mirror of
https://github.com/wader/fq.git
synced 2024-11-29 23:27:12 +03:00
tcp: Ignore TCP option check for now as it seems unreliable in dumps
For example MSS can be to small in local dumps
This commit is contained in:
parent
a2cdb3d6c9
commit
1eb5e502af
@ -30,7 +30,7 @@ type TCPConnection struct {
|
||||
Client TCPDirection
|
||||
Server TCPDirection
|
||||
tcpState *reassembly.TCPSimpleFSM
|
||||
optChecker reassembly.TCPOptionCheck
|
||||
optChecker *reassembly.TCPOptionCheck
|
||||
net gopacket.Flow
|
||||
transport gopacket.Flow
|
||||
}
|
||||
@ -41,10 +41,12 @@ func (t *TCPConnection) Accept(tcp *layers.TCP, ci gopacket.CaptureInfo, dir rea
|
||||
// TODO: handle err?
|
||||
return false
|
||||
}
|
||||
// has ok options?
|
||||
if err := t.optChecker.Accept(tcp, ci, dir, nextSeq, start); err != nil {
|
||||
// TODO: handle err?
|
||||
return false
|
||||
if t.optChecker != nil {
|
||||
// has ok options?
|
||||
if err := t.optChecker.Accept(tcp, ci, dir, nextSeq, start); err != nil {
|
||||
// TODO: handle err?
|
||||
return false
|
||||
}
|
||||
}
|
||||
// TODO: checksum?
|
||||
|
||||
@ -127,10 +129,14 @@ func (fd *Decoder) New(net, transport gopacket.Flow, tcp *layers.TCP, ac reassem
|
||||
Buffer: &bytes.Buffer{},
|
||||
},
|
||||
|
||||
net: net,
|
||||
transport: transport,
|
||||
tcpState: reassembly.NewTCPSimpleFSM(fsmOptions),
|
||||
optChecker: reassembly.NewTCPOptionCheck(),
|
||||
net: net,
|
||||
transport: transport,
|
||||
tcpState: reassembly.NewTCPSimpleFSM(fsmOptions),
|
||||
}
|
||||
|
||||
if fd.Options.CheckTCPOptions {
|
||||
c := reassembly.NewTCPOptionCheck()
|
||||
stream.optChecker = &c
|
||||
}
|
||||
|
||||
fd.TCPConnections = append(fd.TCPConnections, stream)
|
||||
@ -139,6 +145,8 @@ func (fd *Decoder) New(net, transport gopacket.Flow, tcp *layers.TCP, ac reassem
|
||||
}
|
||||
|
||||
type Decoder struct {
|
||||
Options DecoderOptions
|
||||
|
||||
TCPConnections []*TCPConnection
|
||||
IPV4Reassembled []IPV4Reassembled
|
||||
|
||||
@ -146,8 +154,14 @@ type Decoder struct {
|
||||
tcpAssembler *reassembly.Assembler
|
||||
}
|
||||
|
||||
func New() *Decoder {
|
||||
flowDecoder := &Decoder{}
|
||||
type DecoderOptions struct {
|
||||
CheckTCPOptions bool
|
||||
}
|
||||
|
||||
func New(options DecoderOptions) *Decoder {
|
||||
flowDecoder := &Decoder{
|
||||
Options: options,
|
||||
}
|
||||
streamPool := reassembly.NewStreamPool(flowDecoder)
|
||||
tcpAssembler := reassembly.NewAssembler(streamPool)
|
||||
flowDecoder.tcpAssembler = tcpAssembler
|
||||
|
@ -90,7 +90,7 @@ func decodePcap(d *decode.D, _ any) any {
|
||||
})
|
||||
|
||||
d.Endian = endian
|
||||
fd := flowsdecoder.New()
|
||||
fd := flowsdecoder.New(flowsdecoder.DecoderOptions{CheckTCPOptions: false})
|
||||
|
||||
d.FieldArray("packets", func(d *decode.D) {
|
||||
for !d.End() {
|
||||
|
@ -364,7 +364,7 @@ type decodeContext struct {
|
||||
func decodePcapng(d *decode.D, _ any) any {
|
||||
sectionHeaders := 0
|
||||
for !d.End() {
|
||||
fd := flowsdecoder.New()
|
||||
fd := flowsdecoder.New(flowsdecoder.DecoderOptions{CheckTCPOptions: false})
|
||||
dc := decodeContext{
|
||||
interfaceTypes: map[int]int{},
|
||||
flowDecoder: fd,
|
||||
|
19
format/pcap/testdata/sll2_tcp_mss_wrong.fqtest
vendored
Normal file
19
format/pcap/testdata/sll2_tcp_mss_wrong.fqtest
vendored
Normal file
@ -0,0 +1,19 @@
|
||||
# test that fq ignores tcp mss option that is too small as it seems to be unreliable when dumping packets
|
||||
$ fq -d pcap '.tcp_connections | dv' sll2_tcp_mss_wrong.pcap
|
||||
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.tcp_connections[0:1]: 0x1e5-NA (0)
|
||||
| | | [0]{}: tcp_connection 0x1e5-NA (0)
|
||||
| | | client{}: 0x1e5-NA (0)
|
||||
| | | ip: "127.0.0.1" 0x1e5-NA (0)
|
||||
| | | port: 47174 0x1e5-NA (0)
|
||||
| | | has_start: true 0x1e5-NA (0)
|
||||
| | | has_end: false 0x1e5-NA (0)
|
||||
| | | skipped_bytes: 0 0x1e5-NA (0)
|
||||
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|
|
||||
0x0|74 65 73 74 0a| |test.| | stream: raw bits 0x0-0x4.7 (5)
|
||||
| | | server{}: 0x1e5-NA (0)
|
||||
| | | ip: "127.0.0.1" 0x1e5-NA (0)
|
||||
| | | port: 1234 0x1e5-NA (0)
|
||||
| | | has_start: true 0x1e5-NA (0)
|
||||
| | | has_end: false 0x1e5-NA (0)
|
||||
| | | skipped_bytes: 0 0x1e5-NA (0)
|
||||
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef| stream: raw bits 0x0-NA (0)
|
BIN
format/pcap/testdata/sll2_tcp_mss_wrong.pcap
vendored
Normal file
BIN
format/pcap/testdata/sll2_tcp_mss_wrong.pcap
vendored
Normal file
Binary file not shown.
Loading…
Reference in New Issue
Block a user