From 7603567782f5735c815ead75b1ecd6953c555f62 Mon Sep 17 00:00:00 2001 From: Johanna Amann Date: Tue, 26 Jul 2016 15:02:11 -0700 Subject: [PATCH] Correct endianness of IP addresses in SNMP. Addresses BIT-1644 --- src/analyzer/protocol/snmp/snmp-analyzer.pac | 2 +- .../.stdout | 30 ++++++++++++++++++ .../scripts.base.protocols.snmp.v1/out4 | 2 +- testing/btest/Traces/snmp/snmpwalk-short.pcap | Bin 0 -> 43259 bytes .../scripts/base/protocols/snmp/snmp-addr.bro | 15 +++++++++ 5 files changed, 47 insertions(+), 2 deletions(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.snmp.snmp-addr/.stdout create mode 100644 testing/btest/Traces/snmp/snmpwalk-short.pcap create mode 100644 testing/btest/scripts/base/protocols/snmp/snmp-addr.bro diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac index 44dce4dbf5..0394dbda61 100644 --- a/src/analyzer/protocol/snmp/snmp-analyzer.pac +++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac @@ -39,7 +39,7 @@ AddrVal* network_address_to_val(const ASN1Encoding* na) const u_char* data = reinterpret_cast(bs.data()); uint32 network_order = extract_uint32(data); - return new AddrVal(network_order); + return new AddrVal(ntohl(network_order)); } Val* asn1_obj_to_val(const ASN1Encoding* obj) diff --git a/testing/btest/Baseline/scripts.base.protocols.snmp.snmp-addr/.stdout b/testing/btest/Baseline/scripts.base.protocols.snmp.snmp-addr/.stdout new file mode 100644 index 0000000000..f21633eb91 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.snmp.snmp-addr/.stdout @@ -0,0 +1,30 @@ +138.68.0.1 +138.68.14.240 +169.254.169.254 +10.46.0.5 +127.0.0.1 +138.68.10.203 +255.255.0.0 +255.0.0.0 +255.255.240.0 +0.0.0.0 +10.46.0.0 +138.68.0.0 +138.68.0.1 +0.0.0.0 +0.0.0.0 +0.0.0.0 +255.255.0.0 +255.255.240.0 +138.68.0.1 +138.68.14.240 +169.254.169.254 +0.0.0.0 +10.46.0.0 +138.68.0.0 +0.0.0.0 +255.255.0.0 +255.255.240.0 +138.68.0.1 +0.0.0.0 +0.0.0.0 diff --git a/testing/btest/Baseline/scripts.base.protocols.snmp.v1/out4 