mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 02:28:21 +00:00
Rename IPBasedTransportAnalyzer to SessionAdapter
This also also combines the old TransportLayerAnalyzer class into SessionAdapter, and removes the old class. This requires naming changes in a few places but no functionality changes.
This commit is contained in:
Tim Wojtulewicz
parent
c56fb3e8e4
commit
b22ce6848f
24 changed files with 340 additions and 329 deletions
|
|
@ -35,9 +35,9 @@ ICMPAnalyzer::~ICMPAnalyzer()
|
|||
{
|
||||
}
|
||||
|
||||
IPBasedTransportAnalyzer* ICMPAnalyzer::MakeTransportAnalyzer(Connection* conn)
|
||||
SessionAdapter* ICMPAnalyzer::MakeSessionAdapter(Connection* conn)
|
||||
{
|
||||
auto* root = new ICMPTransportAnalyzer(conn);
|
||||
auto* root = new ICMPSessionAdapter(conn);
|
||||
root->SetParent(this);
|
||||
conn->SetInactivityTimeout(zeek::detail::icmp_inactivity_timeout);
|
||||
|
||||
|
|
@ -70,13 +70,13 @@ bool ICMPAnalyzer::BuildConnTuple(size_t len, const uint8_t* data, Packet* packe
|
|||
|
||||
void ICMPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remaining, Packet* pkt)
|
||||
{
|
||||
auto* ta = static_cast<ICMPTransportAnalyzer*>(c->GetRootAnalyzer());
|
||||
auto* adapter = static_cast<ICMPSessionAdapter*>(c->GetSessionAdapter());
|
||||
|
||||
const u_char* data = pkt->ip_hdr->Payload();
|
||||
int len = pkt->ip_hdr->PayloadLen();
|
||||
|
||||
if ( packet_contents && len > 0 )
|
||||
ta->PacketContents(data + 8, std::min(len, remaining) - 8);
|
||||
adapter->PacketContents(data + 8, std::min(len, remaining) - 8);
|
||||
|
||||
const struct icmp* icmpp = (const struct icmp*) data;
|
||||
const std::unique_ptr<IP_Hdr>& ip = pkt->ip_hdr;
|
||||
|
|
@ -104,25 +104,25 @@ void ICMPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int rema
|
|||
|
||||
if ( chksum != 0xffff )
|
||||
{
|
||||
ta->Weird("bad_ICMP_checksum");
|
||||
adapter->Weird("bad_ICMP_checksum");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
c->SetLastTime(run_state::current_timestamp);
|
||||
ta->InitEndpointMatcher(ip.get(), len, is_orig);
|
||||
adapter->InitEndpointMatcher(ip.get(), len, is_orig);
|
||||
|
||||
// Move past common portion of ICMP header.
|
||||
data += 8;
|
||||
remaining -= 8;
|
||||
len -= 8;
|
||||
|
||||
ta->UpdateLength(is_orig, len);
|
||||
adapter->UpdateLength(is_orig, len);
|
||||
|
||||
if ( ip->NextProto() == IPPROTO_ICMP )
|
||||
NextICMP4(run_state::current_timestamp, icmpp, len, remaining, data, ip.get(), ta);
|
||||
NextICMP4(run_state::current_timestamp, icmpp, len, remaining, data, ip.get(), adapter);
|
||||
else if ( ip->NextProto() == IPPROTO_ICMPV6 )
|
||||
NextICMP6(run_state::current_timestamp, icmpp, len, remaining, data, ip.get(), ta);
|
||||
NextICMP6(run_state::current_timestamp, icmpp, len, remaining, data, ip.get(), adapter);
|
||||
else
|
||||
{
|
||||
reporter->Error("expected ICMP as IP packet's protocol, got %d", ip->NextProto());
|
||||
|
|
@ -132,43 +132,43 @@ void ICMPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int rema
|
|||
ForwardPacket(len, data, pkt);
|
||||
|
||||
if ( remaining >= len )
|
||||
ta->ForwardPacket(len, data, is_orig, -1, ip.get(), remaining);
|
||||
adapter->ForwardPacket(len, data, is_orig, -1, ip.get(), remaining);
|
||||
|
||||
ta->MatchEndpoint(data, len, is_orig);
|
||||
adapter->MatchEndpoint(data, len, is_orig);
|
||||
}
|
||||
|
||||
void ICMPAnalyzer::NextICMP4(double t, const struct icmp* icmpp, int len, int caplen,
|
||||
const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
switch ( icmpp->icmp_type )
|
||||
{
|
||||
case ICMP_ECHO:
|
||||
case ICMP_ECHOREPLY:
|
||||
Echo(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
Echo(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
|
||||
case ICMP_UNREACH:
|
||||
case ICMP_TIMXCEED:
|
||||
Context4(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
Context4(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
|
||||
default:
|
||||
ICMP_Sent(icmpp, len, caplen, 0, data, ip_hdr, analyzer);
|
||||
ICMP_Sent(icmpp, len, caplen, 0, data, ip_hdr, adapter);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
void ICMPAnalyzer::NextICMP6(double t, const struct icmp* icmpp, int len, int caplen,
|
||||
const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
switch ( icmpp->icmp_type )
|
||||
{
|
||||
// Echo types.
|
||||
case ICMP6_ECHO_REQUEST:
|
||||
case ICMP6_ECHO_REPLY:
|
||||
Echo(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
Echo(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
|
||||
// Error messages all have the same structure for their context,
|
||||
|
|
@ -177,27 +177,27 @@ void ICMPAnalyzer::NextICMP6(double t, const struct icmp* icmpp, int len, int ca
|
|||
case ICMP6_TIME_EXCEEDED:
|
||||
case ICMP6_PACKET_TOO_BIG:
|
||||
case ICMP6_DST_UNREACH:
|
||||
Context6(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
Context6(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
|
||||
// Router related messages.
