updating Frags handling of IP options and copying IP headers

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 9a1f49655898792454519fad2feb7a5ad88c1a40..02d55d0e349ba9e940e2d837b90184a73d5ef2b0 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -755,17 +755,6 @@ void Ipv4Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr)
         lyr->length = ip::IP4_HEADER_LEN;
         ch->set_ip_len(ip::IP4_HEADER_LEN);
         ch->set_hlen(ip::IP4_HEADER_LEN >> 2);
-
-#if 0
-        // FIXIT-L - J why did Snort check for this?
-        int i = lyr - c->layers;
-        if ( i + 1 == p->num_layers )
-        {
-            lyr->length = ip::IP4_HEADER_LEN;
-            ch->set_ip_len(ip::IP4_HEADER_LEN);
-            ch->set_hlen(ip::IP4_HEADER_LEN >> 2);
-        }
-#endif
     }
 
     c->ptrs.ip_api.set(ch);

diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index 348c8dda6da7ca69b782114990512974bc85b830..8a71add16272071f8888d9397094fa8dd6ca92a1 100644 (file)
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -84,7 +84,7 @@ static const Parameter udp_params[] =
 static const RuleMap udp_rules[] =
 {
 
-    { DECODE_UDP_DGRAM_LT_UDPHDR, "truncated UDP Header" },
+    { DECODE_UDP_DGRAM_LT_UDPHDR, "truncated UDP header" },
     { DECODE_UDP_DGRAM_INVALID_LENGTH, "invalid UDP header, length field < 8" },
     { DECODE_UDP_DGRAM_SHORT_PACKET, "short UDP packet, length field > payload length" },
     { DECODE_UDP_DGRAM_LONG_PACKET, "long UDP packet, length field < payload length" },

diff --git a/src/ips_options/ips_ipopts.cc b/src/ips_options/ips_ipopts.cc
index faef389ab2988cb31ae44b89b5259f041b9d3549..19eb041a0cfd94342244205a0a24acadf40f1a38 100644 (file)
--- a/src/ips_options/ips_ipopts.cc
+++ b/src/ips_options/ips_ipopts.cc
@@ -137,7 +137,7 @@ int IpOptOption::eval(Cursor&, Packet *p)
     }
 
     ip::IpOptionIterator iter(ip4h, p);
-    for( ip::IpOptions opt : iter)
+    for( const ip::IpOptions& opt : iter)
     {
        DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "testing pkt(%d):rule(%d)\n",
                                ipOptionData->ip_option,

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index eeb2f338c393ee8a176ac6d2110abeaea116d7ab..895af773570c375072b12d87ead742f5ea3d1a34 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -665,11 +665,15 @@ static int FragHandleIPOptions(FragTracker *ft,
 
             ip::IpOptionIterator iter(p->ptrs.ip_api.get_ip4h(), p);
 
-            for (ip::IpOptions opt : iter)
+            for (const ip::IpOptions& opt : iter)
             {
                 /* Is the high bit set?  If not, weird anomaly. */
-                if (!(static_cast<uint8_t>(opt.code) & 0x80))
+                if ( !(static_cast<uint8_t>(opt.code) & 0x80) &&
+                     (opt.code != ip::IPOptionCodes::EOL) )
+                {
                     EventAnomIpOpts(ft->engine);
+
+                }
             }
         }
     }
@@ -2262,9 +2266,6 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     uint16_t frag_end;
     uint16_t frag_off;
 
-    // if we're here, then the last layer was a fragment.
-    const Layer& lyr = p->layers[p->num_layers-1];
-    fragStart = lyr.start + lyr.length;
 
     /* Use the actual length here because packet may have been
      * truncated.  Don't want to try to copy more than we actually
@@ -2272,6 +2273,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
      * between the last sucesfully decoded layer (which is ip6_frag
      *  or ipv4) and the end of packet, */
     fragLength = p->dsize;
+    fragStart = p->data;
 
     /* Just to double check */
     if (fragLength > pkt_snaplen)
@@ -2287,15 +2289,15 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
 
     memset(ft, 0, sizeof(*ft));
     
-    if (p->ptrs.ip_api.is_ip4())
+    if ( p->is_ip4() )
     {
-        ft->protocol = p->ptrs.ip_api.get_ip4h()->proto();
-
-        const ip::IP4Hdr *ip4h = reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
+        const ip::IP4Hdr* const ip4h = p->ptrs.ip_api.get_ip4h();
+        ft->protocol = ip4h->proto();
         frag_off = ip4h->off();
     }
     else /* IPv6 */
     {
+        const Layer& lyr = p->layers[p->num_layers-1];
         const ip::IP6Frag* const fragHdr = reinterpret_cast<const ip::IP6Frag*>(lyr.start);
         frag_off = fragHdr->off();