Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 17:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix tcp_option event

Browse source 
It was not being raised in all the cases it should have been due to
an incorrect/unnecessary truncation check.
This commit is contained in:
Jon Siwek 2019-10-03 17:55:07 -07:00
parent 8ba19cd7d1
commit 222e3ad3ea
4 changed files with 24 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/analyzer/protocol/tcp/TCP.cc
View file

@ -1186,8 +1186,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
GeneratePacketEvent(rel_seq, rel_ack, data, len, caplen, is_orig, GeneratePacketEvent(rel_seq, rel_ack, data, len, caplen, is_orig,
flags); flags);
if ( tcp_option && tcp_hdr_len > sizeof(*tp) && if ( tcp_option && tcp_hdr_len > sizeof(*tp) )
tcp_hdr_len <= uint32_t(caplen) )
ParseTCPOptions(tp, TCPOptionEvent, this, is_orig, 0); ParseTCPOptions(tp, TCPOptionEvent, this, is_orig, 0);
if ( DEBUG_tcp_data_sent ) if ( DEBUG_tcp_data_sent )

16
testing/btest/Baseline/core.tcp.options/out Normal file
View file

@ -0,0 +1,16 @@
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 2, 4
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 4, 2
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 8, 10
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 1, 1
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 3, 3
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], F, 2, 4
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], F, 4, 2
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], F, 8, 10
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], F, 1, 1
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], F, 3, 3
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 1, 1
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 1, 1
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 8, 10
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 1, 1
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 1, 1
[orig_h=192.168.1.102, orig_p=36861/tcp, resp_h=193.1.193.64, resp_p=80/tcp], T, 8, 10

BIN
testing/btest/Traces/tcp/options.pcap Normal file
View file

Binary file not shown.

7
testing/btest/core/tcp/options.zeek Normal file
View file

@ -0,0 +1,7 @@
# @TEST-EXEC: zeek -b -r $TRACES/tcp/options.pcap %INPUT > out
# @TEST-EXEC: btest-diff out
event tcp_option(c: connection, is_orig: bool, opt: count, optlen: count)
{
print c$id, is_orig, opt, optlen;
}