CVE-2017-13009/IPv6 mobility: Add a bounds check.

[tcpdump] / print-ntp.c

diff --git a/print-ntp.c b/print-ntp.c
index 2a42c8f61bcabc18192b4f0d2d9941863b216f2f..63a35091fe75af8a0a7e0108d1f6ac89214ea74a 100644 (file)
--- a/print-ntp.c
+++ b/print-ntp.c
@@ -38,6 +38,8 @@
 #include "addrtoname.h"
 #include "extract.h"
 
 #include "addrtoname.h"
 #include "extract.h"
 

+static const char tstr[] = " [|ntp]";
+

 /*
  * Based on ntp.h from the U of MD implementation
  *     This file is based on Version 2 of the NTP spec (RFC1119).
 /*
  * Based on ntp.h from the U of MD implementation
  *     This file is based on Version 2 of the NTP spec (RFC1119).


@@ -66,13 +68,13 @@
  *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 struct l_fixedpt {
  *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 struct l_fixedpt {

-       uint32_t int_part;
-       uint32_t fraction;
+       nd_uint32_t int_part;
+       nd_uint32_t fraction;

 };
 
 struct s_fixedpt {
 };
 
 struct s_fixedpt {

-       uint16_t int_part;
-       uint16_t fraction;
+       nd_uint16_t int_part;
+       nd_uint16_t fraction;

 };
 
 /* rfc2030
 };
 
 /* rfc2030


@@ -113,26 +115,26 @@ struct s_fixedpt {
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
 
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
 

-/* Length of the NTP message with the mandatory fields ("the header")
+/* Length of the NTP data message with the mandatory fields ("the header")

  * and without any optional fields (extension, Key Identifier,
  * Message Digest).
  */
  * and without any optional fields (extension, Key Identifier,
  * Message Digest).
  */

-#define NTP_MSG_MINLEN 48
+#define NTP_TIMEMSG_MINLEN 48U

 
 struct ntp_time_data {
 
 struct ntp_time_data {

-       u_char status;          /* status of local clock and leap info */
-       u_char stratum;         /* Stratum level */
-       int ppoll:8;            /* poll value */
-       int precision:8;
+       nd_uint8_t status;              /* status of local clock and leap info */
+       nd_uint8_t stratum;             /* Stratum level */
+       nd_int8_t ppoll;                /* poll value */
+       nd_int8_t precision;

        struct s_fixedpt root_delay;
        struct s_fixedpt root_dispersion;
        struct s_fixedpt root_delay;
        struct s_fixedpt root_dispersion;

-       uint32_t refid;
+       nd_uint32_t refid;

        struct l_fixedpt ref_timestamp;
        struct l_fixedpt org_timestamp;
        struct l_fixedpt rec_timestamp;
        struct l_fixedpt xmt_timestamp;
        struct l_fixedpt ref_timestamp;
        struct l_fixedpt org_timestamp;
        struct l_fixedpt rec_timestamp;
        struct l_fixedpt xmt_timestamp;

-        uint32_t key_id;
-        uint8_t  message_digest[20];
+       nd_uint32_t key_id;
+       nd_uint8_t  message_digest[20];

 };
 /*
  *     Leap Second Codes (high order two bits)
 };
 /*
  *     Leap Second Codes (high order two bits)


@@ -230,15 +232,21 @@ static const struct tok ntp_stratum_values[] = {
  *
  *               Figure 1: NTP Control Message Header
  */
  *
  *               Figure 1: NTP Control Message Header
  */

+
+/* Length of the NTP control message with the mandatory fields ("the header")
+ * and without any optional fields (Data, Padding, Authenticator).
+ */
+#define NTP_CTRLMSG_MINLEN 12U
+

 struct ntp_control_data {
 struct ntp_control_data {

-       u_char          magic;          /* LI, VN, Mode */
-       u_char          control;        /* R, E, M, OpCode */
-       uint16_t        sequence;       /* Sequence Number */
-       uint16_t        status;         /* Status */
-       uint16_t        assoc;          /* Association ID */
-       uint16_t        offset;         /* Offset */
-       uint16_t        count;          /* Count */
-       u_char          data[564];      /* Data, [Padding, [Authenticator]] */
+       nd_uint8_t      magic;          /* LI, VN, Mode */
+       nd_uint8_t      control;        /* R, E, M, OpCode */
+       nd_uint16_t     sequence;       /* Sequence Number */
+       nd_uint16_t     status;         /* Status */
+       nd_uint16_t     assoc;          /* Association ID */
+       nd_uint16_t     offset;         /* Offset */
+       nd_uint16_t     count;          /* Count */
+       nd_uint8_t      data[564];      /* Data, [Padding, [Authenticator]] */

 };
 
 /*
 };
 
 /*


@@ -250,10 +258,8 @@ ntp_time_print(netdissect_options *ndo,
 {
        int mode, version, leapind;
 
