Commit Graph

102 Commits (64405ae194d8ab4fa73de223d35a8e521c66b23d)

Author SHA1 Message Date
Jason Ish 796dd5223b tests: no longer necessary to provide successful return code
1 pass, 0 is fail.
9 years ago
Victor Julien 8f4eff5f50 defrag: fix bad packet error handling
When defrag creates a new reassembled IP packet, it then passes this
packet to the IP decoder. If this decoder returns an error the packet
is returned back to the packet pool with a call to TmqhOutputPacketpool

This lead to the first problem. The returned packet had it's p->root
pointer set, and it's PKT_TUNNEL flag set. This could cause problems
in TmqhOutputPacketpool, as this may reference the packet referenced
in p->root.

The second and more glaring problem is that the packet that was
returned to the packetpool, was still returned by the Defrag function
and processed further. It would then at the end of it's processing
be returned to the packet pool, which at this point already had a
reference to this packet.

This patch fixes both issues by unsetting the tunnel references and
returning NULL from Defrag in this case.
10 years ago
Eric Leblond d367750633 defrag: free defrag tree at exit
This fixes:

72 bytes in 3 blocks are definitely lost in loss record 153 of 316
   at 0x4C29C0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x9AF041: SCRadixCreateRadixTree (util-radix-tree.c:430)
   by 0x50FF5D: DefragPolicyLoadFromConfig (defrag-config.c:138)
   by 0x5129F5: DefragInit (defrag.c:962)
   by 0x87ECFD: UnixSocketPcapFilesCheck (runmode-unix-socket.c:386)
   by 0x90FEC0: UnixCommandBackgroundTasks (unix-manager.c:430)
   by 0x913C6D: UnixManager (unix-manager.c:980)
   by 0x9072F3: TmThreadsManagement (tm-threads.c:602)
   by 0x68DE283: start_thread (pthread_create.c:333)
   by 0x80A6A4C: clone (in /lib/x86_64-linux-gnu/libc-2.21.so)
10 years ago
Victor Julien 4d83318b46 defrag tests: fix compiler warnings
defrag.c:2423:9: error: variable 'p' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2460:9: note: uninitialized use occurs here
    if (p != NULL) {
        ^
defrag.c:2423:5: note: remove the 'if' if its condition is always false
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2423:9: error: variable 'p' is used uninitialized whenever '||' condition is true [-Werror,-Wsometimes-uninitialized]
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2460:9: note: uninitialized use occurs here
    if (p != NULL) {
        ^
defrag.c:2423:9: note: remove the '||' if its condition is always false
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2423:9: error: variable 'p' is used uninitialized whenever '||' condition is true [-Werror,-Wsometimes-uninitialized]
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~
defrag.c:2460:9: note: uninitialized use occurs here
    if (p != NULL) {
        ^
defrag.c:2423:9: note: remove the '||' if its condition is always false
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~
defrag.c:2427:5: note: variable 'p' is declared here
    Packet *p = Defrag(NULL, NULL, p1, NULL);
    ^
defrag.c:2486:9: error: variable 'p' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2523:9: note: uninitialized use occurs here
    if (p != NULL) {
        ^
defrag.c:2486:5: note: remove the 'if' if its condition is always false
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2486:9: error: variable 'p' is used uninitialized whenever '||' condition is true [-Werror,-Wsometimes-uninitialized]
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2523:9: note: uninitialized use occurs here
    if (p != NULL) {
        ^
defrag.c:2486:9: note: remove the '||' if its condition is always false
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
defrag.c:2486:9: error: variable 'p' is used uninitialized whenever '||' condition is true [-Werror,-Wsometimes-uninitialized]
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~
defrag.c:2523:9: note: uninitialized use occurs here
    if (p != NULL) {
        ^
defrag.c:2486:9: note: remove the '||' if its condition is always false
    if (p1 == NULL || p2 == NULL || p3 == NULL) {
        ^~~~~~~~~~~~~
defrag.c:2490:5: note: variable 'p' is declared here
    Packet *p = Defrag(NULL, NULL, p1, NULL);
    ^
6 errors generated.
make[3]: *** [defrag.o] Error 1
10 years ago
Jason Ish 6f223c6dba defrag: stop reassembly at the first packet with more flags not set 10 years ago
Jason Ish ed400acf8e defrag: unit test for tracker reuse (current fails)
Will be fixed in subsequent commits as tracker reuse is fixed.
10 years ago
Victor Julien 1c0b4ee0ae counters: s/SCPerfCounterIncr/StatsIncr/g 10 years ago
Victor Julien e9b067c1eb counters: make increment call take threadvars
This hides the implementation from the caller.
10 years ago
Victor Julien 9a8bff7d96 counters: threadvars s/sc_perf_pca/perf_private_ctx/g 10 years ago
Victor Julien bcfd61416f Fix a fix: defrag OOM condition
** CID 1257764:  Dereference after null check  (FORWARD_NULL)
/src/defrag.c: 291 in Defrag4Reassemble()

