checksum will not return false on rebuilt packets

diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc
index e8a313d2495597e5b5861a4f91f76fb01efbe072..e39f73bffde1159ef678b6ed00faf04ec95507ae 100644 (file)
--- a/src/codecs/ip/cd_icmp4.cc
+++ b/src/codecs/ip/cd_icmp4.cc
@@ -209,7 +209,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,DecodeData& snort)
     {
         uint16_t csum = checksum::cksum_add((uint16_t *)icmph, raw.len);
 
-        if(csum)
+        if(csum && !codec.is_cooked())
         {
             stats.bad_ip4_cksum++;
             snort.decode_flags |= DECODE_ERR_CKSUM_ICMP;

diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index 85e7f9fece8c8a1d1aefd6f09c73fab446197dd6..51bd3b838300cb1b87f889896de8a2391e0d8a7e 100644 (file)
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -157,7 +157,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 
             csum = checksum::icmp_cksum((uint16_t *)(icmp6h), raw.len, &ph6);
         }
-        if(csum)
+        if(csum && !codec.is_cooked())
         {
             (*bad_cksum_cnt)++;
             snort.decode_flags |= DECODE_ERR_CKSUM_ICMP;

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index c21c86e43fa06600ba812098db3a2c5ec667284e..6743333a25733c11c598415a5e83b47df2ed26d8 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -258,7 +258,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
          */
         int16_t csum = checksum::ip_cksum((uint16_t *)iph, hlen);
 
-        if(csum)
+        if(csum && !codec.is_cooked())
         {
             if ( !(codec.codec_flags & CODEC_UNSURE_ENCAP) )
             {

diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index ed1f09b261d5b7118676337e809462172b623050..3bdc9d340041683c4d25775f83ea3fadbb082b7a 100644 (file)
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -209,7 +209,6 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
         codec.ip6_csum_proto = ip6h->next();
         codec.codec_flags &= ~CODEC_ROUTING_SEEN;
 
-        // FIXIT-M J  tunnel-byppas is NOT checked!!
         return true;
     }
 

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index 5067a4ce29701b43eaeccc19a9ff639db921ff64..f8bd8d115e8b936c95b52dbb5f5833e056686a33 100644 (file)
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -212,7 +212,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
             csum = checksum::tcp_cksum((uint16_t *)(tcph), raw.len, &ph6);
         }
 
-        if(csum)
+        if(csum && !codec.is_cooked())
         {
             if ( !(codec.codec_flags & CODEC_UNSURE_ENCAP) )
             {

diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index a262c745d1a1e5407bc040554ddec7e4c254dde3..f1d80ffcb7118a085a537aed2e71992c63bc0a6a 100644 (file)
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -287,7 +287,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
                 csum = 0;
             }
         }
-        if(csum)
+        if(csum && !codec.is_cooked())
         {
             if ( !(codec.codec_flags & CODEC_UNSURE_ENCAP) )
             {

diff --git a/src/framework/codec.h b/src/framework/codec.h
index ddeaaf10276b006d218dd1738dfa9f07cda7c95d..dccb1b04981e539c88b97dd3fa5295f9b6e1ea5c 100644 (file)
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -197,6 +197,37 @@ struct RawData
     uint32_t len;
 };
 
