Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Do not forward more than the remaining data to downstream UDP analyzer

Browse source 
This fixes a bug introduced in 2b9de839b0
/ GH-3080, which causes UDP padding to be sent to UDP based analyzers.

Fixes GH-3205.
This commit is contained in:
Johanna Amann 2023-07-27 13:35:41 +01:00
parent bd75d72f3f
commit a391367c36
3 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/packet_analysis/protocol/udp/UDP.cc
View file

@ -226,7 +226,7 @@ void UDPAnalyzer::DeliverPacket(Connection* c, double t, bool is_orig, int remai
ForwardPacket(std::min(len, remaining), data, pkt, ntohs(c->RespPort())); ForwardPacket(std::min(len, remaining), data, pkt, ntohs(c->RespPort()));
// Forward any data through session-analysis, too. // Forward any data through session-analysis, too.
adapter->ForwardPacket(remaining, data, is_orig, -1, ip.get(), pkt->cap_len); adapter->ForwardPacket(std::min(len, remaining), data, is_orig, -1, ip.get(), pkt->cap_len);
} }
bool UDPAnalyzer::ValidateChecksum(const IP_Hdr* ip, const udphdr* up, int len) bool UDPAnalyzer::ValidateChecksum(const IP_Hdr* ip, const udphdr* up, int len)

15
testing/btest/Baseline/core.udp-padding/syslog.log Normal file
View file

@ -0,0 +1,15 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path syslog
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto facility severity message
#types time string addr port addr port enum string string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.229.152.216 39887 192.150.187.42 514 udp UNSPECIFIED UNSPECIFIED X
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.229.152.216 39887 192.150.187.42 514 udp UNSPECIFIED UNSPECIFIED X
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.229.152.216 39887 192.150.187.42 514 udp UNSPECIFIED UNSPECIFIED X
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.229.152.216 39887 192.150.187.42 514 udp UNSPECIFIED UNSPECIFIED X
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 169.229.152.216 39887 192.150.187.42 514 udp UNSPECIFIED UNSPECIFIED X
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/fake-syslog-with-padding.pcap Normal file
View file

Binary file not shown.