mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 12:38:20 +00:00
Improve handling of IPv6 Routing Type 0 headers.
- For RH0 headers with non-zero segments left, a "routing0_segleft" flow_weird event is raised (with a destination indicating the last address in the routing header), and an "rh0_segleft" event can also be handled if the other contents of the packet header are of interest. No further analysis is done as the complexity required to correctly identify destination endpoints of connections doesn't seem worth it as RH0 has been deprecated by RFC 5095. - For RH0 headers without any segments left, a "routing0_header" flow_weird event is raised, but further analysis still occurs as normal.
This commit is contained in:
parent
d889f14638
commit
256cd592a7
12 changed files with 93 additions and 4 deletions
18
src/IP.cc
18
src/IP.cc
|
@ -305,6 +305,24 @@ void IPv6_Hdr_Chain::Init(const struct ip6_hdr* ip6, bool set_next, uint16 next)
|
|||
|
||||
chain.push_back(p);
|
||||
|
||||
// RFC 5095 deprecates routing type 0 headers, so raise weirds for that
|
||||
if ( current_type == IPPROTO_ROUTING &&
|
||||
((const struct ip6_rthdr*)hdrs)->ip6r_type == 0 )
|
||||
{
|
||||
IPAddr src(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_src);
|
||||
|
||||
if ( ((const struct ip6_rthdr*)hdrs)->ip6r_segleft > 0 )
|
||||
{
|
||||
const in6_addr* a = (const in6_addr*)(hdrs+len-16);
|
||||
reporter->Weird(src, *a, "routing0_segleft");
|
||||
}
|
||||
else
|
||||
{
|
||||
IPAddr dst(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_dst);
|
||||
reporter->Weird(src, dst, "routing0_header");
|
||||
}
|
||||
}
|
||||
|
||||
hdrs += len;
|
||||
length += len;
|
||||
} while ( current_type != IPPROTO_FRAGMENT &&
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue