From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Tue, 18 Apr 2017 21:59:45 +0000 (-0400)
Subject: Merge pull request #854 in SNORT/snort3 from Bug51812 to master
X-Git-Tag: 3.0.0-233~25
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a42a2f4f9103547adecb5b54a925df5731cd04f2;p=thirdparty%2Fsnort3.git

Merge pull request #854 in SNORT/snort3 from Bug51812 to master

Squashed commit of the following:

commit 83007534003c61344eac25407b13443ab4bc2c30
Author: allewi <allewi@cisco.com>
Date:   Fri Apr 14 19:10:30 2017 -0400

    changes made for detecting naptha attack and generate a codec event
---

diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index 13affde24..e6d7b44a4 100644
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -38,6 +38,14 @@
 #define CD_TCP_NAME "tcp"
 #define CD_TCP_HELP "support for transmission control protocol"
 
+#ifdef WORDS_BIGENDIAN
+    const uint32_t naptha_seq = 0x005c7b2a;
+    const uint16_t naptha_id = 0x019d;
+#else
+    const uint32_t naptha_seq = 0x2a7b5c00;
+    const uint16_t naptha_id = 0x9d01;
+#endif
+
 using namespace tcp;
 
 namespace
@@ -227,12 +235,9 @@ bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
         /* check if only SYN is set */
         if ( tcph->th_flags == TH_SYN )
         {
-            if ( tcph->th_seq == 6060842 )
+            if ((tcph->th_seq == naptha_seq) and (snort.ip_api.get_ip4h()->ip_id  == naptha_id))
             {
-                if ( snort.ip_api.id() == 413 )
-                {
-                    codec_event(codec, DECODE_DOS_NAPTHA);
-                }
+                codec_event(codec, DECODE_DOS_NAPTHA);
             }
         }