mirror of
https://github.com/the-tcpdump-group/tcpdump.git
synced 2024-11-24 02:23:27 +08:00
83c64fce3a
The decoder didn't properly check that the PDU length stored in the PDU header is correct. The only check in place was in rpki_rtr_print() and it tested whether the length is zero but that is not sufficient. Make all necessary length and bounds checks, both generic and type-specific, in rpki_rtr_pdu_print() and reduce rpki_rtr_print() to a simple loop. This also fixes a minor bug and PDU type 0 (Serial Notify from RFC 6810 Section 5.2) is valid again. In rpki_rtr_pdu_print() any protocol version was considered version 0, fix it to skip the rest of input if the PDU protocol version is unknown. Ibid, the PDU type 10 (Error Report from RFC 6810 Section 5.10) case block didn't consider the "Length of Error Text" data element mandatory, put it right. Ibid, when printing an encapsulated PDU, give itself (via recursion) respective buffer length to make it possible to tell whether the encapsulated PDU fits. Do not recurse deeper than 2nd level. Update prior RPKI-Router test cases that now stop to decode earlier because of the stricter checks. This fixes a buffer over-read discovered by Bhargava Shastry, SecT/TU Berlin. Add a test using the capture file supplied by the reporter(s).
23 lines
1.7 KiB
Plaintext
23 lines
1.7 KiB
Plaintext
CFMv0 unknown (204), MD Level 0, length 168
|
|
First TLV offset 52
|
|
0x0000: a300 0000 0080 0000 0000 0000 0000 0000
|
|
0x0010: 0000 00aa 6873 54d7 060b 003c 0000 003c
|
|
0x0020: d4c3 b2a1 0200 1a00 000b 003c 0000 003c
|
|
0x0030: d4c3 b2a1 0200 1a00 0000 0000 3620 0a00
|
|
0x0040: b600 0000 b600 0000 40b5 9cbe 3048 0cc4
|
|
0x0050: ad37 1005 ffff 05cc 0934 9300 0000 0080
|
|
0x0060: 0000 0000 0000 3200 0000 0000 00aa 6873
|
|
Port status TLV (0x02), length 26, Status: Unknown (0)
|
|
Unknown TLV (0x37), length 4101
|
|
packet is too short
|
|
IP (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 52)
|
|
204.9.51.132.50079 > 204.9.54.80.22: Flags [.], cksum 0x8611 (incorrect -> 0xa678), ack 1819218606, win 4094, options [nop,nop,TS val 941371775 ecr 4294967242], length 0
|
|
IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 4504 (->451a)!)
|
|
204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x66a1), ack 2339312418, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
|
|
IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
|
|
204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x7767), ack 3587398274, win 1040, options [nop,nop,TS val 647770294 ecr 2364779354], length 0
|
|
IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
|
|
204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0x8900), seq 3589495407:3589495754, ack 370428050, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
|
|
RPKI-RTRv177 (unknown)
|
|
EXIT CODE 00000100
|