b/testing/btest/Baseline/scripts.base.protocols.snmp.v1/out4 index 0854c7096c..2111edee6f 100644 --- a/testing/btest/Baseline/scripts.base.protocols.snmp.v1/out4 +++ b/testing/btest/Baseline/scripts.base.protocols.snmp.v1/out4 @@ -3,7 +3,7 @@ snmp_trap is_orig: T [community=public] enterprise: 1.3.6.1.4.1.31337.0 - agent: 1.0.0.127 + agent: 127.0.0.1 generic_trap: 0 specific_trap: 0 time_stamp: 0 diff --git a/testing/btest/Traces/snmp/snmpwalk-short.pcap b/testing/btest/Traces/snmp/snmpwalk-short.pcap new file mode 100644 index 0000000000000000000000000000000000000000..90f2a4766477565ced29752bd8b989a5950ce248 GIT binary patch literal 43259 zcma)_2Y41$_Qt=KkVfwo2-ro!03i?(I!Grl^dd+J5J^D@3Kk$LMT~tF>?Rh96%;jb zUF)u0x7gd?-g|dl<$vy(d-L5hbH2myI4ttGyx;Gh_n!C8ojV^dJ-)9l7D+_Rj{^rH zktqDjq4#f}Id*Aw#D!n0D-j*|&A+4Y^LM{SGa{oRk&zed8X6hedgDXeMz;8N+sLeE zFMTmm7jg17IY-B$(M0;nHH*s27T0x-B{FAC8WoF1;2$U3$xKh{ksggj(@?=ZB|GvE z{ORiQ{%lVN74B-NQwr{E^`|S9NF8WgQ}?S=bBQHUUvm!8sCHJRXP`zj8c8gjP*%BS zZSI;yYbvYP^z7HWPsO61tCv>w>FM;&&Ckovb9(me-E&!KW$CK2#koiHbJq8U-^Iw|k=nHn^a5a$O>YKOKInH9KI}A}y)Wg-n$w{JkBX(VRc4Pqvs4FmHQyS`V z#O@;_Ht3~wPG3u;{%9i7$?0H3Vv+PL7`a6B;f#1JOEDc)Au{bjrU$|>jSe!!A|6xc z%IwH2;89nAX7|t z#sp#F8s;xm*^%V{qOJhUoQ9hb<~9OzV%9jP*oNtaFh-=C)78KvB8j#WOLL1WN{5!N zU0AWQyfm+B)w00~uE$Cd?skL&V_1_lh5N<^;Sw6I<*C_`G5}Lo0B&x>EeN-pz>Us3 z)fr^NIS6M&x;wcBE-jL1$IVkkw*iEO(%pe{`@_(U3(}=&x{Fq2M^*!wx&m~i4YwlQ z^@MK9I~5L?uBqSE4@5d6a)NWbp-Yb>x=byrt}d%wmRnVsTfMwAcVyM#6}eSQ@z=u_ zu2Y=9!AB4{??ldf!*Grda;9s}KdQ4MGk{TD0nRZEJCU=IaOOXKu5-N2c{p+!k(N$# z!`TcP{TPLE-Wn0*E=0K}49bKcN;8e}?P($kMwAOZ*9wsQr_Se4jEIGj5g8H1n3{dM zh;lcg>%9rSQR7E+3AS=9R7<; zh}`r{=Jwj=9hnJQ>HGcthk4D;Oy+kNni+d1x#4dfGOfLVbPTv zoZglx>W@TI7?}=EJIfS_^mH^Kmg<`IBGbLd1Y>w`rYS5_!ejbigUE#0;d5Zo@*0lG z$WW#@SXi$t z7cYl@&r|T7E)d}#MEG06z|Z2~<9dIgcWrj$764aQ0DgM|CX73uz@K~B@6I|Kz8v9= z%zS5_1s_XHQt%ZED}lM9w6Z$4tP)0{VqtX|tnrtWE-kApQ@>n|W24smQzyZO!t~Xp zt9mY4xEl5qrj{;Vv#P9mUGBuHC8gy!HV?sv7L4&%9GjcNjLmFzZ1f5yaZz^UEEpGc z1;(bbVZV}bHy`H zIQKE++%pL8l7?yA+&40G?x!W^zQv2PK~4N=BPQpTsZ9zsGjK{E{44OOgknF8@O5F} z=dtj5iPZ1%?8rq>XmtgOy|DqK&^?vFm*-7)7TLv~j>R@Iqn%M!vC|X%nPNA=kDZK- zZ|n$|@5~^)51&pLghy}?ZVWRBC$WQ|*HlGUhz`Kubk~wWSaR=F&H+Y-I-r^CfaxPy z_!r?