IP6 Frag working. Still have an extra IP6 alert from a rebuilt IP6 Frag.

diff --git a/src/codecs/codec_module.h b/src/codecs/codec_module.h
index 85641e96a9e52f033259fade4dc271b246f6b623..85b47a94d74a2f057683083e33797c130a179be5 100644 (file)
--- a/src/codecs/codec_module.h
+++ b/src/codecs/codec_module.h
@@ -164,7 +164,7 @@ enum CodecSid {
     DECODE_ICMP6_HDR_TRUNC,
     DECODE_IP4_MIN_TTL,
     DECODE_IP6_ZERO_HOP_LIMIT,
-    DECODE_IP4_DF_OFFSET,
+    DECODE_IP4_DF_OFFSET, // = 430
     DECODE_ICMP6_TYPE_OTHER,
     DECODE_ICMP6_DST_MULTICAST,
     DECODE_TCP_SHAFT_SYNFLOOD,
@@ -174,7 +174,7 @@ enum CodecSid {
     DECODE_ICMP_REDIRECT_NET,
     DECODE_ICMP_TRACEROUTE_IPOPTS,
     DECODE_ICMP_SOURCE_QUENCH,
-    DECODE_ICMP_BROADSCAN_SMURF_SCANNER,
+    DECODE_ICMP_BROADSCAN_SMURF_SCANNER, // = 440
     DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED,
     DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED,
     DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED,
@@ -184,7 +184,7 @@ enum CodecSid {
     DECODE_UDP_PORT_ZERO,
     DECODE_IP_RESERVED_FRAG_BIT,
     DECODE_IP_UNASSIGNED_PROTO,
-    DECODE_IP_BAD_PROTO,
+    DECODE_IP_BAD_PROTO, // = 450
     DECODE_ICMP_PATH_MTU_DOS,
     DECODE_ICMP_DOS_ATTEMPT,
     DECODE_IPV6_ISATAP_SPOOF,
@@ -194,7 +194,7 @@ enum CodecSid {
     DECODE_ICMPV6_UNREACHABLE_NON_RFC_4443_CODE,
     DECODE_IPV6_BAD_FRAG_PKT,
     DECODE_ZERO_LENGTH_FRAG,
-    DECODE_ICMPV6_NODE_INFO_BAD_CODE,
+    DECODE_ICMPV6_NODE_INFO_BAD_CODE, // = 460
     DECODE_IPV6_ROUTE_ZERO,
     DECODE_ERSPAN_HDR_VERSION_MISMATCH,
     DECODE_ERSPAN2_DGRAM_LT_HDR,
@@ -202,7 +202,7 @@ enum CodecSid {
     DECODE_AUTH_HDR_TRUNC,
     DECODE_AUTH_HDR_BAD_LEN,
     DECODE_TOO_MANY_LAYERS,
-    DECODE_INDEX_MAX
+    DECODE_INDEX_MAX // = 468
 };
 
 

diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc
index c5f0069572a614ce03cc5da9f0310dbf0f020826..3b0899d3745ccff5668c7feaa5c33d3b3605461e 100644 (file)
--- a/src/codecs/ip/cd_frag.cc
+++ b/src/codecs/ip/cd_frag.cc
@@ -87,7 +87,7 @@ bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, DecodeData& sno
     /* If this is an IP Fragment, set some data... */
     codec.codec_flags &= ~CODEC_DF;
 
-    if (ntohs(ip6frag_hdr->ip6f_offlg) & ip::IP6F_MF_MASK)
+    if (ip6frag_hdr->mf())
         snort.decode_flags |= DECODE_MF;
 
 #if 0
@@ -97,7 +97,7 @@ bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, DecodeData& sno
 #endif
 
     // three least signifigant bits are all flags
-    const uint16_t frag_offset =  ip6frag_hdr->off() >> 3;
+    const uint16_t frag_offset = ip6frag_hdr->off();
 
     if (frag_offset || (snort.decode_flags & DECODE_MF))
         snort.decode_flags |= DECODE_FRAG;
@@ -144,12 +144,12 @@ void Ipv6FragCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
 
