From 940e3afab48507348cbf7cc800042926c4ccb2f6 Mon Sep 17 00:00:00 2001 From: Johanna Amann Date: Wed, 2 Aug 2023 17:17:01 +0100 Subject: [PATCH] Do not forward padding to downstream TCP packet analyzer This is similar to GH-3206. There do not seem to be practical consequences - but we should still fix it. This also includes the udp-testcase that was forgotten in GH-3206. --- src/packet_analysis/protocol/tcp/TCP.cc | 4 ++-- testing/btest/Baseline/core.tcp-padding/conn.log | 11 +++++++++++ testing/btest/Baseline/core.tcp-padding/http.log | 11 +++++++++++ testing/btest/Traces/tcp-http-with-padding.pcap | Bin 0 -> 2305 bytes testing/btest/core/tcp-padding.zeek | 6 ++++++ testing/btest/core/udp-padding.zeek | 5 +++++ 6 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 testing/btest/Baseline/core.tcp-padding/conn.log create mode 100644 testing/btest/Baseline/core.tcp-padding/http.log create mode 100644 testing/btest/Traces/tcp-http-with-padding.pcap create mode 100644 testing/btest/core/tcp-padding.zeek create mode 100644 testing/btest/core/udp-padding.zeek diff --git a/src/packet_analysis/protocol/tcp/TCP.cc b/src/packet_analysis/protocol/tcp/TCP.cc index 7df5236048..46fda5e250 100644 --- a/src/packet_analysis/protocol/tcp/TCP.cc +++ b/src/packet_analysis/protocol/tcp/TCP.cc @@ -130,8 +130,8 @@ void TCPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai // Call DeliverPacket on the adapter directly here. Normally we'd call ForwardPacket // but this adapter does some other things in its DeliverPacket with the packet children // analyzers. - adapter->DeliverPacket(remaining, data, is_orig, adapter->LastRelDataSeq(), ip.get(), - pkt->cap_len); + adapter->DeliverPacket(std::min(len, remaining), data, is_orig, adapter->LastRelDataSeq(), + ip.get(), pkt->cap_len); } const struct tcphdr* TCPAnalyzer::ExtractTCP_Header(const u_char*& data, int& len, int& remaining, diff --git a/testing/btest/Baseline/core.tcp-padding/conn.log b/testing/btest/Baseline/core.tcp-padding/conn.log new file mode 100644 index 0000000000..e8e81cfe92 --- /dev/null +++ b/testing/btest/Baseline/core.tcp-padding/conn.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path conn +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents +#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 167.221.30.181 59406 217.207.159.63 27272 tcp http 10.914549 16 191 SF F F 0 ShADadfF 13 704 12 823 - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp-padding/http.log b/testing/btest/Baseline/core.tcp-padding/http.log new file mode 100644 index 0000000000..2d5c08ca2e --- /dev/null +++ b/testing/btest/Baseline/core.tcp-padding/http.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types +#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 167.221.30.181 59406 217.207.159.63 27272 1 GET - / - 1.0 - - 0 6 200 OK - - (empty) - - - - - - Fftt1g15aiP3OV7YTf - - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/tcp-http-with-padding.pcap b/testing/btest/Traces/tcp-http-with-padding.pcap new file mode 100644 index 0000000000000000000000000000000000000000..515512f060aa5fa44ec07bb02c8efae1a44cbaaa GIT binary patch literal 2305 zcmbW3OH30{6ozk0t#x7%M3JI4qbwvw`xqX^Mrn~p5lSIK;sawKVW3D`2o6TvNHhi# zpDSbBAZ$#C3qv$6W@TKMkSGf@ghXU~EZCqX;{rpN@tj)*($3h3O;6HxCg1(efA8Ge z_pc{L&BQ{qm#PwCf-l_zlkJm{OwtISu|l)=ZUy@D4o(Rh>CXh}p8~sVO7FYBJdvapf0>*DPj2R2BIu@N3~0tOPkR z3gsU|e!#k%k8B*{;_yP|=(#g*VT`iJ+m&I-O8L(%W*Z|*71hXxu{KA69J^y8CxD8j zGcR5>FGw*j1NytcEL-l!?~p;lcnZleAkGD?qylJII%3Hxalauk&z5`tjYj;vh{PZw ze*jXG)U{tcR)+1L`IgfDJ80iOm}OGtl>}0jPMXA(--~e|UW;tSsiF1Hl78AYNDe*J zB-K`=R;emNZv!-qrk`qlHP8$sYlg3iD{5;W5VKC1*XCWPN#`Bb)$Wum1DfWe1FM?K z)^1q}Uu|aHY)x}>Ba-uhoW?akUB4K()+D>O+!TQ>0P&dBPAVZ%ES+oV>b&nuajnr@ zFO_Sqxl6Lta?|ZaW)PTZEX%3oX9LUHWXp~mQORBE2jY!an>M~WYcomz$QIp)WLzW^=44EOi$$hztTUjbtU2{A3_mpDY<27nQvakhna` zY+SNllN{WpNjf=MijGrB%NUbRvWiO18AyhcC1cg1;^a_rWP%~f@YG=GwztKxYDz3H zB<7hE>19GvmSVL?#3$VCb$M9M<6#@>>`W8icbV_=u}xjE-Y8Emdt9Y#TurSaIHw*j~ z!5tA|(e(=tfYTX|qqQjbXtalN+Z^i~iEeZH+c6g&J$H5pj=7v+c5NL@BO52} zeExqD?^2>ePgMV(m<^73dSdqObw^#Av}^d=us_Y literal 0 HcmV?d00001 diff --git a/testing/btest/core/tcp-padding.zeek b/testing/btest/core/tcp-padding.zeek new file mode 100644 index 0000000000..0a3625075f --- /dev/null +++ b/testing/btest/core/tcp-padding.zeek @@ -0,0 +1,6 @@ +# Check that data contained in the UDP padding does not make it into protocol analysis + +# @TEST-EXEC: zeek -C -r $TRACES/tcp-http-with-padding.pcap %INPUT >out +# @TEST-EXEC: btest-diff conn.log +# @TEST-EXEC: btest-diff http.log + diff --git a/testing/btest/core/udp-padding.zeek b/testing/btest/core/udp-padding.zeek new file mode 100644 index 0000000000..f3a85f15cd --- /dev/null +++ b/testing/btest/core/udp-padding.zeek @@ -0,0 +1,5 @@ +# Check that data contained in the UDP padding does not make it into protocol analysis + +# @TEST-EXEC: zeek -r $TRACES/fake-syslog-with-padding.pcap %INPUT >out +# @TEST-EXEC: btest-diff syslog.log +