Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

UDP: Forward any remaining data (also empty) to session-analysis

Browse source 
The protocol analyzers are prepared to receive truncated data and
this way we give analyzers a chance to look at data. We previously
allowed empty data being passed: When len ended up 0 and remaining
was 0 too.
This commit is contained in:
Arne Welzel 2023-05-22 13:20:52 +02:00
parent 5654f81dee
commit 2b9de839b0
1 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/packet_analysis/protocol/udp/UDP.cc
View file

@ -225,9 +225,8 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
// detection has to be used. // detection has to be used.
ForwardPacket(std::min(len, remaining), data, pkt, ntohs(c->RespPort())); ForwardPacket(std::min(len, remaining), data, pkt, ntohs(c->RespPort()));
// Also try sending it into session analysis. // Forward any data through session-analysis, too.
if ( remaining >= len ) adapter->ForwardPacket(remaining, data, is_orig, -1, ip.get(), pkt->cap_len);
adapter->ForwardPacket(len, data, is_orig, -1, ip.get(), remaining);
} }
bool UDPAnalyzer::ValidateChecksum(const IP_Hdr* ip, const udphdr* up, int len) bool UDPAnalyzer::ValidateChecksum(const IP_Hdr* ip, const udphdr* up, int len)