Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Change ICMP ND length to a uint16

Browse source
This commit is contained in:
Vlad Grigorescu 2020-10-15 16:56:05 -05:00
parent 5f1ee35d31
commit b5d11d1ace
4 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/analyzer/protocol/icmp/ICMP.cc
View file

@ -764,7 +764,7 @@ VectorValPtr ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
}
uint8_t type = *((const uint8_t*)data);
uint8_t length = *((const uint8_t*)(data + 1));
uint16_t length = *((const uint16_t*)(data + 1));
if ( length == 0 )
{

2
testing/btest/Baseline/scripts.base.protocols.icmp.dnssl/.stdout Normal file
View file

@ -0,0 +1,2 @@
dnssl len 32 payload 254
dnssl len 33 payload 262

BIN
testing/btest/Traces/icmp_nd_dnssl.trace Normal file
View file

Binary file not shown.

14
testing/btest/scripts/base/protocols/icmp/dnssl.zeek Normal file
View file

@ -0,0 +1,14 @@
# @TEST-EXEC: zeek -b -C -r $TRACES/icmp_nd_dnssl.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/conn
event icmp_router_advertisement(c: connection, icmp: icmp_conn, cur_hop_limit: count, managed: bool, other: bool, home_agent: bool,
pref: count, proxy: bool, rsv: count, router_lifetime: interval, reachable_time: interval,
retrans_timer: interval, options: icmp6_nd_options ){
for (i in options){
if(options[i]$otype==31){
print fmt("dnssl len %d payload %d",options[i]$len,|options[i]$payload|);
}
}
}