+/*  Decode Flags */
+constexpr uint16_t CODEC_DF = 0x0001;    /* don't fragment flag */
+constexpr uint16_t CODEC_UNSURE_ENCAP = 0x0002; /* packet may have incorrect encapsulation layer.
+                                                 * don't alert if "next layer" is invalid.
+                                                 * If decode fails with this bit set, PacketManager
+                                                 *          will back out to the previous layer.
+                                                 * IMPORTANT:  This bit can ONLY be set if the
+                                                 *              DECODE_ENCAP_LAYER flag was
+                                                 *              was previously set.
+                                                 */
+constexpr uint16_t CODEC_SAVE_LAYER = 0x0004;   /* DO NOT USE THIS LAYER!!
+                                                 *  --  use DECODE_ENCAP_LAYER
+                                                 */
+constexpr uint16_t CODEC_ENCAP_LAYER = (CODEC_SAVE_LAYER | CODEC_UNSURE_ENCAP );
+                                            /* If encapsulation decode fails, back out to this layer
+                                             * This will be cleared by PacketManager between decodes
+                                             * This flag automatically sets DECODE_ENCAP_LAYER for
+                                             *      the next layer (and only the next layer).
+                                             */
+constexpr uint16_t CODEC_ROUTING_SEEN = 0x0008; /* used to check ip6 extensino order */
+constexpr uint16_t CODEC_IPOPT_RR_SEEN = 0x0010; /* used by icmp4 for alerting */
+constexpr uint16_t CODEC_IPOPT_RTRALT_SEEN = 0x0020;  /* used by IGMP for alerting */
+constexpr uint16_t CODEC_IPOPT_LEN_THREE = 0x0040; /* used by IGMP for alerting */
+constexpr uint16_t CODEC_TEREDO_SEEN = 0x0080; /* used in IPv6 Codec */
+constexpr uint16_t CODEC_STREAM_REBUILT = 0x0100; /* Set by PacketManager. used by codec_event */
+
+constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN |
+                                        CODEC_IPOPT_RTRALT_SEEN |
+                                        CODEC_IPOPT_LEN_THREE);
+
+
 // FIXIT-M J  get rid of invaild bytes. Only needed for TCP options and IP options
 struct CodecData
 {
@@ -225,40 +256,15 @@ struct CodecData
                                     codec_flags(0),
                                     ip_layer_cnt(0)
     { next_prot_id = init_prot; }
-};
 
 
+    bool inline is_cooked() const
+    { return codec_flags & CODEC_STREAM_REBUILT; }
+};
+
 
 
-/*  Decode Flags */
-constexpr uint16_t CODEC_DF = 0x0001;    /* don't fragment flag */
-constexpr uint16_t CODEC_UNSURE_ENCAP = 0x0002; /* packet may have incorrect encapsulation layer.
-                                                 * don't alert if "next layer" is invalid.
-                                                 * If decode fails with this bit set, PacketManager
-                                                 *          will back out to the previous layer.
-                                                 * IMPORTANT:  This bit can ONLY be set if the
-                                                 *              DECODE_ENCAP_LAYER flag was
-                                                 *              was previously set.
-                                                 */
-constexpr uint16_t CODEC_SAVE_LAYER = 0x0004;   /* DO NOT USE THIS LAYER!!
-                                                 *  --  use DECODE_ENCAP_LAYER
-                                                 */
-constexpr uint16_t CODEC_ENCAP_LAYER = (CODEC_SAVE_LAYER | CODEC_UNSURE_ENCAP );
-                                            /* If encapsulation decode fails, back out to this layer
-                                             * This will be cleared by PacketManager between decodes
-                                             * This flag automatically sets DECODE_ENCAP_LAYER for
-                                             *      the next layer (and only the next layer).
-                                             */
-constexpr uint16_t CODEC_ROUTING_SEEN = 0x0008; /* used to check ip6 extensino order */
-constexpr uint16_t CODEC_IPOPT_RR_SEEN = 0x0010; /* used by icmp4 for alerting */
-constexpr uint16_t CODEC_IPOPT_RTRALT_SEEN = 0x0020;  /* used by IGMP for alerting */
-constexpr uint16_t CODEC_IPOPT_LEN_THREE = 0x0040; /* used by IGMP for alerting */
-constexpr uint16_t CODEC_TEREDO_SEEN = 0x0080; /* used in IPv6 Codec */
-constexpr uint16_t CODEC_STREAM_REBUILT = 0x0100; /* Set by PacketManager. used by codec_event */
 
-constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN |
-                                        CODEC_IPOPT_RTRALT_SEEN |
-                                        CODEC_IPOPT_LEN_THREE);
 
 /*  Codec Class */