Re: checking packet size?

Op ma, 07-03-2005 te 20:13 -0300, schreef Horacio J. Peña:
> Hola!
> 
> I'm writing a target for ebtables and reading ebt_log.c to learn how it
> works, I see that it access the IP header without checking the size of
> the payload. Wouldn't that create a vulnerability?

An Ethernet header has at least a size of 64 bytes, which leaves 46 or
42 (if vlan is used) bytes in the data part. This is more than the IP
header (20 bytes), which is why no checking is done until we look at the
tcp header.

> Just checked the 2.6 source, and there it seems to be "corrected".
> Shouldn't that be backported to the 2.4 patch?

Unless someone can crash the machine I don't see any reason. Note that
the log target just reads stuff.

> The 2.6 source does a skb_copy_bits of the payload. Is that the only way
> of checking if the header is incomplete? It seems terrible from a
> performance point of view.

In 2.6 the packet does not necessarily reside in one continuous block of
memory, which is why skb_copy_bits is needed. As a side effect, it
checks the size of the packet.

cheers,
Bart




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click