[Oisf-users] IPv6 & Extension header

[Michel SABORDE]

Thanks for the fix :)

Btw, is it possible (i'm sure it is) to write a signature that trigger when
Routing Header type 0 is present in a packet ?
Or even just if any routing header is present ?

I've found some decode-event rules in the decoder-events.rules file but
rules are only for duplicated extension header.

Michel
Le 18 avril 2012 09:27, Victor Julien <victor at inliniac.net> a écrit :

> On 04/10/2012 12:36 PM, Michel SABORDE wrote:
> > The pcap is attach to this email with the following tests :
> > - 41 Destination Option Extension Header
> > - 41 Atomic Fragmentation Extension Header
>
> I've pushed a new git master that addresses this issue.
>
> Thanks Michel!
>
> Cheers,
> Victor
>
> > Michel
> >
> > Le 10 avril 2012 12:09, Victor Julien <victor at inliniac.net
> > <mailto:victor at inliniac.net>> a écrit :
> >
> >     On 04/10/2012 12:07 PM, Michel SABORDE wrote:
> >     > Hi again,
> >     >
> >     > I just noticed that if you stack 42 extensions headers, for
> example 42
> >     > destination option, the rule is not triggered.
> >
> >     Can share a pcap?
> >
> >     > Is it a config problem ?
> >
> >     No, there are no options affecting that.
> >
> >     Cheers,
> >     Victor
> >
> >     > Michel
> >     > Le 4 avril 2012 11:49, Victor Julien <victor at inliniac.net
> >     <mailto:victor at inliniac.net>
> >     > <mailto:victor at inliniac.net <mailto:victor at inliniac.net>>> a
> écrit :
> >     >
> >     >     On 04/03/2012 08:21 PM, Victor Julien wrote:
> >     >     > On 04/03/2012 03:06 PM, Victor Julien wrote:
> >     >     >> On 04/03/2012 11:28 AM, Michel SABORDE wrote:
> >     >     >>> The pcap is attach to this mail.
> >     >     >>> I tried with the same rule as before and no alert is
> >     trigerred.
> >     >     >>> I already tried reading the pcap with suricata so this
> >     pcap should
> >     >     >>> reproduce the issue.
> >     >     >>> I may also have found something weird in fragmented ICMPv6
> >     Echo
> >     >     Request
> >     >     >>> / Reply.
> >     >     >>
> >     >     >> I think I found the issue. For some reason the reassembled
> >     packet
> >     >     >> contains the ethernet header as well, while the decoder
> doesn't
> >     >     expect
> >     >     >> that. Working on a fix.
> >     >     >
> >     >     > Partial fix pushed. Alert now fires. Http.log doesn't show
> >     the request
> >     >     > though, will look at that tomorrow.
> >     >
> >     >     Fixed that as well. Please resync with the current git master.
> >     >
> >     >     Thanks for the reports!
> >     >
> >     >     --
> >     >     ---------------------------------------------
> >     >     Victor Julien
> >     >     http://www.inliniac.net/
> >     >     PGP: http://www.inliniac.net/victorjulien.asc
> >     >     ---------------------------------------------
> >     >
> >     >     _______________________________________________
> >     >     Oisf-users mailing list
> >     >     Oisf-users at openinfosecfoundation.org
> >     <mailto:Oisf-users at openinfosecfoundation.org>
> >     >     <mailto:Oisf-users at openinfosecfoundation.org
> >     <mailto:Oisf-users at openinfosecfoundation.org>>
> >     >
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> >     >
> >     >
> >
> >
> >     --
> >     ---------------------------------------------
> >     Victor Julien
> >     http://www.inliniac.net/
> >     PGP: http://www.inliniac.net/victorjulien.asc
> >     ---------------------------------------------
> >
> >
>
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20120419/c500e888/attachment-0002.html>