<p>Harald Welte <strong>merged</strong> this change.</p><p><a href="https://gerrit.osmocom.org/10054">View Change</a></p><div style="white-space:pre-wrap">Approvals:
Jenkins Builder: Verified
Pau Espin Pedrol: Looks good to me, but someone else must approve
Harald Welte: Looks good to me, approved
</div><pre style="font-family: monospace,monospace; white-space: pre-wrap;">fix unaligned access in build_ipcp_pco()<br><br>IPCP data can begin at any byte location in the pco_req->v array.<br>Casting to a 'struct ipcp_hdr' pointer could lead to unaligned access.<br>Parse IPCP data with u_int8_t pointers instead to avoid this problem.<br><br>Add some length checks while here.<br>pco_contains_proto() and ipcp_contains_option() now receive the minimum<br>size of the data the caller is looking for, and only return pointers<br>to items of sufficient size.<br><br>Also fix an inifinite loop in ipcp_contains_option() by refusing<br>IPCP options with length small than 2. Previously, a zero length<br>option would trigger an infinite loop in the parser.<br><br>Change-Id: Ia1410abb216831864042f95679330f4508e1af3d<br>Related: OS#3194<br>---<br>M ggsn/ggsn.c<br>1 file changed, 31 insertions(+), 20 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/ggsn/ggsn.c b/ggsn/ggsn.c</span><br><span>index 6d879c0..30584ef 100644</span><br><span>--- a/ggsn/ggsn.c</span><br><span>+++ b/ggsn/ggsn.c</span><br><span>@@ -413,16 +413,19 @@</span><br><span> } __attribute__ ((packed));</span><br><span> </span><br><span> /* determine if IPCP contains given option */</span><br><span style="color: hsl(0, 100%, 40%);">-static struct ipcp_option_hdr *ipcp_contains_option(struct ipcp_hdr *ipcp, enum ipcp_options opt)</span><br><span style="color: hsl(120, 100%, 40%);">+static uint8_t *ipcp_contains_option(uint8_t *ipcp, size_t ipcp_len, enum ipcp_options opt, size_t opt_minlen)</span><br><span> {</span><br><span style="color: hsl(0, 100%, 40%);">- uint8_t *cur = ipcp->options;</span><br><span style="color: hsl(120, 100%, 40%);">+ uint8_t *cur_opt = ipcp + sizeof(struct ipcp_hdr);</span><br><span> </span><br><span> /* iterate over Options and check if protocol contained */</span><br><span style="color: hsl(0, 100%, 40%);">- while (cur + 2 <= ((uint8_t *)ipcp) + ntohs(ipcp->len)) {</span><br><span style="color: hsl(0, 100%, 40%);">- struct ipcp_option_hdr *cur_opt = (struct ipcp_option_hdr *) cur;</span><br><span style="color: hsl(0, 100%, 40%);">- if (cur_opt->type == opt)</span><br><span style="color: hsl(120, 100%, 40%);">+ while (cur_opt + 2 <= ipcp + ipcp_len) {</span><br><span style="color: hsl(120, 100%, 40%);">+ uint8_t type = cur_opt[0];</span><br><span style="color: hsl(120, 100%, 40%);">+ uint8_t len = cur_opt[1]; /* length value includes 2 bytes type/length */</span><br><span style="color: hsl(120, 100%, 40%);">+ if (len < 2)</span><br><span style="color: hsl(120, 100%, 40%);">+ return NULL;</span><br><span style="color: hsl(120, 100%, 40%);">+ if (type == opt && len >= 2 + opt_minlen)</span><br><span> return cur_opt;</span><br><span style="color: hsl(0, 100%, 40%);">- cur += cur_opt->len;</span><br><span style="color: hsl(120, 100%, 40%);">+ cur_opt += len;</span><br><span> }</span><br><span> return NULL;</span><br><span> }</span><br><span>@@ -460,7 +463,7 @@</span><br><span> };</span><br><span> </span><br><span> /* determine if PCO contains given protocol */</span><br><span style="color: hsl(0, 100%, 40%);">-static