|
||||
case ND_REDIRECT:
|
||||
Redirect(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
Redirect(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
case ND_ROUTER_ADVERT:
|
||||
RouterAdvert(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
RouterAdvert(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
case ND_NEIGHBOR_ADVERT:
|
||||
NeighborAdvert(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
NeighborAdvert(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
case ND_NEIGHBOR_SOLICIT:
|
||||
NeighborSolicit(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
NeighborSolicit(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
case ND_ROUTER_SOLICIT:
|
||||
RouterSolicit(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
RouterSolicit(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
break;
|
||||
case ICMP6_ROUTER_RENUMBERING:
|
||||
ICMP_Sent(icmpp, len, caplen, 1, data, ip_hdr, analyzer);
|
||||
ICMP_Sent(icmpp, len, caplen, 1, data, ip_hdr, adapter);
|
||||
break;
|
||||
|
||||
#if 0
|
||||
|
|
@ -211,28 +211,28 @@ void ICMPAnalyzer::NextICMP6(double t, const struct icmp* icmpp, int len, int ca
|
|||
// the same structure for their context, and are
|
||||
// handled by the same function.
|
||||
if ( icmpp->icmp_type < 128 )
|
||||
Context6(t, icmpp, len, caplen, data, ip_hdr, analyzer);
|
||||
Context6(t, icmpp, len, caplen, data, ip_hdr, adapter);
|
||||
else
|
||||
ICMP_Sent(icmpp, len, caplen, 1, data, ip_hdr, analyzer);
|
||||
ICMP_Sent(icmpp, len, caplen, 1, data, ip_hdr, adapter);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
void ICMPAnalyzer::ICMP_Sent(const struct icmp* icmpp, int len, int caplen,
|
||||
int icmpv6, const u_char* data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
if ( icmp_sent )
|
||||
analyzer->EnqueueConnEvent(icmp_sent, analyzer->ConnVal(),
|
||||
BuildInfo(icmpp, len, icmpv6, ip_hdr));
|
||||
adapter->EnqueueConnEvent(icmp_sent, adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, icmpv6, ip_hdr));
|
||||
|
||||
if ( icmp_sent_payload )
|
||||
{
|
||||
String* payload = new String(data, std::min(len, caplen), false);
|
||||
|
||||
analyzer->EnqueueConnEvent(icmp_sent_payload, analyzer->ConnVal(),
|
||||
BuildInfo(icmpp, len, icmpv6, ip_hdr),
|
||||
make_intrusive<StringVal>(payload));
|
||||
adapter->EnqueueConnEvent(icmp_sent_payload, adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, icmpv6, ip_hdr),
|
||||
make_intrusive<StringVal>(payload));
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -446,7 +446,7 @@ zeek::RecordValPtr ICMPAnalyzer::ExtractICMP6Context(int len, const u_char*& dat
|
|||
|
||||
void ICMPAnalyzer::Echo(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
// For handling all Echo related ICMP messages
|
||||
EventHandlerPtr f = nullptr;
|
||||
|
|
@ -466,8 +466,8 @@ void ICMPAnalyzer::Echo(double t, const struct icmp* icmpp, int len,
|
|||
|
||||
String* payload = new String(data, caplen, false);
|
||||
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr),
|
||||
val_mgr->Count(iid),
|
||||
val_mgr->Count(iseq),
|
||||
|
|
@ -478,7 +478,7 @@ void ICMPAnalyzer::Echo(double t, const struct icmp* icmpp, int len,
|
|||
|
||||
void ICMPAnalyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
EventHandlerPtr f = icmp_router_advertisement;
|
||||
|
||||
|
|
@ -495,8 +495,8 @@ void ICMPAnalyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
|
|||
|
||||
int opt_offset = sizeof(reachable) + sizeof(retrans);
|
||||
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, 1, ip_hdr),
|
||||
val_mgr->Count(icmpp->icmp_num_addrs), // Cur Hop Limit
|
||||
val_mgr->Bool(icmpp->icmp_wpa & 0x80), // Managed
|
||||
|
|
@ -508,14 +508,14 @@ void ICMPAnalyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
|
|||
make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds),
|
||||
make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds),
|
||||
make_intrusive<IntervalVal>((double)ntohl(retrans), Milliseconds),
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, analyzer)
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, adapter)
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
void ICMPAnalyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
EventHandlerPtr f = icmp_neighbor_advertisement;
|
||||
|
||||
|
|
@ -529,21 +529,21 @@ void ICMPAnalyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len,
|
|||
|
||||
int opt_offset = sizeof(in6_addr);
|
||||
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, 1, ip_hdr),
|
||||
val_mgr->Bool(icmpp->icmp_num_addrs & 0x80), // Router
|
||||
val_mgr->Bool(icmpp->icmp_num_addrs & 0x40), // Solicited
|
||||
val_mgr->Bool(icmpp->icmp_num_addrs & 0x20), // Override
|
||||
make_intrusive<AddrVal>(tgtaddr),
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, analyzer)
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, adapter)
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
