Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add ability for packet sources to flag a packet's l2 or l3 checksum as valid.

Browse source 
This lets packet source plugins implement handling of hardware checksum offloading, if available. Setting the flags will skip the internal checksumming for either layer 2 and/or layer 3.
This commit is contained in:
Tim Wojtulewicz 2020-03-06 15:36:35 -07:00
parent da5fca7163
commit c6f7665953
6 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/Sessions.cc
View file

@ -251,7 +251,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
if ( packet_filter && packet_filter->Match(ip_hdr, len, caplen) )
return;
if ( ! ignore_checksums && ip4 &&
if ( ! pkt->l2_checksummed && ! ignore_checksums && ip4 &&
ones_complement_checksum((void*) ip4, ip_hdr_len, 0) != 0xffff )
{
Weird("bad_IP_checksum", pkt, encapsulation);

2
src/analyzer/protocol/icmp/ICMP.cc
View file

@ -333,7 +333,7 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
{
bad_hdr_len = 0;
ip_len = ip_hdr->TotalLen();
bad_checksum = (ones_complement_checksum((void*) ip_hdr->IP4_Hdr(), ip_hdr_len, 0) != 0xffff);
bad_checksum = ! current_pkt->l3_checksummed && (ones_complement_checksum((void*) ip_hdr->IP4_Hdr(), ip_hdr_len, 0) != 0xffff);
src_addr = ip_hdr->SrcAddr();
dst_addr = ip_hdr->DstAddr();

2
src/analyzer/protocol/tcp/TCP.cc
View file

@ -275,7 +275,7 @@ const struct tcphdr* TCP_Analyzer::ExtractTCP_Header(const u_char*& data,
bool TCP_Analyzer::ValidateChecksum(const struct tcphdr* tp,
TCP_Endpoint* endpoint, int len, int caplen)
{
if ( ! ignore_checksums && caplen >= len &&
if ( ! current_pkt->l3_checksummed && ! ignore_checksums && caplen >= len &&
! endpoint->ValidChecksum(tp, len) )
{
Weird("bad_TCP_checksum");

2
src/analyzer/protocol/udp/UDP.cc
View file

@ -62,7 +62,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
int chksum = up->uh_sum;
auto validate_checksum = ! ignore_checksums && caplen >=len;
auto validate_checksum = ! current_pkt->l3_checksummed && ! ignore_checksums && caplen >=len;
constexpr auto vxlan_len = 8;
constexpr auto eth_len = 14;

4
src/iosource/Packet.cc
View file

@ -52,6 +52,9 @@ void Packet::Init(int arg_link_type, pkt_timeval *arg_ts, uint32_t arg_caplen,
l2_valid = false;
l2_checksummed = false;
l3_checksummed = false;
if ( data && cap_len < hdr_size )
{
Weird("truncated_link_header");
@ -677,4 +680,3 @@ void Packet::Describe(ODesc* d) const
d->Add("->");
d->Add(ip.DstAddr());
}

12
src/iosource/Packet.h
View file

@ -199,6 +199,18 @@ public:
*/
uint32_t inner_vlan;
/**
* Indicates whether the layer 2 checksum was validated by the
* hardware/kernel before being received by zeek.
*/
bool l2_checksummed;
/**
* Indicates whether the layer 3 checksum was validated by the
* hardware/kernel before being received by zeek.
*/
bool l3_checksummed;
private:
// Calculate layer 2 attributes. Sets
void ProcessLayer2();