From 2b9de839b0948c7de3eb5ed4a397194f96aae6b5 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Mon, 22 May 2023 13:20:52 +0200 Subject: [PATCH] UDP: Forward any remaining data (also empty) to session-analysis The protocol analyzers are prepared to receive truncated data and this way we give analyzers a chance to look at data. We previously allowed empty data being passed: When len ended up 0 and remaining was 0 too. --- src/packet_analysis/protocol/udp/UDP.cc | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/packet_analysis/protocol/udp/UDP.cc b/src/packet_analysis/protocol/udp/UDP.cc index 046e5a2e32..1200cd2f49 100644 --- a/src/packet_analysis/protocol/udp/UDP.cc +++ b/src/packet_analysis/protocol/udp/UDP.cc @@ -225,9 +225,8 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai // detection has to be used. ForwardPacket(std::min(len, remaining), data, pkt, ntohs(c->RespPort())); - // Also try sending it into session analysis. - if ( remaining >= len ) - adapter->ForwardPacket(len, data, is_orig, -1, ip.get(), remaining); + // Forward any data through session-analysis, too. + adapter->ForwardPacket(remaining, data, is_orig, -1, ip.get(), pkt->cap_len); } bool UDPAnalyzer::ValidateChecksum(const IP_Hdr* ip, const udphdr* up, int len)