Improve handling of IPv6 Routing Type 0 headers.

- For RH0 headers with non-zero segments left, a "routing0_segleft"
  flow_weird event is raised (with a destination indicating the last
  address in the routing header), and an "rh0_segleft" event can also
  be handled if the other contents of the packet header are of interest.
  No further analysis is done as the complexity required to correctly
  identify destination endpoints of connections doesn't seem worth it
  as RH0 has been deprecated by RFC 5095.

- For RH0 headers without any segments left, a "routing0_header"
  flow_weird event is raised, but further analysis still occurs
  as normal.
This commit is contained in:
Jon Siwek 2012-03-28 13:49:28 -05:00
parent d889f14638
commit 256cd592a7
12 changed files with 93 additions and 4 deletions

View file

@ -305,6 +305,24 @@ void IPv6_Hdr_Chain::Init(const struct ip6_hdr* ip6, bool set_next, uint16 next)
chain.push_back(p);
// RFC 5095 deprecates routing type 0 headers, so raise weirds for that
if ( current_type == IPPROTO_ROUTING &&
((const struct ip6_rthdr*)hdrs)->ip6r_type == 0 )
{
IPAddr src(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_src);
if ( ((const struct ip6_rthdr*)hdrs)->ip6r_segleft > 0 )
{
const in6_addr* a = (const in6_addr*)(hdrs+len-16);
reporter->Weird(src, *a, "routing0_segleft");
}
else
{
IPAddr dst(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_dst);
reporter->Weird(src, dst, "routing0_header");
}
}
hdrs += len;
length += len;
} while ( current_type != IPPROTO_FRAGMENT &&