Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/johanna/bit-1463'

Browse source 
* origin/topic/johanna/bit-1463:
  Refactor oob tests using different approach.
  Add a number of out_of_bound checks to Packet.cc

BIT-1463 #merged
This commit is contained in:
Robin Sommer 2015-08-31 14:35:49 -07:00
commit 0494a6d882
4 changed files with 64 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

48
src/iosource/Packet.cc
View file

@ -47,6 +47,12 @@ void Packet::Init(int arg_link_type, struct timeval *arg_ts, uint32 arg_caplen,
l2_valid = false;
if ( data && cap_len < hdr_size )
{
Weird("truncated_link_header");
return;
}
if ( data )
ProcessLayer2();
}
@ -94,6 +100,7 @@ void Packet::ProcessLayer2()
bool have_mpls = false;
const u_char* pdata = data;
const u_char* end_of_data = data + cap_len;
switch ( link_type ) {
case DLT_NULL:
@ -140,6 +147,12 @@ void Packet::ProcessLayer2()
// 802.1q / 802.1ad
case 0x8100:
case 0x9100:
if ( pdata + 4 >= end_of_data )
{
Weird("truncated_link_header");
return;
}
vlan = ((pdata[0] << 8) + pdata[1]) & 0xfff;
protocol = ((pdata[2] << 8) + pdata[3]);
pdata += 4; // Skip the vlan header
@ -154,6 +167,12 @@ void Packet::ProcessLayer2()
// Check for double-tagged (802.1ad)
if ( protocol == 0x8100 || protocol == 0x9100 )
{
if ( pdata + 4 >= end_of_data )
{
Weird("truncated_link_header");
return;
}
inner_vlan = ((pdata[0] << 8) + pdata[1]) & 0xfff;
protocol = ((pdata[2] << 8) + pdata[3]);
pdata += 4; // Skip the vlan header
@ -164,6 +183,12 @@ void Packet::ProcessLayer2()
// PPPoE carried over the ethernet frame.
case 0x8864:
if ( pdata + 8 >= end_of_data )
{
Weird("truncated_link_header");
return;
}
protocol = (pdata[6] << 8) + pdata[7];
pdata += 8; // Skip the PPPoE session and PPP header
@ -230,6 +255,12 @@ void Packet::ProcessLayer2()
{
// Assume we're pointing at IP. Just figure out which version.
pdata += GetLinkHeaderSize(link_type);
if ( pdata + sizeof(struct ip) >= end_of_data )
{
Weird("truncated_link_header");
return;
}
const struct ip* ip = (const struct ip *)pdata;
if ( ip->ip_v == 4 )
@ -254,18 +285,18 @@ void Packet::ProcessLayer2()
while ( ! end_of_stack )
{
end_of_stack = *(pdata + 2) & 0x01;
pdata += 4;
if ( pdata >= pdata + cap_len )
if ( pdata + 4 >= end_of_data )
{
Weird("no_mpls_payload");
Weird("truncated_link_header");
return;
}
end_of_stack = *(pdata + 2) & 0x01;
pdata += 4;
}
// We assume that what remains is IP
if ( pdata + sizeof(struct ip) >= data + cap_len )
if ( pdata + sizeof(struct ip) >= end_of_data )
{
Weird("no_ip_in_mpls_payload");
return;
@ -288,13 +319,14 @@ void Packet::ProcessLayer2()
else if ( encap_hdr_size )
{
// Blanket encapsulation. We assume that what remains is IP.
pdata += encap_hdr_size;
if ( pdata + sizeof(struct ip) >= data + cap_len )
if ( pdata + encap_hdr_size + sizeof(struct ip) >= end_of_data )
{
Weird("no_ip_left_after_encap");
return;
}
pdata += encap_hdr_size;
const struct ip* ip = (const struct ip *)pdata;
if ( ip->ip_v == 4 )