 
     TextLog_Print(text_log, "Next:0x%02X Off:%u ID:%u",
-            fragh->ip6f_nxt, (offlg >> 3), fragh->id());
+            fragh->ip6f_nxt, offlg, fragh->id());
 
-    if (offlg & ip::IP6F_MF_MASK)
+    if (fragh->mf())
         TextLog_Puts(text_log, " MF");
 
-    if (offlg & ip::IP6F_RES_MASK)
+    if (fragh->rb())
         TextLog_Puts(text_log, " RB");
 }
 

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index c8123406f3fbd2fb72da8896c0ee027209382c7c..fdfce292df13ade0e0b14c41f4012eaa04ac91b9 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -282,7 +282,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
     ip_len -= hlen;
 
     /* check for fragmented packets */
-    uint16_t frag_off = iph->off();
+    uint16_t frag_off = iph->off_w_flags();
 
     /*
      * get the values of the reserved, more
@@ -303,6 +303,10 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
     /* mask off the high bits in the fragment offset field */
     frag_off &= 0x1FFF;
 
+    // to get the real frag_off, we need to multiply by 8. However, since
+    // the actual frag_off is never used, we can comment this out
+//    frag_off = frag_off << 3;
+
     if ((codec.codec_flags & CODEC_DF) && frag_off )
         codec_events::decoder_event(codec, DECODE_IP4_DF_OFFSET);
 
@@ -599,7 +603,7 @@ void Ipv4Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
 
     const uint16_t hlen = ip4h->hlen();
     const uint16_t len = ip4h->len();
-    const uint16_t frag_off = ip4h->off();
+    const uint16_t frag_off = ip4h->off_w_flags();
 
     TextLog_Print(text_log, "Next:0x%02X TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
             ip4h->proto(), ip4h->ttl(), ip4h->tos(),
@@ -631,7 +635,7 @@ void Ipv4Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
         TextLog_NewLine(text_log);
         TextLog_Putc(text_log, '\t');
         TextLog_Print(text_log, "Frag Offset: 0x%04X   Frag Size: 0x%04X\n",
-                (frag_off & 0x1FFF), (len - hlen));
+                (frag_off & 0x1FFF) * 8, (len - hlen));
     }
 }
 

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index b4728aac72389f9a7f26763c625e781b1241849c..4e9febe95c6ba40b5fe5e74f4a838409cedac71a 100644 (file)
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -580,7 +580,7 @@ void TcpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
             "Win: 0x%X  TcpLen: %d",ntohs(tcph->th_sport),
             ntohs(tcph->th_dport), (u_long) ntohl(tcph->th_seq),
             (u_long) ntohl(tcph->th_ack),
-            ntohs(tcph->th_win), tcph->off() << 2);
+            ntohs(tcph->th_win), tcph->off());
 
     if((tcph->th_flags & TH_URG) != 0)
         TextLog_Print(text_log, "UrgPtr: 0x%X", tcph->urp());

diff --git a/src/codecs/misc/cd_icmp4_ip.cc b/src/codecs/misc/cd_icmp4_ip.cc
index e09a6d0150a09e2b0b00b589cb3162e88fa37701..678dd9408a2c726b0819664f678693292d20e826 100644 (file)
--- a/src/codecs/misc/cd_icmp4_ip.cc
+++ b/src/codecs/misc/cd_icmp4_ip.cc
@@ -66,8 +66,6 @@ void Icmp4IpCodec::get_protocol_ids(std::vector<uint16_t>& v)
 
 bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
-    uint32_t ip_len;       /* length from the start of the ip hdr to the
-                             * pkt end */
 
     /* do a little validation */
     if(raw.len < ip::IP4_HEADER_LEN)
@@ -98,18 +96,14 @@ bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snor
     }
 
     /* set the remaining packet length */
-    ip_len = raw.len - hlen;
-
-    uint16_t orig_frag_offset = ip4h->off();
-    orig_frag_offset &= 0x1FFF;
-
-    if (orig_frag_offset == 0)
+    if (ip4h->off() == 0)
     {
+        const uint32_t ip_len = raw.len - hlen;
+
         /* Original IP payload should be 64 bits */
         if (ip_len < 8)
         {
             codec_events::decoder_event(codec, DECODE_ICMP_ORIG_PAYLOAD_LT_64);
-
             return false;
         }
         /* ICMP error packets could contain as much of original payload
@@ -193,7 +187,7 @@ void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
 
     const uint16_t hlen = ip4h->hlen();
     const uint16_t len = ip4h->len();
-    const uint16_t frag_off = ip4h->off();
+    const uint16_t frag_off = ip4h->off_w_flags();
 
