mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
Add handling for IPv6 extension header chains (addresses #531)
- The script-layer 'pkt_hdr' type is extended with a new 'ip6' field representing the full IPv6 header chain. - The 'new_packet' event is now raised for IPv6 packets (addresses #523) - A new event called 'ipv6_ext_header' is raised for any IPv6 packet containing extension headers. - A new event called 'esp_packet' is raised for any packets using ESP ('new_packet' and 'ipv6_ext_header' events provide connection info, but that info can't be provided here since the upper-layer payload is encrypted). - The 'unknown_protocol' weird is now raised more reliably when Bro sees a transport protocol or IPv6 extension header it can't handle. (addresses #522) Still need to do IPv6 fragment reassembly and needs more testing.
This commit is contained in:
parent
0639487aad
commit
eb9f686bb2
11 changed files with 724 additions and 110 deletions
|
@ -33,7 +33,7 @@ PacketSortElement::PacketSortElement(PktSrc* arg_src,
|
|||
|
||||
if ( ip_hdr->NextProto() == IPPROTO_TCP &&
|
||||
// Note: can't sort fragmented packets
|
||||
(ip_hdr->FragField() & 0x3fff) == 0 )
|
||||
( ! ip_hdr->IsFragment() ) )
|
||||
{
|
||||
tcp_offset = hdr_size + ip_hdr->HdrLen();
|
||||
if ( caplen >= tcp_offset + sizeof(struct tcphdr) )
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue