Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/fastpath'

Browse source 
* origin/fastpath:
  Improve GeoIP City database support.
  Broxygen init fixes, addresses BIT-1110.
  Fix for packet writing to make it use the global snaplength.
  Fix for traffic with TCP segmentation offloading with IP header len field being set to zero.
This commit is contained in:
Robin Sommer 2014-01-13 01:33:28 -08:00
commit ca55d14f67
6 changed files with 120 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/PktSrc.cc
View file

@ -661,7 +661,7 @@ PktDumper::PktDumper(const char* arg_filename, bool arg_append)
if ( linktype < 0 )
linktype = DLT_EN10MB;
pd = pcap_open_dead(linktype, 8192);
pd = pcap_open_dead(linktype, snaplen);
if ( ! pd )
{
Error("error for pcap_open_dead");

9
src/Sessions.cc
View file

@ -384,6 +384,15 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr,
const struct ip* ip4 = ip_hdr->IP4_Hdr();
uint32 len = ip_hdr->TotalLen();
if ( len == 0 )
{
// TCP segmentation offloading can zero out the ip_len field.
Weird("ip_hdr_len_zero", hdr, pkt, encapsulation);
// Cope with the zero'd out ip_len field by using the caplen.
len = hdr->caplen - hdr_size;
}
if ( hdr->len < len + hdr_size )
{
Weird("truncated_IP", hdr, pkt, encapsulation);

80
src/bro.bif
View file

@ -3443,9 +3443,59 @@ static GeoIP* open_geoip_db(GeoIPDBTypes type)
if ( GeoIP_db_avail(type) )
geoip = GeoIP_open_type(type, GEOIP_MEMORY_CACHE);
return geoip;
}
static GeoIP* open_geoip_city_db()
{
GeoIP* geoip = open_geoip_db(GEOIP_CITY_EDITION_REV0);
if ( ! geoip )
reporter->Info("Failed to open GeoIP database: %s",
GeoIPDBFileName[type]);
geoip = open_geoip_db(GEOIP_CITY_EDITION_REV1);
if ( ! geoip )
{
string rev0_path = GeoIPDBFileName[GEOIP_CITY_EDITION_REV0];
string rev1_path = GeoIPDBFileName[GEOIP_CITY_EDITION_REV1];
string db_path = rev0_path;
// Maybe in the future the revisions won't share a common default path.
if ( rev0_path != rev1_path )
db_path = rev0_path + " or " + rev1_path;
reporter->Info("Failed to open GeoIP City database: %s",
db_path.c_str());
}
return geoip;
}
static GeoIP* open_geoip_city_db_v6()
{
GeoIP* geoip = 0;
// Both city edition revisions for IPv6 show up in libGeoIP 1.4.7.
#ifdef HAVE_GEOIP_CITY_EDITION_REV0_V6
geoip = open_geoip_db(GEOIP_CITY_EDITION_REV0_V6);
if ( ! geoip )
geoip = open_geoip_db(GEOIP_CITY_EDITION_REV1_V6);
if ( ! geoip )
{
string rev0_path = GeoIPDBFileName[GEOIP_CITY_EDITION_REV0_V6];
string rev1_path = GeoIPDBFileName[GEOIP_CITY_EDITION_REV1_V6];
string db_path = rev0_path;
// Maybe in the future the revisions won't share a common default path.
if ( rev0_path != rev1_path )
db_path = rev0_path + " or " + rev1_path;
reporter->Info("Failed to open GeoIP Cityv6 database: %s",
db_path.c_str());
}
#endif
return geoip;
}
@ -3476,31 +3526,41 @@ function lookup_location%(a: addr%) : geo_location
if ( ! geoip_initialized )
{
geoip_initialized = true;
geoip = open_geoip_db(GEOIP_CITY_EDITION_REV0);
geoip = open_geoip_city_db();
if ( ! geoip )
{
geoip = open_geoip_db(GEOIP_COUNTRY_EDITION);
string db_path = GeoIPDBFileName[GEOIP_COUNTRY_EDITION];
if ( ! geoip )
builtin_error("Can't initialize GeoIP City/Country database");
builtin_error(fmt("Failed fall back to GeoIP Country "
"database: %s",
GeoIPDBFileName[GEOIP_COUNTRY_EDITION]));
else
reporter->Info("Fell back to GeoIP Country database");
}
else
have_city_db = true;
#ifdef HAVE_GEOIP_CITY_EDITION_REV0_V6
geoip_v6 = open_geoip_db(GEOIP_CITY_EDITION_REV0_V6);
geoip_v6 = open_geoip_city_db_v6();
if ( geoip_v6 )
have_cityv6_db = true;
#endif
#ifdef HAVE_GEOIP_COUNTRY_EDITION_V6
if ( ! geoip_v6 )
{
geoip_v6 = open_geoip_db(GEOIP_COUNTRY_EDITION_V6);
if ( ! geoip_v6 )
reporter->Info("Failed to open GeoIPv6 Country database: %s",
GeoIPDBFileName[GEOIP_COUNTRY_EDITION_V6]);
}
#endif
if ( ! geoip_v6 )
builtin_error("Can't initialize GeoIPv6 City/Country database");
builtin_error("Can't open GeoIPv6 City/Country database");
}
#ifdef HAVE_GEOIP_COUNTRY_EDITION_V6
@ -3592,8 +3652,10 @@ function lookup_asn%(a: addr%) : count
{
geoip_asn_initialized = true;
geoip_asn = open_geoip_db(GEOIP_ASNUM_EDITION);
if ( ! geoip_asn )
builtin_error("Can't initialize GeoIP ASNUM database");
builtin_error(fmt("Can't open GeoIP ASNUM database: %s",
GeoIPDBFileName[GEOIP_ASNUM_EDITION]));
}
if ( geoip_asn )

8
src/broxygen/Manager.cc
View file

@ -35,8 +35,12 @@ Manager::Manager(const string& arg_config, const string& bro_command)
if ( getenv("BRO_DISABLE_BROXYGEN") )
disabled = true;
const char* path = getenv("PATH");
string path_to_bro = path ? find_file(bro_command, path): "";
if ( disabled )
return;
const char* env_path = getenv("PATH");
string path = env_path ? string(env_path) + ":." : ".";
string path_to_bro = find_file(bro_command, path);
struct stat s;
if ( path_to_bro.empty() || stat(path_to_bro.c_str(), &s) < 0 )