** CID 1257763:  Dereference after null check  (FORWARD_NULL)
/src/defrag.c: 409 in Defrag6Reassemble()

In the error case 'rp' can be both NULL or non-NULL.
11 years ago
Victor Julien f8f2ff49de defrag: don't crash when out of memory
Handle memory allocation errors in defrag better. Could lead to
crashes if malloc errors happened.
11 years ago
Victor Julien 9fd96f531a ipv6: convert ext header pointers to const
To prevent accidental writes into the orignal packet buffer, use
const pointers for the extension header pointers used by IPv6. This
will cause compiler warnings in case of writes.
11 years ago
Victor Julien 2b84cd9483 defrag: use 'struct timeval' for timeout tracking
Until now the time out handling in defrag was done using a single
uint32_t that tracked seconds. This lead to corner cases, where
defrag trackers could be timed out a little too early.
11 years ago
Victor Julien 83b031b4e0 ipv6 defrag: fix unfragmentable exthdr handling
Fix or rather implement handling of unfragmentable exthdrs in ipv6.
The exthdr(s) appearing before the frag header were copied into the
reassembled packet correctly, however the stripping of the frag header
did not work correctly.

Example:
The common case is a frag header directly after the ipv6 header:

[ipv6 header]->[frag header]->[icmpv6 (part1)]
[ipv6 header]->[frag header]->[icmpv6 (part2)]

This would result in:
[ipv6 header]->[icmpv6]

The ipv6 headers 'next header' setting would be updated to point to
whatever the frag header was pointing to.

This would also happen when is this case:

[ipv6 header]->[hop header]->[frag header]->[icmpv6 (part1)]
[ipv6 header]->[hop header]->[frag header]->[icmpv6 (part2)]

The result would be:
[ipv6 header]->[hop header]->[icmpv6]

However, here too the ipv6 header would have been updated to point
to what the frag header pointed at. So it would consider the hop header
as if it was an ICMPv6 header, or whatever the frag header pointed at.

The result is that packets would not be correctly parsed, and thus this
issue can lead to evasion.

This patch implements handling of the unfragmentable part. In the first
segment that is stored in the list for reassembly, this patch detects
unfragmentable headers and updates it to have the last unfragmentable
header point to the layer after the frag header.

Also, the ipv6 headers 'next hdr' is only updated if no unfragmentable
headers are used. If they are used, the original value is correct.

Reported-By: Rafael Schaefer <rschaefer@ernw.de>

Bug #1244.
11 years ago
Ken Steele 8f1d75039a Enforce function coding standard
Functions should be defined as:

int foo(void)
{
}

Rather than:
int food(void) {
}

All functions where changed by a script to match this standard.
11 years ago
Eric Leblond 97ca02f0c5 defrag: fix reconstruction
This patch is fixing an issue in defragmentation code. The
insertion of a fragment in the list of fragments is done with
respect to the offset of the fragment. But the code was using
the original offset of the fragment and not the one of the
new reconstructed fragment (which can be different in the
case of overlapping segment where the left part is trimmed).

This case could lead to some evasion techniques by causing
Suricata to analyse a different payload.
11 years ago
Jason Ish b8e13d4bd6 More concise API for setting config values that
can be overrided or not (final values).
12 years ago
Victor Julien 277fb61c1d defrag: clean up
Rename PacketDefragPktFinishSetup to PacketDefragPktSetupParent to
better refect it's function.
12 years ago
Eric Leblond 3fdf52239d defrag: don't modify packet if defrag fails
If defrag fails dur to an invalid decoding, we are not modifying
the origin packet anymore.
12 years ago
Giuseppe Longo f03278d132 feature #417: add support for configuration per host timeout value 12 years ago
Jason Ish 2953b3f640 Feature #901 - VLAN defrag support.
Take VLAN IDs into account when re-assembling fragments.

Prevents fragments that would otherwise match, but on different
VLANs from being reassembled with each other.
12 years ago
Victor Julien 3470b07ea5 Fix several compile and runtime warnings found by clang 3.2 with the -fsanitize=address option. 12 years ago
Victor Julien a698a7600d clang: fix warnings when debug is enabled 13 years ago
Anoop Saldanha b33986c887 Add a packet src for every packet generated inside suricata. 13 years ago
Eric Leblond e176be6fcc Use unlikely for error treatment.
When handling error case on SCMallog, SCCalloc or SCStrdup
we are in an unlikely case. This patch adds the unlikely()
expression to indicate this to gcc.