void ICMPAnalyzer::NeighborSolicit(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
EventHandlerPtr f = icmp_neighbor_solicitation;
|
||||
|
||||
|
|
@ -557,18 +557,18 @@ void ICMPAnalyzer::NeighborSolicit(double t, const struct icmp* icmpp, int len,
|
|||
|
||||
int opt_offset = sizeof(in6_addr);
|
||||
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, 1, ip_hdr),
|
||||
make_intrusive<AddrVal>(tgtaddr),
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, analyzer)
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, adapter)
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
void ICMPAnalyzer::Redirect(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
EventHandlerPtr f = icmp_redirect;
|
||||
|
||||
|
|
@ -585,36 +585,36 @@ void ICMPAnalyzer::Redirect(double t, const struct icmp* icmpp, int len,
|
|||
|
||||
int opt_offset = 2 * sizeof(in6_addr);
|
||||
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, 1, ip_hdr),
|
||||
make_intrusive<AddrVal>(tgtaddr),
|
||||
make_intrusive<AddrVal>(dstaddr),
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, analyzer)
|
||||
BuildNDOptionsVal(caplen - opt_offset, data + opt_offset, adapter)
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
void ICMPAnalyzer::RouterSolicit(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
EventHandlerPtr f = icmp_router_solicitation;
|
||||
|
||||
if ( ! f )
|
||||
return;
|
||||
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, 1, ip_hdr),
|
||||
BuildNDOptionsVal(caplen, data, analyzer)
|
||||
BuildNDOptionsVal(caplen, data, adapter)
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
void ICMPAnalyzer::Context4(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
EventHandlerPtr f = nullptr;
|
||||
|
||||
|
|
@ -630,8 +630,8 @@ void ICMPAnalyzer::Context4(double t, const struct icmp* icmpp, int len,
|
|||
}
|
||||
|
||||
if ( f )
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, 0, ip_hdr),
|
||||
val_mgr->Count(icmpp->icmp_code),
|
||||
ExtractICMP4Context(caplen, data)
|
||||
|
|
@ -641,7 +641,7 @@ void ICMPAnalyzer::Context4(double t, const struct icmp* icmpp, int len,
|
|||
|
||||
void ICMPAnalyzer::Context6(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
EventHandlerPtr f = nullptr;
|
||||
|
||||
|
|
@ -669,8 +669,8 @@ void ICMPAnalyzer::Context6(double t, const struct icmp* icmpp, int len,
|
|||
}
|
||||
|
||||
if ( f )
|
||||
analyzer->EnqueueConnEvent(f,
|
||||
analyzer->ConnVal(),
|
||||
adapter->EnqueueConnEvent(f,
|
||||
adapter->ConnVal(),
|
||||
BuildInfo(icmpp, len, 1, ip_hdr),
|
||||
val_mgr->Count(icmpp->icmp_code),
|
||||
ExtractICMP6Context(caplen, data)
|
||||
|
|
@ -678,7 +678,7 @@ void ICMPAnalyzer::Context6(double t, const struct icmp* icmpp, int len,
|
|||
}
|
||||
|
||||
zeek::VectorValPtr ICMPAnalyzer::BuildNDOptionsVal(int caplen, const u_char* data,
|
||||
ICMPTransportAnalyzer* analyzer)
|
||||
ICMPSessionAdapter* adapter)
|
||||
{
|
||||
static auto icmp6_nd_option_type = id::find_type<RecordType>("icmp6_nd_option");
|
||||
static auto icmp6_nd_prefix_info_type = id::find_type<RecordType>("icmp6_nd_prefix_info");
|
||||
|
|
@ -691,7 +691,7 @@ zeek::VectorValPtr ICMPAnalyzer::BuildNDOptionsVal(int caplen, const u_char* dat
|
|||
// Must have at least type & length to continue parsing options.
|
||||
if ( caplen < 2 )
|
||||
{
|
||||
analyzer->Weird("truncated_ICMPv6_ND_options");
|
||||
adapter->Weird("truncated_ICMPv6_ND_options");
|
||||
break;
|
||||
}
|
||||
|
||||
|
|
@ -700,7 +700,7 @@ zeek::VectorValPtr ICMPAnalyzer::BuildNDOptionsVal(int caplen, const u_char* dat
|
|||
|
||||
if ( length == 0 )
|
||||
{
|
||||
analyzer->Weird("zero_length_ICMPv6_ND_option");
|
||||
adapter->Weird("zero_length_ICMPv6_ND_option");
|
||||
break;
|
||||
}
|
||||
|
||||
|
|
@ -867,7 +867,7 @@ int ICMPAnalyzer::ICMP6_counterpart(int icmp_type, int icmp_code, bool& is_one_w
|
|||
}
|
||||
}
|
||||
|
||||
void ICMPTransportAnalyzer::AddExtraAnalyzers(Connection* conn)
|
||||
void ICMPSessionAdapter::AddExtraAnalyzers(Connection* conn)
|
||||
{
|
||||
static analyzer::Tag analyzer_connsize = analyzer_mgr->GetComponentTag("CONNSIZE");
|
||||
|
||||
|
|
@ -876,7 +876,7 @@ void ICMPTransportAnalyzer::AddExtraAnalyzers(Connection* conn)
|
|||
AddChildAnalyzer(new analyzer::conn_size::ConnSize_Analyzer(conn));
|
||||
}
|
||||
|
||||
void ICMPTransportAnalyzer::UpdateConnVal(zeek::RecordVal* conn_val)
|
||||
void ICMPSessionAdapter::UpdateConnVal(zeek::RecordVal* conn_val)
|
||||
{
|
||||
const auto& orig_endp = conn_val->GetField("orig");
|
||||
const auto& resp_endp = conn_val->GetField("resp");
|
||||
|
|
@ -887,7 +887,7 @@ void ICMPTransportAnalyzer::UpdateConnVal(zeek::RecordVal* conn_val)
|
|||
analyzer::Analyzer::UpdateConnVal(conn_val);
|
||||
}
|
||||
|
||||
void ICMPTransportAnalyzer::UpdateEndpointVal(const ValPtr& endp_arg, bool is_orig)
|
||||
void ICMPSessionAdapter::UpdateEndpointVal(const ValPtr& endp_arg, bool is_orig)
|
||||
{
|
