X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/e84f58700fe17ee5c4680247fcdcf506ff38587d..refs/heads/master:/print-ip6.c

diff --git a/print-ip6.c b/print-ip6.c
index 82948334..269b41fb 100644
--- a/print-ip6.c
+++ b/print-ip6.c
@@ -21,9 +21,7 @@
 
 /* \summary: IPv6 printer */
 
-#ifdef HAVE_CONFIG_H
 #include <config.h>
-#endif
 
 #include "netdissect-stdinc.h"
 
@@ -231,28 +229,23 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	u_int total_advance;
 	const u_char *cp;
 	uint32_t payload_len;
-	uint8_t nh;
+	uint8_t ph, nh;
 	int fragmented = 0;
 	u_int flow;
 	int found_extension_header;
 	int found_jumbo;
+	int found_hbh;
 
 	ndo->ndo_protocol = "ip6";
 	ip6 = (const struct ip6_hdr *)bp;
 
-	ND_TCHECK_SIZE(ip6);
-	if (length < sizeof (struct ip6_hdr)) {
-		ND_PRINT("truncated-ip6 %u", length);
-		return;
+	if (!ndo->ndo_eflag) {
+		nd_print_protocol_caps(ndo);
+		ND_PRINT(" ");
 	}
 
-	if (!ndo->ndo_eflag)
-	    ND_PRINT("IP6 ");
-
-	if (IP6_VERSION(ip6) != 6) {
-	  ND_PRINT("version error: %u != 6", IP6_VERSION(ip6));
-	  return;
-	}
+	ND_ICHECK_ZU(length, <, sizeof (struct ip6_hdr));
+	ND_ICHECKMSG_U("version", IP6_VERSION(ip6), !=, 6);
 
 	payload_len = GET_BE_U_2(ip6->ip6_plen);
 	/*
@@ -279,12 +272,16 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	 */
 	if (payload_len != 0) {
 		len = payload_len + sizeof(struct ip6_hdr);
-		if (length < len)
-			ND_PRINT("truncated-ip6 - %u bytes missing!",
-				len - length);
+		if (len > length) {
+			ND_PRINT("[header+payload length %u > length %u]",
+				 len, length);
+			nd_print_invalid(ndo);
+			ND_PRINT(" ");
+		}
 	} else
 		len = length + sizeof(struct ip6_hdr);
 
+	ph = 255;
 	nh = GET_U_1(ip6->ip6_nxt);
 	if (ndo->ndo_vflag) {
 	    flow = GET_BE_U_4(ip6->ip6_flow);
@@ -295,17 +292,20 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	    if (flow & 0x000fffff)
 	        ND_PRINT("flowlabel 0x%05x, ", flow & 0x000fffff);
 
-	    ND_PRINT("hlim %u, next-header %s (%u) payload length: %u) ",
+	    ND_PRINT("hlim %u, next-header %s (%u), payload length %u) ",
 	                 GET_U_1(ip6->ip6_hlim),
 	                 tok2str(ipproto_values,"unknown",nh),
 	                 nh,
 	                 payload_len);
 	}
+	ND_TCHECK_SIZE(ip6);
 
 	/*
-	 * Cut off the snapshot length to the end of the IP payload.
+	 * Cut off the snapshot length to the end of the IP payload
+	 * or the end of the data in which it's contained, whichever
+	 * comes first.
 	 */
-	if (!nd_push_snaplen(ndo, bp, len)) {
+	if (!nd_push_snaplen(ndo, bp, ND_MIN(length, len))) {
 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 			"%s: can't push snaplen on buffer stack", __func__);
 	}
@@ -316,6 +316,7 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	/* Process extension headers */
 	found_extension_header = 0;
 	found_jumbo = 0;
+	found_hbh = 0;
 	while (cp < ndo->ndo_snapend && advance > 0) {
 		if (len < (u_int)advance)
 			goto trunc;
@@ -327,18 +328,38 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 		    nh != IPPROTO_TCP && nh != IPPROTO_UDP &&
 		    nh != IPPROTO_DCCP && nh != IPPROTO_SCTP) {
 			ND_PRINT("%s > %s: ", GET_IP6ADDR_STRING(ip6->ip6_src),
-				     GET_IP6ADDR_STRING(ip6->ip6_dst));
+				 GET_IP6ADDR_STRING(ip6->ip6_dst));
 		}
 
 		switch (nh) {
 
 		case IPPROTO_HOPOPTS:
+			/*
+			 * The Hop-by-Hop Options header, when present,
+			 * must immediately follow the IPv6 header (RFC 8200)
+			 */
+			if (found_hbh == 1) {
+				ND_PRINT("[The Hop-by-Hop Options header was already found]");
+				nd_print_invalid(ndo);
+				return;
+			}
+			if (ph != 255) {
+				ND_PRINT("[The Hop-by-Hop Options header don't follow the IPv6 header]");
+				nd_print_invalid(ndo);
+				return;
+			}
 			advance = hbhopt_process(ndo, cp, &found_jumbo, &payload_len);
+			if (payload_len == 0 && found_jumbo == 0) {
+				ND_PRINT("[No valid Jumbo Payload Hop-by-Hop option found]");
+				nd_print_invalid(ndo);
+				return;
+			}
 			if (advance < 0) {
 				nd_pop_packet_info(ndo);
 				return;
 			}
 			found_extension_header = 1;
+			found_hbh = 1;
 			nh = GET_U_1(cp);
 			break;
 
@@ -366,7 +387,7 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 		case IPPROTO_MOBILITY_OLD:
 		case IPPROTO_MOBILITY:
 			/*
-			 * XXX - we don't use "advance"; RFC 3775 says that
+			 * RFC 3775 says that
 			 * the next header field in a mobility header
 			 * should be IPPROTO_NONE, but speaks of
 			 * the possibility of a future extension in
@@ -413,9 +434,12 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 				len = payload_len + sizeof(struct ip6_hdr);
 				if (len < total_advance)
 					goto trunc;
-				if (length < len)
-					ND_PRINT("truncated-ip6 - %u bytes missing!",
-						len - length);
+				if (len > length) {
+					ND_PRINT("[header+payload length %u > length %u]",
+						 len, length);
+					nd_print_invalid(ndo);
+					ND_PRINT(" ");
+				}
 				nd_change_snaplen(ndo, bp, len);
 
 				/*
@@ -441,7 +465,7 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 						goto trunc;
 
 					/*
-					 * OK, we didn't see any extnesion
+					 * OK, we didn't see any extension
 					 * header, but that means we have
 					 * no payload, so set the length
 					 * to the IPv6 header length,
@@ -466,6 +490,7 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 			nd_pop_packet_info(ndo);
 			return;
 		}
+		ph = nh;
 
 		/* ndo_protocol reassignment after xxx_print() calls */
 		ndo->ndo_protocol = "ip6";
@@ -475,4 +500,8 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	return;
 trunc:
 	nd_print_trunc(ndo);
+	return;
+
+invalid:
+	nd_print_invalid(ndo);
 }