From: Josh <jrosenba@cisco.com>
Date: Thu, 13 Nov 2014 18:06:16 +0000 (-0600)
Subject: tweaking frag.  FragStart had the wrong start point
X-Git-Tag: 3.0.0-233~1225^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7ea6c01fd05df493013b2eef7c4a4f9027e8e51f;p=thirdparty%2Fsnort3.git

tweaking frag.  FragStart had the wrong start point
---

diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index 565d3cf0c..187746b81 100644
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -249,7 +249,7 @@ void StreamBase::eval(Packet *p)
         break;
 
     case PktType::IP:
-        if ( p->ptrs.ip_api.is_valid() )
+        if ( p->has_ip() )
             flow_con->process_ip(p);
         break;
 
diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 895af7735..bc5b679c2 100644
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -1567,16 +1567,13 @@ int Defrag::insert(Packet *p, FragTracker *ft, FragEngine *fe)
      */
     firstLastOk = FragCheckFirstLast(p, ft, net_frag_offset);
 
-    // if we're here, then the last layer was a fragment.
-    const Layer& lyr = p->layers[p->num_layers-1];
-    fragStart = lyr.start + lyr.length;
-
     /* Use the actual length here because packet may have been
      * truncated.  Don't want to try to copy more than we actually
      * captured. Use dsize as the frag length since it is distance
      * between the last sucesfully decoded layer (which is ip6_frag
      *  or ipv4) and the end of packet, */
     len = fragLength = p->dsize;
+    fragStart = p->data;
 
     /*
      * setup local variables for tracking this frag