mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 03:28:19 +00:00
924ed053c7
IP packets that have a header length that is greater than the total length of the packet cause a integer overflow, which cause range-checks to fail, which causes OOB reads. Furthermore Bro does not currently check the version field of IP packets that are read from tunnels. I added this check - otherwhise Bro reports bogus IP information in its error messages, just converting the data from the place where the IP information is supposed to be to IPs. This behavior brings us closer to what other software (e.g. Wireshark) displays in these cases.
14 lines
487 B
Text
14 lines
487 B
Text
# Trace in we have mpls->ip6->ip6->ip4 where the ip4 packet
|
|
# has an invalid IP version.
|
|
# @TEST-EXEC: bro -C -r $TRACES/tunnels/mpls-6in6-6in6-4in6-invalid-version-4.pcap
|
|
# @TEST-EXEC: mv weird.log output
|
|
|
|
# Trace in which we have mpls->ip6->ip6 where the ip6 packet
|
|
# has an invalid IP version.
|
|
# @TEST-EXEC: bro -C -r $TRACES/tunnels/mpls-6in6-6in6-invalid-version-6.pcap
|
|
# @TEST-EXEC: cat weird.log >> output
|
|
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
@load base/frameworks/notice/weird.bro
|
|
|