Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net: ipv6: tcp: unexpected reply to malformed HBH in TCP/IPv6 SYN #16323

Closed
rmstoi opened this issue May 22, 2019 · 3 comments · Fixed by #18650
Closed

net: ipv6: tcp: unexpected reply to malformed HBH in TCP/IPv6 SYN #16323

rmstoi opened this issue May 22, 2019 · 3 comments · Fixed by #18650
Assignees
@jukkar
Labels
area: Networking bug The issue is a bug, or the PR is fixing a bug priority: medium Medium impact/importance bug
Milestone
v2.0.0

Comments

@rmstoi
Copy link
Collaborator

rmstoi commented May 22, 2019

If Zephyr receives TCP/IPv6 SYN with malformed Hop-by-Hop having wrong length, it replies with ICMPv6 Destination Unreachable (Port unreachable). Since the length of Hop-by-Hop option is wrong, Zephyr should instead send ICMP parameter problem message or silently drop the packet.

Note that it this packet is dropped for ICMPv6 and UDPv6.

bad-hbho-len.pcap.gz
@rmstoi rmstoi added bug The issue is a bug, or the PR is fixing a bug area: Networking labels May 22, 2019
@nashif nashif added the priority: medium Medium impact/importance bug label May 22, 2019
@jukkar
Copy link
Member

jukkar commented Aug 15, 2019

@rmstoi can you check this one, I fixed the TCP option calc len which hopefully fixes this.

@rmstoi
Copy link
Collaborator Author

rmstoi commented Aug 16, 2019

@jukkar I checked it still fails. The problem is that unknown option 0x42 in HBH has wrong length, and because of this packet must be dropped.

@jenmwms jenmwms added this to the v2.1.0 milestone Aug 23, 2019
jukkar added a commit to jukkar/zephyr that referenced this issue Aug 26, 2019
@jukkar
net: ipv6: Check sub-option length
c73dae9 
Make sure that the extension, like HBHO, sub-option length is
not too large.

Fixes zephyrproject-rtos#16323

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar jukkar mentioned this issue Aug 26, 2019
Merged
@jukkar jukkar modified the milestones: v2.1.0, v2.0.0 Aug 26, 2019
@jukkar
Copy link
Member

jukkar commented Aug 26, 2019

We can have this for 2.0 so adjusting target.

@pabigot pabigot added the has-pr label Aug 26, 2019
ioannisg pushed a commit that referenced this issue Aug 27, 2019
@jukkar @ioannisg
net: ipv6: Check sub-option length
0049c52 
Make sure that the extension, like HBHO, sub-option length is
not too large.

Fixes #16323

Signed-off-by: Jukka Rissanen <[email protected]>
backporting bot pushed a commit that referenced this issue Aug 27, 2019
@jukkar
net: ipv6: Check sub-option length
50b6e3f 
Make sure that the extension, like HBHO, sub-option length is
not too large.

Fixes #16323

Signed-off-by: Jukka Rissanen <[email protected]>
nashif pushed a commit that referenced this issue Aug 29, 2019
@jukkar @nashif
net: ipv6: Check sub-option length
8f5b5db 
Make sure that the extension, like HBHO, sub-option length is
not too large.

Fixes #16323

Signed-off-by: Jukka Rissanen <[email protected]>
LeiW000 pushed a commit to LeiW000/zephyr that referenced this issue Sep 2, 2019
@jukkar
net: ipv6: Check sub-option length
b78129b 
Make sure that the extension, like HBHO, sub-option length is
not too large.

Fixes zephyrproject-rtos#16323

Signed-off-by: Jukka Rissanen <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jukkar jukkar

Labels
area: Networking bug The issue is a bug, or the PR is fixing a bug priority: medium Medium impact/importance bug
Projects
None yet
Milestone
v2.0.0
Development

Successfully merging a pull request may close this issue.

net: ipv6: Check sub-option length jukkar/zephyr
5 participants
@nashif @pabigot @jukkar @rmstoi @jenmwms