This patch has been obtained via coccinelle. The transformation
is the following:

@istested@
identifier x;
statement S1;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)";
@@

x = func(...)
... when != x
- if (x == NULL) S1
+ if (unlikely(x == NULL)) S1
13 years ago
Victor Julien 20d2db085e reintroduce pool free func for cases where block alloc is not used. 13 years ago
Victor Julien 7a044a99ee Defrag engine
Big rewrite of defrag engine to make it more scalable and fix some
locking logic flaws.

Now uses a hash of trackers similar to Flow and Host hashes.
13 years ago
Eric Leblond 937ba71491 defrag: don't return after a cleaning.
This patch changes the policy of the timeout function by cleaning
every timeouted trackers.
Previous code was only freeing the first tracker and this was resulting
in calling the timeout function continuously. One of my previous patch
has modified the function to avoid to run it more than twice a second.
But as it was not taken into account the fact only the first tracker was
freed, the result was that a lot of tracker could not be allocated.
13 years ago
Eric Leblond 619014a280 pool: rename Free function to Cleanup
This patch renames Free functions to Cleanup as the free is made
by the pool system.
13 years ago
Eric Leblond f241312a36 defrag: don't use message for repetitive error
When nothing can be fetch from the pool, this can repeat frequently.
Thus displaying a message in the log will not help. This patch
uses a counter instead of a log message. As this is a sort of memcap
this is conformed to what is done for other issues of the same type.
13 years ago
Victor Julien 829d975d63 Make sure defrag pool sizes are not initialized to 0, see #540. 13 years ago
Eric Leblond 4e6a4c65f6 defrag: be sure to output NULL tracker
Coverity 720337 pointed out a use after free. We can't be dependent
to HashListTableAdd outputting a NULL tracker.
13 years ago
Eric Leblond d3824bd1ab defrag: fix potential use after free.
Coverity pointed out that PoolReturn is almost like free and detected
a use after free when accessing to tracker->af (issue 720339).
This patch fixes this by storing the value in a local variable.
13 years ago
Eric Leblond 90052609ee defrag: avoid to run cleaning repetitively 13 years ago
Eric Leblond fa079c1da0 pool: realize a block allocation for preallocated item.
This patch required a evolution of Pool API as it is needed to
proceed to alloc or init separetely. The PoolInit has been changed
with a new Init function parameter.
13 years ago
Eric Leblond 09d893127e defrag: prealloc more frags. 13 years ago
Eric Leblond fd32159464 defrag: add some events relative to defragmentation 13 years ago
Eric Leblond d2aa0407c4 defrag: Fix unittest logic.
We've linked the size of hash with trackers. Thus calling DefragInit()
after setting the configuration variable is more logic.
13 years ago
Eric Leblond 0fd2c93c96 defrag: link hash size with number of frags.
We set defrag_hash_size by using the number of trackers. This is
effective to avoid collision.
13 years ago
Eric Leblond f328e18d59 defrag: fix some integer type warning. 13 years ago
Eric Leblond b1b4cd2729 defrag: really use 'max-frags' variable.
The 'max-frags' variable was not used and the 'trackers' variable was
not documented. This patch fixes the two issues.
13 years ago
Eric Leblond 4df509f87a defrag: use IP ID in hash
This patch fixes the collision issue observed on an intensive network
trafic. When there is fragmentation it is the case for all data
exchanged between two hosts. Thus using a hash func only involving
IP addresses (and protocol) was leading to a collision for all
exchanges between the hosts. At a larger scale, it was resulting in
a packet loss. By using the IP ID instead of the protocol family, we
introduce a real difference between the trackers.
13 years ago
Victor Julien 79691f675a defrag: don't increment recursion level for reassembled packets. Fixes defragged packets not seeing the same flow. 14 years ago
Victor Julien e237841a8e Fix compilation with profiling enabled. Minor unittest fixes. 14 years ago
Victor Julien cdba2f50d1 Various fixes and improvements based on feedback by Coverity analyzer. 14 years ago
Victor Julien 55da9787a4 Win32 compile fixes. 14 years ago
Eric Leblond 6bf15bac31 Fix various packet access.
The coccinelle based tests have detected invalid uses of access to
Packet data. This patch fixes the detected problems.
14 years ago
pilcrow ed69eeab14 Safer macro parenthesization and do/while use 14 years ago
Eric Leblond 7425bf5ca6 Rename some decode event structure and macro.
This patch renames DECODER_SET_EVENT, DECODER_ISSET_EVENT and some
other structures to ENGINE equivalent to take into account the fact
the event list is now related to all engines and not only to decoder.
14 years ago
Victor Julien 4025567a5a Fix a number of unittests not properly initializing a packet causing issues on some archs. 14 years ago