     TextLog_Print(text_log, "Next:%s(%02X) TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
             PacketManager::get_proto_name(ip4h->proto()),
@@ -250,7 +244,7 @@ void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
                     "Ack: 0x%lX  Win: 0x%X  TcpLen: %d",ntohs(tcph->th_sport),
                     ntohs(tcph->th_dport), (u_long) ntohl(tcph->th_seq),
                     (u_long) ntohl(tcph->th_ack),
-                    ntohs(tcph->th_win), tcph->off() << 2);
+                    ntohs(tcph->th_win), tcph->off());
 
             break;
         }

diff --git a/src/framework/codec.h b/src/framework/codec.h
index e73e2ed4423713e70409abb11a15ac80693b4777..65fe5c8fb16ad00daa0a6a4feecf92b10551b6ac 100644 (file)
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -32,6 +32,7 @@
 // unfortunately necessary due to use of Ipapi in struct
 #include "protocols/ip.h"
 #include "protocols/mpls.h"  // FIXIT-M remove MPLS from Convenience pointers
+#include "protocols/layer.h"
 #include "framework/decode_data.h"
 
 struct TextLog;
@@ -357,8 +358,8 @@ public:
     { return true; }
 
     // update function
-    virtual bool update(Packet*, Layer*, uint32_t* /*len*/)
-    { return true; }
+    virtual bool update(Packet*, Layer* lyr, uint32_t* len)
+    { *len += lyr->length;  return true; }
 
     // formatter
     virtual void format(EncodeFlags, const Packet* /*orig*/, Packet* /*clone*/, Layer*)

diff --git a/src/ips_options/ips_fragbits.cc b/src/ips_options/ips_fragbits.cc
index a485e916d8995ade8db04333b76df1db7283ba31..57b80a19a4bf0593661d280caa027b28a94a3234 100644 (file)
--- a/src/ips_options/ips_fragbits.cc
+++ b/src/ips_options/ips_fragbits.cc
@@ -156,7 +156,7 @@ int FragBitsOption::eval(Cursor&, Packet *p)
         return rval;
     }
 
-    const uint16_t frag_offset = p->ptrs.ip_api.off();
+    const uint16_t frag_offset = p->ptrs.ip_api.off_w_flags();
     MODULE_PROFILE_START(fragBitsPerfStats);
 
     DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "           <!!> CheckFragBits: ");

diff --git a/src/ips_options/ips_fragoffset.cc b/src/ips_options/ips_fragoffset.cc
index 8472252a7bb4707de8ce7634f14a86ba05d227be..96880bc5b0efc30706baec06332e3fb524f54e8b 100644 (file)
--- a/src/ips_options/ips_fragoffset.cc
+++ b/src/ips_options/ips_fragoffset.cc
@@ -90,11 +90,11 @@ bool FragOffsetOption::operator==(const IpsOption& ips) const
 
 int FragOffsetOption::eval(Cursor&, Packet *p)
 {
-    int p_offset = p->ptrs.ip_api.off() * 8;
+    int p_offset = p->ptrs.ip_api.off();
     int rval = DETECTION_OPTION_NO_MATCH;
     PROFILE_VARS;
 
-    if(!p->ptrs.ip_api.is_valid())
+    if(!p->has_ip())
     {
         return rval;
     }

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 1322d9afb1c551e8d9aaf344c8922aa2db1601a2..508fb47f7ee0a4ca0aa942123fa2d853a62e4068 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -647,15 +647,14 @@ void LogIPHeader(TextLog*  log, Packet * p)
         }
         else
         {
-            frag_off = ip6_frag->off();
 
-            if(frag_off & ip::IP6F_RES_MASK)
+            if(ip6_frag->rb())
                 TextLog_Puts(log, " RB");
 
-            if(frag_off & ip::IP6F_MF_MASK)
+            if(ip6_frag->mf())
                 TextLog_Puts(log, " MF");
 
