From e17106eaad136d217fdd6409c79a7864e222231c Mon Sep 17 00:00:00 2001 From: "Russ Combs (rucombs)" Date: Fri, 20 Nov 2015 15:35:37 -0500 Subject: [PATCH] Merge pull request #147 in SNORT/snort3 from crc/my_bad to master Squashed commit of the following: commit d89bc6f0de5e1f231a76085b3ad7a174fb3972d0 Author: russ Date: Fri Nov 20 10:33:05 2015 -0500 squelch repeated ip6 ooo extensions and bad options per packet --- ChangeLog | 2 +- src/framework/codec.cc | 19 +++++++++++-------- src/framework/codec.h | 5 ++++- 3 files changed, 16 insertions(+), 10 deletions(-) diff --git a/ChangeLog b/ChangeLog index f83ece548..f654a7ad4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,7 +7,7 @@ -- decode past excess ip6 extensions and bad options -- add iface to alert_csv.fields -- add hyperscan fast pattern search engine - functional but not yet used --- remote --enable-perf-profiling so it is always built +-- remove --enable-perf-profiling so it is always built -- perf profiling changes in preparation for memory profiling -- remove obsolete LibDAQ preprocessor conditionals -- fix arp inspection diff --git a/src/framework/codec.cc b/src/framework/codec.cc index d76e73e5c..e2679e461 100644 --- a/src/framework/codec.cc +++ b/src/framework/codec.cc @@ -80,7 +80,7 @@ void Codec::codec_event(const CodecData& codec, CodecSid sid) SnortEventqAdd(GID_DECODE, sid); } -bool Codec::CheckIPV6HopOptions(const RawData& raw, const CodecData& codec) +bool Codec::CheckIPV6HopOptions(const RawData& raw, CodecData& codec) { const ip::IP6Extension* const exthdr = reinterpret_cast(raw.data); @@ -97,7 +97,6 @@ bool Codec::CheckIPV6HopOptions(const RawData& raw, const CodecData& codec) /* Skip to the options */ pkt += 2; - bool my_bad = false; /* Iterate through the options, check for bad ones */ while (pkt < hdr_end) @@ -110,10 +109,10 @@ bool Codec::CheckIPV6HopOptions(const RawData& raw, const CodecData& codec) break; default: - if ( !my_bad ) + if ( !(codec.codec_flags & CODEC_IP6_BAD_OPT) ) { codec_event(codec, DECODE_IPV6_BAD_OPT_TYPE); - my_bad = true; + codec.codec_flags |= CODEC_IP6_BAD_OPT; } // fall thru ... @@ -151,11 +150,15 @@ void Codec::CheckIPv6ExtensionOrder(CodecData& codec, const uint8_t proto) 1) A routing header was already seen, and 2) The second destination header is the last one before the upper layer. */ - if (!((codec.codec_flags & CODEC_ROUTING_SEEN) && - (proto == IPPROTO_ID_DSTOPTS) && - (next_order == ip::IPV6_ORDER_MAX))) + if ( !((codec.codec_flags & CODEC_ROUTING_SEEN) and + (proto == IPPROTO_ID_DSTOPTS) and + (next_order == ip::IPV6_ORDER_MAX)) ) { - codec_event(codec, DECODE_IPV6_UNORDERED_EXTENSIONS); + if ( !(codec.codec_flags & CODEC_IP6_EXT_OOO) ) + { + codec_event(codec, DECODE_IPV6_UNORDERED_EXTENSIONS); + codec.codec_flags |= CODEC_IP6_EXT_OOO; + } } } else diff --git a/src/framework/codec.h b/src/framework/codec.h index 278fb723e..163cc6ea5 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -112,6 +112,9 @@ constexpr uint16_t CODEC_TEREDO_SEEN = 0x0080; constexpr uint16_t CODEC_STREAM_REBUILT = 0x0100; constexpr uint16_t CODEC_NON_IP_TUNNEL = 0x0200; +constexpr uint16_t CODEC_IP6_EXT_OOO = 0x0400; +constexpr uint16_t CODEC_IP6_BAD_OPT = 0x0800; + constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN | CODEC_IPOPT_RTRALT_SEEN | CODEC_IPOPT_LEN_THREE); @@ -354,7 +357,7 @@ protected: // Create an event with the Codec GID void codec_event(const CodecData &, CodecSid); // Check the Hop and DST IPv6 extension - bool CheckIPV6HopOptions(const RawData&, const CodecData&); + bool CheckIPV6HopOptions(const RawData&, CodecData&); // NOTE:: data.next_prot_id MUST be set before calling this!! void CheckIPv6ExtensionOrder(CodecData&, const uint8_t proto); -- 2.47.3