*3Gk01{0(8?=dDt5x=RUm^+%3#ij92|VjGzfXQG9jnHWNi@1*Bbe=Z#JM~S4y=8c+|f&j2W}T}Fb`a4pf=8S7RSg?oGgtq`3@21 z1;n{549*G`N3RMd-6=jY!#wa+Cx6!q+#@q1lYC@`y0~NaJ*Wr|GGAnBlj3o7xrRv| zhJfGj_O|BSEmj7zz=h^%SLV8>xCM?8Nmd3nRHJI0qi)x8_KKDHC&FA3rZN?Q%Ak&i zbJRW&2eZJ1=4sQtRv~jNb z2Zv*1C{8@)Z4T$%E8_ecaV`pjQ^n%w1+NE<#;_JBjfPm<29$8w;oZF*BW> z_MJp7-bomlHcl(OnpTyGCSv7PsyuIikWilgAkT$icvf;e=Iqti_hm=s0*kr=JQEu* z3|ug^#Z&mnH%>2`r#tc(nRZSaizk*ylvXcy6w#9VMWUCGs5T7IsVtE;+}sC5BFqC9 zd~Fkb$PyVDN)$&Te9YGfQbLVhMxqPC5UpZ~wC6r<5T_7Ef_o_;D%gG(H-(H0nL=@J zT_;tbnnn@l6~x&V24^*gW47b3eo(~0Q1Dr<;EG2%93w+c<>oWj3~IIkkk`C)LX zSsd-R#Se)%7z;kX6tsVnL}PI{S*q%@AC!dI^Ev`;2?KN*2V^!3 zo_<8^*cc2xp#J+F;ySjGAsssri^bC3Qaq)Piac*14?Idac!5r5d9>fE9}{^n7+h#N zR)PB8&GHx-$`dy{KY@@?pEr?bQy8ALERQza=Z}m18e_rtIHs`tBQAlA4C&Wt(cy{6 zjw?5+3T=BrBzg;p&I>~X&jx+B3ea`Z^cGe9-^GrAvEV`;4aEYQoT* z#nGf|ujM}@9#+6qaADA_;uLMJ=Z-ZQndD&w6{N95x;H#({_F!Wp+fH>)5b7NXR}P& za8EreGGQ>dFmyK4xh#{Bp-gejgttK>pA(thL#7R3nAWpQ+I0(`7bg*hgA2{nVk)@c zF|H>V88V5QnVZzlKu0Li`-lSvJq{j18#tV1+ICqlia3}JE_6~G=X@5&$WR=x9^P|r z1RVkA1H^%ccL&GW$l_?n?fj>RgTdfJC$(|5uxmIYLvdgYhh{tEUn0(jh;vpLoEjEK zo2}2kMH~zUUsEX9%HkLqf|Fs)wi9%O>U@MaXNJK!hr`LxX1nV@A`S+FuOAd_W^s%R z#W7|({3Q|RW5j`j5(hWixh#&!)0agYOa>RasBO0M9^qPnk)b%oY^v!cV|ZSEPX);d?dB?5hcKx@JP zZRLQnwB2rdTfFZgF z~<>%3HA8~dEn&T!8<}N%cJe~@CTyZFcy3~1!uAi&d3nEWgELq|4_vF7I9XF z!MTvd(RN$*k%)t_;5(^QaMlKH_81w0lM~gm=Y7x-s`DM6q6$H-8en8um>iHP$(;#7vgxtPV#W^+CjaWE8IXrVUFS{BF1P#j~nCqPH2 z&JT!F5eDZH7Dt=yt2u^cjwzZ#&I6opzc^I5aIh^L&Z1cYm zaWD~F=%6;v=`4u zw$0y&IG6`6G*BC-n#D0P6vvqDC(sdaenp(+VQ{WsakSa~_*TThJaD0b+BmCN93w+< zjM+APC*u5uILpG|T*=~Svu*lb#KAmpp@G^stIy)hW@HFXOJlb94IyuR8`pq&;6eknaZY7%j10vwW?S~7i1Rz*l!n3C!QyDMZT(5a z!8~xGf!a7#ERK<(IL2&;|19GC4{?