-            frag_off = (frag_off >> 3);
+            frag_off = ip6_frag->off();
         }
     }
     else
@@ -673,14 +672,14 @@ void LogIPHeader(TextLog*  log, Packet * p)
         if (frag_off)
         {
           /* print the reserved bit if it's set */
-          if(frag_off & 0x8000)
+          if(ip4h->rb())
               TextLog_Puts(log, " RB");
 
           /* printf more frags/don't frag bits */
-          if(frag_off & 0x4000)
+          if(ip4h->df())
               TextLog_Puts(log, " DF");
 
-          if(frag_off & 0x2000)
+          if(ip4h->mf())
               TextLog_Puts(log, " MF");
 
           frag_off = (frag_off & 0x1FFF);
@@ -907,7 +906,7 @@ void LogTCPHeader(TextLog*  log, Packet * p)
     TextLog_Print(log, " Seq: 0x%lX  Ack: 0x%lX  Win: 0x%X  TcpLen: %d",
             (u_long) ntohl(tcph->th_seq),
             (u_long) ntohl(tcph->th_ack),
-            ntohs(tcph->th_win), tcph->off() << 2);
+            ntohs(tcph->th_win), tcph->off());
 
     if((tcph->th_flags & TH_URG) != 0)
     {

diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc
index 63d75dd76fcf7f7e827a87676665c584cfa1e664..00d3423b8f8bae482e87065cd62a72416ed46728 100644 (file)
--- a/src/loggers/alert_csv.cc
+++ b/src/loggers/alert_csv.cc
@@ -378,7 +378,7 @@ void CsvLogger::alert(Packet *p, const char *msg, Event *event)
         else if (!strcasecmp("tcp_len", type))
         {
             if (p->ptrs.tcph != NULL)
-                TextLog_Print(csv_log, "%d", (p->ptrs.tcph->off()) << 2);
+                TextLog_Print(csv_log, "%d", (p->ptrs.tcph->off()));
         }
         else if (!strcasecmp("tcp_win", type))
         {

diff --git a/src/protocols/ip.cc b/src/protocols/ip.cc
index dcc58dab313fe2e5d38e7fc716d2b84e752391fe..07e88aaf166618c03ce49b8558f1a3ea91d4a2e7 100644 (file)
--- a/src/protocols/ip.cc
+++ b/src/protocols/ip.cc
@@ -112,6 +112,17 @@ uint16_t IpApi::off() const
     return 0;
 }
 
+uint16_t IpApi::off_w_flags() const
+{
+    if (ip4h)
+        return ip4h->off_w_flags();
+
+    const IP6Frag* const frag_hdr = layer::get_inner_ip6_frag();
+
+    if (frag_hdr)
+        return frag_hdr->off_w_flags();
+    return 0;
+}
 
 const uint8_t* IpApi::ip_data() const
 {

diff --git a/src/protocols/ip.h b/src/protocols/ip.h
index 61ca7846a94c3747e3a42181c29661a339d68a37..9b63404d4b499c88b2a66e48e22191f3d9975605 100644 (file)
--- a/src/protocols/ip.h
+++ b/src/protocols/ip.h
@@ -61,8 +61,13 @@ public:
     void set(const IP6Hdr* h6);
     bool set(const uint8_t* raw_ip_data);
     void reset();
-    uint32_t id() const;  // return the frag_id
-    uint16_t off() const; // return the frag_offset
+    // return the 16 bits associated with this IP layers frag_offset/flags
+    uint16_t off_w_flags() const;
+    // return the frag_offset associated with this IP layers in word size.
+    //   (the value is internally masked and multiplied)
+    uint16_t off() const;
+    // return the frag_id associated with this IP layers
+    uint32_t id() const;
     const uint8_t* ip_data() const; // return a pointer to the ip layers data
 
     // FIXIT-L J get rid of the unnecessary ones

diff --git a/src/protocols/ipv4.h b/src/protocols/ipv4.h
index f74938daa48008b8322445625b4cc6ca28421abf..ddf0da105624f5290b581d7f44ed352f0f21ab60 100644 (file)
--- a/src/protocols/ipv4.h
+++ b/src/protocols/ipv4.h
@@ -92,9 +92,21 @@ struct IP4Hdr
     inline uint8_t proto() const
     { return ip_proto; }
 
