Store some additional information in the packet during processing

- Session related to the packet
- is_orig information if a UDP header was found
This commit is contained in:
Tim Wojtulewicz 2021-08-26 10:16:48 -07:00
parent 5f58ce8a5d
commit f93c5a6942
5 changed files with 30 additions and 5 deletions

View file

@ -18,6 +18,7 @@ using pkt_timeval = struct timeval;
#include "zeek/IP.h"
#include "zeek/NetVar.h" // For BifEnum::Tunnel
#include "zeek/TunnelEncapsulation.h"
#include "zeek/session/Session.h"
namespace zeek
{
@ -172,29 +173,35 @@ public:
/**
* (Outermost) VLAN tag if any, else 0.
*/
uint32_t vlan;
uint32_t vlan = 0;
/**
* (Innermost) VLAN tag if any, else 0.
*/
uint32_t inner_vlan;
uint32_t inner_vlan = 0;
/**
* If this packet is related to a connection, this flag denotes whether
* this packet is from the originator of the connection.
*/
bool is_orig = false;
/**
* Indicates whether the layer 2 checksum was validated by the
* hardware/kernel before being received by zeek.
*/
bool l2_checksummed;
bool l2_checksummed = false;
/**
* Indicates whether the layer 3 checksum was validated by the
* hardware/kernel before being received by zeek.
*/
bool l3_checksummed;
bool l3_checksummed = false;
/**
* Indicates whether this packet should be recorded.
*/
mutable bool dump_packet;
mutable bool dump_packet = false;
/**
* Indicates the amount of data to be dumped. If only a header is needed,
@ -255,6 +262,11 @@ public:
*/
bool processed = false;
/**
* The session related to this packet, if one exists.
*/
session::Session* session = nullptr;
private:
// Renders an MAC address into its ASCII representation.
ValPtr FmtEUI48(const u_char* mac) const;