From: Josh <jrosenba@cisco.com>
Date: Wed, 12 Nov 2014 19:02:40 +0000 (-0600)
Subject: updating Frags handling of IP options and copying IP headers
X-Git-Tag: 3.0.0-233~1230^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=034b55adccd7a403a47a58518bbcbabb67f64332;p=thirdparty%2Fsnort3.git

updating Frags handling of IP options and copying IP headers
---

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 9a1f49655..02d55d0e3 100644
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -755,17 +755,6 @@ void Ipv4Codec::format(EncodeFlags f, const Packet* p, Packet* c, Layer* lyr)
         lyr->length = ip::IP4_HEADER_LEN;
         ch->set_ip_len(ip::IP4_HEADER_LEN);
         ch->set_hlen(ip::IP4_HEADER_LEN >> 2);
-
-#if 0
-        // FIXIT-L - J why did Snort check for this?
-        int i = lyr - c->layers;
-        if ( i + 1 == p->num_layers )
-        {
-            lyr->length = ip::IP4_HEADER_LEN;
-            ch->set_ip_len(ip::IP4_HEADER_LEN);
-            ch->set_hlen(ip::IP4_HEADER_LEN >> 2);
-        }
-#endif
     }
 
     c->ptrs.ip_api.set(ch);
diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index 348c8dda6..8a71add16 100644
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -84,7 +84,7 @@ static const Parameter udp_params[] =
 static const RuleMap udp_rules[] =
 {
 
-    { DECODE_UDP_DGRAM_LT_UDPHDR, "truncated UDP Header" },
+    { DECODE_UDP_DGRAM_LT_UDPHDR, "truncated UDP header" },
     { DECODE_UDP_DGRAM_INVALID_LENGTH, "invalid UDP header, length field < 8" },
     { DECODE_UDP_DGRAM_SHORT_PACKET, "short UDP packet, length field > payload length" },
     { DECODE_UDP_DGRAM_LONG_PACKET, "long UDP packet, length field < payload length" },
diff --git a/src/ips_options/ips_ipopts.cc b/src/ips_options/ips_ipopts.cc
index faef389ab..19eb041a0 100644
--- a/src/ips_options/ips_ipopts.cc
+++ b/src/ips_options/ips_ipopts.cc
@@ -137,7 +137,7 @@ int IpOptOption::eval(Cursor&, Packet *p)
     }
 
     ip::IpOptionIterator iter(ip4h, p);
-    for( ip::IpOptions opt : iter)
+    for( const ip::IpOptions& opt : iter)
     {
     	DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "testing pkt(%d):rule(%d)\n",
 				ipOptionData->ip_option,
diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index eeb2f338c..895af7735 100644
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -665,11 +665,15 @@ static int FragHandleIPOptions(FragTracker *ft,
 
             ip::IpOptionIterator iter(p->ptrs.ip_api.get_ip4h(), p);
 
-            for (ip::IpOptions opt : iter)
+            for (const ip::IpOptions& opt : iter)
             {
                 /* Is the high bit set?  If not, weird anomaly. */
-                if (!(static_cast<uint8_t>(opt.code) & 0x80))
+                if ( !(static_cast<uint8_t>(opt.code) & 0x80) &&
+                     (opt.code != ip::IPOptionCodes::EOL) )
+                {
                     EventAnomIpOpts(ft->engine);
+
+                }
             }
         }
     }
@@ -2262,9 +2266,6 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     uint16_t frag_end;
     uint16_t frag_off;
 
-    // if we're here, then the last layer was a fragment.
-    const Layer& lyr = p->layers[p->num_layers-1];
-    fragStart = lyr.start + lyr.length;
 
     /* Use the actual length here because packet may have been
      * truncated.  Don't want to try to copy more than we actually
@@ -2272,6 +2273,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
      * between the last sucesfully decoded layer (which is ip6_frag
      *  or ipv4) and the end of packet, */
     fragLength = p->dsize;
+    fragStart = p->data;
 
     /* Just to double check */
     if (fragLength > pkt_snaplen)
@@ -2287,15 +2289,15 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
 
     memset(ft, 0, sizeof(*ft));
     
-    if (p->ptrs.ip_api.is_ip4())
+    if ( p->is_ip4() )
     {
-        ft->protocol = p->ptrs.ip_api.get_ip4h()->proto();
-
-        const ip::IP4Hdr *ip4h = reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
+        const ip::IP4Hdr* const ip4h = p->ptrs.ip_api.get_ip4h();
+        ft->protocol = ip4h->proto();
         frag_off = ip4h->off();
     }
     else /* IPv6 */
     {
+        const Layer& lyr = p->layers[p->num_layers-1];
         const ip::IP6Frag* const fragHdr = reinterpret_cast<const ip::IP6Frag*>(lyr.start);
         frag_off = fragHdr->off();