||||
Conn()->EnableStatusUpdateTimer();
|
||||
|
||||
|
|
@ -906,7 +906,7 @@ void ICMPTransportAnalyzer::UpdateEndpointVal(const ValPtr& endp_arg, bool is_or
|
|||
}
|
||||
}
|
||||
|
||||
void ICMPTransportAnalyzer::UpdateLength(bool is_orig, int len)
|
||||
void ICMPSessionAdapter::UpdateLength(bool is_orig, int len)
|
||||
{
|
||||
int& len_stat = is_orig ? request_len : reply_len;
|
||||
if ( len_stat < 0 )
|
||||
|
|
@ -915,7 +915,7 @@ void ICMPTransportAnalyzer::UpdateLength(bool is_orig, int len)
|
|||
len_stat += len;
|
||||
}
|
||||
|
||||
void ICMPTransportAnalyzer::InitEndpointMatcher(const IP_Hdr* ip_hdr, int len, bool is_orig)
|
||||
void ICMPSessionAdapter::InitEndpointMatcher(const IP_Hdr* ip_hdr, int len, bool is_orig)
|
||||
{
|
||||
if ( zeek::detail::rule_matcher )
|
||||
{
|
||||
|
|
@ -924,15 +924,15 @@ void ICMPTransportAnalyzer::InitEndpointMatcher(const IP_Hdr* ip_hdr, int len, b
|
|||
}
|
||||
}
|
||||
|
||||
void ICMPTransportAnalyzer::MatchEndpoint(const u_char* data, int len, bool is_orig)
|
||||
void ICMPSessionAdapter::MatchEndpoint(const u_char* data, int len, bool is_orig)
|
||||
{
|
||||
if ( zeek::detail::rule_matcher )
|
||||
matcher_state.Match(zeek::detail::Rule::PAYLOAD, data, len, is_orig,
|
||||
false, false, true);
|
||||
}
|
||||
|
||||
void ICMPTransportAnalyzer::Done()
|
||||
void ICMPSessionAdapter::Done()
|
||||
{
|
||||
TransportLayerAnalyzer::Done();
|
||||
SessionAdapter::Done();
|
||||
matcher_state.FinishEndpointMatcher();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ using RecordValPtr = IntrusivePtr<RecordVal>;
|
|||
|
||||
namespace packet_analysis::ICMP {
|
||||
|
||||
class ICMPTransportAnalyzer;
|
||||
class ICMPSessionAdapter;
|
||||
|
||||
class ICMPAnalyzer final : public IP::IPBasedAnalyzer {
|
||||
public:
|
||||
|
|
@ -29,7 +29,7 @@ public:
|
|||
return std::make_shared<ICMPAnalyzer>();
|
||||
}
|
||||
|
||||
packet_analysis::IP::IPBasedTransportAnalyzer* MakeTransportAnalyzer(Connection* conn) override;
|
||||
packet_analysis::IP::SessionAdapter* MakeSessionAdapter(Connection* conn) override;
|
||||
|
||||
protected:
|
||||
|
||||
|
|
@ -46,34 +46,34 @@ private:
|
|||
|
||||
void NextICMP4(double t, const struct icmp* icmpp, int len, int caplen,
|
||||
const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
|
||||
void NextICMP6(double t, const struct icmp* icmpp, int len, int caplen,
|
||||
const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
|
||||
void ICMP_Sent(const struct icmp* icmpp, int len, int caplen, int icmpv6,
|
||||
const u_char* data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
|
||||
void Echo(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
void Redirect(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
void RouterAdvert(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
void NeighborAdvert(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
void NeighborSolicit(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
void RouterSolicit(double t, const struct icmp* icmpp, int len,
|
||||
int caplen, const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
|
||||
RecordValPtr BuildInfo(const struct icmp* icmpp, int len,
|
||||
bool icmpv6, const IP_Hdr* ip_hdr);
|
||||
|
|
@ -82,7 +82,7 @@ private:
|
|||
|
||||
void Context4(double t, const struct icmp* icmpp, int len, int caplen,
|
||||
const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
|
||||
TransportProto GetContextProtocol(const IP_Hdr* ip_hdr, uint32_t* src_port,
|
||||
uint32_t* dst_port);
|
||||
|
|
@ -91,11 +91,11 @@ private:
|
|||
|
||||
void Context6(double t, const struct icmp* icmpp, int len, int caplen,
|
||||
const u_char*& data, const IP_Hdr* ip_hdr,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
|
||||
// RFC 4861 Neighbor Discover message options
|
||||
VectorValPtr BuildNDOptionsVal(int caplen, const u_char* data,
|
||||
ICMPTransportAnalyzer* analyzer);
|
||||
ICMPSessionAdapter* adapter);
|
||||
|
||||
void UpdateEndpointVal(const ValPtr& endp, bool is_orig);
|
||||
|
||||
|
|
@ -105,16 +105,16 @@ private:
|
|||
int ICMP6_counterpart(int icmp_type, int icmp_code, bool& is_one_way);
|
||||
};
|
||||
|
||||
class ICMPTransportAnalyzer final : public IP::IPBasedTransportAnalyzer {
|
||||
class ICMPSessionAdapter final : public IP::SessionAdapter {
|
||||
|
||||
public:
|
||||
|
||||
ICMPTransportAnalyzer(Connection* conn) :
|
||||
IP::IPBasedTransportAnalyzer("ICMP", conn) { }
|
||||
ICMPSessionAdapter(Connection* conn) :
|
||||
IP::SessionAdapter("ICMP", conn) { }
|
||||
|
||||
static zeek::analyzer::Analyzer* Instantiate(Connection* conn)
|
||||
{
|
||||
return new ICMPTransportAnalyzer(conn);
|
||||
return new ICMPSessionAdapter(conn);
|
||||
}
|
||||
|
||||
void AddExtraAnalyzers(Connection* conn) override;
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ public:
|
|||
AddComponent(new zeek::packet_analysis::Component("ICMP",
|
||||
zeek::packet_analysis::ICMP::ICMPAnalyzer::Instantiate));
