Bug ? [was: Re: icmp checksum with build_data()s]
"Frederic Raynal" <[email protected]> Sat, 22 May 2004 00:37:41 +0200
| Newsgroups | gmane.comp.security.libnet |
|---|---|
| Message-ID | <[email protected]> |
Re, The (geek) party is going on ... and the techno music made me think of a potential bug in all builders using the "solution" I proposed bellow. Example: ptag = libnet_build_foo(); // <-- dont use l->total_size libnet_build_bar(); // <-- use l->total_size libnet_write(); // <-- Ok libnet_build_foo(..., ptag); // <-- BUG CAUSED HERE ... If the second build_foo() has a different size, then there will be an error in checksum computation as total_size will have changed :-( This need to be checked ... but it's too late for me now. Fred Raynal Frédéric Raynal writes: > Hi, > > I am currently at Berlin (others there ?) > > As far as I can tell, you sould not use it that way: the checksums are > computed according to what is in the pblock, not after. > > But you are right here: this problem is also present for all other > packets that do include paylaod in the checksum computation :( > > raynal@Joker:~/LIBNET/libnet/src$ grep "h =" *c|grep payload > libnet_build_cdp.c: h = LIBNET_CDP_H + len + payload_s; > libnet_build_icmp.c: h = LIBNET_ICMPV4_ECHO_H + payload_s; /* hl for checksum */ > libnet_build_icmp.c: h = LIBNET_ICMPV4_MASK_H + payload_s; /* hl for checksum */ > libnet_build_icmp.c: h = LIBNET_ICMPV4_TS_H + payload_s; /* hl for checksum */ > libnet_build_icmp.c: h = LIBNET_ICMPV4_UNREACH_H + payload_s + l->total_size; > libnet_build_icmp.c: h = LIBNET_ICMPV4_TIMXCEED_H + payload_s + l->total_size; > libnet_build_icmp.c: h = LIBNET_ICMPV4_REDIRECT_H + payload_s + l->total_size; > libnet_build_ospf.c: h = LIBNET_OSPF_H + payload_s + len; > libnet_build_ospf.c: h = len + payload_s; > libnet_build_vrrp.c: h = LIBNET_VRRP_H + payload_s; > > > Without any garantee, the solution might be to systematically include > "+ l->total_size;" so that the data is included each time it is > required for the checksum. > > > Fred Raynal >