mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
Fixes for IPv6 truncation and ICMP/ICMP6 analysis.
- Add more guards against trying to analyze captured packets with a truncated IPv6 static header or extension header chain. - Add back in the ICMP payload tracking for ICMP "connections". - Fix 'icmp_context' record construction. Some field assignments were mismatched for ICMP and ICMP6. Source and destination addresses were set incorrectly for context packets that don't contain a full IP header. Some fields for ICMP6 weren't filled out. - Changed ICMP Time Exceeded packets to raise the 'icmp_time_exceeded' event instead of 'icmp_error_message'. - Add unit tests for truncation and the main types of ICMP/ICMP6 that have specific events. - Documentation clarifications.
This commit is contained in:
parent
27ba3118c1
commit
51bad73e1e
39 changed files with 422 additions and 52 deletions
|
@ -102,11 +102,13 @@ type icmp_conn: record {
|
|||
## .. bro:see:: icmp_time_exceeded icmp_unreachable
|
||||
type icmp_context: record {
|
||||
id: conn_id; ##< The packet's 4-tuple.
|
||||
len: count; ##< The lenght of the packet's IP header.
|
||||
len: count; ##< The length of the IP packet (headers + payload).
|
||||
proto: count; ##< The packet's transport-layer protocol.
|
||||
frag_offset: count; ##< The packet's fragementation offset.
|
||||
## True if the packet's IP header is fully included in the context. If that is not
|
||||
## the case, the other fields will all be set to null values.
|
||||
## True if the packet's IP header is not fully included in the context
|
||||
## or if there is not enough of the transport header to determine source
|
||||
## and destination ports. If that is the cast, the appropriate fields
|
||||
## of this record will be set to null values.
|
||||
bad_hdr_len: bool;
|
||||
bad_checksum: bool; ##< True if the packet's IP checksum is not correct.
|
||||
MF: bool; ##< True if the packets *more fragements* flag is set.
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue