Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

af_packet: AF_Packet: Fix wrong vlan when PCP or DEI bits are set in tp_vlan_tci

Browse source 
A user reported vlan ids > 4095 being logged by Zeek [1]. For populating
packet->vlan, mask away Priority Code Point (PCP) and Drop Eligible
Indicator (DEI) bits from the tp_vlan_tci field, else we're not setting
the correct value on the packet.

Fixes #60

[1] https://community.zeek.org/t/zeek-reporting-vlan-ids-above-4095-bug-found/7000
This commit is contained in:
Arne Welzel 2023-04-22 12:08:32 +02:00 • committed by Tim Wojtulewicz
parent c3a13304cb
commit aefa52821c
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/iosource/af_packet/src/AF_Packet.cc
View file

@ -295,7 +295,7 @@ bool AF_PacketSource::ExtractNextPacket(zeek::Packet* pkt)
pkt->Init(props.link_type, &current_hdr.ts, current_hdr.caplen, current_hdr.len, data); pkt->Init(props.link_type, &current_hdr.ts, current_hdr.caplen, current_hdr.len, data);
if ( packet->tp_status & TP_STATUS_VLAN_VALID ) if ( packet->tp_status & TP_STATUS_VLAN_VALID )
pkt->vlan = packet->hv1.tp_vlan_tci; pkt->vlan = packet->hv1.tp_vlan_tci & 0x0fff;
#if ZEEK_VERSION_NUMBER >= 50100 #if ZEEK_VERSION_NUMBER >= 50100
switch ( checksum_mode ) switch ( checksum_mode )