CVS log for snort/src/preprocessors/spp_frag3.c
	Help

Request diff between arbitrary revisions

Final RC merge. Includes copyright changes.

Final RC merge. Includes copyright changes.

Snort 2.8.6 RC commit

Numerous updates for 2.8.6 RC

Snort 2.8.6 Beta initial commit.

Merged 2.8.5 branch into HEAD for release.

Updating from 2.8.5 RC to 2.8.5 almost-final. Expecting another commit before drop to QA.

Merging the latest chages to HEAD into the SNORT_2_8_5 branch for RC.

Update for Snort 2.8.5 RC

Updating open-source CVS for Snort 2.8.5 beta release.

Thought I was checking into 2_8_4 and HEAD but 2.8.4 was actually head.  Anyway, not going through the business again.  See HEAD checkins for comments

Added rule and preprocessor filtering by protocol so that traffic will not be evaluated for which there are no rules or preprocessors interested in that traffic.

Added rule and preprocessor filtering by protocol so that traffic will not be evaluated for which there are no rules or preprocessors interested in that traffic.

* IPv6 updates and support for sfportscan, ftp_telnet, frag3 and dns preprocessors and adaptive IPS.
* Harden rule option tree code.

Change log, build

Change log, build

Fix MPLS fragmentation reassembly issue.

Fix MPLS fragmentation reassembly issue.

Added MPLS decoding support.

Fix typos.  Thanks to rmkml for pointing this out.

Fix typos.  Thanks to rmkml for pointing this out.

Pattern Matcher Caching & Rule Processing Performance Improvements.

Update frag3 to remove enforcement of ttl_limit. Add preprocessor alert for min_ttl anomaly.

Update frag3 to remove enforcement of ttl_limit. Add preprocessor alert for min_ttl anomaly.

* Win32 complier warning cleanup.

* Win32 complier warning cleanup.

more 2008 updates

more year 2008 updates

more year updates

Added IP in IP encapsulation support for both IPv4 and IPv6.

Added IP in IP encapsulation support for both IPv4 and IPv6.

Code cleanup

Code cleanup

* Snort can now read multiple pcaps on the command line.  The '-r' flag can be given multiple times, as well as options for reading a list of pcaps on the command line, a file containing pcaps to read and/or a directory to recurse through gathering pcaps.  Multiple filters can be used and an option to reset Snort to a post initialization state for each pcap read can be given.
* Fixed issue where frag3 does not initialize correctly without any configuration arguments.  Thanks to Jason Carr for reporting this.

* Handle VLAN tags in fragmented traffic and include in rebuilt packets if
  part of original traffic.

* Handle VLAN tags in fragmented traffic and include in rebuilt packets if
  part of original traffic.

* Added experimental support for Target-Based processing for Stream
  reassembly, IP Frag reassembly, and rule processing.
* Added 1st phase of support for IPv6.

* Added experimental support for Target-Based processing for Stream
  reassembly, IP Frag reassembly, and rule processing.
* Added 1st phase of support for IPv6.

License changes

License changes

* Fix configuration parsing to validate parameters for memcap,
  max_frags, prealloc_frags.

* Fix configuration parsing to validate parameters for memcap,
  max_frags, prealloc_frags.

* Update to not change original packet buffer when rebuilding fragments
  with IP options.

* Update to not change original packet buffer when rebuilding fragments
  with IP options.

* Added code to cleanup memory at Snort exit/restart.

* Added code to cleanup memory at Snort exit/restart.

* Further update to handle iptables (and other datalink layers) that
  do not have ethernet headers to be included in rebuilt fragment.
* Cleanup to use safe snprintf and strncpy functions, check return values
  of SafeMemcpy, use calloc or SnortAlloc, and other static size buffer
  bounds checks.  Add handling for FatalError not returning for static
  code analysis tools.

* Further update to handle iptables (and other datalink layers) that
  do not have ethernet headers to be included in rebuilt fragment.
* Cleanup to use safe snprintf and strncpy functions, check return values
  of SafeMemcpy, use calloc or SnortAlloc, and other static size buffer
  bounds checks.  Add handling for FatalError not returning for static
  code analysis tools.

* Handle readback mode when compiled for IPFW or IPQ.

* Cleanup to use safe snprintf functions, check return values of SafeMemcpy,      and other static size buffer bounds checks.  Update Stream4 session
  management.

* Further update to handle iptables (and other datalink layers) that
  do not have ethernet headers to be included in rebuilt fragment.

* Fix issue when on iptables, ethernet header doesn't exist.  Should not
  occur since with iptables, OS is supposed to do fragment reassembly.

