OISF/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-10-12 02:07:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

decode/tcp: only set data ptr for valid option lengths

Browse Source
This commit is contained in:
Victor Julien
2026-06-12 21:04:14 +00:00
parent 32414573a7
commit caa9ddaa26
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/decode-tcp.c
+17 -2
View File
@@ -79,8 +79,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
}
tcp_opts[tcp_opt_cnt].type = type;
tcp_opts[tcp_opt_cnt].len = olen;
tcp_opts[tcp_opt_cnt].data = (olen > 2) ? (pkt+2) : NULL;
tcp_opts[tcp_opt_cnt].len = olen;
/* we are parsing the most commonly used opts to prevent
* us from having to walk the opts list for these all the
@@ -90,6 +89,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
if (olen != TCP_OPT_WS_LEN) {
ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
if (p->l4.vars.tcp.wscale_set != 0) {
ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE);
} else {
@@ -107,6 +107,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
if (olen != TCP_OPT_MSS_LEN) {
ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
if (p->l4.vars.tcp.mss_set) {
ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE);
} else {
@@ -119,6 +120,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
if (olen != TCP_OPT_SACKOK_LEN) {
ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
if (TCP_GET_SACKOK(p)) {
ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE);
} else {
@@ -130,6 +132,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
if (olen != TCP_OPT_TS_LEN) {
ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
if (p->l4.vars.tcp.ts_set) {
ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE);
} else {
@@ -149,6 +152,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
!((olen - 2) % 8 == 0)) {
ENGINE_SET_EVENT(p, TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
if (p->l4.vars.tcp.sack_set) {
ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE);
} else {
@@ -166,6 +170,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
!(((olen - 2) & 0x1) == 0))) {
ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
if (p->l4.vars.tcp.tfo_set) {
ENGINE_SET_EVENT(p,TCP_OPT_DUPLICATE);
} else {
@@ -178,6 +183,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
case TCP_OPT_EXP2:
SCLogDebug("TCP EXP option, len %u", olen);
if (olen == 4 || olen == 12) {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
uint16_t magic = DecodeTCPGetU16(tcp_opts[tcp_opt_cnt].data);
if (magic == 0xf989) {
if (p->l4.vars.tcp.tfo_set) {
@@ -196,6 +202,7 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
if (olen != 18) {
ENGINE_SET_INVALID_EVENT(p,TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
/* we can't validate the option as the key is out of band */
p->l4.vars.tcp.md5_option_present = true;
}
@@ -206,10 +213,18 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
if (olen < 4) {
ENGINE_SET_INVALID_EVENT(p,TCP_OPT_INVALID_LEN);
} else {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
/* we can't validate the option as the key is out of band */
p->l4.vars.tcp.ao_option_present = true;
}
break;
default:
if (olen > 2) {
tcp_opts[tcp_opt_cnt].data = (pkt + 2);
} else {
tcp_opts[tcp_opt_cnt].data = NULL;
}
}
pkt += olen;