buglwIP - A Lightweight TCP/IP stack - Bugs: bug #35616, Corruption of ICMP with IP...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #35616: Corruption of ICMP with IP fragmentation and alignment > 2

Submitter:  Lars Jeppesen <larsjep>
Submitted:  Fri 24 Feb 2012 08:51:08 AM UTC
   
 
Category:  IPv4 Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Duplicate
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.0

Fri 24 Feb 2012 09:46:13 AM UTC, comment #3: 


> Yes, that patch solves the problem.


OK, so this is a duplicate.

> But notice that only alignment > 2 is needed to trigger the bug.


But that's only because you have ETH_PAD_SIZE set to 0. When set to 2, you need alignment > 4 to trigger it. Anyway, I've adapted the summary of bug #34534 to reflect that.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 24 Feb 2012 09:28:20 AM UTC, comment #2: 

Yes, that patch solves the problem.

But notice that only alignment > 2 is needed to trigger the bug.

Lars Jeppesen <larsjep>
Fri 24 Feb 2012 09:11:16 AM UTC, comment #1: 

If you're using 1.4.0, have you tried applying the fix for bug #34534? I tried to reproduce this with the 1.4.1 git branch but it works for me. If it works for you, too, this is a duplicate.

You can find the fix at:
http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=c74d881d3d854900e6ef8a7126356d45672342b6

Simon Goldschmidt <goldsimon>
Group administrator
Fri 24 Feb 2012 08:51:08 AM UTC, original submission:  

Corruption of ICMP with IP fragmentation and alignment > 2

Hi,

I have discovered a problem in the IP fragmentation.
The problems occurs when I ping my target with an ICMP package that requires IP fragmentation.

What happens is that the ICMP reply from my target is corrupted, or more precise the 2 first bytes are missing.

This is what happens in the code:
(NOTE: My target requires 4 bytes alignment, MEM_ALIGNMENT=4)

1. The Ethernet package is placed in an pbuf and the payload is aligned.
2. The Ethernet header (14 bytes) is removed and payload is now unaligned.
3. The IP header is removed and the payload is still unaligned.
4. The ICMP sends back the incomming data by using the same pbuf. (That have an unaligned payload)
5. In ip_frag.c a new pbuf is created with pbuf_alloced_custom, but in pbuf.c, line 379,
   the new payload pointer is aligned, and therefore the new payload pointer points incorrectly.
6. The returned ICMP reply is incorrect.


NOTE: It seems that this problem is related to bug #34534. But the difference is that my bug occurs when alignment is > 2.

Best regard
  Lars Jeppesen

Lars Jeppesen <larsjep>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by larsjep (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-02-24 goldsimon StatusNeed Info Duplicate
        Open/ClosedOpen Closed
    2012-02-24 goldsimon StatusNone Need Info
        Assigned toNone goldsimon

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code