet_wallclock() { // We stop time when we are suspended. if ( run_state::is_processing_suspended() ) diff --git a/src/RunState.h b/src/RunState.h index 1928a7cd60..5afbea596e 100644 --- a/src/RunState.h +++ b/src/RunState.h @@ -28,9 +28,15 @@ extern void dispatch_packet(zeek::Packet* pkt, zeek::iosource::PktSrc* pkt_src); extern void expire_timers(); extern void zeek_terminate_loop(const char* reason); +/** + * Returns the packet source for the packet currently being processed. This will + * return null if some other iosrc is currently active. + */ +extern zeek::iosource::PktSrc* current_packet_source(); + extern double check_pseudo_time(const Packet *pkt); -extern zeek::iosource::PktSrc* current_pktsrc [[deprecated("Remove in v4.1. Use static_cast(zeek::detail::iosource.)")]]; +extern zeek::iosource::PktSrc* current_pktsrc [[deprecated("Remove in v4.1. Use zeek::run_state::detail::get_current_pktsrc().")]]; extern zeek::iosource::IOSource* current_iosrc; extern zeek::iosource::PktDumper* pkt_dumper; // where to save packets @@ -107,7 +113,7 @@ constexpr auto net_update_time [[deprecated("Remove in v4.1. Use zeek::run_state constexpr auto net_packet_dispatch [[deprecated("Remove in v4.1. Use zeek::run_state::detail::dispatch_packet.")]] = zeek::run_state::detail::dispatch_packet; constexpr auto expire_timers [[deprecated("Remove in v4.1. Use zeek::run_state::detail::expire_timers.")]] = zeek::run_state::detail::expire_timers; constexpr auto zeek_terminate_loop [[deprecated("Remove in v4.1. Use zeek::run_state::detail::zeek_terminate_loop.")]] = zeek::run_state::detail::zeek_terminate_loop; -extern zeek::iosource::PktSrc*& current_pktsrc [[deprecated("Remove in v4.1. Use static_cast(zeek::detail::iosource).")]]; +extern zeek::iosource::PktSrc*& current_pktsrc [[deprecated("Remove in v4.1. Use zeek::run_state::detail::get_current_pktsrc().")]]; extern zeek::iosource::IOSource*& current_iosrc [[deprecated("Remove in v4.1. Use zeek::run_state::detail::current_iosrc.")]]; extern zeek::iosource::PktDumper*& pkt_dumper [[deprecated("Remove in v4.1. Use zeek::run_state::detail::pkt_dumper.")]]; extern bool& have_pending_timers [[deprecated("Remove in v4.1. Use zeek::run_state::detail::have_pending_timers.")]]; diff --git a/src/iosource/Packet.h b/src/iosource/Packet.h index 8248fb7684..35ea6b446d 100644 --- a/src/iosource/Packet.h +++ b/src/iosource/Packet.h @@ -16,7 +16,7 @@ typedef struct timeval pkt_timeval; #endif #include "pcap.h" // For DLT_ constants -#include "NetVar.h" // For BifEnum::Tunnel +#include "zeek/NetVar.h" // For BifEnum::Tunnel ZEEK_FORWARD_DECLARE_NAMESPACED(ODesc, zeek); ZEEK_FORWARD_DECLARE_NAMESPACED(Val, zeek); @@ -221,11 +221,45 @@ public: // These are fields passed between various packet analyzers. They're best // stored with the packet so they stay available as the packet is passed // around. + + /** + * The stack of encapsulations this packet belongs to, if any. This is + * used by the tunnel analyzers to keep track of the encapsulations as + * processing occurs. + */ EncapsulationStack* encap = nullptr; + + /** + * The IP header for this packet. This is filled in by the IP analyzer + * during processing if the packet contains an IP header. + */ IP_Hdr* ip_hdr = nullptr; + + /** + * The protocol of the packet. This is used by the tunnel analyzers to + * pass outer protocol from one level to the next. + */ int proto = -1; + + /** + * If the packet contains a tunnel, this field will be filled in with + * the type of tunnel. It is used to pass the tunnel type between the + * packet analyzers during analysis. + */ BifEnum::Tunnel::Type tunnel_type = BifEnum::Tunnel::IP; + + /** + * If the packet contains a GRE tunnel, this field will contain the + * GRE version. It is used to pass this information from the GRE + * analyzer to the IPTunnel analyzer. + */ int gre_version = -1; + + /** + * If the packet contains a GRE tunnel, this field will contain the + * GRE link type. It is used to pass this information from the GRE + * analyzer to the IPTunnel analyzer. + */ int gre_link_type = DLT_RAW; private: diff --git a/src/packet_analysis/Manager.cc b/src/packet_analysis/Manager.cc index 7341a9ba90..d3b0ac00b3 