Date: Mon, 02 Feb 2004 18:28:11 +0100 From: Radim Kolar <hsn@netmag.cz> To: FreeBSD-gnats-submit@FreeBSD.org Cc: trevor@FreeBSD.org Subject: ports/62274: patch: p0f - fix layer header Message-ID: <E1Anhrn-0000J6-3L@asura.bsd> Resent-Message-ID: <200402021740.i12He4IO005113@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 62274
>Category: ports
>Synopsis: patch: p0f - fix layer header
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Feb 02 09:40:04 PST 2004
>Closed-Date:
>Last-Modified:
>Originator: Radim Kolar
>Release: FreeBSD 5.2-RELEASE i386
>Organization:
Sanatana Dharma
>Environment:
System: FreeBSD asura.bsd 5.2-RELEASE FreeBSD 5.2-RELEASE #1: Wed Jan 28 18:18:58 CET 2004 root@asura.bsd:/usr/src/sys/i386/compile/GENERIC i386
>Description:
p0f 2.0.3 has wrong size of BPF_NUL link layer, it should be 4 bytes,
not 0.
>How-To-Repeat:
p0f -i lo0
do not works without patch
>Fix:
--- p0f.c.orig Mon Oct 13 20:57:21 2003
+++ p0f.c Mon Feb 2 13:20:05 2004
@@ -161,7 +161,8 @@
switch(type) {
- case DLT_NULL:
+ case DLT_NULL: header_len=4; break;
+
case DLT_SLIP:
case DLT_RAW: break;
@@ -1199,11 +1200,15 @@
/* Whoops, IP header ends past end_ptr */
if ((_u8*)(iph + 1) > end_ptr) return;
- if ( ((iph->ihl & 0x40) != 0x40) || iph->proto != IPPROTO_TCP) {
- debug("[!] WARNING: Non-IP packet received. Bad header_len!\n");
+ if ( iph->proto != IPPROTO_TCP) {
+ debug("[!] WARNING: Non-IP packet received.\n");
return;
}
+ if ( ((iph->ihl & 0x40) != 0x40) ) {
+ debug("[!] WARNING: Bad header_len!\n");
+ return;
+ }
/* If the declared length is shorter than the snapshot (etherleak
or such), truncate this bad boy. */
--- mtu.h.orig Fri Oct 10 22:56:39 2003
+++ mtu.h Mon Feb 2 13:30:57 2004
@@ -58,6 +58,7 @@
{ 4352, "FDDI" },
{ 4500, "token ring (2)" },
{ 9180, "FORE ATM" },
+ { 16384, "loopback" },
{ 16436, "sometimes loopback" },
{ 18000, "token ring x4" },
};
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E1Anhrn-0000J6-3L>