ip defrag fixes

diff --git a/ChangeLog b/ChangeLog
index e6ab5432d6f8f90895a11e1fc95ba351276ea827..7bbb9d20635e8df0afb9d1d9c159f2e00a8d8bd5 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@
 -- pulled latest from tom
 -- added paramaters to doc reference section
 -- flow state updates
+-- ip defrag fixes
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index d63ddc7c57f4c45cc78d43f650b6abf30ff6ce23..49d07455b9b682238d442c6f93f821ea3a854bb7 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -319,9 +319,9 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 
     /* if this packet isn't a fragment
      * or if it is, its a UDP packet and offset is 0 */
-    if(!(snort.decode_flags & DECODE_FRAG) ||
-        ((frag_off == 0) &&
-         (iph->get_proto() == IPPROTO_UDP)))
+    if(!(snort.decode_flags & DECODE_FRAG) /*||
+        ((frag_off == 0) &&  // FIXIT-M this forces flow to udp instead of ip
+         (iph->get_proto() == IPPROTO_UDP))*/)
     {
         if (iph->get_proto() >= MIN_UNASSIGNED_IP_PROTO)
             codec_events::decoder_event(codec, DECODE_IP_UNASSIGNED_PROTO);

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 6b84a53dc45c4cb3c9fe3f7b01194d2f089418d0..7f9b46f123202bf5349ed24759a6277b2483f683 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -2326,7 +2326,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
         ft->protocol = p->ptrs.ip_api.get_ip4h()->get_proto();
 
         const ip::IP4Hdr *ip4h = reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
-        frag_off = ntohs(ip4h->get_off());
+        frag_off = ntohs(ip4h->get_off()) & 0x1FFF;
     }
     else /* IPv6 */
     {
@@ -2666,10 +2666,7 @@ inline int Defrag::expire(Packet*, FragTracker *ft, FragEngine *fe)
     /*
      * Check the FragTracker that was passed in first
      */
-    if(CheckTimeout(
-                pkttime,
-                &(ft)->frag_time,
-                fe) == FRAG_TIMEOUT)
+    if(CheckTimeout(pkttime, &(ft)->frag_time, fe) == FRAG_TIMEOUT)
     {
         /*
          * Oops, we've timed out, whack the FragTracker

diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc
index aa121ccb427292f32e7842214a27ed1715e98027..36065ace224a09b6ebe9ebff53217ff1266d3736 100644 (file)
--- a/src/stream/ip/ip_module.cc
+++ b/src/stream/ip/ip_module.cc
@@ -71,7 +71,10 @@ using namespace std;
     ",iny fragment"
 
 FragEngine::FragEngine()
-{ memset(this, 0, sizeof(*this)); }
+{ 
+    memset(this, 0, sizeof(*this));
+    frag_timeout = 60;
+}
 
 //-------------------------------------------------------------------------
 // stream_ip module

diff --git a/src/stream/ip/stream_ip.cc b/src/stream/ip/stream_ip.cc
index 6995ada62e37791b6a1752ed3e671f824a9839f3..130314ab2cc8d9e0a4b1c18fedc5fe6a4177b019 100644 (file)
--- a/src/stream/ip/stream_ip.cc
+++ b/src/stream/ip/stream_ip.cc
@@ -40,7 +40,7 @@
 
 StreamIpConfig::StreamIpConfig()
 {
-    session_timeout = 30;
+    session_timeout = 60;
 }
 
 static void ip_show (StreamIpConfig* pc)