uint8_t *pco_contains_proto(struct ul255_t *pco, uint16_t prot)</span><br><span style="color: hsl(120, 100%, 40%);">+static uint8_t *pco_contains_proto(struct ul255_t *pco, uint16_t prot, size_t prot_minlen)</span><br><span> {</span><br><span> uint8_t *cur = pco->v + 1;</span><br><span> </span><br><span>@@ -468,7 +471,7 @@</span><br><span> while (cur + 3 <= pco->v + pco->l) {</span><br><span> uint16_t cur_prot = osmo_load16be(cur);</span><br><span> uint8_t cur_len = cur[2];</span><br><span style="color: hsl(0, 100%, 40%);">- if (cur_prot == prot)</span><br><span style="color: hsl(120, 100%, 40%);">+ if (cur_prot == prot && cur_len >= prot_minlen)</span><br><span> return cur;</span><br><span> cur += cur_len + 3;</span><br><span> }</span><br><span>@@ -500,35 +503,45 @@</span><br><span> }</span><br><span> </span><br><span> /* construct an IPCP PCO response from request*/</span><br><span style="color: hsl(0, 100%, 40%);">-static int build_ipcp_pco(struct apn_ctx *apn, struct pdp_t *pdp, struct msgb *msg)</span><br><span style="color: hsl(120, 100%, 40%);">+static void build_ipcp_pco(struct apn_ctx *apn, struct pdp_t *pdp, struct msgb *msg)</span><br><span> {</span><br><span> const struct in46_addr *dns1 = &apn->v4.cfg.dns[0];</span><br><span> const struct in46_addr *dns2 = &apn->v4.cfg.dns[1];</span><br><span style="color: hsl(0, 100%, 40%);">- struct ipcp_hdr *ipcp;</span><br><span style="color: hsl(120, 100%, 40%);">+ uint8_t *ipcp;</span><br><span style="color: hsl(120, 100%, 40%);">+ uint16_t ipcp_len;</span><br><span> uint8_t *len1, *len2, *pco_ipcp;</span><br><span> uint8_t *start = msg->tail;</span><br><span> unsigned int len_appended;</span><br><span style="color: hsl(120, 100%, 40%);">+ ptrdiff_t consumed;</span><br><span style="color: hsl(120, 100%, 40%);">+ size_t remain;</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if (!(pco_ipcp = pco_contains_proto(&pdp->pco_req, PCO_P_IPCP)))</span><br><span style="color: hsl(0, 100%, 40%);">- return 0;</span><br><span style="color: hsl(0, 100%, 40%);">- ipcp = (struct ipcp_hdr*) (pco_ipcp + 3); /* 2=type + 1=len */</span><br><span style="color: hsl(120, 100%, 40%);">+ /* pco_contains_proto() returns a potentially unaligned pointer into pco_req->v (see OS#3194) */</span><br><span style="color: hsl(120, 100%, 40%);">+ if (!(pco_ipcp = pco_contains_proto(&pdp->pco_req, PCO_P_IPCP, sizeof(struct ipcp_hdr))))</span><br><span style="color: hsl(120, 100%, 40%);">+ return;</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ ipcp = (pco_ipcp + 3); /* 2=type + 1=len */</span><br><span style="color: hsl(120, 100%, 40%);">+ consumed = (ipcp - &pdp->pco_req.v[0]);</span><br><span style="color: hsl(120, 100%, 40%);">+ remain = sizeof(pdp->pco_req.v) - consumed;</span><br><span style="color: hsl(120, 100%, 40%);">+ ipcp_len = osmo_load16be(ipcp + 2); /* 1=code + 1=id */</span><br><span style="color: hsl(120, 100%, 40%);">+ if (remain < 0 || remain < ipcp_len)</span><br><span style="color: hsl(120, 100%, 40%);">+ return;</span><br><span> </span><br><span> /* Three byte T16L header */</span><br><span> msgb_put_u16(msg, 0x8021); /* IPCP */</span><br><span> len1 = msgb_put(msg, 1); /* Length of contents: delay */</span><br><span> </span><br><span> msgb_put_u8(msg, 0x02); /* ACK */</span><br><span style="color: hsl(0, 100%, 40%);">- msgb_put_u8(msg, ipcp->id); /* ID: Needs to match request */</span><br><span style="color: hsl(120, 100%, 