From: Tom Peters (thopeter) <thopeter@cisco.com>
Date: Tue, 4 Apr 2017 19:25:44 +0000 (-0400)
Subject: Merge pull request #849 in SNORT/snort3 from Bug66844 to master
X-Git-Tag: 3.0.0-233~35
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=008088859580c1ccdaa31082783bcade417aca08;p=thirdparty%2Fsnort3.git

Merge pull request #849 in SNORT/snort3 from Bug66844 to master

Squashed commit of the following:

commit e92aca867900d9001f10871e5c0e8469f748bc60
Author: allewi <allewi@cisco.com>
Date:   Thu Mar 30 16:37:01 2017 -0400

    removed unused payload_type variable

commit 434f377d7225a6063641e51d1ff979b57f8fbf39
Author: allewi <allewi@cisco.com>
Date:   Thu Mar 30 12:30:09 2017 -0400

    added decoder check for label 0 or 2 set in non bottom of stack header

commit 3ce099cc788a5ce2a1b7f775c26fe99eaaf598a9
Author: allewi <allewi@cisco.com>
Date:   Mon Mar 27 06:04:37 2017 -0400

    added ip proto 137 to mpls decoder
---

diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc
index c07689b6e..f46cadf2c 100644
--- a/src/codecs/link/cd_mpls.cc
+++ b/src/codecs/link/cd_mpls.cc
@@ -143,6 +143,7 @@ void MplsCodec::get_protocol_ids(std::vector<ProtocolId>& v)
 {
     v.push_back(ProtocolId::ETHERTYPE_MPLS_UNICAST);
     v.push_back(ProtocolId::ETHERTYPE_MPLS_MULTICAST);
+    v.push_back(ProtocolId::MPLS_IP);
 }
 
 bool MplsCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
@@ -269,7 +270,7 @@ int MplsCodec::checkMplsHdr(const CodecData& codec, uint32_t label, uint8_t bos)
     {
     case 0:
     case 2:
-        /* check if this label is the bottom of the stack */
+        //if this label is the bottom of the stack
         if (bos)
         {
             if ( label == 0 )
@@ -279,8 +280,8 @@ int MplsCodec::checkMplsHdr(const CodecData& codec, uint32_t label, uint8_t bos)
 
             /* when label == 2, IPv6 is expected;
              * when label == 0, IPv4 is expected */
-            if ((label&&(SnortConfig::get_mpls_payload_type() != MPLS_PAYLOADTYPE_IPV6))
-                ||((!label)&&(SnortConfig::get_mpls_payload_type() != MPLS_PAYLOADTYPE_IPV4)))
+            if ( (label && ( SnortConfig::get_mpls_payload_type() != MPLS_PAYLOADTYPE_IPV6) )
+                || ( (!label) && (SnortConfig::get_mpls_payload_type() != MPLS_PAYLOADTYPE_IPV4)))
             {
                 if ( !label )
                     codec_event(codec, DECODE_BAD_MPLS_LABEL0);
@@ -289,7 +290,17 @@ int MplsCodec::checkMplsHdr(const CodecData& codec, uint32_t label, uint8_t bos)
             }
             break;
         }
-
+        //if bos is false we are believed to NOT be at the bottom of the stack
+        //and if we arent at the bottom of the stack then we should NOT see 
+        //label 0 or 2 (according to RFC 3032)
+        else 
+        {
+             if ( label == 0 )
+                    codec_event(codec, DECODE_BAD_MPLS_LABEL0);
+            //it MUST be label 2 
+             else
+                    codec_event(codec, DECODE_BAD_MPLS_LABEL2);
+        }
 #if 0
         /* This is valid per RFC 4182.  Just pop this label off, ignore it
          * and move on to the next one.
diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h
index 20f5293ce..f56d662dd 100644
--- a/src/protocols/protocol_ids.h
+++ b/src/protocols/protocol_ids.h
@@ -73,7 +73,7 @@ enum class IpProtocol : std::uint8_t
     DSTOPTS = 60,
     SUN_ND = 77,
     PGM = 113,
-
+    MPLS_IP = 137,
     /* Last updated 3/31/2016.
        Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */
     MIN_UNASSIGNED_IP_PROTO = 143,
@@ -107,6 +107,7 @@ enum class ProtocolId : std::uint16_t
     DSTOPTS = 60,
     SUN_ND = 77,
     PGM = 113,
+    MPLS_IP = 137,
 
     /* Last updated 3/31/2016.
        Source: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml */