mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 02:58:20 +00:00
55 lines
1.1 KiB
C++
55 lines
1.1 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#include "MPLS.h"
|
|
|
|
using namespace zeek::packet_analysis::MPLS;
|
|
|
|
MPLSAnalyzer::MPLSAnalyzer()
|
|
: zeek::packet_analysis::Analyzer("MPLS")
|
|
{
|
|
}
|
|
|
|
bool MPLSAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|
{
|
|
// Skip the MPLS label stack.
|
|
bool end_of_stack = false;
|
|
|
|
while ( ! end_of_stack )
|
|
{
|
|
if ( 4 >= len )
|
|
{
|
|
packet->Weird("truncated_link_header");
|
|
return false;
|
|
}
|
|
|
|
end_of_stack = *(data + 2u) & 0x01;
|
|
data += 4;
|
|
len -= 4;
|
|
}
|
|
|
|
// According to RFC3032 the encapsulated protocol is not encoded.
|
|
// We assume that what remains is IP.
|
|
//TODO: Make that configurable
|
|
if ( sizeof(struct ip) >= len )
|
|
{
|
|
packet->Weird("no_ip_in_mpls_payload");
|
|
return false;
|
|
}
|
|
|
|
auto ip = (const struct ip*)data;
|
|
|
|
if ( ip->ip_v == 4 )
|
|
packet->l3_proto = L3_IPV4;
|
|
else if ( ip->ip_v == 6 )
|
|
packet->l3_proto = L3_IPV6;
|
|
else
|
|
{
|
|
// Neither IPv4 nor IPv6.
|
|
packet->Weird("no_ip_in_mpls_payload");
|
|
return false;
|
|
}
|
|
|
|
packet->hdr_size = (data - packet->data);
|
|
packet->session_analysis = true;
|
|
return true;
|
|
}
|