added more checks to eliminate false positives while parsing packets

Author: shadowy-pycoder

layers/ftp.go

@@ -26,20 +26,22 @@ func (f *FTPMessage) Parse(data []byte) error {
 	if !checkFTP(buf) {
 		return fmt.Errorf("malformed ftp message")
 	}
-	f.summary = nil
-	f.data = nil
 	sp := bytes.Split(buf, crlf)
 	lsp := len(sp)
 	switch {
 	case lsp > 2:
-		f.summary = bytes.Join(sp[:2], bspace)
+		f.summary = bytes.TrimSpace(bytes.Join(sp[:2], bspace))
 		sp[0] = joinBytes(dash, sp[0])
-		f.data = bytes.TrimSuffix(bytes.TrimSuffix(bytes.Join(sp, lfd), dash), lf)
+		f.data = bytes.TrimSpace(bytes.TrimSuffix(bytes.TrimSuffix(bytes.Join(sp, lfd), dash), lf))
 	case lsp > 1:
-		f.summary = sp[0]
+		f.summary = bytes.TrimSpace(sp[0])
 		sp[0] = joinBytes(dash, sp[0])
-		f.data = bytes.TrimSuffix(bytes.TrimSuffix(bytes.Join(sp, lfd), dash), lf)
+		f.data = bytes.TrimSpace(bytes.TrimSuffix(bytes.TrimSuffix(bytes.Join(sp, lfd), dash), lf))
 	default:
+		return fmt.Errorf("failed parsing FTP message")
+	}
+	if len(f.summary) == 0 || len(f.data) == 0 {
+		return fmt.Errorf("failed parsing FTP message")
 	}
 	return nil
 }

layers/icmp.go

@@ -65,6 +65,9 @@ func (i *ICMPSegment) Parse(data []byte) error {
 		return fmt.Errorf("minimum payload length for ICMP with type %d is %d bytes", i.Type, pLen)
 	}
 	i.TypeDesc, i.CodeDesc = i.typecode()
+	if i.TypeDesc == "Unknown" || i.CodeDesc == "Unknown" {
+		return fmt.Errorf("failed determining type or code")
+	}
 	return nil
 }
 

layers/ipv4.go

@@ -170,8 +170,14 @@ func (p *IPv4Packet) UnmarshalBinary(data []byte) error {
 	dscpECN := buf[1]
 	p.DSCP = dscpECN >> 2
 	p.DSCPDesc = dscpdesc(p.DSCP)
+	if p.DSCPDesc == "Unknown" {
+		return fmt.Errorf("unknown DSCP")
+	}
 	p.ECN = dscpECN & 3
 	p.TotalLength = binary.BigEndian.Uint16(buf[2:4])
+	if int(p.TotalLength) != len(buf) {
+		return fmt.Errorf("total length is not equal to actual packet size")
+	}
 	p.Identification = binary.BigEndian.Uint16(buf[4:6])
 	flagsOffset := binary.BigEndian.Uint16(buf[6:8])
 	flags := uint8(flagsOffset >> 13)

layers/ipv6.go

@@ -15,7 +15,7 @@ type TrafficClass struct {
 	ECN      uint8
 }
 
-func newTrafficiClass(tc uint8) *TrafficClass {
+func newTrafficClass(tc uint8) *TrafficClass {
 	dscpbin := tc >> 2
 	return &TrafficClass{
 		Raw:      tc,
@@ -87,7 +87,7 @@ func (p *IPv6Packet) Parse(data []byte) error {
 	if p.Version != 6 {
 		return fmt.Errorf("unknown version")
 	}
-	p.TrafficClass = newTrafficiClass(uint8((versionTrafficFlow >> 20) & 0xFF))
+	p.TrafficClass = newTrafficClass(uint8((versionTrafficFlow >> 20) & 0xFF))
 	if p.TrafficClass.DSCPDesc == "Unknown" {
 		return fmt.Errorf("unknown DSCP")
 	}
@@ -109,6 +109,9 @@ func (p *IPv6Packet) Parse(data []byte) error {
 		return fmt.Errorf("malformed IPv6 address")
 	}
 	p.Payload = buf[headerSizeIPv6:]
+	if p.PayloadLength != 0 && int(p.PayloadLength) != len(p.Payload) {
+		return fmt.Errorf("payload length filed is not equal to actual payload size")
+	}
 	return nil
 }