buglwIP - A Lightweight TCP/IP stack - Bugs: bug #35616, Corruption of ICMP with IP...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #35616: Corruption of ICMP with IP fragmentation and alignment > 2

Submitted by:  Lars Jeppesen <larsjep>
Submitted on:  Fri 24 Feb 2012 08:51:08 AM UTC  
 
Category: IPv4Severity: 3 - Normal
Item Group: Faulty BehaviourStatus: Duplicate
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.4.0

Fri 24 Feb 2012 09:46:13 AM UTC, comment #3:

> Yes, that patch solves the problem.


OK, so this is a duplicate.

> But notice that only alignment > 2 is needed to trigger the bug.


But that's only because you have ETH_PAD_SIZE set to 0. When set to 2, you need alignment > 4 to trigger it. Anyway, I've adapted the summary of bug #34534 to reflect that.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 24 Feb 2012 09:28:20 AM UTC, comment #2:

Yes, that patch solves the problem.

But notice that only alignment > 2 is needed to trigger the bug.

Lars Jeppesen <larsjep>
Fri 24 Feb 2012 09:11:16 AM UTC, comment #1:

If you're using 1.4.0, have you tried applying the fix for bug #34534? I tried to reproduce this with the 1.4.1 git branch but it works for me. If it works for you, too, this is a duplicate.

You can find the fix at:
http://git.savannah.gnu.org/cgit/lwip.git/commit/?id=c74d881d3d854900e6ef8a7126356d45672342b6

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 24 Feb 2012 08:51:08 AM UTC, original submission:

Corruption of ICMP with IP fragmentation and alignment > 2

Hi,

I have discovered a problem in the IP fragmentation.
The problems occurs when I ping my target with an ICMP package that requires IP fragmentation.

What happens is that the ICMP reply from my target is corrupted, or more precise the 2 first bytes are missing.

This is what happens in the code:
(NOTE: My target requires 4 bytes alignment, MEM_ALIGNMENT=4)

1. The Ethernet package is placed in an pbuf and the payload is aligned.
2. The Ethernet header (14 bytes) is removed and payload is now unaligned.
3. The IP header is removed and the payload is still unaligned.
4. The ICMP sends back the incomming data by using the same pbuf. (That have an unaligned payload)
5. In ip_frag.c a new pbuf is created with pbuf_alloced_custom, but in pbuf.c, line 379,
the new payload pointer is aligned, and therefore the new payload pointer points incorrectly.
6. The returned ICMP reply is incorrect.

NOTE: It seems that this problem is related to bug #34534. But the difference is that my bug occurs when alignment is > 2.

Best regard
Lars Jeppesen

Lars Jeppesen <larsjep>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by larsjep (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 24 Feb 2012 09:46:13 AM UTCgoldsimonStatusNeed Info=>Duplicate
      Open/ClosedOpen=>Closed
    Fri 24 Feb 2012 09:11:16 AM UTCgoldsimonStatusNone=>Need Info
      Assigned toNone=>goldsimon

    Back to the top


    Powered by Savane 3.1-cleanup1