Vlad Grigorescu created BIT-1045:
Summary: Review usage of InternalError when parsing network traffic
Key: BIT-1045
URL: https://bro-tracker.atlassian.net/browse/BIT-1045
Project: Bro Issue Tracker
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13400#comment-13400
]
Robin Sommer commented on BIT-1045:
---
Ack, InternalError() is not something that external
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13401#comment-13401
]
Vern Paxson commented on BIT-1045:
--
In line with what you frame, the history behind these is
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jon Siwek updated BIT-1045:
---
Assignee: Robin Sommer
> Review usage of InternalError when parsing network traffic
> --
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jon Siwek updated BIT-1045:
---
Status: Merge Request (was: Open)
> Review usage of InternalError when parsing network traffic
> --
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14205#comment-14205
]
Jon Siwek commented on BIT-1045:
I did a pass over InternalError usage in topic/jsiwek/internal
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14211#comment-14211
]
Robin Sommer commented on BIT-1045:
---
Going through, I see number of places where I'd argue it
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14213#comment-14213
]
Robin Sommer commented on BIT-1045:
---
Ok, good job on this. I went through and put a few small
[
https://bro-tracker.atlassian.net/browse/BIT-1045?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Robin Sommer updated BIT-1045:
--
Resolution: Merged (was: Fixed)
Status: Closed (was: Merge Request)
> Review usage of Intern
On Sun, Jul 28, 2013 at 09:11 -0500, you wrote:
> Reporter->InternalError denotes a fatal error, and will cause Bro to
> stop. Calling this function when parsing network traffic creates the
> possibility for an attacker using a "packet of death," which could
> stop Bro.
Ack, InternalError() is
> > I suspect that in most cases, a weird should be generated instead, and
> > Bro should just move on to the next packet.
>
> Agreed, though sometimes they aren't about the traffic but about a
> logic error in decoding it; it would be good to still differentiate
> those cases from a broken packet
11 matches
Mail list logo