|
||||
AddComponent(new zeek::analyzer::Component("ICMP",
|
||||
zeek::packet_analysis::ICMP::ICMPTransportAnalyzer::Instantiate));
|
||||
zeek::packet_analysis::ICMP::ICMPSessionAdapter::Instantiate));
|
||||
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::ICMP";
|
||||
|
|
|
|||
|
|
@ -4,5 +4,5 @@ include(ZeekPlugin)
|
|||
include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR})
|
||||
|
||||
zeek_plugin_begin(PacketAnalyzer IP)
|
||||
zeek_plugin_cc(IP.cc IPBasedAnalyzer.cc Plugin.cc)
|
||||
zeek_plugin_cc(IP.cc IPBasedAnalyzer.cc SessionAdapter.cc Plugin.cc)
|
||||
zeek_plugin_end()
|
||||
|
|
|
|||
|
|
@ -218,7 +218,7 @@ zeek::Connection* IPBasedAnalyzer::NewConn(const ConnTuple* id, const detail::Co
|
|||
|
||||
bool IPBasedAnalyzer::BuildSessionAnalyzerTree(Connection* conn)
|
||||
{
|
||||
packet_analysis::IP::IPBasedTransportAnalyzer* root = MakeTransportAnalyzer(conn);
|
||||
SessionAdapter* root = MakeSessionAdapter(conn);
|
||||
analyzer::pia::PIA* pia = MakePIA(conn);
|
||||
|
||||
// TODO: temporary, can be replaced when the port lookup stuff is moved from analyzer_mgr
|
||||
|
|
@ -262,7 +262,7 @@ bool IPBasedAnalyzer::BuildSessionAnalyzerTree(Connection* conn)
|
|||
if ( pia )
|
||||
root->AddChildAnalyzer(pia->AsAnalyzer());
|
||||
|
||||
conn->SetRootAnalyzer(root, pia);
|
||||
conn->SetSessionAdapter(root, pia);
|
||||
root->Init();
|
||||
root->InitChildren();
|
||||
|
||||
|
|
|
|||
|
|
@ -4,6 +4,7 @@
|
|||
|
||||
#include "zeek/packet_analysis/Analyzer.h"
|
||||
#include "zeek/packet_analysis/Component.h"
|
||||
#include "zeek/packet_analysis/protocol/ip/SessionAdapter.h"
|
||||
#include "zeek/analyzer/Analyzer.h"
|
||||
#include "zeek/analyzer/Manager.h"
|
||||
|
||||
|
|
@ -11,11 +12,9 @@ namespace zeek::analyzer::pia { class PIA; }
|
|||
|
||||
namespace zeek::packet_analysis::IP {
|
||||
|
||||
class IPBasedTransportAnalyzer;
|
||||
|
||||
/**
|
||||
* A base class for any packet analyzer based on IP. This is used by default by
|
||||
* the TCP, UDP, and ICMP analyzers to reduce a large amount of duplicated code
|
||||
* A base class for reuse by packet analyzers based on IP. This is used by default
|
||||
* by the TCP, UDP, and ICMP analyzers to reduce a large amount of duplicated code
|
||||
* that those plugins have in common.
|
||||
*/
|
||||
class IPBasedAnalyzer : public Analyzer {
|
||||
|
|
@ -91,13 +90,15 @@ protected:
|
|||
}
|
||||
|
||||
/**
|
||||
* Returns a transport analyzer appropriate for this IP-based analyzer. This
|
||||
* can also be used to do any extra initialization of connection timers, etc.
|
||||
* Returns an analyzer adapter appropriate for this IP-based analyzer. This adapter
|
||||
* is used to hook into the session analyzer framework. This function can also be used
|
||||
* to do any extra initialization of connection timers, etc.
|
||||
*/
|
||||
virtual IPBasedTransportAnalyzer* MakeTransportAnalyzer(Connection* conn) { return nullptr; }
|
||||
virtual SessionAdapter* MakeSessionAdapter(Connection* conn) = 0;
|
||||
|
||||
/**
|
||||
* Returns a PIA appropriate for this IP-based analyzer.
|
||||
* Returns a PIA appropriate for this IP-based analyzer. This method is optional to
|
||||
* override in child classes, as not all analyzers need a PIA.
|
||||
*/
|
||||
virtual analyzer::pia::PIA* MakePIA(Connection* conn) { return nullptr; }
|
||||
|
||||
|
|
@ -145,44 +146,4 @@ private:
|
|||
uint32_t server_port_mask;
|
||||
};
|
||||
|
||||
/**
|
||||
* This class represents the interface between the packet analysis framework and
|
||||
* the session analysis framework. One of these should be implemented for each
|
||||
* packet analyzer that intends to forward into the session analysis.
|
||||
*/
|
||||
class IPBasedTransportAnalyzer : public zeek::analyzer::TransportLayerAnalyzer {
|
||||
|
||||
public:
|
||||
|
||||
IPBasedTransportAnalyzer(const char* name, Connection* conn)
|
||||
: TransportLayerAnalyzer(name, conn) { }
|
||||
|
||||
/**
|
||||
* Sets the parent packet analyzer for this transport analyzer. This can't be passed to
|
||||
* the constructor due to the way that TransportLayerAnalyzer gets instantiated.
|
||||
*
|
||||
* @param p The parent packet analyzer to store
|
||||
*/
|
||||
void SetParent(IPBasedAnalyzer* p) { parent = p; }
|
||||
|
||||
/**
|
||||
* Returns true if the analyzer determines that in fact a new connection has started
|
||||
* without the connection statement having terminated the previous one, i.e., the new
|
||||
* data is arriving at what's the analyzer for the previous instance. This is used only
|
||||
* for TCP.
|
||||
*/
|
||||
bool IsReuse(double t, const u_char* pkt) override { return parent->IsReuse(t, pkt); }
|
||||
|
||||
/**
|
||||
* Pure virtual method to allow extra session analzyers to be added to this analyzer's
|
||||
* tree of children. This is used by analyzer::Manager when creating the session analyzer
|
||||
* tree.
