CVE-2016-7929/Make sure a Juniper header TLV isn't bigger than what's left in the...

[tcpdump] / print-tcp.c

diff --git a/print-tcp.c b/print-tcp.c
index 61fb93e66c3314a8903153ac05c1f16e1a8e20a0..f00ff32514802bebf9dd4ad8df20b300ffeb873a 100644 (file)
--- a/print-tcp.c
+++ b/print-tcp.c
@@ -127,9 +127,8 @@ static const struct tok tcp_option_values[] = {
         { TCPOPT_CCNEW, "ccnew" },
         { TCPOPT_CCECHO, "" },
         { TCPOPT_SIGNATURE, "md5" },
         { TCPOPT_CCNEW, "ccnew" },
         { TCPOPT_CCECHO, "" },
         { TCPOPT_SIGNATURE, "md5" },

-        { TCPOPT_SCPS, "scps" },
+        { TCPOPT_AUTH, "enhanced auth" },

         { TCPOPT_UTO, "uto" },
         { TCPOPT_UTO, "uto" },

-        { TCPOPT_TCPAO, "tcp-ao" },

         { TCPOPT_MPTCP, "mptcp" },
         { TCPOPT_FASTOPEN, "tfo" },
         { TCPOPT_EXPERIMENT2, "exp" },
         { TCPOPT_MPTCP, "mptcp" },
         { TCPOPT_FASTOPEN, "tfo" },
         { TCPOPT_EXPERIMENT2, "exp" },


@@ -190,8 +189,6 @@ tcp_print(netdissect_options *ndo,
         sport = EXTRACT_16BITS(&tp->th_sport);
         dport = EXTRACT_16BITS(&tp->th_dport);
 
         sport = EXTRACT_16BITS(&tp->th_sport);
         dport = EXTRACT_16BITS(&tp->th_dport);
 

-        hlen = TH_OFF(tp) * 4;
-

         if (ip6) {
                 if (ip6->ip6_nxt == IPPROTO_TCP) {
                         ND_PRINT((ndo, "%s.%s > %s.%s: ",
         if (ip6) {
                 if (ip6->ip6_nxt == IPPROTO_TCP) {
                         ND_PRINT((ndo, "%s.%s > %s.%s: ",


@@ -216,14 +213,16 @@ tcp_print(netdissect_options *ndo,
                 }
         }
 
                 }
         }
 

+        ND_TCHECK(*tp);
+
+        hlen = TH_OFF(tp) * 4;
+

         if (hlen < sizeof(*tp)) {
                 ND_PRINT((ndo, " tcp %d [bad hdr length %u - too short, < %lu]",
                              length - hlen, hlen, (unsigned long)sizeof(*tp)));
                 return;
         }
 
         if (hlen < sizeof(*tp)) {
                 ND_PRINT((ndo, " tcp %d [bad hdr length %u - too short, < %lu]",
                              length - hlen, hlen, (unsigned long)sizeof(*tp)));
                 return;
         }
 

-        ND_TCHECK(*tp);
-

         seq = EXTRACT_32BITS(&tp->th_seq);
         ack = EXTRACT_32BITS(&tp->th_ack);
         win = EXTRACT_16BITS(&tp->th_win);
         seq = EXTRACT_32BITS(&tp->th_seq);
         ack = EXTRACT_32BITS(&tp->th_ack);
         win = EXTRACT_16BITS(&tp->th_win);


@@ -538,32 +537,16 @@ tcp_print(netdissect_options *ndo,
 #endif
                                 break;
 
 #endif
                                 break;
 

-                        case TCPOPT_SCPS:
-                                datalen = 2;
-                                LENCHECK(datalen);
-                                ND_PRINT((ndo, " cap %02x id %u", cp[0], cp[1]));
-                                break;
-
-                        case TCPOPT_TCPAO:
-                                datalen = len - 2;
-                                LENCHECK(datalen);
-                                /* RFC 5925 Section 2.2:
-                                 * "The Length value MUST be greater than or equal to 4."
-                                 * (This includes the Kind and Length fields already processed
-                                 * at this point.)
-                                 */
-                                if (datalen < 2) {
-                                        ND_PRINT((ndo, " invalid"));
-                                } else {
-                                        ND_PRINT((ndo, " keyid %u rnextkeyid %u", cp[0], cp[1]));
-                                        if (datalen > 2) {
-                                                ND_PRINT((ndo, " mac "));
-                                                for (i = 2; i < datalen; i++)
-                                                        ND_PRINT((ndo, "%02x", cp[i]));
-                                        }
+                        case TCPOPT_AUTH:
+                                ND_PRINT((ndo, " keyid %d", *cp++));
+                                datalen = len - 3;
+                                for (i = 0; i < datalen; ++i) {
+                                        LENCHECK(i + 1);
+                                        ND_PRINT((ndo, "%02x", cp[i]));

                                 }
                                 break;
 
                                 }
                                 break;
 

+

                         case TCPOPT_EOL:
                         case TCPOPT_NOP:
                         case TCPOPT_SACKOK:
                         case TCPOPT_EOL:
                         case TCPOPT_NOP:
                         case TCPOPT_SACKOK:


@@ -626,7 +609,7 @@ tcp_print(netdissect_options *ndo,
                                 if (datalen)
                                         ND_PRINT((ndo, " 0x"));
                                 for (i = 0; i < datalen; ++i) {
                                 if (datalen)
                                         ND_PRINT((ndo, " 0x"));
                                 for (i = 0; i < datalen; ++i) {

-                                        LENCHECK(i);
+                                        LENCHECK(i + 1);

                                         ND_PRINT((ndo, "%02x", cp[i]));
                                 }
                                 break;
                                         ND_PRINT((ndo, "%02x", cp[i]));
                                 }
                                 break;