Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

PPPoE: add session id logging

Browse source 
This adds a new PacketAnalyzer::PPPoE::session_id bif, which extracts
the PPPoE session ID from the current packet.

Furthermore, a new policy script is added which adds the pppoe session
id to the connection log.

Related to GH-4602
This commit is contained in:
Johanna Amann 2025-07-02 17:14:18 +01:00
parent 55cdb707e9
commit e5a434c392
10 changed files with 72 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/packet_analysis/protocol/pppoe/CMakeLists.txt
View file

@ -1,3 +1,4 @@
zeek_add_plugin(
PacketAnalyzer PPPoE
SOURCES PPPoE.cc Plugin.cc)
Zeek PPPoE
SOURCES PPPoE.cc Plugin.cc
BIFS functions.bif)

22
src/packet_analysis/protocol/pppoe/functions.bif Normal file
View file

@ -0,0 +1,22 @@
module PacketAnalyzer::PPPoE;
%%{
#include "zeek/packet_analysis/Manager.h"
%%}
## Returns the PPPoE Session ID of the current packet, if present.
##
## If no PPPoE Session ID is present, 0xFFFFFFFF is returned, which
## is out of range of the session ID.
##
## Returns: The PPPoE session ID if present, 0xFFFFFFFF otherwise.
function session_id%(%): count
%{
static const auto& analyzer = zeek::packet_mgr->GetAnalyzer("PPPoE");
auto spans = zeek::packet_mgr->GetAnalyzerData(analyzer);
if ( spans.size() == 0 || spans[0].size() <=8 )
return zeek::val_mgr->Count(0xFFFFFFFF);
return zeek::val_mgr->Count((spans[0][2] << 8u) + spans[0][3]);
%}