Merge pull request #571 in SNORT/snort3 from ips_options_update to master

Squashed commit of the following:

commit 84eae81aa133c86913677f6a3e79bd3778912dee
Author: alewis <albert.l.lewis@gmail.com>
Date:   Thu Jul 28 16:27:47 2016 -0400

    updated ips_options endian problem with icmp_id and icmp_seq rule keywords

commit e735c60e6161c58b62765b9f7141198fefefa0a4
Author: alewis <albert.l.lewis@gmail.com>
Date:   Thu Jul 28 15:49:28 2016 -0400

    fixed an ntohs (endian) issue with icmp_seq and icmp_id field matching

commit 46eca1d12a0142e68877c8e4c94b024f6b8795ae
Author: alewis <albert.l.lewis@gmail.com>
Date:   Thu Jul 28 12:35:09 2016 -0400

    endian fix for ips_options icmp_id field

diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc
index c37a2aae31c3bf756a11fdb5c90fdd5e0ac62939..3f559d4dc4012a41de63a6e80adea27a1b3de99b 100644 (file)
--- a/src/ips_options/ips_icmp_id.cc
+++ b/src/ips_options/ips_icmp_id.cc
@@ -115,13 +115,13 @@ int IcmpIdOption::eval(Cursor&, Packet* p)
 
     if ( (p->ptrs.icmph->type == ICMP_ECHO ||
         p->ptrs.icmph->type == ICMP_ECHOREPLY) ||
-        ((uint16_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REQUEST ||
-        (uint16_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REPLY) )
+        ((uint8_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REQUEST ||
+        (uint8_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REPLY) )
     {
-        if ( config.eval(p->ptrs.icmph->s_icmp_id) )
+               uint16_t icmp_id = ntohs(p->ptrs.icmph->s_icmp_id);
+        if ( config.eval( icmp_id ) ) 
             return DETECTION_OPTION_MATCH;
     }
-
     return DETECTION_OPTION_NO_MATCH;
 }
 

diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc
index b68522cb15bc6996950b2dba455acf875470de8c..a10485e67c16262f5d2319ccee5718d822555a74 100644 (file)
--- a/src/ips_options/ips_icmp_seq.cc
+++ b/src/ips_options/ips_icmp_seq.cc
@@ -114,15 +114,15 @@ int IcmpSeqOption::eval(Cursor&, Packet* p)
 
     if ( (p->ptrs.icmph->type == ICMP_ECHO ||
         p->ptrs.icmph->type == ICMP_ECHOREPLY) ||
-        ((uint16_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REQUEST ||
-        (uint16_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REPLY) )
+        ((uint8_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REQUEST ||
+        (uint8_t)p->ptrs.icmph->type == icmp::Icmp6Types::ECHO_REPLY) )
     {
-        if ( config.eval(p->ptrs.icmph->s_icmp_seq) )
+               uint16_t icmp_seq = ntohs(p->ptrs.icmph->s_icmp_seq);
+        if ( config.eval( icmp_seq ) )
         {
             return DETECTION_OPTION_MATCH;
         }
     }
-
     return DETECTION_OPTION_NO_MATCH;
 }