NetBSD Problem Report #53479
From www@NetBSD.org Sun Jul 29 14:27:41 2018
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id EBFA07A17C
for <gnats-bugs@gnats.NetBSD.org>; Sun, 29 Jul 2018 14:27:40 +0000 (UTC)
Message-Id: <20180729142739.A72357A186@mollari.NetBSD.org>
Date: Sun, 29 Jul 2018 14:27:39 +0000 (UTC)
From: max@m00nbsd.net
Reply-To: max@m00nbsd.net
To: gnats-bugs@NetBSD.org
Subject: NPF: wrong checksum alignment
X-Send-Pr-Version: www-1.0
>Number: 53479
>Category: kern
>Synopsis: NPF: wrong checksum alignment
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Sun Jul 29 14:30:00 +0000 2018
>Closed-Date: Fri Aug 31 14:21:12 +0000 2018
>Last-Modified: Fri Aug 31 14:21:12 +0000 2018
>Originator: Maxime Villard
>Release: -current, -8, -7 (probably)
>Organization:
TNF
>Environment:
amd64, i386, whatever
>Description:
As explained here:
http://mail-index.netbsd.org/tech-net/2018/04/07/msg006777.html
http://mail-index.netbsd.org/tech-net/2018/04/08/msg006785.html
There is a bug when computing the TCP checksum of a received packet when
max-mss clamping was active.
The problem is that NPF expects the MSS option to be on a 16bit boundary,
while the spec (RFC793) specifies that "An option may begin on any octet
boundary".
The call path is: npf_normalize() -> npf_fixup16_cksum().
Such packets are probably not seen a lot in the wild, however.
>How-To-Repeat:
I had tested by hand-crafting the packets.
>Fix:
When the MSS is not on a 16bit boundary, we need to call npf_fixup16_cksum
twice on two consecutive 16bit areas, the MSS being exactly in the middle.
0 8 16 24 32
+------+-----------+-----------+------+
| data | MSS (low) | MSS(high) | data |
+------+-----------+-----------+------+
^ ^
first call second call
And merge the results.
But given how NPF is written it looks like it is a headache to do just
that.
>Release-Note:
>Audit-Trail:
From: "Maxime Villard" <maxv@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/53479 CVS commit: src/sys/net/npf
Date: Fri, 31 Aug 2018 14:16:07 +0000
Module Name: src
Committed By: maxv
Date: Fri Aug 31 14:16:07 UTC 2018
Modified Files:
src/sys/net/npf: npf_ext_normalize.c npf_impl.h npf_inet.c
Log Message:
Introduce npf_set_mss(). When the MSS is not 16bit-aligned, it sets:
0 8 16 24 32
+------+-----------+-----------+------+
| data | MSS (low) | MSS (hig) | data |
+------+-----------+-----------+------+
^ ^
old[0] old[1]
And sets new[0,1] accordingly with the new value. The MSS-clamping code
then adjusts twice the checksum on a 16bit boundary:
from old[0] to new[0]
from old[1] to new[1]
Fixes PR/53479, opened by myself. Tested with wireshark and kASan.
To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.8 src/sys/net/npf/npf_ext_normalize.c
cvs rdiff -u -r1.70 -r1.71 src/sys/net/npf/npf_impl.h
cvs rdiff -u -r1.50 -r1.51 src/sys/net/npf/npf_inet.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->closed
State-Changed-By: maxv@NetBSD.org
State-Changed-When: Fri, 31 Aug 2018 14:21:12 +0000
State-Changed-Why:
fixed
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.43 2018/01/16 07:36:43 maya Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2017
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.