|
||||
*/
|
||||
virtual void AddExtraAnalyzers(Connection* conn) = 0;
|
||||
|
||||
protected:
|
||||
|
||||
IPBasedAnalyzer* parent;
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
39
src/packet_analysis/protocol/ip/SessionAdapter.cc
Normal file
39
src/packet_analysis/protocol/ip/SessionAdapter.cc
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
#include "zeek/packet_analysis/protocol/ip/SessionAdapter.h"
|
||||
|
||||
#include "zeek/File.h"
|
||||
#include "zeek/ZeekString.h"
|
||||
#include "zeek/packet_analysis/protocol/ip/IPBasedAnalyzer.h"
|
||||
|
||||
using namespace zeek::packet_analysis::IP;
|
||||
|
||||
void SessionAdapter::Done()
|
||||
{
|
||||
Analyzer::Done();
|
||||
}
|
||||
|
||||
bool SessionAdapter::IsReuse(double t, const u_char* pkt)
|
||||
{
|
||||
return parent->IsReuse(t, pkt);
|
||||
}
|
||||
|
||||
void SessionAdapter::SetContentsFile(unsigned int /* direction */,
|
||||
FilePtr /* f */)
|
||||
{
|
||||
reporter->Error("analyzer type does not support writing to a contents file");
|
||||
}
|
||||
|
||||
zeek::FilePtr SessionAdapter::GetContentsFile(unsigned int /* direction */) const
|
||||
{
|
||||
reporter->Error("analyzer type does not support writing to a contents file");
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
void SessionAdapter::PacketContents(const u_char* data, int len)
|
||||
{
|
||||
if ( packet_contents && len > 0 )
|
||||
{
|
||||
zeek::String* cbs = new zeek::String(data, len, true);
|
||||
auto contents = make_intrusive<StringVal>(cbs);
|
||||
EnqueueConnEvent(packet_contents, ConnVal(), std::move(contents));
|
||||
}
|
||||
}
|
||||
102
src/packet_analysis/protocol/ip/SessionAdapter.h
Normal file
102
src/packet_analysis/protocol/ip/SessionAdapter.h
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
#pragma once
|
||||
|
||||
#include "zeek/analyzer/Analyzer.h"
|
||||
|
||||
namespace zeek::analyzer::pia { class PIA; }
|
||||
|
||||
namespace zeek::packet_analysis::IP {
|
||||
|
||||
class IPBasedAnalyzer;
|
||||
|
||||
/**
|
||||
* This class represents the interface between the packet analysis framework and
|
||||
* the session analysis framework. One of these should be implemented for each
|
||||
* packet analyzer that intends to forward into the session analysis.
|
||||
*/
|
||||
class SessionAdapter : public analyzer::Analyzer {
|
||||
|
||||
public:
|
||||
|
||||
SessionAdapter(const char* name, Connection* conn)
|
||||
: analyzer::Analyzer(name, conn) { }
|
||||
|
||||
/**
|
||||
* Overridden from parent class.
|
||||
*/
|
||||
virtual void Done() override;
|
||||
|
||||
/**
|
||||
* Sets the parent packet analyzer for this session adapter. This can't be passed to
|
||||
* the constructor due to the way that SessionAdapter gets instantiated.
|
||||
*
|
||||
* @param p The parent packet analyzer to store
|
||||
*/
|
||||
void SetParent(IPBasedAnalyzer* p) { parent = p; }
|
||||
|
||||
/**
|
||||
* Returns true if the analyzer determines that in fact a new connection has started
|
||||
* without the connection statement having terminated the previous one, i.e., the new
|
||||
* data is arriving at what's the analyzer for the previous instance. This is used only
|
||||
* for TCP.
|
||||
*/
|
||||
virtual bool IsReuse(double t, const u_char* pkt);
|
||||
|
||||
/**
|
||||
* Pure virtual method to allow extra session analzyers to be added to this analyzer's
|
||||
* tree of children. This is used by analyzer::Manager when creating the session analyzer
|
||||
* tree.
|
||||
*/
|
||||
virtual void AddExtraAnalyzers(Connection* conn) = 0;
|
||||
|
||||
/**
|
||||
* Associates a file with the analyzer in which to record all
|
||||
* analyzed input. This must only be called with derived classes that
|
||||
* overide the method; the default implementation will abort.
|
||||
*
|
||||
* @param direction One of the CONTENTS_* constants indicating which
|
||||
* direction of the input stream is to be recorded.
|
||||
*
|
||||
* @param f The file to record to.
|
||||
*
|
||||
*/
|
||||
virtual void SetContentsFile(unsigned int direction, FilePtr f);
|
||||
|
||||
/**
|
||||
* Returns an associated contents file, if any. This must only be
|
||||
* called with derived classes that overide the method; the default
|
||||
* implementation will abort.
|
||||
*
|
||||
* @param direction One of the CONTENTS_* constants indicating which
|
||||
* direction the query is for.
|
||||
*/
|
||||
virtual FilePtr GetContentsFile(unsigned int direction) const;
|
||||
|
||||
/**
|
||||
* Associates a PIA with this analyzer. A PIA takes the
|
||||
* transport-layer input and determine which protocol analyzer(s) to
|
||||
* use for parsing it.
|
||||
*/
|
||||
void SetPIA(analyzer::pia::PIA* arg_PIA) { pia = arg_PIA; }
|
||||
|
||||
/**
|
||||
* Returns the associated PIA, or null of none. Does not take
|
||||
* ownership.
|
||||
*/
|
||||
analyzer::pia::PIA* GetPIA() const { return pia; }
|
||||
|
||||
/**
|
||||
* Helper to raise a \c packet_contents event.
|
||||
*
|
||||
* @param data The dass to pass to the event.
|
||||
*
|
||||
* @param len The length of \a data.
