ips/drop-log: fix crash on logging drops

When logging drops for fragmented UDP packets, triggered by detection
in the reassembled packet, a missing check could lead to access of the
packets UDP header pointer when it was NULL.
pull/1790/head
Victor Julien 11 years ago
parent 136c6440c8
commit 64017cd29b

@ -224,6 +224,7 @@ static int LogDropLogNetFilter (ThreadVars *tv, const Packet *p, void *data)
switch (proto) { switch (proto) {
case IPPROTO_TCP: case IPPROTO_TCP:
if (PKT_IS_TCP(p)) {
fprintf(dlt->file_ctx->fp, " SPT=%"PRIu16" DPT=%"PRIu16" " fprintf(dlt->file_ctx->fp, " SPT=%"PRIu16" DPT=%"PRIu16" "
"SEQ=%"PRIu32" ACK=%"PRIu32" WINDOW=%"PRIu32"", "SEQ=%"PRIu32" ACK=%"PRIu32" WINDOW=%"PRIu32"",
GET_TCP_SRC_PORT(p), GET_TCP_DST_PORT(p), TCP_GET_SEQ(p), GET_TCP_SRC_PORT(p), GET_TCP_DST_PORT(p), TCP_GET_SEQ(p),
@ -236,11 +237,14 @@ static int LogDropLogNetFilter (ThreadVars *tv, const Packet *p, void *data)
fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_FIN(p) ? " FIN" : ""); fprintf(dlt->file_ctx->fp, TCP_ISSET_FLAG_FIN(p) ? " FIN" : "");
fprintf(dlt->file_ctx->fp, " RES=0x%02"PRIu8" URGP=%"PRIu16"", fprintf(dlt->file_ctx->fp, " RES=0x%02"PRIu8" URGP=%"PRIu16"",
TCP_GET_RAW_X2(p->tcph), TCP_GET_URG_POINTER(p)); TCP_GET_RAW_X2(p->tcph), TCP_GET_URG_POINTER(p));
}
break; break;
case IPPROTO_UDP: case IPPROTO_UDP:
if (PKT_IS_UDP(p)) {
fprintf(dlt->file_ctx->fp, " SPT=%"PRIu16" DPT=%"PRIu16"" fprintf(dlt->file_ctx->fp, " SPT=%"PRIu16" DPT=%"PRIu16""
" LEN=%"PRIu16"", UDP_GET_SRC_PORT(p), " LEN=%"PRIu16"", UDP_GET_SRC_PORT(p),
UDP_GET_DST_PORT(p), UDP_GET_LEN(p)); UDP_GET_DST_PORT(p), UDP_GET_LEN(p));
}
break; break;
case IPPROTO_ICMP: case IPPROTO_ICMP:
if (PKT_IS_ICMPV4(p)) { if (PKT_IS_ICMPV4(p)) {

@ -114,6 +114,7 @@ static int DropLogJSON (JsonDropLogThread *aft, const Packet *p)
} }
switch (proto) { switch (proto) {
case IPPROTO_TCP: case IPPROTO_TCP:
if (PKT_IS_TCP(p)) {
json_object_set_new(djs, "tcpseq", json_integer(TCP_GET_SEQ(p))); json_object_set_new(djs, "tcpseq", json_integer(TCP_GET_SEQ(p)));
json_object_set_new(djs, "tcpack", json_integer(TCP_GET_ACK(p))); json_object_set_new(djs, "tcpack", json_integer(TCP_GET_ACK(p)));
json_object_set_new(djs, "tcpwin", json_integer(TCP_GET_WINDOW(p))); json_object_set_new(djs, "tcpwin", json_integer(TCP_GET_WINDOW(p)));
@ -125,9 +126,12 @@ static int DropLogJSON (JsonDropLogThread *aft, const Packet *p)
json_object_set_new(djs, "fin", TCP_ISSET_FLAG_FIN(p) ? json_true() : json_false()); json_object_set_new(djs, "fin", TCP_ISSET_FLAG_FIN(p) ? json_true() : json_false());
json_object_set_new(djs, "tcpres", json_integer(TCP_GET_RAW_X2(p->tcph))); json_object_set_new(djs, "tcpres", json_integer(TCP_GET_RAW_X2(p->tcph)));
json_object_set_new(djs, "tcpurgp", json_integer(TCP_GET_URG_POINTER(p))); json_object_set_new(djs, "tcpurgp", json_integer(TCP_GET_URG_POINTER(p)));
}
break; break;
case IPPROTO_UDP: case IPPROTO_UDP:
if (PKT_IS_UDP(p)) {
json_object_set_new(djs, "udplen", json_integer(UDP_GET_LEN(p))); json_object_set_new(djs, "udplen", json_integer(UDP_GET_LEN(p)));
}
break; break;
case IPPROTO_ICMP: case IPPROTO_ICMP:
if (PKT_IS_ICMPV4(p)) { if (PKT_IS_ICMPV4(p)) {

Loading…
Cancel
Save