Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Remove workaround for tunnels from IEEE 802.11 analyzer

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-04-24 14:43:44 -07:00 • committed by Tim Wojtulewicz
parent 934207c05b
commit f62f8e5cc9
7 changed files with 121 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/packet_analysis/protocol/gre/GRE.cc
View file

@ -149,6 +149,23 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
return false;
}
}
else if ( ((proto_typ & 0x8200) == 0x8200 && (proto_typ & 0x0F) == 0) ||
((proto_typ & 0x8300) == 0x8300 && (proto_typ & 0x0F) == 0 &&
(proto_typ <= 0x8370)) ||
(proto_typ == 0x9000) )
{
// ARUBA: Set gre_link_type to IEEE802.11 so the IPTUNNEL analyzer uses
// that to instantiate the fake tunnel packet, otherwise it'd be using
// DLT_RAW which is not correct for ARUBA.
if ( len <= gre_len )
{
Weird("truncated_GRE", packet);
return false;
}
gre_link_type = DLT_IEEE802_11;
proto = proto_typ;
}
else
{
// Otherwise let the packet analysis forwarding handle it.

14
src/packet_analysis/protocol/ieee802_11/IEEE802_11.cc
View file

@ -172,17 +172,5 @@ bool IEEE802_11Analyzer::HandleInnerPacket(size_t len, const uint8_t* data, Pack
data += 2;
len -= 2;
if ( packet->tunnel_type == BifEnum::Tunnel::NONE )
return ForwardPacket(len, data, packet, protocol);
else
{
// For tunneled packets, reset the packet's protocol based on the one in the LLC header.
// This makes sure that the IP analyzer can process it correctly.
if ( protocol == 0x0800 )
packet->proto = IPPROTO_IPV4;
else if ( protocol == 0x86DD )
packet->proto = IPPROTO_IPV6;
return ForwardPacket(len, data, packet, packet->proto);
}
return ForwardPacket(len, data, packet, protocol);
}