Skip to content

Commit 8d4f6e0

Browse files
fxlbfxlb
committed
IPv6 mobility: Modernize packet parsing and make fixes
Define ND_LONGJMP_FROM_TCHECK and remove two 'trunc' labels. Report invalid packets as invalid with a reason, not truncated. Use ND_ICHECKMSG_U() for some length tests and add two 'invalid' labels. Fix the incorrect bounds check 'ND_TCHECK_1(bp + i + optlen)'. Replace it by 'ND_TCHECK_LEN(bp + i, optlen)'. Remove an useless ND_TCHECK_2(). Update the output for unknown options: Use decimal for type as IANA. Update the reference from RFC 3775 to RFC 6275. Fix some indentations. Remove an extra blank line. Update the outputs of some tests accordingly.
1 parent 0cb381b commit 8d4f6e0

10 files changed

+54
-72
lines changed

‎print-mobility.c‎

Lines changed: 43 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -28,19 +28,19 @@
2828
*/
2929

3030
/* \summary: IPv6 mobility printer */
31-
/* RFC 3775 */
31+
/* RFC 6275 */
3232

3333
#include <config.h>
3434

3535
#include "netdissect-stdinc.h"
3636

37+
#define ND_LONGJMP_FROM_TCHECK
3738
#include "netdissect.h"
3839
#include "addrtoname.h"
3940
#include "extract.h"
4041

4142
#include "ip6.h"
4243

43-
4444
/* Mobility header */
4545
struct ip6_mobility {
4646
nd_uint8_t ip6m_pproto; /* following payload protocol (for PG) */
@@ -120,78 +120,65 @@ static int
120120
mobility_opt_print(netdissect_options *ndo,
121121
const u_char *bp, const unsigned len)
122122
{
123-
unsigned i, optlen;
123+
unsigned i, opttype, optlen;
124124

125125
for (i = 0; i < len; i += optlen) {
126-
if (GET_U_1(bp + i) == IP6MOPT_PAD1)
126+
opttype = GET_U_1(bp + i);
127+
if (opttype == IP6MOPT_PAD1)
127128
optlen = 1;
128129
else {
129-
if (i + 1 < len) {
130-
optlen = GET_U_1(bp + i + 1) + 2;
131-
} else
132-
goto trunc;
130+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, 1);
131+
optlen = GET_U_1(bp + i + 1) + 2;
133132
}
134-
if (i + optlen > len)
135-
goto trunc;
136-
ND_TCHECK_1(bp + i + optlen);
133+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, optlen);
134+
ND_TCHECK_LEN(bp + i, optlen);
137135

138-
switch (GET_U_1(bp + i)) {
136+
switch (opttype) {
139137
case IP6MOPT_PAD1:
140138
ND_PRINT("(pad1)");
141139
break;
142140
case IP6MOPT_PADN:
143-
if (len - i < IP6MOPT_MINLEN) {
144-
ND_PRINT("(padn: trunc)");
145-
goto trunc;
146-
}
147141
ND_PRINT("(padn)");
142+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
143+
IP6MOPT_MINLEN);
148144
break;
149145
case IP6MOPT_REFRESH:
150-
if (len - i < IP6MOPT_REFRESH_MINLEN) {
151-
ND_PRINT("(refresh: trunc)");
152-
goto trunc;
153-
}
146+
ND_PRINT("(refresh: ");
147+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
148+
IP6MOPT_REFRESH_MINLEN);
154149
/* units of 4 secs */
155-
ND_PRINT("(refresh: %u)",
156-
GET_BE_U_2(bp + i + 2) << 2);
150+
ND_PRINT("%u)", GET_BE_U_2(bp + i + 2) << 2);
157151
break;
158152
case IP6MOPT_ALTCOA:
159-
if (len - i < IP6MOPT_ALTCOA_MINLEN) {
160-
ND_PRINT("(altcoa: trunc)");
161-
goto trunc;
162-
}
163-
ND_PRINT("(alt-CoA: %s)", GET_IP6ADDR_STRING(bp + i + 2));
153+
ND_PRINT("(alt-CoA: ");
154+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
155+
IP6MOPT_ALTCOA_MINLEN);
156+
ND_PRINT("%s)", GET_IP6ADDR_STRING(bp + i + 2));
164157
break;
165158
case IP6MOPT_NONCEID:
166-
if (len - i < IP6MOPT_NONCEID_MINLEN) {
167-
ND_PRINT("(ni: trunc)");
168-
goto trunc;
169-
}
170-
ND_PRINT("(ni: ho=0x%04x co=0x%04x)",
171-
GET_BE_U_2(bp + i + 2),
172-
GET_BE_U_2(bp + i + 4));
159+
ND_PRINT("(ni: ");
160+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
161+
IP6MOPT_NONCEID_MINLEN);
162+
ND_PRINT("ho=0x%04x co=0x%04x)",
163+
GET_BE_U_2(bp + i + 2),
164+
GET_BE_U_2(bp + i + 4));
173165
break;
174166
case IP6MOPT_AUTH:
175-
if (len - i < IP6MOPT_AUTH_MINLEN) {
176-
ND_PRINT("(auth: trunc)");
177-
goto trunc;
178-
}
179167
ND_PRINT("(auth)");
168+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
169+
IP6MOPT_AUTH_MINLEN);
180170
break;
181171
default:
182-
if (len - i < IP6MOPT_MINLEN) {
183-
ND_PRINT("(sopt_type %u: trunc)",
184-
GET_U_1(bp + i));
185-
goto trunc;
186-
}
187-
ND_PRINT("(type-0x%02x: len=%u)", GET_U_1(bp + i),
188-
GET_U_1(bp + i + 1));
172+
ND_PRINT("(unknown: ");
173+
ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
174+
IP6MOPT_MINLEN);
175+
ND_PRINT("type-#%u len=%u)", opttype, optlen - 2);
189176
break;
190177
}
191178
}
192179
return 0;
193180