|
||||
*/
|
||||
void PacketContents(const u_char* data, int len);
|
||||
|
||||
protected:
|
||||
|
||||
IPBasedAnalyzer* parent;
|
||||
analyzer::pia::PIA* pia;
|
||||
};
|
||||
|
||||
} // namespace zeek::packet_analysis::IP
|
||||
|
|
@ -18,6 +18,15 @@ public:
|
|||
return std::make_shared<TCPAnalyzer>();
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns an adapter appropriate for this IP-based analyzer. This adapter is used to
|
||||
* hook into the session analyzer framework. This function can also be used to do any
|
||||
* extra initialization of connection timers, etc.
|
||||
*
|
||||
* TODO: this is a stub until the TCP analyzer moves to the packet analysis framework.
|
||||
*/
|
||||
IP::SessionAdapter* MakeSessionAdapter(Connection* conn) override { return nullptr; }
|
||||
|
||||
protected:
|
||||
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ public:
|
|||
AddComponent(new zeek::packet_analysis::Component("UDP",
|
||||
zeek::packet_analysis::UDP::UDPAnalyzer::Instantiate));
|
||||
AddComponent(new zeek::analyzer::Component("UDP",
|
||||
zeek::packet_analysis::UDP::UDPTransportAnalyzer::Instantiate));
|
||||
zeek::packet_analysis::UDP::UDPSessionAdapter::Instantiate));
|
||||
|
||||
zeek::plugin::Configuration config;
|
||||
config.name = "Zeek::UDP";
|
||||
|
|
|
|||
|
|
@ -33,9 +33,9 @@ UDPAnalyzer::~UDPAnalyzer()
|
|||
{
|
||||
}
|
||||
|
||||
IPBasedTransportAnalyzer* UDPAnalyzer::MakeTransportAnalyzer(Connection* conn)
|
||||
SessionAdapter* UDPAnalyzer::MakeSessionAdapter(Connection* conn)
|
||||
{
|
||||
auto* root = new UDPTransportAnalyzer(conn);
|
||||
auto* root = new UDPSessionAdapter(conn);
|
||||
root->SetParent(this);
|
||||
|
||||
conn->EnableStatusUpdateTimer();
|
||||
|
|
@ -95,7 +95,7 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
{
|
||||
conn = c;
|
||||
|
||||
auto* ta = static_cast<UDPTransportAnalyzer*>(conn->GetRootAnalyzer());
|
||||
auto* adapter = static_cast<UDPSessionAdapter*>(conn->GetSessionAdapter());
|
||||
|
||||
const u_char* data = pkt->ip_hdr->Payload();
|
||||
int len = pkt->ip_hdr->PayloadLen();
|
||||
|
|
@ -103,7 +103,7 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
const struct udphdr* up = (const struct udphdr*) data;
|
||||
const std::unique_ptr<IP_Hdr>& ip = pkt->ip_hdr;
|
||||
|
||||
ta->DeliverPacket(len, data, is_orig, -1, ip.get(), remaining);
|
||||
adapter->DeliverPacket(len, data, is_orig, -1, ip.get(), remaining);
|
||||
|
||||
// Increment data before checksum check so that data will
|
||||
// point to UDP payload even if checksum fails. Particularly,
|
||||
|
|
@ -113,7 +113,7 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
// We need the min() here because Ethernet frame padding can lead to
|
||||
// remaining > len.
|
||||
if ( packet_contents )
|
||||
ta->PacketContents(data, std::min(len, remaining) - sizeof(struct udphdr));
|
||||
adapter->PacketContents(data, std::min(len, remaining) - sizeof(struct udphdr));
|
||||
|
||||
int chksum = up->uh_sum;
|
||||
|
||||
|
|
@ -159,24 +159,24 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
|
||||
if ( bad )
|
||||
{
|
||||
ta->Weird("bad_UDP_checksum");
|
||||
adapter->Weird("bad_UDP_checksum");
|
||||
|
||||
if ( is_orig )
|
||||
{
|
||||
uint32_t t = ta->req_chk_thresh;
|
||||
uint32_t t = adapter->req_chk_thresh;
|
||||
|
||||
if ( conn->ScaledHistoryEntry('C',
|
||||
ta->req_chk_cnt,
|
||||
ta->req_chk_thresh) )
|
||||
adapter->req_chk_cnt,
|
||||
adapter->req_chk_thresh) )
|
||||
ChecksumEvent(is_orig, t);
|
||||
}
|
||||
else
|
||||
{
|
||||
uint32_t t = ta->rep_chk_thresh;
|
||||
uint32_t t = adapter->rep_chk_thresh;
|
||||
|
||||
if ( conn->ScaledHistoryEntry('c',
|
||||
ta->rep_chk_cnt,
|
||||
ta->rep_chk_thresh) )
|
||||
adapter->rep_chk_cnt,
|
||||
adapter->rep_chk_thresh) )
|
||||
ChecksumEvent(is_orig, t);
|
||||
}
|
||||
|
||||
|
|
@ -186,7 +186,7 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
|
||||
int ulen = ntohs(up->uh_ulen);
|
||||
if ( ulen != len )
|
||||
ta->Weird("UDP_datagram_length_mismatch", util::fmt("%d != %d", ulen, len));
|
||||
adapter->Weird("UDP_datagram_length_mismatch", util::fmt("%d != %d", ulen, len));
|
||||
|
||||
len -= sizeof(struct udphdr);
|
||||
ulen -= sizeof(struct udphdr);
|
||||
|
|
@ -229,8 +229,8 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
}
|
||||
|
||||
if ( do_udp_contents )
|
||||
ta->EnqueueConnEvent(udp_contents,
|
||||
ta->ConnVal(),
|
||||
adapter->EnqueueConnEvent(udp_contents,
|
||||
adapter->ConnVal(),
|
||||
val_mgr->Bool(is_orig),
|
||||
make_intrusive<StringVal>(len, (const char*) data));
|
||||
}
|
||||
|
|
@ -238,14 +238,14 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
if ( is_orig )
|
||||
{
|
||||
conn->CheckHistory(HIST_ORIG_DATA_PKT, 'D');
|
||||
ta->UpdateLength(is_orig, ulen);
|
||||
ta->Event(udp_request);
|
||||
adapter->UpdateLength(is_orig, ulen);
|
||||
adapter->Event(udp_request);
|
||||
}
|
||||
else
|
||||
{
|
||||
conn->CheckHistory(HIST_RESP_DATA_PKT, 'd');
|
||||
ta->UpdateLength(is_orig, ulen);
|
||||
ta->Event(udp_reply);
|
||||
adapter->UpdateLength(is_orig, ulen);
|
||||
adapter->Event(udp_reply);
|
||||
}
|
||||
|
||||
// Send the packet back into the packet analysis framework.