-    inline uint16_t off() const
+    inline uint16_t off_w_flags() const
     { return ntohs(ip_off); }
 
+    inline uint16_t rb() const
+    { return ntohs(ip_off) & 0x8000; }
+
+    inline uint16_t mf() const
+    { return ntohs(ip_off) & 0x2000; }
+
+    inline uint16_t df() const
+    { return ntohs(ip_off) & 0x4000; }
+
+    inline uint16_t off() const
+    { return (ntohs(ip_off) & 0x1FFF) << 3; }
+
     inline uint16_t id() const
     { return ntohs(ip_id); }
 

diff --git a/src/protocols/ipv6.h b/src/protocols/ipv6.h
index 869f755bd20b8b223703b424b249f20a99e5e990..8c349374809b2a52895fe08f791d45b726572f51 100644 (file)
--- a/src/protocols/ipv6.h
+++ b/src/protocols/ipv6.h
@@ -99,9 +99,18 @@ struct IP6Frag
     uint16_t  ip6f_offlg;   /* offset, reserved, and flag */
     uint32_t  ip6f_ident;   /* identification */
 
-    inline uint16_t off() const
+    inline uint16_t off_w_flags() const
     { return ntohs(ip6f_offlg); }
-//    { return ntohs(ip6f_offlg) >> 3; } // FIXIT-M  This will return the actual offset
+
+    inline uint16_t off() const
+    { return ntohs(ip6f_offlg) & 0xFFF8; }
+
+    inline uint16_t mf() const
+    { return ntohs(ip6f_offlg) & IP6F_MF_MASK; }
+
+    inline uint16_t rb() const
+    { return ntohs(ip6f_offlg) & IP6F_RES_MASK; }
+
 
     inline uint32_t id() const
     { return ntohl(ip6f_ident); }
@@ -111,7 +120,7 @@ struct IP6Frag
 
 
 
-    inline uint16_t raw_off() const
+    inline uint16_t raw_off_w_flags() const
     { return ip6f_offlg; }
 
     inline uint32_t raw_id() const

diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index 48b0c03ba64440d5b2ed8a968528cc4bc14bfe5b..1365c07b8a677da97c638f83ae20fffeafebc7ba 100644 (file)
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -729,7 +729,7 @@ int PacketManager::encode_format(EncodeFlags f, const Packet* p, Packet* c, Pseu
 void PacketManager::encode_update (Packet* p)
 {
     int i;
-    uint32_t len = 0;
+    uint32_t len = p->dsize;
     DAQ_PktHdr_t* pkth = (DAQ_PktHdr_t*)p->pkth;
 
     Layer *lyr = p->layers;

diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h
index db5f5c069faf91cae922a11c85c598503d1f9c3b..41236a30eeef43cf39f8c723576c1168fed6a8ae 100644 (file)
--- a/src/protocols/tcp.h
+++ b/src/protocols/tcp.h
@@ -87,7 +87,7 @@ struct TCPHdr
     { return (th_offx2 & 0xf0) >> 2; }
 
     inline uint8_t off() const
-    { return th_offx2 >> 4; }
+    { return (th_offx2 & 0xf0) >> 2; }
 
     inline uint8_t options_len() const
     { return hdr_len() - TCP_MIN_HEADER_LEN; }

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 7c8a00c5d9ecb9679d2295bf10444543e267a1d5..f87e385733fb25923baafe1185bd65f42596cb69 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -249,7 +249,9 @@ THREAD_LOCAL ProfileStats fragRebuildPerfStats;
 /*  P R O T O T Y P E S  ********************************************/
 static void FragRebuild(FragTracker *, Packet *);
 static inline int FragIsComplete(FragTracker *);
-static int FragHandleIPOptions(FragTracker *, const Packet* const);
+static int FragHandleIPOptions(FragTracker *,
+                               const Packet* const,
+                               const uint16_t frag_off);
 
