Remove unnecessary assert in ICMP analyzer (addresses #822).

The ICMP/ICMPv6 analyzers function correctly when full packets have
not been captured, but everything up to and including the ICMP header
is there (e.g. the functions that inspect ICMP error message context
correctly check the caplen to see if more info can be extracted).

The "Should have been caught earlier already." comment may have referred
to NetSessions::CheckHeaderTrunc, which works as intended to catch cases
where the ICMP header is not there in full, but then the assert was
still not correctly formulated for that...

Also changed the ICMP checksum calculation to not occur when the full
packet has not been captured, which seems consistent with what the UDP
analysis does.
This commit is contained in:
Jon Siwek 2012-05-29 17:29:11 -05:00
parent 0c5afc59f7
commit 0aecca979e
5 changed files with 22 additions and 3 deletions

View file

@ -22,3 +22,11 @@
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string
1334094648.590126 - - - - - truncated_IP - F bro
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string
1338328954.078361 - - - - - internally_truncated_header - F bro

Binary file not shown.

Binary file not shown.

View file

@ -6,4 +6,17 @@
# @TEST-EXEC: cat weird.log >> output
# @TEST-EXEC: bro -r $TRACES/trunc/ip6-ext-trunc.pcap
# @TEST-EXEC: cat weird.log >> output
# If an ICMP packet's payload is truncated due to too small snaplen,
# the checksum calculation is bypassed (and Bro doesn't crash, of course).
# @TEST-EXEC: rm -f weird.log
# @TEST-EXEC: bro -r $TRACES/trunc/icmp-payload-trunc.pcap
# @TEST-EXEC: test ! -e weird.log
# If an ICMP packet has the ICMP header truncated due to too small snaplen,
# an internally_truncated_header weird gets generated.
# @TEST-EXEC: bro -r $TRACES/trunc/icmp-header-trunc.pcap
# @TEST-EXEC: cat weird.log >> output
# @TEST-EXEC: btest-diff output