Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'topic/tunnels' of ssh://git.bro-ids.org/bro into topic/tunnels

Browse source
This commit is contained in:
Seth Hall 2012-04-24 17:30:57 -04:00
commit ad55331258
4 changed files with 2 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/init-bare.bro
View file

@ -2629,10 +2629,8 @@ const ignore_keep_alive_rexmit = F &redef;
module Tunnel; module Tunnel;
export { export {
## Whether to decapsulate IP tunnels (IPinIP, 6in4, 6to4)
const decapsulate_ip = T &redef;
## The maximum depth of a tunnel to decapsulate until giving up. ## The maximum depth of a tunnel to decapsulate until giving up.
## Setting this to zero will disable tunnel decapsulation.
const max_depth: count = 2 &redef; const max_depth: count = 2 &redef;
} # end export } # end export
module GLOBAL; module GLOBAL;

2
src/AYIYA.h
View file

@ -16,7 +16,7 @@ public:
{ return new AYIYA_Analyzer(conn); } { return new AYIYA_Analyzer(conn); }
static bool Available() static bool Available()
{ return BifConst::Tunnel::decapsulate_ip; } { return BifConst::Tunnel::max_depth > 0; }
protected: protected:
friend class AnalyzerTimer; friend class AnalyzerTimer;

9
src/Sessions.cc
View file

@ -522,17 +522,9 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr,
break; break;
} }
case IPPROTO_IP:
case IPPROTO_IPV4: case IPPROTO_IPV4:
case IPPROTO_IPV6: case IPPROTO_IPV6:
{ {
if ( ! BifConst::Tunnel::decapsulate_ip )
{
reporter->Weird(ip_hdr->SrcAddr(), ip_hdr->DstAddr(), "ip_tunnel");
Remove(f);
return;
}
if ( encapsulation.Depth() >= BifConst::Tunnel::max_depth ) if ( encapsulation.Depth() >= BifConst::Tunnel::max_depth )
{ {
reporter->Weird(ip_hdr->SrcAddr(), ip_hdr->DstAddr(), "tunnel_depth"); reporter->Weird(ip_hdr->SrcAddr(), ip_hdr->DstAddr(), "tunnel_depth");
@ -674,7 +666,6 @@ bool NetSessions::CheckHeaderTrunc(int proto, uint32 len, uint32 caplen,
case IPPROTO_UDP: case IPPROTO_UDP:
min_hdr_len = sizeof(struct udphdr); min_hdr_len = sizeof(struct udphdr);
break; break;
case IPPROTO_IP:
case IPPROTO_IPV4: case IPPROTO_IPV4:
min_hdr_len = sizeof(struct ip); min_hdr_len = sizeof(struct ip);
break; break;

1
src/const.bif
View file

@ -11,5 +11,4 @@ const NFS3::return_data: bool;
const NFS3::return_data_max: count; const NFS3::return_data_max: count;
const NFS3::return_data_first_only: bool; const NFS3::return_data_first_only: bool;
const Tunnel::decapsulate_ip: bool;
const Tunnel::max_depth: count; const Tunnel::max_depth: count;