Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Extending rexmit_inconsistency() event to receive an additional

Browse source 
parameter with the packet's TCP flags, if available.
This commit is contained in:
Robin Sommer 2015-10-26 14:11:21 -07:00
parent 88a4683d22
commit a83d97937e
14 changed files with 53 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/analyzer/protocol/tcp/TCP_Reassembler.cc
View file

@ -433,8 +433,13 @@ void TCP_Reassembler::Overlap(const u_char* b1, const u_char* b2, uint64 n)
{
BroString* b1_s = new BroString((const u_char*) b1, n, 0);
BroString* b2_s = new BroString((const u_char*) b2, n, 0);
tcp_analyzer->Event(rexmit_inconsistency,
new StringVal(b1_s), new StringVal(b2_s));
val_list* vl = new val_list(3);
vl->append(tcp_analyzer->BuildConnVal());
vl->append(new StringVal(b1_s));
vl->append(new StringVal(b2_s));
vl->append(new StringVal(flags.AsString()));
tcp_analyzer->ConnectionEvent(rexmit_inconsistency, vl);
}
}
@ -461,7 +466,7 @@ void TCP_Reassembler::Deliver(uint64 seq, int len, const u_char* data)
}
int TCP_Reassembler::DataSent(double t, uint64 seq, int len,
const u_char* data, bool replaying)
const u_char* data, TCP_Flags arg_flags, bool replaying)
{
uint64 ack = endp->ToRelativeSeqSpace(endp->AckSeq(), endp->AckWraps());
uint64 upper_seq = seq + len;
@ -492,7 +497,9 @@ int TCP_Reassembler::DataSent(double t, uint64 seq, int len,
len -= amount_acked;
}
flags = arg_flags;
NewBlock(t, seq, len, data);
flags = TCP_Flags();
if ( Endpoint()->NoDataAcked() && tcp_max_above_hole_without_any_acks &&
NumUndeliveredBytes() > static_cast<uint64>(tcp_max_above_hole_without_any_acks) )