in src/filtration/packet.h [128:168]
inline void check_ipv4() __attribute__((always_inline))
{
if(dlen < sizeof(IPv4Header)) return;
auto header = reinterpret_cast<const IPv4Header*>(data);
if(header->version() != 4) return;
/*
IP packet may be fragmented by NIC or snaplen parameter of libpcap
IP is fragmented AND it is first part of original (offset == 0)
- Ok, pass it.
IP is fragmented AND it is not first part of it (offset != 0)
- DISCARD IT! We do not reassemble fragmented IP packets at all
*/
if(header->is_fragmented_and_not_the_first_part())
{
return; // discard tail of fragmented ip packets
}
const uint32_t ihl = header->ihl();
if(dlen < ihl) return; // truncated packet
if((header->length()) < ihl) return; // incorrect packet
data += ihl;
dlen = (std::min((uint16_t)dlen, header->length())) - ihl; // trunk data to length of IP packet
switch(header->protocol())
{
case ip::NextProtocol::TCP:
check_tcp();
break;
case ip::NextProtocol::UDP:
check_udp();
break;
default:
return;
}
ipv4 = header;
}