|
||||
|
|
@ -253,7 +253,7 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
|
|||
|
||||
// Also try sending it into session analysis.
|
||||
if ( remaining >= len )
|
||||
ta->ForwardPacket(len, data, is_orig, -1, ip.get(), remaining);
|
||||
adapter->ForwardPacket(len, data, is_orig, -1, ip.get(), remaining);
|
||||
|
||||
conn = nullptr;
|
||||
}
|
||||
|
|
@ -272,7 +272,7 @@ void UDPAnalyzer::ChecksumEvent(bool is_orig, uint32_t threshold)
|
|||
conn->HistoryThresholdEvent(udp_multiple_checksum_errors, is_orig, threshold);
|
||||
}
|
||||
|
||||
void UDPTransportAnalyzer::AddExtraAnalyzers(Connection* conn)
|
||||
void UDPSessionAdapter::AddExtraAnalyzers(Connection* conn)
|
||||
{
|
||||
static analyzer::Tag analyzer_connsize = analyzer_mgr->GetComponentTag("CONNSIZE");
|
||||
|
||||
|
|
@ -281,7 +281,7 @@ void UDPTransportAnalyzer::AddExtraAnalyzers(Connection* conn)
|
|||
AddChildAnalyzer(new analyzer::conn_size::ConnSize_Analyzer(conn));
|
||||
}
|
||||
|
||||
void UDPTransportAnalyzer::UpdateConnVal(RecordVal* conn_val)
|
||||
void UDPSessionAdapter::UpdateConnVal(RecordVal* conn_val)
|
||||
{
|
||||
auto orig_endp = conn_val->GetField("orig");
|
||||
auto resp_endp = conn_val->GetField("resp");
|
||||
|
|
@ -293,7 +293,7 @@ void UDPTransportAnalyzer::UpdateConnVal(RecordVal* conn_val)
|
|||
Analyzer::UpdateConnVal(conn_val);
|
||||
}
|
||||
|
||||
void UDPTransportAnalyzer::UpdateEndpointVal(const ValPtr& endp_arg, bool is_orig)
|
||||
void UDPSessionAdapter::UpdateEndpointVal(const ValPtr& endp_arg, bool is_orig)
|
||||
{
|
||||
bro_int_t size = is_orig ? request_len : reply_len;
|
||||
auto endp = endp_arg->AsRecordVal();
|
||||
|
|
@ -311,7 +311,7 @@ void UDPTransportAnalyzer::UpdateEndpointVal(const ValPtr& endp_arg, bool is_ori
|
|||
}
|
||||
}
|
||||
|
||||
void UDPTransportAnalyzer::UpdateLength(bool is_orig, int len)
|
||||
void UDPSessionAdapter::UpdateLength(bool is_orig, int len)
|
||||
{
|
||||
if ( is_orig )
|
||||
{
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ protected:
|
|||
bool WantConnection(uint16_t src_port, uint16_t dst_port,
|
||||
const u_char* data, bool& flip_roles) const override;
|
||||
|
||||
packet_analysis::IP::IPBasedTransportAnalyzer* MakeTransportAnalyzer(Connection* conn) override;
|
||||
packet_analysis::IP::SessionAdapter* MakeSessionAdapter(Connection* conn) override;
|
||||
analyzer::pia::PIA* MakePIA(Connection* conn) override;
|
||||
|
||||
private:
|
||||
|
|
@ -67,16 +67,16 @@ private:
|
|||
std::vector<uint16_t> vxlan_ports;
|
||||
};
|
||||
|
||||
class UDPTransportAnalyzer final : public IP::IPBasedTransportAnalyzer {
|
||||
class UDPSessionAdapter final : public IP::SessionAdapter {
|
||||
|
||||
public:
|
||||
|
||||
UDPTransportAnalyzer(Connection* conn) :
|
||||
IP::IPBasedTransportAnalyzer("UDP", conn) { }
|
||||
UDPSessionAdapter(Connection* conn) :
|
||||
IP::SessionAdapter("UDP", conn) { }
|
||||
|
||||
static zeek::analyzer::Analyzer* Instantiate(Connection* conn)
|
||||
{
|
||||
return new UDPTransportAnalyzer(conn);
|
||||
return new UDPSessionAdapter(conn);
|
||||
}
|
||||
|
||||
void AddExtraAnalyzers(Connection* conn) override;
|
||||
|
|
@ -85,8 +85,7 @@ public:
|
|||
void UpdateLength(bool is_orig, int len);
|
||||
|
||||
// For tracking checksum history. These are connection-specific so they
|
||||
// need to be stored in the transport analyzer created for each
|
||||
// connection.
|
||||
// need to be stored in the session adapter created for each connection.
|
||||
uint32_t req_chk_cnt = 0;
|
||||
uint32_t req_chk_thresh = 1;
|
||||
uint32_t rep_chk_cnt = 0;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue