Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/timw/fix-ip-header-length-checking'

Browse source 
* origin/topic/timw/fix-ip-header-length-checking:
  Fix handling of IP packets with bogus IP header lengths
This commit is contained in:
Tim Wojtulewicz 2021-06-04 08:28:57 -07:00
commit d15fca7e17
5 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/packet_analysis/protocol/ip/IP.cc
View file

@ -235,6 +235,13 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
packet->proto = proto; packet->proto = proto;
// Double check the lengths one more time before forwarding this on.
if ( packet->ip_hdr->TotalLen() < packet->ip_hdr->HdrLen() )
{
Weird("bogus_IP_header_lengths", packet);
return false;
}
switch ( proto ) { switch ( proto ) {
case IPPROTO_NONE: case IPPROTO_NONE:
// If the packet is encapsulated in Teredo, then it was a bubble and // If the packet is encapsulated in Teredo, then it was a bubble and

12
testing/btest/Baseline/core.ip-broken-header/ip-bogus-header-weird.log Normal file
View file

@ -0,0 +1,12 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX - 118.181.144.194 0 136.255.115.116 0 ip_hdr_len_zero - F zeek IP
XXXXXXXXXX.XXXXXX - 118.181.144.194 0 136.255.115.116 0 bogus_IP_header_lengths - F zeek IP
#close XXXX-XX-XX-XX-XX-XX

0
testing/btest/Baseline/core.ip-broken-header/weird.log → testing/btest/Baseline/core.ip-broken-header/mpls-6in6-broken-wierd.log
View file

BIN
testing/btest/Traces/ip-bogus-header-len.pcap Normal file
View file

Binary file not shown.

6
testing/btest/core/ip-broken-header.zeek
View file

@ -2,6 +2,10 @@
# OOB reads in Zeek. It has a number of packets broken in weird ways. # OOB reads in Zeek. It has a number of packets broken in weird ways.
# #
# @TEST-EXEC: gunzip -c $TRACES/trunc/mpls-6in6-broken.pcap.gz | zeek -C -b -r - %INPUT # @TEST-EXEC: gunzip -c $TRACES/trunc/mpls-6in6-broken.pcap.gz | zeek -C -b -r - %INPUT
# @TEST-EXEC: btest-diff weird.log # @TEST-EXEC: mv weird.log mpls-6in6-broken-wierd.log
# @TEST-EXEC: btest-diff mpls-6in6-broken-wierd.log
# @TEST-EXEC: zeek -C -b -r $TRACES/ip-bogus-header-len.pcap %INPUT
# @TEST-EXEC: mv weird.log ip-bogus-header-weird.log
# @TEST-EXEC: btest-diff ip-bogus-header-weird.log
@load base/frameworks/notice/weird @load base/frameworks/notice/weird