@+!MTdX(PlgH7xAVP^T35EYT*pn-}F($-C7&F&4}a( zcB_pc4!qcU@btNX#nEU5OFXQTxg*-&Qcb~ z$WR<(w);Rws7@N<%ngH6&*EsaJ(?!sU?RBCLT#L7YdNzS8G_T+n5}ENh?9;ubHd=< z#No8nW;?!_h=YmXLI<^RN?9BuLvf7Rc7u*koo0wLI}FavERHr?U513yh=Jfj1GRA$ zvp7bE;uy2F&lGVo5NB2xoLg8NZMMEyA`a$(@0$S%mYmL+&Bzd(cE)UPfR0d|OvITP z2Ip1|r=2$2r`aM7=79?h)UM7V7RSg?9Amcf91$lAab|?U*~#K)v(0TT;$R-Q&_HdR zlUW=iLvf7R-Ul6_I@yRbJq*q+7Dt=y*A^lU=79?h)W%u3hBKRyAvo=$!@UP1=e87a zau8=)7@XZ4PJ3;(3tNdemOUtD@$tIAk-KF zRg`xLIr3QNeLLM<8cH1x45)c;V;z4;j_^&pjhGGYM1nTxhaTKF?HV!lO}nirT8kQZ zc?Q|;0y%3WDcj`Qw#arOVJptNl#FDZHVW~>b!5a+^g}_H->S79^fH|=R_8RmbwCf(;G26+|dMZ*tPK8&Nkrj2x#;Ua}G&b z1rCm(F%#*^`_ZS=7Q+i5c@oH}D}Y#1+a3`|5yTYk+{d}oNP2uvcgcw?0U>n-_+~U> zn7ANjO}ycIx;q1Gz8=VD#13~3P1?m119#$qSvV=J02g!>E!u&pVG4`h!&$UR(<5A; zn-f_Ibm|Ha&T7PbafcJaksp^h18u^dNNCi$I)^76qtvuT6X|U>Z*b~HC`PB7=+lnK zIFuAIg-`G0d}^tBl-;|F6A@#_g=ufqamW#`a}&|%sfpOs(%?iO`gCYw8?;dccn1gy zF71SXFs#$|I8yXzXQqBBJbEAJ(I!QY@5rOXS%`t;4kLWSYo~Iv(5R_d*wodO zn)c|>#O^$x5UDFbHM;gtq=J5J*)qlZ;ty!5`OQlBVwV%00oafop_vxau}k}Bu|0T5JWNGnLpupvcB`Z%hHHpG$)I z+`BABM15nP_xC0w;*nvo<@1%|}$TBz# z%cDV-EX~rnK(rY4d>>2xN2AOu6j89}`)-HwC+*}=jEIHO9M&#f z)MR-ZRD`M=gD6E|P@V{)G}kDf4ir(a=lfR8`4cyBC`QCWX<@3ezDPtl7EuOc8<$F*Os&X8n6ox_hM-Zi@MtN_Lh=M)eg+6Jc zjA#E=7$ah#v@$5m2a71jBg%jAg z5d}NG3vJRy8MBc?F(MX9TZ2+QLPY6_DE-2qJQGA|t5Ld)BD)Oq?rU-*c6_%lK`DNv zm~7V8dz-aJL~YhK$L-TZyJ$2kFOoJip?+3Pc@L<~f%{^01@4U})aD^lFM>26??Q4Y zug?2omS;7RI+RD%yc^`VP87MY{kwfA*B3W%Ttpl+^BX%cgq49$Qw;c(n_a^{gUm zH8v+Q52~fEK*c82I!M-okPXbc*l}XXZyl~X0{6Y1*JSOTwgEklZQZyW;d{IqF&une zEbM+J_a33qQtuHqxg(}rs5faMZ$c0(rg5RySQCxaG$7Pf#m$Jst1YjZ8_^BdS zKc-?Sxc<#@C5?FFG_f6GptvxC7T4gL3%Pb^lt?>_n|65Mz_&;?YP#sf0wg<%R4j!T z|HFAv>v=W1d4||IFjRbAEbOw5>l{XlbPfz<_z=p7V`hp4>yKDR6RZ>kdxmVmrh%@wu?*)lpnKG)kl$ zCQLiTE}xhyTCfnYx|3R^u;42iizKoZ^Qtv>p4c`pQQTw5^eTR*j%yo6%W50#qfzJ= zk)a9ovvT1ZpeC#i2O`-Kge*nDUJVvZt9e{6og{K$q`2UBt8ElNJ&NNpN|X!QJaDO> z6_-0-sCQVX zqycx7i3Y?Nak~+yfzz+!3}}>y0o59x# zu_~KdWQ?p5oj3}?IufuHPJEwpq9^B7?822q%HIkxOMFf&Y`>H18n#qZE6h+x@Fnt! zs_Us@xlUxLQk3fhu3RYPL5*G|LSdBnY*?7h-fbBr(h4)YR*26&9|0-BgQF3u11VJs zs1I4Fqz8|$7F!