IPfilter
[Top] [All Lists]

Re: Alignment bug in IPv6 ICMP handling

To: <strube@physik3.gwdg.de>
Subject: Re: Alignment bug in IPv6 ICMP handling
From: "Stuart Remphrey" <stuart.remphrey@rmit.edu.au>
Date: Wed, 06 Jun 2007 18:45:28 +1000
Cc: <ipfilter@coombs.anu.edu.au>
Delivered-to: sp-com-lists@consult.net
Delivered-to: ipfilter-list@securepoint.com
Sender: owner-ipfilter@coombs.anu.edu.au
However, while the ip6_hdrctl union is 64 bits,
it's largest member is only 32 bits.
So it is forced to align to 32 bits, not 64.

On 64-bit platforms which care about 64-bit alignment
this may need to be enforced via a 64-bit dummy
union member or pragma.

Rgds, Stuart.


Stuart Remphrey
RMIT ITS Infrastructure Services - Unix Systems
Phone (03) 992 55 070  (or extension 55070)
>>> Hans Werner Strube <strube@physik3.gwdg.de> 06/06/07 5:40 PM >>>
Geoff Adams wrote:
> struct ip6_hdr {
>          union {
>                  struct ip6_hdrctl {
>                          u_int32_t ip6_un1_flow; /* 20 bits of flow- 
> ID */
>                          u_int16_t ip6_un1_plen; /* payload length */
>                          u_int8_t  ip6_un1_nxt;  /* next header */
>                          u_int8_t  ip6_un1_hlim; /* hop limit */
>                  } ip6_un1;
>                  u_int8_t ip6_un2_vfc;   /* 4 bits version, top 4  
> bits class */
>          } ip6_ctlun;
>          struct in6_addr ip6_src;        /* source address */
>          struct in6_addr ip6_dst;        /* destination address */
> } __attribute__((__packed__));
> 
> Sure enough, that 8-bit ip6_un2_vfc un-aligns ip6_src.

Hardly. ip6_ctlun is a union, not a struct. ip6_un2_vfc is just made
equivalent to the first 8 bits of ip6_un1, which has size 64 bits, which
is
thus also the size of union ip6_ctlun. This kind of union appears to
depend
on the byte order, but neither ip6_un1_flow nor ip6_un2_vfc seem to be
used
anywhere in the ipfilter sources.

<Prev in Thread] Current Thread [Next in Thread>