 {
        int mode, version, leapind;
 

-       if (length < NTP_MSG_MINLEN) {
-               ND_PRINT((ndo, "NTP, length %u", length));
+       if (length < NTP_TIMEMSG_MINLEN)

                goto invalid;
                goto invalid;

-       }

 
        ND_TCHECK(bp->status);
 
 
        ND_TCHECK(bp->status);
 


@@ -282,13 +288,11 @@ ntp_time_print(netdissect_options *ndo,
                bp->stratum,
                tok2str(ntp_stratum_values, (bp->stratum >=2 && bp->stratum<=15) ? "secondary reference" : "reserved", bp->stratum)));
 
                bp->stratum,
                tok2str(ntp_stratum_values, (bp->stratum >=2 && bp->stratum<=15) ? "secondary reference" : "reserved", bp->stratum)));
 

-       /* Can't ND_TCHECK bp->ppoll bitfield so bp->stratum + 2 instead */
-       ND_TCHECK2(bp->stratum, 2);
+       ND_TCHECK(bp->ppoll);

        ND_PRINT((ndo, ", poll %d", bp->ppoll));
        p_poll(ndo, bp->ppoll);
 
        ND_PRINT((ndo, ", poll %d", bp->ppoll));
        p_poll(ndo, bp->ppoll);
 

-       /* Can't ND_TCHECK bp->precision bitfield so bp->distance + 0 instead */
-       ND_TCHECK2(bp->root_delay, 0);
+       ND_TCHECK(bp->precision);

        ND_PRINT((ndo, ", precision %d", bp->precision));
 
        ND_TCHECK(bp->root_delay);
        ND_PRINT((ndo, ", precision %d", bp->precision));
 
        ND_TCHECK(bp->root_delay);


@@ -353,10 +357,10 @@ ntp_time_print(netdissect_options *ndo,
        p_ntp_delta(ndo, &(bp->org_timestamp), &(bp->xmt_timestamp));
 
        /* FIXME: this code is not aware of any extension fields */
        p_ntp_delta(ndo, &(bp->org_timestamp), &(bp->xmt_timestamp));
 
        /* FIXME: this code is not aware of any extension fields */

-       if (length == NTP_MSG_MINLEN + 4) {     /* Optional: key-id (crypto-NAK) */
+       if (length == NTP_TIMEMSG_MINLEN + 4) {         /* Optional: key-id (crypto-NAK) */

                ND_TCHECK(bp->key_id);
                ND_PRINT((ndo, "\n\tKey id: %u", EXTRACT_32BITS(&bp->key_id)));
                ND_TCHECK(bp->key_id);
                ND_PRINT((ndo, "\n\tKey id: %u", EXTRACT_32BITS(&bp->key_id)));

-       } else if (length == NTP_MSG_MINLEN + 4 + 16) {         /* Optional: key-id + 128-bit digest */
+       } else if (length == NTP_TIMEMSG_MINLEN + 4 + 16) {     /* Optional: key-id + 128-bit digest */

                ND_TCHECK(bp->key_id);
                ND_PRINT((ndo, "\n\tKey id: %u", EXTRACT_32BITS(&bp->key_id)));
                ND_TCHECK2(bp->message_digest, 16);
                ND_TCHECK(bp->key_id);
                ND_PRINT((ndo, "\n\tKey id: %u", EXTRACT_32BITS(&bp->key_id)));
                ND_TCHECK2(bp->message_digest, 16);


@@ -365,7 +369,7 @@ ntp_time_print(netdissect_options *ndo,
                               EXTRACT_32BITS(bp->message_digest + 4),
                               EXTRACT_32BITS(bp->message_digest + 8),
                               EXTRACT_32BITS(bp->message_digest + 12)));
                               EXTRACT_32BITS(bp->message_digest + 4),
                               EXTRACT_32BITS(bp->message_digest + 8),
                               EXTRACT_32BITS(bp->message_digest + 12)));

-       } else if (length == NTP_MSG_MINLEN + 4 + 20) {         /* Optional: key-id + 160-bit digest */
+       } else if (length == NTP_TIMEMSG_MINLEN + 4 + 20) {     /* Optional: key-id + 160-bit digest */

                ND_TCHECK(bp->key_id);
                ND_PRINT((ndo, "\n\tKey id: %u", EXTRACT_32BITS(&bp->key_id)));
                ND_TCHECK2(bp->message_digest, 20);
                ND_TCHECK(bp->key_id);
                ND_PRINT((ndo, "\n\tKey id: %u", EXTRACT_32BITS(&bp->key_id)));
                ND_TCHECK2(bp->message_digest, 20);


