Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'topic/tunnels' of ssh://git.bro-ids.org/bro into topic/tunnels

Browse source
This commit is contained in:
Seth Hall 2012-04-24 17:30:57 -04:00
commit ad55331258
4 changed files with 2 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/init-bare.bro
View file

@ -2629,10 +2629,8 @@ const ignore_keep_alive_rexmit = F &redef;
module Tunnel;
export {
## Whether to decapsulate IP tunnels (IPinIP, 6in4, 6to4)
const decapsulate_ip = T &redef;
## The maximum depth of a tunnel to decapsulate until giving up.
## Setting this to zero will disable tunnel decapsulation.
const max_depth: count = 2 &redef;
} # end export
module GLOBAL;

2
src/AYIYA.h
View file

@ -16,7 +16,7 @@ public:
{ return new AYIYA_Analyzer(conn); }
static bool Available()
{ return BifConst::Tunnel::decapsulate_ip; }
{ return BifConst::Tunnel::max_depth > 0; }
protected:
friend class AnalyzerTimer;

9
src/Sessions.cc
View file

@ -522,17 +522,9 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr,
break;
}
case IPPROTO_IP:
case IPPROTO_IPV4:
case IPPROTO_IPV6:
{
if ( ! BifConst::Tunnel::decapsulate_ip )
{
reporter->Weird(ip_hdr->SrcAddr(), ip_hdr->DstAddr(), "ip_tunnel");
Remove(f);
return;
}
if ( encapsulation.Depth() >= BifConst::Tunnel::max_depth )
{
reporter->Weird(ip_hdr->SrcAddr(), ip_hdr->DstAddr(), "tunnel_depth");
@ -674,7 +666,6 @@ bool NetSessions::CheckHeaderTrunc(int proto, uint32 len, uint32 caplen,
case IPPROTO_UDP:
min_hdr_len = sizeof(struct udphdr);
break;
case IPPROTO_IP:
case IPPROTO_IPV4:
min_hdr_len = sizeof(struct ip);
break;

1
src/const.bif
View file

@ -11,5 +11,4 @@ const NFS3::return_data: bool;
const NFS3::return_data_max: count;
const NFS3::return_data_first_only: bool;
const Tunnel::decapsulate_ip: bool;
const Tunnel::max_depth: count;