Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add ability for packet sources to flag a packet's l2 or l3 checksum as valid.

Browse source 
This lets packet source plugins implement handling of hardware checksum offloading, if available. Setting the flags will skip the internal checksumming for either layer 2 and/or layer 3.
This commit is contained in:
Tim Wojtulewicz 2020-03-06 15:36:35 -07:00
parent da5fca7163
commit c6f7665953
6 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/Sessions.cc
View file

@ -251,7 +251,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
if ( packet_filter && packet_filter->Match(ip_hdr, len, caplen) ) if ( packet_filter && packet_filter->Match(ip_hdr, len, caplen) )
return; return;
if ( ! ignore_checksums && ip4 && if ( ! pkt->l2_checksummed && ! ignore_checksums && ip4 &&
ones_complement_checksum((void*) ip4, ip_hdr_len, 0) != 0xffff ) ones_complement_checksum((void*) ip4, ip_hdr_len, 0) != 0xffff )
{ {
Weird("bad_IP_checksum", pkt, encapsulation); Weird("bad_IP_checksum", pkt, encapsulation);

2
src/analyzer/protocol/icmp/ICMP.cc
View file

@ -333,7 +333,7 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
{ {
bad_hdr_len = 0; bad_hdr_len = 0;
ip_len = ip_hdr->TotalLen(); ip_len = ip_hdr->TotalLen();
bad_checksum = (ones_complement_checksum((void*) ip_hdr->IP4_Hdr(), ip_hdr_len, 0) != 0xffff); bad_checksum = ! current_pkt->l3_checksummed && (ones_complement_checksum((void*) ip_hdr->IP4_Hdr(), ip_hdr_len, 0) != 0xffff);
src_addr = ip_hdr->SrcAddr(); src_addr = ip_hdr->SrcAddr();
dst_addr = ip_hdr->DstAddr(); dst_addr = ip_hdr->DstAddr();

2
src/analyzer/protocol/tcp/TCP.cc
View file

@ -275,7 +275,7 @@ const struct tcphdr* TCP_Analyzer::ExtractTCP_Header(const u_char*& data,
bool TCP_Analyzer::ValidateChecksum(const struct tcphdr* tp, bool TCP_Analyzer::ValidateChecksum(const struct tcphdr* tp,
TCP_Endpoint* endpoint, int len, int caplen) TCP_Endpoint* endpoint, int len, int caplen)
{ {
if ( ! ignore_checksums && caplen >= len && if ( ! current_pkt->l3_checksummed && ! ignore_checksums && caplen >= len &&
! endpoint->ValidChecksum(tp, len) ) ! endpoint->ValidChecksum(tp, len) )
{ {
Weird("bad_TCP_checksum"); Weird("bad_TCP_checksum");

2
src/analyzer/protocol/udp/UDP.cc
View file

@ -62,7 +62,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
int chksum = up->uh_sum; int chksum = up->uh_sum;
auto validate_checksum = ! ignore_checksums && caplen >=len; auto validate_checksum = ! current_pkt->l3_checksummed && ! ignore_checksums && caplen >=len;
constexpr auto vxlan_len = 8; constexpr auto vxlan_len = 8;
constexpr auto eth_len = 14; constexpr auto eth_len = 14;

4
src/iosource/Packet.cc
View file

@ -52,6 +52,9 @@ void Packet::Init(int arg_link_type, pkt_timeval *arg_ts, uint32_t arg_caplen,
l2_valid = false; l2_valid = false;
l2_checksummed = false;
l3_checksummed = false;
if ( data && cap_len < hdr_size ) if ( data && cap_len < hdr_size )
{ {
Weird("truncated_link_header"); Weird("truncated_link_header");
@ -677,4 +680,3 @@ void Packet::Describe(ODesc* d) const
d->Add("->"); d->Add("->");
d->Add(ip.DstAddr()); d->Add(ip.DstAddr());
} }

12
src/iosource/Packet.h
View file

@ -199,6 +199,18 @@ public:
*/ */
uint32_t inner_vlan; uint32_t inner_vlan;
/**
* Indicates whether the layer 2 checksum was validated by the
* hardware/kernel before being received by zeek.
*/
bool l2_checksummed;
/**
* Indicates whether the layer 3 checksum was validated by the
* hardware/kernel before being received by zeek.
*/
bool l3_checksummed;
private: private:
// Calculate layer 2 attributes. Sets // Calculate layer 2 attributes. Sets
void ProcessLayer2(); void ProcessLayer2();