* Fix issue when on iptables, ethernet header doesn't exist in rebuilt frag.
  Should not see fragments since with iptables, OS is supposed to do fragment
  reassembly.

* Fix issue when on iptables, ethernet header doesn't exist in rebuilt frag.
  Should not see fragments since with iptables, OS is supposed to do fragment
  reassembly.

* Cleanup of GRE code for GRE nested fragments.
* Code cleanup, change malloc to calloc, use safer functions
  SnortAlloc, SnortStrdup.  Check pointers before use.

* Added support to decode GRE encapsulated traffic.  Only IP as transport
  protocol is supported and only one layer of encapsulation will be
  decoded - packets with multiple GRE headers will be discarded.
* Added support for communcation with an Aruba Networks wireless
  mobility authentication/access control system.

* Added support to decode GRE encapsulated traffic.  Only IP as transport
  protocol is supported and only one layer of encapsulation will be
  decoded - packets with multiple GRE headers will be discarded.
* Added support for communcation with an Aruba Networks wireless
  mobility authentication/access control system.

* Fix memory leak in ascii and cmg output modules.
  Remove calls to ClearDumpBuf() from related calls
  PrintIPPkt() and PrintNetData(), as it is no longer
  needed.
* Fix reassembly issue in Stream4 with midstream pickups to
  previous changes as part of adding DNS.

* Fix memory leak in ascii and cmg output modules.
  Remove calls to ClearDumpBuf() from related calls
  PrintIPPkt() and PrintNetData(), as it is no longer
  needed.
* Fix reassembly issue in Stream4 with midstream pickups to
  previous changes as part of adding DNS.

* Fix memory leak in ascii and cmg output modules.
  Remove calls to ClearDumpBuf() from related calls
  PrintIPPkt() and PrintNetData(), as it is no longer
  needed.
* Fix reassembly issue in Stream4 with midstream pickups to
  previous changes as part of adding DNS.

* Code cleanup, 2.6.1 Beta prep.

* Fix race condition with daemonization.
* Add support for correct shared library extensions on HP & MAC

Change some frag3 log messages to debug messages.

* Handle pass rule that hits a pipelined URI and an alert
  that matches a secondary pipelined URI.
* Fix issue with Frag3 First policy when dealing with whole overlaps.
* Performance improvement for logging tagged packets from rebuilt Streams.

* Handle pass rule that hits a pipelined URI and an alert
  that matches a secondary pipelined URI.
* Fix issue with Frag3 First policy when dealing with whole overlaps.
* Performance improvement for logging tagged packets from rebuilt Streams.

* Further code review cleanup.  Cleanup possible null pointer
  dereferences, memory leaks, etc.
* Move SPARC_TWIDDLE to common place.

* Further code review cleanup.  Cleanup possible null pointer
  dereferences, memory leaks, etc.
* Move SPARC_TWIDDLE to common place.

* Further code review cleanup.  Cleanup possible null pointer
  dereferences, memory leaks, etc.

* Further code review cleanup.  Cleanup possible null pointer
  dereferences, memory leaks, etc.

* Correctly calculate the number of preallocated frags when
  preallocating based on a memory limit.

* Correctly calculate the number of preallocated frags when
  preallocating based on a memory limit.

* Added Fatal error messages for unknown config options.

* Added Fatal error messages for unknown config options.

* Added option for frag3 preallocation by memcap.

* Added option for frag3 preallocation by memcap.

* Fix ip_options processing in Frag3.

* Fixed a few warnings and noisy messages.

* Fixed a few warnings and noisy messages.

* Fix Frag3 IPOptions processing.
* Fix FTPTelnet option parsing.

* Fix Frag3 IPOptions processing.
* Fix FTPTelnet option parsing.

* Properly handled timeout fragments.  Purge old data and
  mark FragTracker as if it were just created with the newly
  received fragment.

* Properly handled timeout fragments.  Purge old data and
  mark FragTracker as if it were just created with the newly
  received fragment.

* Change noisy LogMessage to Debug.

* Change noisy LogMessage to Debug.

* Updated for preprocessor protocol ordering.
* Added performance measurements.

* Allow value of 0 to be used with -G flag
* Fix memory leak and mishandling of IP Options in Frag3

* Allow value of 0 to be used with -G flag
* Fix memory leak and mishandling of IP Options in Frag3

* Fixes to better handle various targets and extensions to
  the Shankar/Paxson model.

* Fixes to better handle various targets and extensions to
  the Shankar/Paxson model.

