Changeset ed3a238 for libpacketdump/ip_132.c

Timestamp:

04/21/17 13:58:20 (4 years ago)

Author:

Shane Alcock <salcock@…>

Branches:

cachetimestamps, develop, dpdk-ndag, etsilive, master, ndag_format, rc-4.0.2, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance

Children:

f398c61

Parents:

33a106a

Message:

Fix issues with SCTP libpacketdump parser

• Ignore bogus chunk lengths that would cause us to walk off the end of the packet (Issue #47) .
• Fixed bug where we were not correctly detecting and accounting for chunk padding.
• Don't overwrite the chunk->length field with a byteswapped version.
• Abort parsing if we don't have enough packet remaining to read an entire SCTP chunk header.

File:

• libpacketdump/ip_132.c (modified) (6 diffs)

libpacketdump/ip_132.c

@@ -155 +155 @@
                 int len = ntohs(ph->length) - 
                     sizeof(struct sctp_var_param_hdr);
-                
+
                 printf(" SCTP: Option Supported address types ");
-                
+
                 while(len) {
                     printf("%hu ", ntohs(*p));
@@ -181 +181 @@
     struct sctp_chunk_hdr *chunk;
     int chunk_num = 1;
-    int vlen;
+    int vlen = 0;
+    uint16_t chunklen = 0;
 
     if(len < (signed)sizeof(struct sctp_common_hdr)) {
@@ -198 +199 @@
 
     while(len > 0) {
+        if (len < sizeof(struct sctp_chunk_hdr)) {
+                printf(" SCTP: [Truncated]\n\n");
+                break;
+        }
+
         chunk = (struct sctp_chunk_hdr *)packet;
 
-        chunk->length = ntohs(chunk->length);
+        chunklen = ntohs(chunk->length);
 
         printf(" SCTP: Chunk %d Type %s Flags %u Len %u\n",
             chunk_num++,
-            sctp_type_to_str(chunk->type), chunk->flags, chunk->length);
-
-        if(chunk->length == 0) {
+            sctp_type_to_str(chunk->type), chunk->flags, chunklen);
+
+        if(chunklen == 0) {
             printf(" SCTP: Invalid chunk length, aborting.\n\n");
             break;
+        }
+
+        /* Stupid SCTP has padding that is not accounted for in either
+         * the chunk length or the payload length fields */
+        if ((chunklen % 4) != 0) {
+                /* Pad to the next four byte boundary */
+                chunklen += ( 4 - (chunklen % 4) );
+        }
+
+        /* Truncate any ridiculous chunk lengths so that they don't
+         * exceed the confines of the packet */
+        if (chunklen > len) {
+                chunklen = len;
         }
 
@@ -229 +248 @@
                 struct sctp_init_ack *ack = (struct sctp_init_ack *)
                     (chunk + 1);
-                
+
                 printf(" SCTP: Tag %u Credit %u Outbound %hu Inbound %hu "
                         "TSN %u\n",
@@ -238 +257 @@
                         ntohl(ack->init_tsn));
 
-                vlen = chunk->length - (sizeof(struct sctp_init_ack) +
+                vlen = chunklen - (sizeof(struct sctp_init_ack) +
                         sizeof(struct sctp_chunk_hdr) +
                         sizeof(struct sctp_common_hdr)
@@ -270 +289 @@
             break;
         }
-        
-        packet += chunk->length;
-        len -= chunk->length;
+
+        packet += chunklen;
+        len -= chunklen;
     }
     printf("\n");