 /* deletion funcs */
 static THREAD_LOCAL struct timeval *pkttime;    /* packet timestamp */
@@ -540,7 +542,7 @@ static inline int FragCheckFirstLast(const Packet* const p,
          * between the last sucesfully decoded layer (which is ip6_frag
          *  or ipv4) and the end of packet, */
         fragLength = p->dsize;
-        endOfThisFrag = (frag_offset << 3) + fragLength;
+        endOfThisFrag = frag_offset + fragLength;
 
         if (ft->frag_flags & FRAG_GOT_LAST)
         {
@@ -639,10 +641,10 @@ static inline int FragCheckFirstLast(const Packet* const p,
  * @retval 1 on success
  */
 static int FragHandleIPOptions(FragTracker *ft,
-                               const Packet* const p)
+                               const Packet* const p,
+                               const uint16_t frag_offset)
 {
-    // FIXIT-J pass in frag_offset as a parameter
-    const uint16_t frag_offset = p->ptrs.ip_api.off();
+    // Is this for ipv6 too?
     const uint16_t ip_options_len = p->ptrs.ip_api.get_ip_opt_len();
 
     if(frag_offset == 0)
@@ -1019,9 +1021,14 @@ static void FragRebuild(FragTracker *ft, Packet *p)
 
         /* Set the 'next' protocol */
         if (fragh != nullptr)
+        {
             fragh->ip6f_nxt = ft->protocol;
+            fragh->ip6f_offlg = 0x0000;
+        }
         else
+        {
             rawHdr->ip6_next = ft->protocol;
+        }
 
         dpkt->dsize = (uint16_t)ft->calculated_size;
         PacketManager::encode_update(dpkt);
@@ -1367,8 +1374,9 @@ void Defrag::process(Packet* p, FragTracker* ft)
      *    Disable Inspection since we'll look at the payload in
      *    a rebuilt packet later.  So don't process it further.
      */
-    if ((frag_offset != 0) ||
-        ((p->get_ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF)))
+    //  FIXIT-M  Since we no longer let UDP through, does this detection still work?
+    if ((frag_offset != 0)) /* ||
+        ((p->get_ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF))) */
     {
         DisableDetect(p);
     }
@@ -1571,7 +1579,7 @@ int Defrag::insert(Packet *p, FragTracker *ft, FragEngine *fe)
 
     MODULE_PROFILE_START(fragInsertPerfStats);
 
-    if (p->ptrs.ip_api.is_ip6() && (net_frag_offset == 0))
+    if (p->is_ip6() && (net_frag_offset == 0))
     {
 
         const ip::IP6Frag* const fragHdr = layer::get_inner_ip6_frag();
@@ -1601,7 +1609,7 @@ int Defrag::insert(Packet *p, FragTracker *ft, FragEngine *fe)
     /*
      * setup local variables for tracking this frag
      */
-    orig_offset = frag_offset = net_frag_offset << 3;
+    orig_offset = frag_offset = net_frag_offset;
     /* Reset the offset to handle the weird Solaris case */
     if (firstLastOk == FRAG_LAST_OFFSET_ADJUST)
         frag_offset = (uint16_t)ft->calculated_size;
@@ -1619,7 +1627,7 @@ int Defrag::insert(Packet *p, FragTracker *ft, FragEngine *fe)
         }
 
         //    ft->frag_flags |= FRAG_GOT_LAST;
-        //    ft->calculated_size = (p->frag_offset << 3) + fragLength;
+        //    ft->calculated_size = (p->frag_offset) + fragLength;
         lastfrag = 1;
     }
     else
@@ -1703,7 +1711,7 @@ int Defrag::insert(Packet *p, FragTracker *ft, FragEngine *fe)
      * This may alert on bad options, but we still want to
      * insert the packet
      */
-    FragHandleIPOptions(ft, p);
+    FragHandleIPOptions(ft, p, frag_offset);
 
     ft->frag_pkts++;
 
