From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Tue, 17 Nov 2015 10:38:43 +0000 (-0500)
Subject: Merge pull request #136 in SNORT/snort3 from arpfix to master
X-Git-Tag: 3.0.0-233~726
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=aee6b9eafe9a55d2d4c8c07901b2cee56f3fd8a9;p=thirdparty%2Fsnort3.git

Merge pull request #136 in SNORT/snort3 from arpfix to master

Squashed commit of the following:

commit da42c8bafa4a46be209557e3f4654ecb6cf5bee9
Author: Steve Chew <stechew@cisco.com>
Date:   Mon Nov 16 18:04:19 2015 -0500

    Fix arp inspection bug
---

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index 1c3622464..8d72607ce 100644
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -793,7 +793,10 @@ void InspectorManager::execute(Packet* p)
 
     Flow* flow = p->flow;
 
-    if ( flow && flow->full_inspection() )
+    if ( !flow )
+        ::execute(p, fp->network.vec, fp->network.num);
+
+    else if ( flow->full_inspection() )
         full_inspection(fp, p);
 
     ::execute(p, fp->probe.vec, fp->probe.num);
diff --git a/src/protocols/arp.h b/src/protocols/arp.h
index 533eb759b..a18f2b61f 100644
--- a/src/protocols/arp.h
+++ b/src/protocols/arp.h
@@ -22,6 +22,7 @@
 
 namespace arp
 {
+
 struct ARPHdr
 {
     uint16_t ar_hrd;       /* format of hardware address   */
@@ -42,9 +43,10 @@ struct EtherARP
     };
     uint8_t arp_tha[6];    /* target hardware address */
     uint8_t arp_tpa[4];    /* target protocol address */
-};
+} __attribute__((__packed__));
 
 constexpr uint16_t ETHERARP_HDR_LEN = 28; /*  sizeof EtherARP != 28 */
+
 } // namespace arp
 
 #ifndef ARPOP_REQUEST