Project

General

Profile

Actions
Copy link

Bug #6942

open

decode/ppp: decoder.event.ppp.wrong_type on valid packet

Added by Victor Julien 17 days ago. Updated 14 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Victor Julien
Target version:
8.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

packet = PPP()/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])

Results in a packet with a single byte PPP header. However, Suricata expects the header to be at least 4 bytes and the protocol field to be at least 2.

Wireshark accepts the packet w/o issues.

Subtasks 1 (1 open — 0 closed)

Bug #6950: decode/ppp: decoder.event.ppp.wrong_type on valid packet (7.0.x backport)AssignedVictor JulienActions
Actions
Copy link
 #1

Updated by Victor Julien 17 days ago

  • Status changed from New to In Progress
  • Assignee changed from OISF Dev to Victor Julien
Actions
Copy link
 #2

Updated by Victor Julien 17 days ago

  • Status changed from In Progress to In Review
  • Label Needs backport to 7.0 added
Actions
Copy link
 #3

Updated by OISF Ticketbot 17 days ago

  • Subtask #6950 added
Actions
Copy link
 #4

Updated by OISF Ticketbot 17 days ago

  • Label deleted (Needs backport to 7.0)
Actions
Copy link
 #5

Updated by Victor Julien 14 days ago

  • Status changed from In Review to Resolved
Actions
Copy link

Also available in: Atom PDF