mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
Improve handling of IPv6 routing type 0 extension headers.
- flow_weird event with name argument value of "routing0_hdr" is raised for packets containing an IPv6 routing type 0 header because this type of header is now deprecated according to RFC 5095. - packets with a routing type 0 header and non-zero segments left now use the last address in that header in order to associate with a connection/flow and for calculating TCP/UDP checksums. - added a set of IPv4/IPv6 TCP/UDP checksum unit tests
This commit is contained in:
parent
d889f14638
commit
f4101b5265
39 changed files with 171 additions and 121 deletions
9
testing/btest/Baseline/core.checksums/bad.out
Normal file
9
testing/btest/Baseline/core.checksums/bad.out
Normal file
|
@ -0,0 +1,9 @@
|
|||
1332784981.078396 weird: bad_IP_checksum
|
||||
1332784885.686428 weird: bad_TCP_checksum
|
||||
1332784933.501023 weird: bad_UDP_checksum
|
||||
1332785210.013051 weird: routing0_hdr
|
||||
1332785210.013051 weird: bad_TCP_checksum
|
||||
1332782580.798420 weird: routing0_hdr
|
||||
1332782580.798420 weird: bad_UDP_checksum
|
||||
1332785250.469132 weird: bad_TCP_checksum
|
||||
1332781342.923813 weird: bad_UDP_checksum
|
2
testing/btest/Baseline/core.checksums/good.out
Normal file
2
testing/btest/Baseline/core.checksums/good.out
Normal file
|
@ -0,0 +1,2 @@
|
|||
1332785125.596793 weird: routing0_hdr
|
||||
1332782508.592037 weird: routing0_hdr
|
|
@ -1 +1,3 @@
|
|||
weird routing0_hdr from 2001:4f8:4:7:2e0:81ff:fe52:ffff to 2001:78:1:32::2
|
||||
[orig_h=2001:4f8:4:7:2e0:81ff:fe52:ffff, orig_p=53/udp, resp_h=2001:78:1:32::2, resp_p=53/udp]
|
||||
[ip=<uninitialized>, ip6=[class=0, flow=0, len=59, nxt=0, hlim=64, src=2001:4f8:4:7:2e0:81ff:fe52:ffff, dst=2001:4f8:4:7:2e0:81ff:fe52:9a6b, exts=[[id=0, hopopts=[nxt=43, len=0, options=[[otype=1, len=4, data=\0\0\0\0]]], dstopts=<uninitialized>, routing=<uninitialized>, fragment=<uninitialized>, ah=<uninitialized>, esp=<uninitialized>], [id=43, hopopts=<uninitialized>, dstopts=<uninitialized>, routing=[nxt=17, len=4, rtype=0, segleft=2, data=\0\0\0\0 ^A\0x\0^A\02\0\0\0\0\0\0\0^A ^A\0x\0^A\02\0\0\0\0\0\0\0^B], fragment=<uninitialized>, ah=<uninitialized>, esp=<uninitialized>]]], tcp=<uninitialized>, udp=[sport=53/udp, dport=53/udp, ulen=11], icmp=<uninitialized>]
|
||||
|
|
BIN
testing/btest/Traces/chksums/ip4-bad-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip4-bad-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip4-tcp-bad-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip4-tcp-bad-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip4-tcp-good-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip4-tcp-good-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip4-udp-bad-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip4-udp-bad-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip4-udp-good-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip4-udp-good-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-route0-tcp-bad-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-route0-tcp-bad-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-route0-tcp-good-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-route0-tcp-good-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-route0-udp-bad-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-route0-udp-bad-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-route0-udp-good-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-route0-udp-good-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-tcp-bad-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-tcp-bad-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-tcp-good-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-tcp-good-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-udp-bad-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-udp-bad-chksum.pcap
Normal file
Binary file not shown.
BIN
testing/btest/Traces/chksums/ip6-udp-good-chksum.pcap
Normal file
BIN
testing/btest/Traces/chksums/ip6-udp-good-chksum.pcap
Normal file
Binary file not shown.
|
@ -1,4 +1,4 @@
|
|||
# @TEST-EXEC: bro -C -b -r $TRACES/ext_hdr_hbh_routing.trace %INPUT >output
|
||||
# @TEST-EXEC: bro -b -r $TRACES/ipv6-hbh-routing0.trace %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
||||
event ipv6_ext_headers(c: connection, p: pkt_hdr)
|
||||
|
|
15
testing/btest/core/checksums.test
Normal file
15
testing/btest/core/checksums.test
Normal file
|
@ -0,0 +1,15 @@
|
|||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip4-bad-chksum.pcap >>bad.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip4-tcp-bad-chksum.pcap >>bad.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip4-udp-bad-chksum.pcap >>bad.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-route0-tcp-bad-chksum.pcap >>bad.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-route0-udp-bad-chksum.pcap >>bad.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-tcp-bad-chksum.pcap >>bad.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-udp-bad-chksum.pcap >>bad.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip4-tcp-good-chksum.pcap >>good.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip4-udp-good-chksum.pcap >>good.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-route0-tcp-good-chksum.pcap >>good.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-route0-udp-good-chksum.pcap >>good.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-tcp-good-chksum.pcap >>good.out 2>&1
|
||||
# @TEST-EXEC: bro -b -r $TRACES/chksums/ip6-udp-good-chksum.pcap >>good.out 2>&1
|
||||
# @TEST-EXEC: btest-diff bad.out
|
||||
# @TEST-EXEC: btest-diff good.out
|
|
@ -1,10 +1,22 @@
|
|||
# @TEST-EXEC: bro -C -b -r $TRACES/ext_hdr_hbh_routing.trace %INPUT >output
|
||||
# @TEST-EXEC: bro -b -r $TRACES/ipv6-hbh-routing0.trace %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
|
||||
# Just check that the event is raised correctly for a packet containing
|
||||
# extension headers.
|
||||
|
||||
event ipv6_ext_headers(c: connection, p: pkt_hdr)
|
||||
{
|
||||
print p;
|
||||
}
|
||||
|
||||
# Also check the weird for routing type 0 extensions headers
|
||||
event flow_weird(name: string, src: addr, dst: addr)
|
||||
{
|
||||
print fmt("weird %s from %s to %s", name, src, dst);
|
||||
}
|
||||
|
||||
# And the connection for routing type 0 packets with non-zero segments left
|
||||
# should use the last address in that extension header.
|
||||
event new_connection(c: connection)
|
||||
{
|
||||
print c$id;
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue