Merge pull request #909 in SNORT/snort3 from arp_spoof_assert to master

Squashed commit of the following:

commit 0eb7bdb71fb583dfbb555090dcdefe274469e423
Author: mdagon <mdagon@cisco.com>
Date:   Thu May 25 16:09:09 2017 -0400

    Comment

commit 51b55863d608eec4c00dc4fe4af48470b49d539f
Author: mdagon <mdagon@cisco.com>
Date:   Wed May 24 16:22:40 2017 -0400

    Code review

commit 54766baa91c8f0d6b5f3285d705907cabff752d7
Author: mdagon <mdagon@cisco.com>
Date:   Tue May 23 12:46:30 2017 -0400

    Arp spoof with non-ethernet packet - return instead of assert

diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc
index bbd5c1637d3ac833a705544a18d899906d18d5d7..fe32b4364a33687fc18ea16bfedc8ffd0f292ded 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_spoof.cc
+++ b/src/network_inspectors/arp_spoof/arp_spoof.cc
@@ -169,9 +169,12 @@ void ArpSpoof::eval(Packet* p)
 {
     Profile profile(arpPerfStats);
 
-    // preconditions - what we registered for
+    // precondition - what we registered for
     assert(p->type() == PktType::ARP);
-    assert(p->proto_bits & PROTO_BIT__ETH);
+
+    // 802.11 not supported
+    if ((p->proto_bits & PROTO_BIT__ETH) == 0)
+        return;
 
     const arp::EtherARP* ah = layer::get_arp_layer(p);
     const eth::EtherHdr* eh = layer::get_eth_layer(p);
@@ -222,7 +225,7 @@ void ArpSpoof::eval(Packet* p)
     if ( ipme )
     {
         DebugFormat(DEBUG_INSPECTOR,
-            "MODNAME: LookupIPMacEntryByIP returned %p\n", (void*) ipme);
+            "MODNAME: LookupIPMacEntryByIP returned %p\n", (void*)ipme);
 
         auto cmp_ether_src = memcmp(eh->ether_src, ipme->mac_addr, 6);
         auto cmp_arp_sha = memcmp(ah->arp_sha, ipme->mac_addr, 6);
@@ -235,7 +238,6 @@ void ArpSpoof::eval(Packet* p)
             DebugMessage(DEBUG_INSPECTOR, "MODNAME: Attempted ARP cache overwrite attack\n");
         }
     }
-
     else
     {
         DebugMessage(DEBUG_INSPECTOR,
@@ -298,4 +300,3 @@ const BaseApi* nin_arp_spoof[] =
     &as_api.base,
     nullptr
 };
-