* Mark -z as to be deprecated
* Frag3 update

1) Mark -z as to be deprecated
2) Frag3 update

Removing unnecessary debugging info.

Removing unnecessary debugging info.

* Fix Frag3 Teardrop alerts to only fire in overlap conditions.
* Add Deprecation warning to obsolete Portscan Preprocessors.
* Disallow use of -T & -D

* Fix Frag3 Teardrop alerts to only fire in overlap conditions.
* Add Deprecation warning to obsolete Portscan Preprocessors.
* Disallow use of -T & -D

* Frag3 policy fix.

* Frag3 policy fix.

Fix previous checkin that removed snort head features from frag3.

* Update frag3 with fix for Solaris policy & update README
* Fix docs & code comments for sfportscan ip proto config
* Fix broken -T option to verify rules as it used to
* Prelude startup patch

* Update frag3 with fix for Solaris policy & update README
* Fix docs & code comments for sfportscan ip proto config
* Fix broken -T option to verify rules as it used to
* Prelude startup patch

* Frag3: Update to handle additional overlap conditions, multiple 'last
  frag'.  Added windows & solaris target policies since they are different
  (and not always 'first').
* Fixed issues with Solaris & 64 bit platforms
* Wrap same src/dst & loopback alerts in decoder alert & IDS Mode checks.
* Updated content detection plugin when rechecking for a content to start at
  the correct place.

* Frag3: Update to handle additional overlap conditions, multiple 'last
  frag'.  Added windows & solaris target policies since they are different
  (and not always 'first').
* Fixed issues with Solaris & 64 bit platforms
* Wrap same src/dst & loopback alerts in decoder alert & IDS Mode checks.
* Updated content detection plugin when rechecking for a content to start at
  the correct place.

* Rollover perf stats file on signal
* Frag3 Performance improvements
* Fix log messages in sp_byte_jump
* Convert ICMP Router Advertisement time to host byte order before printing

* Rollover perf stats file on signal
* Frag3 Performance improvements
* Fix log messages in sp_byte_jump
* Convert ICMP Router Advertisement time to host byte order before printing

* Handle case when Packet pointer is NULL for Portscan alerts.
* Fixed processing of fragmented UDP traffic.

* Handle case when Packet pointer is NULL for Portscan alerts.
* Fixed processing of fragmented UDP traffic.

* Added processing of IP Options in fragmented packets.
* Fixed potential stream4 memory corruption.
* Fixed problem with parsing IP addresses of 255.255.255.255 for rules.
* Fixed compile warnings on some architectures.

* Added processing of IP Options in fragmented packets.
* Fixed potential stream4 memory corruption.
* Fixed problem with parsing IP addresses of 255.255.255.255 for rules.
* Fixed compile warnings on some architectures.

* Sync win32 fixes

* Increase  limit  on  number  of rule options to 256 (was 64).
  Report error if limit is reached -- previously,  extra  options
  were ignored.  Also increased max line length to 4096 chars, from
  1024.
* Bugfix for PowerPC architecture.

* Add snort's PID to syslog. Thanks Steve Sturges.
* Added to default ports in Stream4 and cleaned up Stream4
  configuration processing. Thanks Steve Sturges.
* Added packet dump (debug only) to Frag3. Patch from Steve Sturges.
* Added detail to config error messages for thresholding. Patch from
  Steve Sturges.
* Added schemas to distro, and 'sharedscripts' to logrotate. General
  clean up of spec file. Thanks Josh Kelley for pointing this out.

* Add snort's PID to syslog. Thanks Steve Sturges.
* Added to default ports in Stream4 and cleaned up Stream4
  configuration processing. Thanks Steve Sturges.
* Added packet dump (debug only) to Frag3. Patch from Steve Sturges.
* Added detail to config error messages for thresholding. Patch from
  Steve Sturges.
* Added schemas to distro, and 'sharedscripts' to logrotate. General
  clean up of spec file. Thanks Josh Kelley for pointing this out.

