Merge pull request #2450 in SNORT/snort3 from ~OKHOMIAK/snort3:jolt2_attack to master

Squashed commit of the following:

commit f57e74ffc9ec150810f7c7bf6c62c1cc5c393a5f
Author: Oleksii Khomiakovskyi <okhomiak@cisco.com>
Date:   Wed Sep 2 13:09:53 2020 +0300

    frag3: fix zero fragment built-in rule triggering for some reassembly policies

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index b704283b353c98948b1ff5267389e788e9980b4d..dd4dbe1ccac966d56dd820d045de8475676e6678 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -1603,6 +1603,8 @@ left_overlap_last:
 
                     ip_stats.discards++;
 
+                    EventAnomZeroFrag(fe);
+
                     return FRAG_INSERT_ANOMALY;
                 }
 
@@ -1871,7 +1873,7 @@ int Defrag::new_tracker(Packet* p, FragTracker* ft)
  */
 int Defrag::add_frag_node(
     FragTracker* ft,
-    FragEngine*,
+    FragEngine* fe,
     const uint8_t* fragStart,
     int16_t fragLength,
     char lastfrag,
@@ -1912,6 +1914,8 @@ int Defrag::add_frag_node(
         }
 #endif
 
+        EventAnomZeroFrag(fe);
+
         return FRAG_INSERT_ANOMALY;
     }