Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 02:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Adding a weird for when truncated packets lead TCP reassembly to

Browse source 
ignore content.

(Private test suite has a bunch of test cases.)
This commit is contained in:
Robin Sommer 2015-07-03 10:40:21 -07:00
parent de3932bc42
commit 85b433b13f
3 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/analyzer/protocol/tcp/TCP_Endpoint.cc
View file

@ -201,13 +201,18 @@ int TCP_Endpoint::DataSent(double t, uint64 seq, int len, int caplen,
{
int status = 0;
if ( contents_processor && caplen >= len )
status = contents_processor->DataSent(t, seq, len, data);
if ( contents_processor )
{
if ( caplen >= len )
status = contents_processor->DataSent(t, seq, len, data);
else
TCP()->Weird("truncated_tcp_payload");
}
if ( caplen <= 0 )
return status;
if ( contents_file && ! contents_processor &&
if ( contents_file && ! contents_processor &&
seq + len > contents_start_seq )
{
int64 under_seq = contents_start_seq - seq;