From: Russ Combs <rucombs@cisco.com>
Date: Wed, 22 Oct 2014 12:42:23 +0000 (-0400)
Subject: ip defrag fixes
X-Git-Tag: 3.0.0-233~1351
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a650ed2bad75c58800efdc2d71fd34b8b21ae38c;p=thirdparty%2Fsnort3.git

ip defrag fixes
---

diff --git a/ChangeLog b/ChangeLog
index e6ab5432d..7bbb9d206 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@
 -- pulled latest from tom
 -- added paramaters to doc reference section
 -- flow state updates
+-- ip defrag fixes
 
 125
 -- discovered can't catch exceptions thrown from Lua to C++; need to
diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index d63ddc7c5..49d07455b 100644
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -319,9 +319,9 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 
     /* if this packet isn't a fragment
      * or if it is, its a UDP packet and offset is 0 */
-    if(!(snort.decode_flags & DECODE_FRAG) ||
-        ((frag_off == 0) &&
-         (iph->get_proto() == IPPROTO_UDP)))
+    if(!(snort.decode_flags & DECODE_FRAG) /*||
+        ((frag_off == 0) &&  // FIXIT-M this forces flow to udp instead of ip
+         (iph->get_proto() == IPPROTO_UDP))*/)
     {
         if (iph->get_proto() >= MIN_UNASSIGNED_IP_PROTO)
             codec_events::decoder_event(codec, DECODE_IP_UNASSIGNED_PROTO);
diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 6b84a53dc..7f9b46f12 100644
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -2326,7 +2326,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
         ft->protocol = p->ptrs.ip_api.get_ip4h()->get_proto();
 
         const ip::IP4Hdr *ip4h = reinterpret_cast<const ip::IP4Hdr*>(lyr.start);
-        frag_off = ntohs(ip4h->get_off());
+        frag_off = ntohs(ip4h->get_off()) & 0x1FFF;
     }
     else /* IPv6 */
     {
@@ -2666,10 +2666,7 @@ inline int Defrag::expire(Packet*, FragTracker *ft, FragEngine *fe)
     /*
      * Check the FragTracker that was passed in first
      */
-    if(CheckTimeout(
-                pkttime,
-                &(ft)->frag_time,
-                fe) == FRAG_TIMEOUT)
+    if(CheckTimeout(pkttime, &(ft)->frag_time, fe) == FRAG_TIMEOUT)
     {
         /*
          * Oops, we've timed out, whack the FragTracker
diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc
index aa121ccb4..36065ace2 100644
--- a/src/stream/ip/ip_module.cc
+++ b/src/stream/ip/ip_module.cc
@@ -71,7 +71,10 @@ using namespace std;
     ",iny fragment"
 
 FragEngine::FragEngine()
-{ memset(this, 0, sizeof(*this)); }
+{ 
+    memset(this, 0, sizeof(*this));
+    frag_timeout = 60;
+}
 
 //-------------------------------------------------------------------------
 // stream_ip module
diff --git a/src/stream/ip/stream_ip.cc b/src/stream/ip/stream_ip.cc
index 6995ada62..130314ab2 100644
--- a/src/stream/ip/stream_ip.cc
+++ b/src/stream/ip/stream_ip.cc
@@ -40,7 +40,7 @@
 
 StreamIpConfig::StreamIpConfig()
 {
-    session_timeout = 30;
+    session_timeout = 60;
 }
 
 static void ip_show (StreamIpConfig* pc)