From: Russ Combs (rucombs) Date: Wed, 30 Mar 2016 20:54:00 +0000 (-0400) Subject: Merge pull request #381 in SNORT/snort3 from bug_fixes1 to master X-Git-Tag: 3.0.0-233~493 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e0ff5fe78a7541ee7ae63cc91c511faddac16b72;p=thirdparty%2Fsnort3.git Merge pull request #381 in SNORT/snort3 from bug_fixes1 to master Squashed commit of the following: commit c5e9690c300e1d28fca5e5fcfa96c25e6a08d200 Author: Steve Chew Date: Wed Mar 30 15:58:16 2016 -0400 Updates based on reviews. commit 98cad5e2a1ac5b49cfed171b2366d0307c852a4b Author: Steve Chew Date: Wed Mar 30 13:43:27 2016 -0400 Bug fixes for problems found while investigating protocol usage. --- diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc index ccabd9ec8..2fc572575 100644 --- a/src/protocols/layer.cc +++ b/src/protocols/layer.cc @@ -20,7 +20,6 @@ #include "layer.h" #include -#include #include "protocols/layer.h" #include "protocols/protocol_ids.h" #include "protocols/packet.h" @@ -238,9 +237,7 @@ bool set_inner_ip_api(const Packet* const p, if (curr_layer < 0 || curr_layer >= p->num_layers) return false; - const uint16_t proto = p->layers[curr_layer].prot_id; - const uint8_t ip_proto_max = std::numeric_limits::max(); - if ( (proto <= ip_proto_max) && is_ip6_extension((uint8_t)proto) ) + if (is_ip6_extension(p->layers[curr_layer].prot_id)) { const ip::IP6Extension* const ip6_ext = reinterpret_cast(p->layers[curr_layer].start); diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h index c5e4f3624..497dcbc69 100644 --- a/src/protocols/protocol_ids.h +++ b/src/protocols/protocol_ids.h @@ -92,8 +92,11 @@ constexpr uint16_t ETHERTYPE_PPP = 0x880B; constexpr uint16_t ETHERTYPE_EAPOL = 0x888e; constexpr uint16_t ETHERTYPE_FPATH = 0x8903; -inline bool is_ip6_extension(const uint8_t proto) +inline bool is_ip6_extension(const uint16_t proto) { + if(proto > UINT8_MAX) + return false; + switch (proto) { case IPPROTO_ID_HOPOPTS: diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc index c778f9fd8..57a82757f 100644 --- a/src/service_inspectors/ftp_telnet/pp_ftp.cc +++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc @@ -1090,8 +1090,8 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p, stream.ignore_session( &session->clientIP, session->clientPort, &session->serverIP, session->serverPort, - p->type(), FtpDataFlowData::flow_id, - SSN_DIR_BOTH); + p->type(), SSN_DIR_BOTH, + FtpDataFlowData::flow_id); } } } @@ -1162,8 +1162,8 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p, stream.ignore_session( &session->clientIP, session->clientPort, &session->serverIP, session->serverPort, - p->type(), FtpDataFlowData::flow_id, - SSN_DIR_BOTH); + p->type(), SSN_DIR_BOTH, + FtpDataFlowData::flow_id); } } } diff --git a/src/service_inspectors/sip/sip_dialog.cc b/src/service_inspectors/sip/sip_dialog.cc index 805e3915d..13fc18879 100644 --- a/src/service_inspectors/sip/sip_dialog.cc +++ b/src/service_inspectors/sip/sip_dialog.cc @@ -419,7 +419,7 @@ static int SIP_ignoreChannels(SIP_DialogData* dialog, Packet* p, SIP_PROTO_CONF* else { stream.ignore_session(&mdataA->maddress, mdataA->mport, &mdataB->maddress, - mdataB->mport, p->type(), SipFlowData::flow_id, SSN_DIR_BOTH); + mdataB->mport, p->type(), SSN_DIR_BOTH, SipFlowData::flow_id); } sip_stats.ignoreChannels++; mdataA = mdataA->nextM; diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc index 1285a15b8..8f59d8909 100644 --- a/src/target_based/sftarget_reader.cc +++ b/src/target_based/sftarget_reader.cc @@ -217,7 +217,7 @@ static void PrintHostAttributeEntry(HostAttributeEntry* host) for (i=0, app = host->services; app; app = app->next,i++) { DebugFormat(DEBUG_ATTRIBUTE, "\tService #%d:\n", i); - DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tPort: %s\tProtocol %s\n", + DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %d\tPort: %d\tProtocol %d\n", app->ipproto, app->port, app->protocol); } if (i==0) @@ -227,12 +227,12 @@ static void PrintHostAttributeEntry(HostAttributeEntry* host) for (i=0, app = host->clients; app; app = app->next,i++) { DebugFormat(DEBUG_ATTRIBUTE, "\tClient #%d:\n", i); - DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tProtocol %s\n", + DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %d\tProtocol %d\n", app->ipproto, app->protocol); if (app->fields & APPLICATION_ENTRY_PORT) { - DebugFormat(DEBUG_ATTRIBUTE, "\t\tPort: %s\n", app->port); + DebugFormat(DEBUG_ATTRIBUTE, "\t\tPort: %d\n", app->port); } } if (i==0) diff --git a/src/target_based/snort_protocols.h b/src/target_based/snort_protocols.h index 326310fc8..9acf0f60e 100644 --- a/src/target_based/snort_protocols.h +++ b/src/target_based/snort_protocols.h @@ -32,6 +32,7 @@ // other protos are added dynamically as used enum SnortProtocols { + // The is_*_protocol functions depend on the order of these enums. SNORT_PROTO_IP = 1, SNORT_PROTO_ICMP, SNORT_PROTO_TCP, @@ -48,7 +49,7 @@ inline bool is_builtin_protocol(int16_t proto) { return proto < SNORT_PROTO_MAX; } inline bool is_service_protocol(int16_t proto) -{ return !is_network_protocol(proto); } +{ return proto > SNORT_PROTO_UDP; } void InitializeProtocolReferenceTable(void); void FreeProtoocolReferenceTable(void);