40%);">+ msgb_put_u8(msg, ipcp[1]); /* ID: Needs to match request */</span><br><span> msgb_put_u8(msg, 0x00); /* Length MSB */</span><br><span> len2 = msgb_put(msg, 1); /* Length LSB: delay */</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if (dns1->len == 4 && ipcp_contains_option(ipcp, IPCP_OPT_PRIMARY_DNS)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ if (dns1->len == 4 && ipcp_contains_option(ipcp, ipcp_len, IPCP_OPT_PRIMARY_DNS, 4)) {</span><br><span> msgb_put_u8(msg, 0x81); /* DNS1 Tag */</span><br><span> msgb_put_u8(msg, 2 + dns1->len);/* DNS1 Length, incl. TL */</span><br><span> msgb_put_u32(msg, ntohl(dns1->v4.s_addr));</span><br><span> }</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if (dns2->len == 4 && ipcp_contains_option(ipcp, IPCP_OPT_SECONDARY_DNS)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ if (dns2->len == 4 && ipcp_contains_option(ipcp, ipcp_len, IPCP_OPT_SECONDARY_DNS, 4)) {</span><br><span> msgb_put_u8(msg, 0x83); /* DNS2 Tag */</span><br><span> msgb_put_u8(msg, 2 + dns2->len);/* DNS2 Length, incl. TL */</span><br><span> msgb_put_u32(msg, ntohl(dns2->v4.s_addr));</span><br><span>@@ -538,8 +551,6 @@</span><br><span> len_appended = msg->tail - start;</span><br><span> *len1 = len_appended - 3;</span><br><span> *len2 = len_appended - 3;</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span style="color: hsl(0, 100%, 40%);">- return 0;</span><br><span> }</span><br><span> </span><br><span> /* process one PCO request from a MS/UE, putting together the proper responses */</span><br><span>@@ -555,7 +566,7 @@</span><br><span> if (peer_v4)</span><br><span> build_ipcp_pco(apn, pdp, msg);</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if (pco_contains_proto(&pdp->pco_req, PCO_P_DNS_IPv6_ADDR)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ if (pco_contains_proto(&pdp->pco_req, PCO_P_DNS_IPv6_ADDR, 0)) {</span><br><span> for (i = 0; i < ARRAY_SIZE(apn->v6.cfg.dns); i++) {</span><br><span> struct in46_addr *i46a = &apn->v6.cfg.dns[i];</span><br><span> if (i46a->len != 16)</span><br><span>@@ -564,7 +575,7 @@</span><br><span> }</span><br><span> }</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if (pco_contains_proto(&pdp->pco_req, PCO_P_DNS_IPv4_ADDR)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ if (pco_contains_proto(&pdp->pco_req, PCO_P_DNS_IPv4_ADDR, 0)) {</span><br><span> for (i = 0; i < ARRAY_SIZE(apn->v4.cfg.dns); i++) {</span><br><span> struct in46_addr *i46a = &apn->v4.cfg.dns[i];</span><br><span> if (i46a->len != 4)</span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/10054">change 10054</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/10054"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: osmo-ggsn </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: merged </div>
<div style="display:none"> Gerrit-Change-Id: Ia1410abb216831864042f95679330f4508e1af3d </div>
<div style="display:none"> Gerrit-Change-Number: 10054 </div>
<div style="display:none"> Gerrit-PatchSet: 4 </div>
<div style="display:none"> Gerrit-Owner: Stefan Sperling <ssperling@sysmocom.de> </div>
<div style="display:none"> Gerrit-Reviewer: Harald Welte <laforge@gnumonks.org> </div>
<div style="display:none"> Gerrit-Reviewer: Jenkins Builder </div>
<div style="display:none"> Gerrit-Reviewer: Pau Espin Pedrol <pespin@sysmocom.de> </div>
<div style="display:none"> Gerrit-Reviewer: Stefan Sperling <ssperling@sysmocom.de> </div>