Set original/outer packet flags to reflect inner packet results

Propagate inner packet flags such as 'processed', 'dump_packet', 'dump_size' to outer packet for packets involving tunneled data.
bingooyong · Feb 12, 2025 · 0257b6c · 0257b6c
1 parent b7b31eb
commit 0257b6c
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 4 deletions.
diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc
@@ -46,6 +46,7 @@ void Packet::Init(int arg_link_type, pkt_timeval* arg_ts, uint32_t arg_caplen, u
         data = arg_data;
 
     dump_packet = false;
+    dump_size = 0;
 
     time = ts.tv_sec + double(ts.tv_usec) / 1e6;
     eth_type = 0;

diff --git a/src/packet_analysis/protocol/iptunnel/IPTunnel.cc b/src/packet_analysis/protocol/iptunnel/IPTunnel.cc
@@ -78,7 +78,7 @@ bool IPTunnelAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
 /**
  * Handles a packet that contains an IP header directly after the tunnel header.
  */
-bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, const std::shared_ptr<IP_Hdr>& inner,
+bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, Packet* pkt, const std::shared_ptr<IP_Hdr>& inner,
                                                  std::shared_ptr<EncapsulationStack> prev,
                                                  const EncapsulatingConn& ec) {
     uint32_t caplen, len;
@@ -113,13 +113,18 @@ bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, co
     // Forward the packet back to the IP analyzer.
     bool return_val = ForwardPacket(len, data, &p);
 
+    // Propagate the flags from fake inner packet to outer packet
+    pkt->processed = p.processed;
+    pkt->dump_packet = p.dump_packet;
+    pkt->dump_size = ( p.dump_size > 0 ) ? static_cast<int>(data - pkt->data) + p.dump_size : p.dump_size;
+
     return return_val;
 }
 
 /**
  * Handles a packet that contains a physical-layer header after the tunnel header.
  */
-bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, uint32_t caplen, uint32_t len,
+bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, Packet* pkt, uint32_t caplen, uint32_t len,
                                                  const u_char* data, int link_type,
                                                  std::shared_ptr<EncapsulationStack> prev,
                                                  const EncapsulatingConn& ec) {
@@ -145,6 +150,11 @@ bool IPTunnelAnalyzer::ProcessEncapsulatedPacket(double t, const Packet* pkt, ui
     // to the packet manager.
     bool return_val = packet_mgr->ProcessInnerPacket(&p);
 
+    // Propagate the flags from fake inner packet to outer packet
+    pkt->processed = p.processed;
+    pkt->dump_packet = p.dump_packet;
+    pkt->dump_size = ( p.dump_size > 0 ) ? static_cast<int>(data - pkt->data) + p.dump_size : p.dump_size;
+
     return return_val;
 }
 

diff --git a/src/packet_analysis/protocol/iptunnel/IPTunnel.h b/src/packet_analysis/protocol/iptunnel/IPTunnel.h
@@ -37,7 +37,7 @@ class IPTunnelAnalyzer : public Analyzer {
      *        the most-recently found depth of encapsulation.
      * @param ec The most-recently found depth of encapsulation.
      */
-    bool ProcessEncapsulatedPacket(double t, const Packet* pkt, const std::shared_ptr<IP_Hdr>& inner,
+    bool ProcessEncapsulatedPacket(double t, Packet* pkt, const std::shared_ptr<IP_Hdr>& inner,
                                    std::shared_ptr<EncapsulationStack> prev, const EncapsulatingConn& ec);
 
     /**
@@ -56,7 +56,7 @@ class IPTunnelAnalyzer : public Analyzer {
      *        including the most-recently found depth of encapsulation.
      * @param ec The most-recently found depth of encapsulation.
      */
-    bool ProcessEncapsulatedPacket(double t, const Packet* pkt, uint32_t caplen, uint32_t len, const u_char* data,
+    bool ProcessEncapsulatedPacket(double t, Packet* pkt, uint32_t caplen, uint32_t len, const u_char* data,
                                    int link_type, std::shared_ptr<EncapsulationStack> prev,
                                    const EncapsulatingConn& ec);