8 commits

Author	SHA1	Message	Date
Arne Welzel	d2689379bc	Update baselines after AnalyzePacket changes ... Mainly, for bad headers we do not (can not) put addresses into the log anymore. Some were rather obviously bogus previously already.	2022-11-08 16:44:15 -07:00
Johanna Amann	e14b695497	Accept packets that use tcp segment offloading. ... When checksum offloading is enabled, we now forward packets that have 0 header lengths set - and assume that they have TSO enabled. If checksum offloading is not enabled, we drop the packets. Addresses GH-1829	2021-10-28 17:12:54 +02:00
Tim Wojtulewicz	0e34f2e02f	Fix handling of IP packets with bogus IP header lengths ... Credit to OSS-Fuzz for discovery https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34711 (Link to details becomes public 30 days after patch release)	2021-05-27 16:33:50 -07:00
Tim Wojtulewicz	e27008ef26	GH-1184: Add 'source' field to weird log denoting where the weird was reported	2020-12-01 09:34:37 -07:00
Tim Wojtulewicz	a99b540e46	Rework Sessions::Weird	2020-10-15 13:03:11 -07:00
Tim Wojtulewicz	1cf251d1ca	Move IP and IP tunnel code from Sessions into packet analyzers	2020-10-15 12:18:30 -07:00
Jon Siwek	2fa74e4bcb	Change default value of peer_description "zeek"	2019-06-06 19:49:30 -07:00
Johanna Amann	924ed053c7	Fix OOB read in Sessions.cc ... IP packets that have a header length that is greater than the total length of the packet cause a integer overflow, which cause range-checks to fail, which causes OOB reads. Furthermore Bro does not currently check the version field of IP packets that are read from tunnels. I added this check - otherwhise Bro reports bogus IP information in its error messages, just converting the data from the place where the IP information is supposed to be to IPs. This behavior brings us closer to what other software (e.g. Wireshark) displays in these cases.	2017-10-19 10:29:29 -07:00