@@ -375,8 +379,8 @@ ntp_time_print(netdissect_options *ndo,
                               EXTRACT_32BITS(bp->message_digest + 8),
                               EXTRACT_32BITS(bp->message_digest + 12),
                               EXTRACT_32BITS(bp->message_digest + 16)));
                               EXTRACT_32BITS(bp->message_digest + 8),
                               EXTRACT_32BITS(bp->message_digest + 12),
                               EXTRACT_32BITS(bp->message_digest + 16)));

-       } else if (length > NTP_MSG_MINLEN) {
-               ND_PRINT((ndo, "\n\t(%u more bytes after the header)", length - NTP_MSG_MINLEN));
+       } else if (length > NTP_TIMEMSG_MINLEN) {
+               ND_PRINT((ndo, "\n\t(%u more bytes after the header)", length - NTP_TIMEMSG_MINLEN));

        }
        return;
 
        }
        return;
 


@@ -386,7 +390,7 @@ invalid:
        return;
 
 trunc:
        return;
 
 trunc:

-       ND_PRINT((ndo, " [|ntp]"));
+       ND_PRINT((ndo, " %s", tstr));

 }
 
 /*
 }
 
 /*


@@ -399,6 +403,10 @@ ntp_control_print(netdissect_options *ndo,
        u_char R, E, M, opcode;
        uint16_t sequence, status, assoc, offset, count;
 
        u_char R, E, M, opcode;
        uint16_t sequence, status, assoc, offset, count;
 

+       if (length < NTP_CTRLMSG_MINLEN)
+               goto invalid;
+
+       ND_TCHECK(cd->control);

        R = (cd->control & 0x80) != 0;
        E = (cd->control & 0x40) != 0;
        M = (cd->control & 0x20) != 0;
        R = (cd->control & 0x80) != 0;
        E = (cd->control & 0x40) != 0;
        M = (cd->control & 0x20) != 0;


@@ -407,29 +415,41 @@ ntp_control_print(netdissect_options *ndo,
                  R ? "Response" : "Request", E ? "Error" : "OK",
                  M ? "More" : "Last", (unsigned)opcode));
 
                  R ? "Response" : "Request", E ? "Error" : "OK",
                  M ? "More" : "Last", (unsigned)opcode));
 

+       ND_TCHECK(cd->sequence);

        sequence = EXTRACT_16BITS(&cd->sequence);
        ND_PRINT((ndo, "\tSequence=%hu", sequence));
 
        sequence = EXTRACT_16BITS(&cd->sequence);
        ND_PRINT((ndo, "\tSequence=%hu", sequence));
 

+       ND_TCHECK(cd->status);

        status = EXTRACT_16BITS(&cd->status);
        ND_PRINT((ndo, ", Status=%#hx", status));
 
        status = EXTRACT_16BITS(&cd->status);
        ND_PRINT((ndo, ", Status=%#hx", status));
 

+       ND_TCHECK(cd->assoc);

        assoc = EXTRACT_16BITS(&cd->assoc);
        ND_PRINT((ndo, ", Assoc.=%hu", assoc));
 
        assoc = EXTRACT_16BITS(&cd->assoc);
        ND_PRINT((ndo, ", Assoc.=%hu", assoc));
 

+       ND_TCHECK(cd->offset);

        offset = EXTRACT_16BITS(&cd->offset);
        ND_PRINT((ndo, ", Offset=%hu", offset));
 
        offset = EXTRACT_16BITS(&cd->offset);
        ND_PRINT((ndo, ", Offset=%hu", offset));
 

+       ND_TCHECK(cd->count);

        count = EXTRACT_16BITS(&cd->count);
        ND_PRINT((ndo, ", Count=%hu", count));
 
        count = EXTRACT_16BITS(&cd->count);
        ND_PRINT((ndo, ", Count=%hu", count));
 

-       if ((cd->data - (const u_char *)cd) + count > length)
-               goto trunc;
-       if (count != 0)
+       if (NTP_CTRLMSG_MINLEN + count > length)
+               goto invalid;
+       if (count != 0) {
+               ND_TCHECK2(cd->data, count);

                ND_PRINT((ndo, "\n\tTO-BE-DONE: data not interpreted"));
                ND_PRINT((ndo, "\n\tTO-BE-DONE: data not interpreted"));

+       }
+       return;
+
+invalid:
+       ND_PRINT((ndo, " %s", istr));
+       ND_TCHECK2(*cd, length);

        return;
 
 trunc:
        return;
 
 trunc:

-       ND_PRINT((ndo, " [|ntp]"));
+       ND_PRINT((ndo, " %s", tstr));

 }
 
 union ntpdata {
 }
 
 union ntpdata {


@@ -478,7 +498,7 @@ ntp_print(netdissect_options *ndo,
        return;
 
 trunc:
        return;
 
 trunc:

-       ND_PRINT((ndo, " [|ntp]"));
+       ND_PRINT((ndo, " %s", tstr));

 }
 
 static void
 }
 
 static void