100644 --- a/src/packet_analysis/Manager.cc +++ b/src/packet_analysis/Manager.cc @@ -37,7 +37,7 @@ void Manager::InitPostScript() root_analyzer = analyzers["Root"]; - static auto pkt_profile_file = id::find_val("pkt_profile_file"); + auto pkt_profile_file = id::find_val("pkt_profile_file"); if ( detail::pkt_profile_mode && detail::pkt_profile_freq > 0 && pkt_profile_file ) pkt_profiler = new detail::PacketProfiler(detail::pkt_profile_mode, diff --git a/src/packet_analysis/protocol/ip/IP.cc b/src/packet_analysis/protocol/ip/IP.cc index 5bf4d27539..b6acfa2d50 100644 --- a/src/packet_analysis/protocol/ip/IP.cc +++ b/src/packet_analysis/protocol/ip/IP.cc @@ -93,7 +93,7 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) if ( packet->len < total_len + packet->hdr_size ) { - packet->Weird("truncated_IP", encapsulation); + packet->Weird("truncated_IPv6", encapsulation); return false; } @@ -246,6 +246,8 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) case IPPROTO_UDP: case IPPROTO_ICMP: case IPPROTO_ICMPV6: + DBG_LOG(DBG_PACKET_ANALYSIS, "Analysis in %s succeeded, next layer identifier is %#x.", + GetAnalyzerName(), proto); sessions->DoNextPacket(run_state::processing_start_time, packet, ip_hdr, encapsulation); break; case IPPROTO_NONE: diff --git a/src/packet_analysis/protocol/iptunnel/IPTunnel.h b/src/packet_analysis/protocol/iptunnel/IPTunnel.h index 5c259135c1..cb9b7c9aa7 100644 --- a/src/packet_analysis/protocol/iptunnel/IPTunnel.h +++ b/src/packet_analysis/protocol/iptunnel/IPTunnel.h @@ -2,8 +2,8 @@ #pragma once -#include -#include +#include "zeek/packet_analysis/Analyzer.h" +#include "zeek/packet_analysis/Component.h" #include "zeek/IPAddr.h" #include "zeek/TunnelEncapsulation.h" diff --git a/src/zeek.bif b/src/zeek.bif index e0254b8522..fbb10791f2 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -3399,7 +3399,7 @@ const char* conn_id_string(zeek::Val* c) function dump_current_packet%(file_name: string%) : bool %{ const Packet* pkt; - auto* pkt_src = static_cast(zeek::run_state::detail::current_iosrc); + auto* pkt_src = dynamic_cast(zeek::run_state::detail::current_iosrc); if ( ! pkt_src || ! pkt_src->GetCurrentPacket(&pkt) ) return zeek::val_mgr->False(); @@ -3432,7 +3432,7 @@ function get_current_packet%(%) : pcap_packet static auto pcap_packet = zeek::id::find_type("pcap_packet"); const Packet* p; auto pkt = zeek::make_intrusive(pcap_packet); - auto* pkt_src = static_cast(zeek::run_state::detail::current_iosrc); + zeek::iosource::PktSrc* pkt_src = zeek::run_state::detail::current_packet_source(); if ( ! pkt_src || ! pkt_src->GetCurrentPacket(&p) ) { @@ -3464,7 +3464,7 @@ function get_current_packet%(%) : pcap_packet function get_current_packet_header%(%) : raw_pkt_hdr %{ const Packet* p; - auto* pkt_src = static_cast(zeek::run_state::detail::current_iosrc); + zeek::iosource::PktSrc* pkt_src = zeek::run_state::detail::current_packet_source(); if ( pkt_src && pkt_src->GetCurrentPacket(&p) ) { diff --git a/testing/btest/Baseline/core.reassembly/output b/testing/btest/Baseline/core.reassembly/output index 8f2ebd37b1..6f2aaf6c95 100644 --- a/testing/btest/Baseline/core.reassembly/output +++ b/testing/btest/Baseline/core.reassembly/output @@ -18,14 +18,14 @@ flow weird, excessively_small_fragment, 128.32.46.142, 10.0.0.1 flow weird, excessively_small_fragment, 128.32.46.142, 10.0.0.1 flow weird, fragment_inconsistency, 128.32.46.142, 10.0.0.1 ---------------------- -net_weird, truncated_IP -net_weird, truncated_IP -net_weird, truncated_IP -net_weird, truncated_IP +net_weird, truncated_IPv6 +net_weird, truncated_IPv6 +net_weird, truncated_IPv6 +net_weird, truncated_IPv6 rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliidlhd, A rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], dgphrodofqhq, orgmmpelofil, A rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], lenhfdqhqfgs, dfpqssidkpdg, A rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliislrr, A rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], iokgedlsdkjkiefgmeqkfjoh, ggdeolssksemrhedoledddml, A -net_weird, truncated_IP +net_weird, truncated_IPv6 rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO\x0d\x0a