194-
trunc:
181+
invalid:
195182
return 1;
196183
}
197184

@@ -235,9 +222,9 @@ mobility_print(netdissect_options *ndo,
235222
hlen = IP6M_MINLEN;
236223
if (ndo->ndo_vflag) {
237224
ND_PRINT(" %s Init Cookie=%08x:%08x",
238-
type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
239-
GET_BE_U_4(bp + hlen),
240-
GET_BE_U_4(bp + hlen + 4));
225+
type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
226+
GET_BE_U_4(bp + hlen),
227+
GET_BE_U_4(bp + hlen + 4));
241228
}
242229
hlen += 8;
243230
break;
@@ -247,16 +234,16 @@ mobility_print(netdissect_options *ndo,
247234
hlen = IP6M_MINLEN;
248235
if (ndo->ndo_vflag) {
249236
ND_PRINT(" %s Init Cookie=%08x:%08x",
250-
type == IP6M_HOME_TEST ? "Home" : "Care-of",
251-
GET_BE_U_4(bp + hlen),
252-
GET_BE_U_4(bp + hlen + 4));
237+
type == IP6M_HOME_TEST ? "Home" : "Care-of",
238+
GET_BE_U_4(bp + hlen),
239+
GET_BE_U_4(bp + hlen + 4));
253240
}
254241
hlen += 8;
255242
if (ndo->ndo_vflag) {
256243
ND_PRINT(" %s Keygen Token=%08x:%08x",
257-
type == IP6M_HOME_TEST ? "Home" : "Care-of",
258-
GET_BE_U_4(bp + hlen),
259-
GET_BE_U_4(bp + hlen + 4));
244+
type == IP6M_HOME_TEST ? "Home" : "Care-of",
245+
GET_BE_U_4(bp + hlen),
246+
GET_BE_U_4(bp + hlen + 4));
260247
}
261248
hlen += 8;
262249
break;
@@ -265,7 +252,6 @@ mobility_print(netdissect_options *ndo,
265252
int bits;
266253
ND_PRINT(" seq#=%u", GET_BE_U_2(mh->ip6m_data16[0]));
267254
hlen = IP6M_MINLEN;
268-
ND_TCHECK_2(bp + hlen);
269255
bits = (GET_U_1(bp + hlen) & 0xf0) >> 4;
270256
if (bits) {
271257
ND_PRINT(" ");
@@ -307,14 +293,10 @@ mobility_print(netdissect_options *ndo,
307293
}
308294
if (ndo->ndo_vflag)
309295
if (mobility_opt_print(ndo, bp + hlen, mhlen - hlen))
310-
goto trunc;
296+
goto invalid;
311297

312298
return(mhlen);
313299

314-
trunc:
315-
nd_print_trunc(ndo);
316-
return(-1);
317-
318300
invalid:
319301
nd_print_invalid(ndo);
320302
return(-1);