`EiO+)rORnHrp;02OFhjROq}mHwLKcrfs&<4bg#ka}4CrZjwR&p} zk@6c5v&4s0*zQ)&fVNbV0W&=V;%Tl0r-`*1%TT4L)yG_|P|Abae7XoVTq(H_B~~9S z%v{Ss86{%COwWJ_)qbrAH4dTLl2WCB`h7rQG*tdMBGhDrYEDX(0_rOkD(S&x=ZdWmlf>u2fhW=@Y5Km{D3Mm!96hM1egG|@ z6;45_Y(ka7fM0V4^t8NM_1YxvePWilFo~^}QS|e>+}@{=vi3eZzxnc-VamV6=1QuEL@Zxx@KV4%2Q4-0MZtygeQO^ld&YSPBr zCPXy)%G3eSTL6tjU4ebVDYerO4t5o-^Q43FE+g%??r407{GEnV?U&KhmfR-3tAV-V zW)Qrgo8sKN8b(gNtI_0=m}g1*g{i%uDEM+Z0;Utd6u$hP^QBhw=;(M#RV;^ zc*9n-<=zJ~TFLjpz$vKZdtIuqRy5}frhX~R`2%N8BkA#tx-chF3Pw>En1v?V%tnkE zH%|CQT;V!})`^4q6VNP1tc!D4(kvjxye#zuhzbs!iG)#7z!VPsk#lHL)MI?*B5?v@ z>bNl5tr`yQb|E(bjhyw^vO_fPIW)PObIQe{KW8BxjHxvNQ~2{I&YxP(W7~9z_#PN$ zkDEr=hV(jvdk@TLCEo)Bf1(z7Q7ZRR(VerI+NE&k&zw7rpmyhF;_Sl&a$|&U*p>g~ zW}gvLv#+U@fmq-*smDQ5@a7!Fx8YAxycFL2h4W@o(j$EHax$EB{*^Rh68XGY^yS-J zpc^?7=m`_(xM{HbFQPH$V(lV?Erl_E<&3GtJg_xah=GnNt_|_}=9na#&27Y>neq$iAEOTxID_nTb1>bENOvbUy_2`} z>Xh&vsl%TgiQu|9xrs338WO8?fjP5w0ha6sQnC?wJ4me7d9nIGO{ZctrLb4H4cF#G zPJz#&t^n=4M$DZlKM~q76Nfm1ZQ9;QYebK5x}|qc(yH65nhiA@6fpcqK6B5#j=XbC zac9+@jJV$s+>v=#k$0}^ymzku(75WI>(t5~Z|U_pk#hJP>I(4AZ^S5?@;%`lxA1po zsLk6Kd5!8(&JpQ{CVBBDPXX7gRJ@AVJdDq{At$mNen(w_hBK#jArgO0h)>MB#woV6 z>w2N~pPIOv(^b^=m~(Fw9gXocZ_9@(ro(xL*e|j&4$=j>gphPT{1Z%{JP*pe;Ch2@-!n3d}pYL>&oJ z#MIG2ZI3zo7BbRw1vIM>)6M7Tk@5AUchqC=Xwp?9ooto(06ytx_+aW$*A`F}>|Bbp zUlCf~&LuHTOB=LL)kEEXYffYtd=zyB8rJMa%sii+M_swjDYBYIeV%F>O`^F@7pqO; z2>{E^n)R@qWQ6I|omIP(scZ@_$2BYUvR~GN9kNU8R2YFiFOTjqfyv$yqpCVpvO9ZE z>+SBWabEyo!N|)H_ft~Z6h=;HTx#T?um}9yZV?zma0*0%b(=XF&YlMs8zn}Uw&nzy zSpB3I8<0hKf@SI+(aXyb_;UiB!pm@AA7?K0vQOBft+-8W%@}}Fz9h6`#&fN?#E8{s@9f4p66&5M-kl+Ot7xOazet=Xv3 z)~rr~LS@Nf0|2pE?YcvB^eIUE5h-vAM>k^~9n|)iufLOww7)fD2>Kj7^7k{j)@*cX zYfe*u_yZlSx1BrRCE9rf(tbi{Q`k9!wX;vvLp|Ol(yzH-`ZKT zJ_oXbm&=*Trtoqm>t(;J2m9Gxu~T9A`Mf;38{3+VDs9ba0WWLZQ}&5Qu0Y)PNoi9U zIg2%NP}l?Bat|41zmYKkr@-3AYRw~mS;raK=u#u68y|bESs$l~+$$Qn5@|mqv?+|7 z%^KOK>Y;YqFB%!s&sW<~TUa9-QEKG$fRS;J;xUjFj9kT3HieOMSR?yoJ=o{(6OD|? WH|1ke*U^WuMmDO{$mxuc