NetBSD Problem Report #53479

From www@NetBSD.org  Sun Jul 29 14:27:41 2018
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id EBFA07A17C
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 29 Jul 2018 14:27:40 +0000 (UTC)
Message-Id: <20180729142739.A72357A186@mollari.NetBSD.org>
Date: Sun, 29 Jul 2018 14:27:39 +0000 (UTC)
From: max@m00nbsd.net
Reply-To: max@m00nbsd.net
To: gnats-bugs@NetBSD.org
Subject: NPF: wrong checksum alignment
X-Send-Pr-Version: www-1.0

>Number:         53479
>Category:       kern
>Synopsis:       NPF: wrong checksum alignment
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 29 14:30:00 +0000 2018
>Closed-Date:    Fri Aug 31 14:21:12 +0000 2018
>Last-Modified:  Fri Aug 31 14:21:12 +0000 2018
>Originator:     Maxime Villard
>Release:        -current, -8, -7 (probably)
>Organization:
TNF
>Environment:
amd64, i386, whatever
>Description:
As explained here:

	http://mail-index.netbsd.org/tech-net/2018/04/07/msg006777.html
	http://mail-index.netbsd.org/tech-net/2018/04/08/msg006785.html

There is a bug when computing the TCP checksum of a received packet when
max-mss clamping was active.

The problem is that NPF expects the MSS option to be on a 16bit boundary,
while the spec (RFC793) specifies that "An option may begin on any octet
boundary".

The call path is: npf_normalize() -> npf_fixup16_cksum().

Such packets are probably not seen a lot in the wild, however.
>How-To-Repeat:
I had tested by hand-crafting the packets.
>Fix:
When the MSS is not on a 16bit boundary, we need to call npf_fixup16_cksum
twice on two consecutive 16bit areas, the MSS being exactly in the middle.

	0      8           16          24    32
	+------+-----------+-----------+------+
	| data | MSS (low) | MSS(high) | data |
	+------+-----------+-----------+------+
	^                  ^
	first call         second call

And merge the results.

But given how NPF is written it looks like it is a headache to do just
that.

>Release-Note:

>Audit-Trail:
From: "Maxime Villard" <maxv@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/53479 CVS commit: src/sys/net/npf
Date: Fri, 31 Aug 2018 14:16:07 +0000

 Module Name:	src
 Committed By:	maxv
 Date:		Fri Aug 31 14:16:07 UTC 2018

 Modified Files:
 	src/sys/net/npf: npf_ext_normalize.c npf_impl.h npf_inet.c

 Log Message:
 Introduce npf_set_mss(). When the MSS is not 16bit-aligned, it sets:

 	0      8           16          24    32
 	+------+-----------+-----------+------+
 	| data | MSS (low) | MSS (hig) | data |
 	+------+-----------+-----------+------+
 	^                  ^
 	old[0]             old[1]

 And sets new[0,1] accordingly with the new value. The MSS-clamping code
 then adjusts twice the checksum on a 16bit boundary:

 	from old[0] to new[0]
 	from old[1] to new[1]

 Fixes PR/53479, opened by myself. Tested with wireshark and kASan.


 To generate a diff of this commit:
 cvs rdiff -u -r1.7 -r1.8 src/sys/net/npf/npf_ext_normalize.c
 cvs rdiff -u -r1.70 -r1.71 src/sys/net/npf/npf_impl.h
 cvs rdiff -u -r1.50 -r1.51 src/sys/net/npf/npf_inet.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: maxv@NetBSD.org
State-Changed-When: Fri, 31 Aug 2018 14:21:12 +0000
State-Changed-Why:
fixed


>Unformatted:

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.43 2018/01/16 07:36:43 maya Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2017 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.