Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/vlad/gh-1225'

Browse source 
* origin/topic/vlad/gh-1225:
  Extract length as a uint8
  Change ICMP ND length to a uint16
This commit is contained in:
Jon Siwek 2020-10-16 10:34:53 -07:00
commit 5e164469f3
6 changed files with 25 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
CHANGES
View file

@ -1,4 +1,11 @@
3.3.0-dev.454 | 2020-10-16 10:34:53 -0700
* Change ICMP Neighbor Discovery option length storage to a uint16 (Vlad Grigorescu)
This fixes an overflow in the calculation of option lengths in
ICMP Neighbor Discovery messages.
3.3.0-dev.451 | 2020-10-16 07:09:43 +0000
* Make event ordering deterministic

2
VERSION
View file

@ -1 +1 @@
3.3.0-dev.451
3.3.0-dev.454

2
src/analyzer/protocol/icmp/ICMP.cc
View file

@ -764,7 +764,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
}
uint8_t type = *((const uint8_t*)data);
uint8_t length = *((const uint8_t*)(data + 1));
uint16_t length = *((const uint8_t*)(data + 1));
if ( length == 0 )
{

2
testing/btest/Baseline/scripts.base.protocols.icmp.dnssl/.stdout Normal file
View file

@ -0,0 +1,2 @@
dnssl len 32 payload 254
dnssl len 33 payload 262

BIN
testing/btest/Traces/icmp_nd_dnssl.trace Normal file
View file

Binary file not shown.

14
testing/btest/scripts/base/protocols/icmp/dnssl.zeek Normal file
View file

@ -0,0 +1,14 @@
# @TEST-EXEC: zeek -b -C -r $TRACES/icmp_nd_dnssl.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/conn
event icmp_router_advertisement(c: connection, icmp: icmp_conn, cur_hop_limit: count, managed: bool, other: bool, home_agent: bool,
pref: count, proxy: bool, rsv: count, router_lifetime: interval, reachable_time: interval,
retrans_timer: interval, options: icmp6_nd_options ){
for (i in options){
if(options[i]$otype==31){
print fmt("dnssl len %d payload %d",options[i]$len,|options[i]$payload|);
}
}
}