Previously, the "unused" field in our ICMP messages was left
uninitialised (!)
This is a security problem, at least in principle, as the field would
as a result contain bits of previous packets. In practice, the
information leaked could be IP options, TCP ports and sequence
numbers, or UDP ports, length and/or checksum, or similar information
for other protocols, so the impact is limited.
Set the field to 0. Also, make provision for netlink_icmp_simple's
callers to be able to specify a different value, if desired.
Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
* Fix formatting error in p-t-p startup message.
* Additions to the test-example suite.
* SECURITY: Fixes to MTU and fragmentation handling.
* Fix formatting error in p-t-p startup message.
* Additions to the test-example suite.
* SECURITY: Fixes to MTU and fragmentation handling.
+ * SECURITY: Correctly set "unused" ICMP header field.
uint8_t type;
uint8_t code;
uint16_t check;
uint8_t type;
uint8_t code;
uint16_t check;
uint32_t unused;
struct {
uint8_t pointer;
uint32_t unused;
struct {
uint8_t pointer;
+
+static const union icmpinfofield icmp_noinfo;
static void netlink_packet_deliver(struct netlink *st,
struct netlink_client *client,
static void netlink_packet_deliver(struct netlink *st,
struct netlink_client *client,
comes from. NULL indicates the host. */
static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf,
struct netlink_client *client,
comes from. NULL indicates the host. */
static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf,
struct netlink_client *client,
- uint8_t type, uint8_t code)
+ uint8_t type, uint8_t code,
+ union icmpinfofield info)
{
struct icmphdr *h;
uint16_t len;
{
struct icmphdr *h;
uint16_t len;
struct iphdr *iph=(struct iphdr *)buf->start;
len=netlink_icmp_reply_len(buf);
h=netlink_icmp_tmpl(st,ntohl(iph->saddr),len);
struct iphdr *iph=(struct iphdr *)buf->start;
len=netlink_icmp_reply_len(buf);
h=netlink_icmp_tmpl(st,ntohl(iph->saddr),len);
- h->type=type; h->code=code;
+ h->type=type; h->code=code; h->d=info;
memcpy(buf_append(&st->icmp,len),buf->start,len);
netlink_icmp_csum(h);
netlink_packet_deliver(st,NULL,&st->icmp);
memcpy(buf_append(&st->icmp,len),buf->start,len);
netlink_icmp_csum(h);
netlink_packet_deliver(st,NULL,&st->icmp);
"(s=%s, d=%s)\n", st->name, s, d);
free(s); free(d);
netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
"(s=%s, d=%s)\n", st->name, s, d);
free(s); free(d);
netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
- ICMP_CODE_NET_UNREACHABLE);
+ ICMP_CODE_NET_UNREACHABLE, icmp_noinfo);
BUF_FREE(buf);
}
} else {
BUF_FREE(buf);
}
} else {
free(s); free(d);
netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
free(s); free(d);
netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
- ICMP_CODE_NET_PROHIBITED);
+ ICMP_CODE_NET_PROHIBITED, icmp_noinfo);
BUF_FREE(buf);
} else {
if (best_quality>0) {
BUF_FREE(buf);
} else {
if (best_quality>0) {
BUF_ASSERT_FREE(buf);
} else {
/* Generate ICMP destination unreachable */
BUF_ASSERT_FREE(buf);
} else {
/* Generate ICMP destination unreachable */
- netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
- ICMP_CODE_NET_UNREACHABLE); /* client==NULL */
+ netlink_icmp_simple(st,buf,client,/* client==NULL */
+ ICMP_TYPE_UNREACHABLE,
+ ICMP_CODE_NET_UNREACHABLE,
+ icmp_noinfo);
if (iph->ttl<=1) {
/* Generate ICMP time exceeded */
netlink_icmp_simple(st,buf,client,ICMP_TYPE_TIME_EXCEEDED,
if (iph->ttl<=1) {
/* Generate ICMP time exceeded */
netlink_icmp_simple(st,buf,client,ICMP_TYPE_TIME_EXCEEDED,
- ICMP_CODE_TTL_EXCEEDED);
+ ICMP_CODE_TTL_EXCEEDED,icmp_noinfo);
} else {
/* Send ICMP protocol unreachable */
netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
} else {
/* Send ICMP protocol unreachable */
netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE,
- ICMP_CODE_PROTOCOL_UNREACHABLE);
+ ICMP_CODE_PROTOCOL_UNREACHABLE,icmp_noinfo);