* Updates/Fixes to Frag3 IP reassembler (thanks ssturges):
  1) Push first fragmented UDP packet through, but do not inspect
  other fragmented packets (until rebuilt).
  2) Printing of Configuration Info
  3) Code readability
* Removal of comment parsing code added for 2.3.1.
* Added support for detection of Lookback & Same src/dest attacks in
  the packet decoder. This obsoletes sids 527, 528. Thanks Marc
  Norton for the feature.
* Added FTP Bounce detection Plugin. Thanks Steve Sturges.
* Increased Flowbits hash table size. Thanks Marc Norton.
* Performance improvement in pattern matcher from Marc Norton.
* Eliminate duplicate alerts on Rebuilt Streams/IP reassembled packets.
* Patch from Andy Mullican and Steve Sturges.
* Added handling of midstream sessions in portscan preprocessors.
  Thanks Andy Mullican.
* Stream4 fixes - Handle PAWS, NULL TCP Flags in established session,
  limit overlaps in established session, update ACK when server sends
  RST. Performance changes for cleaning up session cache. Thanks
  Steve Sturges and Andy Mullican for the patches.
* Added uri_tab_delimiter option to HttpInspect. Patch from Andy
  Mullican.
* Updates to PerfMon to handle multiple CPUs properly. Thanks Steve Sturges.
* Fixed telnet decoder bug when ignoring Sub-negotiation end command.
  Thanks Steve Sturges.

* Snort 2.4 CVS branch, build 1.
* Added support for detection of Lookback & Same src/dest attacks in
  the packet decoder. This obsoletes sids 527, 528. Thanks Marc
  Norton for the feature.
* Added global ignore ports feature. Thanks Andy Mullican for the feature. Usage:
* Provide ability for 3rd party code to take action when Snort
  indicates a packet should be dropped. Thanks Marc Norton.
* Added FTP Bounce detection Plugin. Thanks Steve Sturges for this feature.
* Performance improvement in pattern matcher from Marc Norton.
* Eliminate duplicate alerts on rebuilt streams/IP reassembled packets.
  Thanks Andy Mullican and Steve Sturges.
* Added better determination of direction for Back Orifice packets.
  Thanks Andy Mullican.
* Added handling of midstream sessions in portscan preprocessors.
  Thanks Andy Mullican.
* Stream4 fixes - Handle PAWS, NULL TCP Flags in established session,
  limit overlaps in established session, update ACK when server sends
  RST. Performance changes for cleaning up session cache. Thanks
  Steve Sturges and Andy Mullican for the patches.
* Added uri_tab_delimiter option to HttpInspect. Thanks Andy
  Mullican.
* Added categories (wire, ip defrag, tcp rebuilt, app layer) to
  PerfMon.  Also added atexitonly option to dump stats for entire life
  of snort. Thanks Steve Sturges.
* Fixed telnet decoder bug when ignoring Sub-negotiation end command.
  Thanks Steve Sturges.

* Fixed compiler warnings and code formatting.
* In Inline mode, if the 'Q' option is set, set a global variable that
  can be used externally (droelker).
* Added ability to ignore packets based on port (amullican).
* Added two BackOrifice alerts (1 client, 1 server) so that some
  alerts can be suppressed (amullican).
* Performance fixes to get correct 'on-the-wire' statistics (ssturges).
* Added 'atexitonly' option for perfmonitor that results in
  performance stats only being dumped when snort exits,
  rather than periodically throughout snort's lifetime (ssturges).
* Change to verify that preprocessors (httpinspect, frag3) have
  sufficient configuration data to correctly operate (ssturges).
* Fixes to Frag3 to only have one instance of preprocessor.
  Uses policy context internally based on destination address of
  packet.  Previously, each Frag3 Policy would result in a separate
  preprocessor instance.  Also fixed use of ttl_limit option (ssturges).
* Fixed issues with how telnet options are handled (ssturges).

* Fixed issue with sfPortscan reporting incorrect IP datagram length.
  Thanks Jon Hart for the test case and finding the bug.
* Threshold/Suppression now prints properly when logging to syslog.
  Thanks Sekure for pointing out the problem.
* Threshold memcap argument now correctly handles non-integer input.
  Thanks nnposter for the patch.
* Fixed issue reported by Allan Jensen where on MacOS X ppp links were
  not decoded properly.
* Fixed parsing of frag3 options to use space delimited options
  to handle IP address lists correctly.
* Win32 updates from Chris Reid

* Added --enable-64bit-gcc to set up the build environment for 64bit
  (tested only on Solaris9). Still are some memory alignment issues
  to work out before 64bit mode is fully functional, Patches are
  welcomed.
* Fixed reference times to match log time for first packet, for an event
  generated by a reassembled packet.  Incremented event ID to give
  unique ID for each packet.  Also made unified logging compatible with
  Windows (Andrew Mullican).
* Policy fixes to Frag3 from Marty.

* src/preprocessors/spp_frag3.c:
    Fixed a bad pointer dereference that could lead to a crash in
    Frag3FraglistAddNode()

* Minor updates to frag3. Looks like more than what it is.

* Adding Marty's frag3 preprocessor
* sfPortscan doc update