‎tests/cve2015-0261-ipv6.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
1 2002-12-31 13:55:31.300000 IP6 [header+payload length 26510 > length 185] (invalid) (class 0x76, flowlabel 0x76767, hlim 103, next-header Mobility (135), payload length 26470) 6767:6767:6767:6767:6767:6767:6767:6767 > 6767:6767:6767:6767:6767:6767:6767:6705: mobility: (payload protocol 255 should be 59) BU seq#=26471 HL lifetime=105884(type-0x67: len=103) [|mobility]
1+
1 2002-12-31 13:55:31.300000 IP6 [header+payload length 26510 > length 185] (invalid) (class 0x76, flowlabel 0x76767, hlim 103, next-header Mobility (135), payload length 26470) 6767:6767:6767:6767:6767:6767:6767:6767 > 6767:6767:6767:6767:6767:6767:6767:6705: mobility: (payload protocol 255 should be 59) BU seq#=26471 HL lifetime=105884(unknown: type-#103 len=103) [|mobility]
22
2 2003-03-06 15:21:11.300000 IP6 [header+payload length 26510 > length 185] (invalid) (class 0x76, flowlabel 0x76767, hlim 103, next-header Mobility (135), payload length 26470) 6767:6767:6767:6767:6767:6767:6767:6767 > 6767:6767:4f67:6767:6767:6767:6767:6767: mobility: (payload protocol 0 should be 59) BA (header length 8 < 16) (invalid)

‎tests/mobility_opt_asan.out‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
1 1975-04-27 07:53:17.131862 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d400:7fa1:0:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15872(pad1) [|mobility]
2-
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d4c3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b291: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360 [|mobility]
1+
1 1975-04-27 07:53:17.131862 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d400:7fa1:0:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15872(pad1)(refresh: [|mobility]
2+
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d4c3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b291: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360(refresh: 2056) [|mobility]

‎tests/mobility_opt_asan_2.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1 1975-06-23 00:41:36.999999 IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: (payload protocol 6 should be 59) BRR(type-0x06: len=0) [|mobility]
1+
1 1975-06-23 00:41:36.999999 IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: (payload protocol 6 should be 59) BRR(unknown: type-#6 len=0)(ni: [|mobility]

‎tests/mobility_opt_asan_3.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
1 1975-04-27 07:53:17.131862 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d400:7fa1:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) CoT nonce id=0x74 Care-of Init Cookie=80570f80:00000004 [|mobility]
2-
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=39837 lifetime=261452 [|mobility]
2+
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=39837 lifetime=261452(alt-CoA: [|mobility]

‎tests/mobility_opt_asan_4.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1 2018-01-12 12:49:44.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62), payload length 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360(pad1)(pad1)(type-0x3c: len=19)(ni: ho=0x0400 co=0x0012) [|mobility]
1+
1 2018-01-12 12:49:44.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62), payload length 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360(pad1)(pad1)(unknown: type-#60 len=19)(ni: ho=0x0400 co=0x0012)(ni: [|mobility]

‎tests/mobility_opt_asan_5.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1 1975-06-23 00:41:36.999999 IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: (payload protocol 6 should be 59) BRR(type-0x06: len=0) [|mobility]
1+
1 1975-06-23 00:41:36.999999 IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: (payload protocol 6 should be 59) BRR(unknown: type-#6 len=0)(ni: [|mobility]

‎tests/mobility_opt_asan_6.out‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
1 1975-04-27 07:53:17.131862 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d400:7fa1:0:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15872(pad1) [|mobility]
2-
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d4c3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b291: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360 [|mobility]
1+
1 1975-04-27 07:53:17.131862 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d400:7fa1:0:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15872(pad1)(refresh: [|mobility]
2+
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d4c3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b291: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360(refresh: 2056) [|mobility]

‎tests/mobility_opt_asan_7.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
1 1975-04-27 07:53:17.131862 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) d400:7fa1:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) CoT nonce id=0x74 Care-of Init Cookie=80570f80:00000004 [|mobility]
2-
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=39837 lifetime=261452 [|mobility]
2+
2 2017-12-27 14:32:13.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62), payload length 7168) ffc3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=39837 lifetime=261452(alt-CoA: [|mobility]

‎tests/mobility_opt_asan_8.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1 2018-01-12 12:49:44.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62), payload length 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360(pad1)(pad1)(type-0x3c: len=19)(ni: ho=0x0400 co=0x0012) [|mobility]
1+
1 2018-01-12 12:49:44.999999 IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62), payload length 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: (payload protocol 2 should be 59) BU seq#=116 A lifetime=15360(pad1)(pad1)(unknown: type-#60 len=19)(ni: ho=0x0400 co=0x0012)(ni: [|mobility]

0 commit comments

Comments
 (0)