Merge pull request #147 in SNORT/snort3 from crc/my_bad to master

Squashed commit of the following:

commit d89bc6f0de5e1f231a76085b3ad7a174fb3972d0
Author: russ <rucombs@cisco.com>
Date:   Fri Nov 20 10:33:05 2015 -0500

    squelch repeated ip6 ooo extensions and bad options per packet

diff --git a/ChangeLog b/ChangeLog
index f83ece54805cc7fdbfb61a4b15bd267109ab1dd7..f654a7ad4474a671a7f9aa568039302ff3c5d33c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,7 +7,7 @@
 -- decode past excess ip6 extensions and bad options
 -- add iface to alert_csv.fields
 -- add hyperscan fast pattern search engine - functional but not yet used
--- remote --enable-perf-profiling so it is always built
+-- remove --enable-perf-profiling so it is always built
 -- perf profiling changes in preparation for memory profiling
 -- remove obsolete LibDAQ preprocessor conditionals
 -- fix arp inspection

diff --git a/src/framework/codec.cc b/src/framework/codec.cc
index d76e73e5c50a642f5b062244373b400f174db440..e2679e4618fd0809342e8f7e1feaa0e855289eca 100644 (file)
--- a/src/framework/codec.cc
+++ b/src/framework/codec.cc
@@ -80,7 +80,7 @@ void Codec::codec_event(const CodecData& codec, CodecSid sid)
     SnortEventqAdd(GID_DECODE, sid);
 }
 
-bool Codec::CheckIPV6HopOptions(const RawData& raw, const CodecData& codec)
+bool Codec::CheckIPV6HopOptions(const RawData& raw, CodecData& codec)
 {
     const ip::IP6Extension* const exthdr =
         reinterpret_cast<const ip::IP6Extension*>(raw.data);
@@ -97,7 +97,6 @@ bool Codec::CheckIPV6HopOptions(const RawData& raw, const CodecData& codec)
 
     /* Skip to the options */
     pkt += 2;
-    bool my_bad = false;
 
     /* Iterate through the options, check for bad ones */
     while (pkt < hdr_end)
@@ -110,10 +109,10 @@ bool Codec::CheckIPV6HopOptions(const RawData& raw, const CodecData& codec)
             break;
 
         default:
-            if ( !my_bad )
+            if ( !(codec.codec_flags & CODEC_IP6_BAD_OPT) )
             {
                 codec_event(codec, DECODE_IPV6_BAD_OPT_TYPE);
-                my_bad = true;
+                codec.codec_flags |= CODEC_IP6_BAD_OPT;
             }
             // fall thru ...
 
@@ -151,11 +150,15 @@ void Codec::CheckIPv6ExtensionOrder(CodecData& codec, const uint8_t proto)
            1) A routing header was already seen, and
            2) The second destination header is the last one before the upper layer.
         */
-        if (!((codec.codec_flags & CODEC_ROUTING_SEEN) &&
-            (proto == IPPROTO_ID_DSTOPTS) &&
-            (next_order == ip::IPV6_ORDER_MAX)))
+        if ( !((codec.codec_flags & CODEC_ROUTING_SEEN) and
+            (proto == IPPROTO_ID_DSTOPTS) and
+            (next_order == ip::IPV6_ORDER_MAX)) )
         {
-            codec_event(codec, DECODE_IPV6_UNORDERED_EXTENSIONS);
+            if ( !(codec.codec_flags & CODEC_IP6_EXT_OOO) )
+            {
+                codec_event(codec, DECODE_IPV6_UNORDERED_EXTENSIONS);
+                codec.codec_flags |= CODEC_IP6_EXT_OOO;
+            }
         }
     }
     else

diff --git a/src/framework/codec.h b/src/framework/codec.h
index 278fb723ed36af2795924040d702419ff3af156d..163cc6ea526b0557d42d1709c34a43eff4f3c0cf 100644 (file)
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -112,6 +112,9 @@ constexpr uint16_t CODEC_TEREDO_SEEN = 0x0080;
 constexpr uint16_t CODEC_STREAM_REBUILT = 0x0100;
 constexpr uint16_t CODEC_NON_IP_TUNNEL = 0x0200;
 
+constexpr uint16_t CODEC_IP6_EXT_OOO = 0x0400;
+constexpr uint16_t CODEC_IP6_BAD_OPT = 0x0800;
+
 constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN |
     CODEC_IPOPT_RTRALT_SEEN | CODEC_IPOPT_LEN_THREE);
 
@@ -354,7 +357,7 @@ protected:
     // Create an event with the Codec GID
     void codec_event(const CodecData &, CodecSid);
     // Check the Hop and DST IPv6 extension
-    bool CheckIPV6HopOptions(const RawData&, const CodecData&);
+    bool CheckIPV6HopOptions(const RawData&, CodecData&);
     // NOTE:: data.next_prot_id MUST be set before calling this!!
     void CheckIPv6ExtensionOrder(CodecData&, const uint8_t proto);