@@ -1919,7 +1927,7 @@ left_overlap_last:
         DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
                     "Overly large fragment %d 0x%x 0x%x %d\n",
                     fragLength, p->ptrs.ip_api.dgram_len(), p->ptrs.ip_api.off(),
-                    net_frag_offset << 3););
+                    net_frag_offset););
         MODULE_PROFILE_END(fragInsertPerfStats);
         return FRAG_INSERT_FAILED;
     }
@@ -2302,8 +2310,8 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     {
         DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
             "Overly large fragment length:%d(0x%x) off:0x%x(%d)\n",
-            fragLength, p->ptrs.ip_api.dgram_len(), p->ptrs.ip_api.off() << 3,
-            p->ptrs.ip_api.off() << 3););
+            fragLength, p->ptrs.ip_api.dgram_len(), p->ptrs.ip_api.off(),
+            p->ptrs.ip_api.off()););
 
         /* Ah, crap.  Return that tracker. */
         return 0;
@@ -2316,11 +2324,11 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
         ft->protocol = p->ptrs.ip_api.get_ip4h()->proto();
 
         const ip::IP4Hdr *ip4h = reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
-        frag_off = ip4h->off() & 0x1FFF;
+        frag_off = ip4h->off();
     }
     else /* IPv6 */
     {
-        const ip::IP6Frag *fragHdr = reinterpret_cast<const ip::IP6Frag*>(lyr.start);
+        const ip::IP6Frag* const fragHdr = reinterpret_cast<const ip::IP6Frag*>(lyr.start);
         frag_off = fragHdr->off();
 
         if (frag_off == 0)
@@ -2375,7 +2383,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     memcpy(f->fptr, fragStart, fragLength);
 
     f->size = f->flen = fragLength;
-    f->offset = frag_off << 3;
+    f->offset = frag_off;
     frag_end = f->offset + fragLength;
     f->ord = ft->ordinal++;
     f->data = f->fptr;     /* ptr to adjusted start position */
@@ -2421,7 +2429,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
 
     ft->frag_bytes += fragLength;
 
-    FragHandleIPOptions(ft, p);
+    FragHandleIPOptions(ft, p, frag_off);
 
     t_stats.trackers_created++;
     return 1;

diff --git a/tools/snort2lua/data/data_types/dt_var.cc b/tools/snort2lua/data/data_types/dt_var.cc
index 6b334f948d0d657fe6895b755e5656dfd5090444..070bbe84d72157c794944f670f28415d2af7c24e 100644 (file)
--- a/tools/snort2lua/data/data_types/dt_var.cc
+++ b/tools/snort2lua/data/data_types/dt_var.cc
@@ -64,6 +64,7 @@ bool Variable::add_value(std::string elem)
     std::string s(elem);
     util::trim(elem);
 
+    // FIXIT-M J.  Variables do not need to start with a '$'/  for instance. !$HOME_NET
     if(s.front() == '$')
     {
         // add a space between strings

diff --git a/tools/snort2lua/keyword_states/kws_var.cc b/tools/snort2lua/keyword_states/kws_var.cc
index e62379e7d89a26743807be52fc3c188419b17091..2ece29a2cdf03a159ab3398b194e470ee63f2b4c 100644 (file)
--- a/tools/snort2lua/keyword_states/kws_var.cc
+++ b/tools/snort2lua/keyword_states/kws_var.cc
@@ -63,6 +63,7 @@ bool Var::convert(std::istringstream& data_stream)
         std::vector<std::string> port_list;
         bool retval = true;
 
+        // FIXIT-M J   ---  Should not be removing the '[' from a PORT_LIST
         if(ports.front() == '[')
             ports.erase(ports.begin());
         

diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in
index 948a34fc10af1028265aea1ea0ef41b452e42a37..98933068c45cbde4fd0f65c712b333fbc3c24e1f 100644 (file)
--- a/tools/snort2lua/tests/snort.conf.in
+++ b/tools/snort2lua/tests/snort.conf.in
@@ -1295,3 +1295,5 @@ alert tcp any any -> any any ( sid:26816; msg:"tunnel"; flow:established; conten
 alert tcp any any -> any any ( sid:26817; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:enable,client,fastpath,noalert; )
 alert tcp any any -> any any ( sid:26818; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:enable,server,fastpath,noalert; )
 
+
+alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"MISC CVS non-relative path access attempt"; flow:to_server,established; content:"Argument"; pcre:"m?^Argument\s+/?smi"; pcre:"/^Directory/smiR"; reference:bugtraq,9178; reference:cve,2003-0977; reference:nessus,11947; classtype:misc-attack; sid:2318; rev:4;)