Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Adding a weird for when truncated packets lead TCP reassembly to

Browse source 
ignore content.

(Private test suite has a bunch of test cases.)
This commit is contained in:
Robin Sommer 2015-07-03 10:40:21 -07:00
parent de3932bc42
commit 85b433b13f
3 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
CHANGES
View file

@ -1,4 +1,9 @@
2.4-20 | 2015-07-03 10:40:21 -0700
* Adding a weird for when truncated packets lead TCP reassembly to
ignore content. (Robin Sommer)
2.4-19 | 2015-07-03 09:04:54 -0700 2.4-19 | 2015-07-03 09:04:54 -0700
* A set of tests exercising IP defragmentation and TCP reassembly. * A set of tests exercising IP defragmentation and TCP reassembly.

2
VERSION
View file

@ -1 +1 @@
2.4-19 2.4-20

9
src/analyzer/protocol/tcp/TCP_Endpoint.cc
View file

@ -201,8 +201,13 @@ int TCP_Endpoint::DataSent(double t, uint64 seq, int len, int caplen,
{ {
int status = 0; int status = 0;
if ( contents_processor && caplen >= len ) if ( contents_processor )
status = contents_processor->DataSent(t, seq, len, data); {
if ( caplen >= len )
status = contents_processor->DataSent(t, seq, len, data);
else
TCP()->Weird("truncated_tcp_payload");
}
if ( caplen <= 0 ) if ( caplen <= 0 )
return status; return status;