From: Josh Date: Thu, 20 Nov 2014 18:39:10 +0000 (-0600) Subject: checksum will not return false on rebuilt packets X-Git-Tag: 3.0.0-233~1175^2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2a257f1e37e0071ece99f83acfb21ebfd016cd8c;p=thirdparty%2Fsnort3.git checksum will not return false on rebuilt packets --- diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index e8a313d24..e39f73bff 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -209,7 +209,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,DecodeData& snort) { uint16_t csum = checksum::cksum_add((uint16_t *)icmph, raw.len); - if(csum) + if(csum && !codec.is_cooked()) { stats.bad_ip4_cksum++; snort.decode_flags |= DECODE_ERR_CKSUM_ICMP; diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index 85e7f9fec..51bd3b838 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -157,7 +157,7 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) csum = checksum::icmp_cksum((uint16_t *)(icmp6h), raw.len, &ph6); } - if(csum) + if(csum && !codec.is_cooked()) { (*bad_cksum_cnt)++; snort.decode_flags |= DECODE_ERR_CKSUM_ICMP; diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index c21c86e43..6743333a2 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -258,7 +258,7 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) */ int16_t csum = checksum::ip_cksum((uint16_t *)iph, hlen); - if(csum) + if(csum && !codec.is_cooked()) { if ( !(codec.codec_flags & CODEC_UNSURE_ENCAP) ) { diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index ed1f09b26..3bdc9d340 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -209,7 +209,6 @@ bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) codec.ip6_csum_proto = ip6h->next(); codec.codec_flags &= ~CODEC_ROUTING_SEEN; - // FIXIT-M J tunnel-byppas is NOT checked!! return true; } diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 5067a4ce2..f8bd8d115 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -212,7 +212,7 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) csum = checksum::tcp_cksum((uint16_t *)(tcph), raw.len, &ph6); } - if(csum) + if(csum && !codec.is_cooked()) { if ( !(codec.codec_flags & CODEC_UNSURE_ENCAP) ) { diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index a262c745d..f1d80ffcb 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -287,7 +287,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) csum = 0; } } - if(csum) + if(csum && !codec.is_cooked()) { if ( !(codec.codec_flags & CODEC_UNSURE_ENCAP) ) { diff --git a/src/framework/codec.h b/src/framework/codec.h index ddeaaf102..dccb1b049 100644 --- a/src/framework/codec.h +++ b/src/framework/codec.h @@ -197,6 +197,37 @@ struct RawData uint32_t len; }; +/* Decode Flags */ +constexpr uint16_t CODEC_DF = 0x0001; /* don't fragment flag */ +constexpr uint16_t CODEC_UNSURE_ENCAP = 0x0002; /* packet may have incorrect encapsulation layer. + * don't alert if "next layer" is invalid. + * If decode fails with this bit set, PacketManager + * will back out to the previous layer. + * IMPORTANT: This bit can ONLY be set if the + * DECODE_ENCAP_LAYER flag was + * was previously set. + */ +constexpr uint16_t CODEC_SAVE_LAYER = 0x0004; /* DO NOT USE THIS LAYER!! + * -- use DECODE_ENCAP_LAYER + */ +constexpr uint16_t CODEC_ENCAP_LAYER = (CODEC_SAVE_LAYER | CODEC_UNSURE_ENCAP ); + /* If encapsulation decode fails, back out to this layer + * This will be cleared by PacketManager between decodes + * This flag automatically sets DECODE_ENCAP_LAYER for + * the next layer (and only the next layer). + */ +constexpr uint16_t CODEC_ROUTING_SEEN = 0x0008; /* used to check ip6 extensino order */ +constexpr uint16_t CODEC_IPOPT_RR_SEEN = 0x0010; /* used by icmp4 for alerting */ +constexpr uint16_t CODEC_IPOPT_RTRALT_SEEN = 0x0020; /* used by IGMP for alerting */ +constexpr uint16_t CODEC_IPOPT_LEN_THREE = 0x0040; /* used by IGMP for alerting */ +constexpr uint16_t CODEC_TEREDO_SEEN = 0x0080; /* used in IPv6 Codec */ +constexpr uint16_t CODEC_STREAM_REBUILT = 0x0100; /* Set by PacketManager. used by codec_event */ + +constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN | + CODEC_IPOPT_RTRALT_SEEN | + CODEC_IPOPT_LEN_THREE); + + // FIXIT-M J get rid of invaild bytes. Only needed for TCP options and IP options struct CodecData { @@ -225,40 +256,15 @@ struct CodecData codec_flags(0), ip_layer_cnt(0) { next_prot_id = init_prot; } -}; + bool inline is_cooked() const + { return codec_flags & CODEC_STREAM_REBUILT; } +}; + -/* Decode Flags */ -constexpr uint16_t CODEC_DF = 0x0001; /* don't fragment flag */ -constexpr uint16_t CODEC_UNSURE_ENCAP = 0x0002; /* packet may have incorrect encapsulation layer. - * don't alert if "next layer" is invalid. - * If decode fails with this bit set, PacketManager - * will back out to the previous layer. - * IMPORTANT: This bit can ONLY be set if the - * DECODE_ENCAP_LAYER flag was - * was previously set. - */ -constexpr uint16_t CODEC_SAVE_LAYER = 0x0004; /* DO NOT USE THIS LAYER!! - * -- use DECODE_ENCAP_LAYER - */ -constexpr uint16_t CODEC_ENCAP_LAYER = (CODEC_SAVE_LAYER | CODEC_UNSURE_ENCAP ); - /* If encapsulation decode fails, back out to this layer - * This will be cleared by PacketManager between decodes - * This flag automatically sets DECODE_ENCAP_LAYER for - * the next layer (and only the next layer). - */ -constexpr uint16_t CODEC_ROUTING_SEEN = 0x0008; /* used to check ip6 extensino order */ -constexpr uint16_t CODEC_IPOPT_RR_SEEN = 0x0010; /* used by icmp4 for alerting */ -constexpr uint16_t CODEC_IPOPT_RTRALT_SEEN = 0x0020; /* used by IGMP for alerting */ -constexpr uint16_t CODEC_IPOPT_LEN_THREE = 0x0040; /* used by IGMP for alerting */ -constexpr uint16_t CODEC_TEREDO_SEEN = 0x0080; /* used in IPv6 Codec */ -constexpr uint16_t CODEC_STREAM_REBUILT = 0x0100; /* Set by PacketManager. used by codec_event */ -constexpr uint16_t CODEC_IPOPT_FLAGS = (CODEC_IPOPT_RR_SEEN | - CODEC_IPOPT_RTRALT_SEEN | - CODEC_IPOPT_LEN_THREE); /* Codec Class */