Skip to content

Commit

Permalink
lwip: Security fixes; PPPoS null-deref; NAPT ip-forward
Browse files Browse the repository at this point in the history 
* Cherry-pick important fixes to 2.1.2-esp
  - CVE-2020-22283: Attacker could craft a packet that would disclose 8 bytes of some heap memory:
    - icmp6: Don't copy too much data
    - icmp6: Fix copying of chained pbuf in reply
    - icmp6: keep to the RFC and send as much as possible with icmp6 error messages
  - CVE-2020-22284: ZEP - ZigBee Encapsulation Protocol/6LoWPAN is not supported in IDF,
    the netif module (zepif.c) is not included in the build, but users can still inject
    the file into compilation process, implement IO interface and use this.
    - zepif: Copy possibly chained output pbuf properly
    - Add #define for minimum IPv6 MTU length
    - pbuf: Add pbuf_copy_partial_pbuf library function
* PPPoS: Fix null-deref when processing double break packet
  - pppos: fix in_tail null (espressif/esp-lwip@537c69d5)
  - PPP: Add test exhibiting empty packet null-deref (espressif/esp-lwip@202a07da)
* NAPT: Fix PBUF_REF type to clone the pbuf before forwarding
  - IP-FORWARD: If packet-type is PBUF_REF clone it before forwarding
  - Add NAPT unit test to exercise NAT feature for both RAM and REF pbuf types
* version: Update version numbers to match 2.1.2-esp

* Update submodule: espressif/esp-lwip@2749568...76303df
  - test/napt: Add unit test for IP forward with PBUF_REF (espressif/esp-lwip@76303df2)
  - napt: Fix PBUF_REF type to clone the pbuf before forwarding (espressif/esp-lwip@39068263)
  - version: Update version numbers to match 2.1.2-esp (espressif/esp-lwip@2b922919)
  - pppos: fix in_tail null (espressif/esp-lwip@537c69d5)
  - PPP: Add test exhibiting empty packet null-deref (espressif/esp-lwip@202a07da)
  - pbuf: Add pbuf_copy_partial_pbuf library function (espressif/esp-lwip@1c9cd9c1)
  - Add #define for minimum IPv6 MTU length (espressif/esp-lwip@d2dc577b)
  - zepif: Copy possibly chained output pbuf properly (espressif/esp-lwip@64ab7f2a)
  - icmp6: Don't copy too much data (espressif/esp-lwip@4a64731b)
  - icmp6: Fix copying of chained pbuf in reply (espressif/esp-lwip@7c822ff4)
  - icmp6: keep to the RFC and send as much as possible with icmp6 error messages (espressif/esp-lwip@29100ab6)
  - dns: Add API to clear dns cache (espressif/esp-lwip@ee59f77d)
  - CI: Fixed adding gitlab key (espressif/esp-lwip@5a2bdba7)
  - test case: modify test case test_tcp_new_max_num_remove_FIN_WAIT_1 (espressif/esp-lwip@6b090f7d)

Closes #8300
Closes #8451
  • Loading branch information
@david-cermak
david-cermak committed Mar 11, 2022
1 parent 45dcc43 commit 47414ef
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 1 deletion.
2 changes: 1 addition & 1 deletion components/lwip/lwip
Submodule lwip updated 24 files
+7 −1 .gitlab-ci.yml
+6 −0 src/core/dns.c
+16 −0 src/core/ipv4/ip4.c
+18 −9 src/core/ipv6/icmp6.c
+2 −2 src/core/ipv6/nd6.c
+45 −11 src/core/pbuf.c
+1 −0 src/include/lwip/dns.h
+2 −2 src/include/lwip/init.h
+4 −2 src/include/lwip/opt.h
+1 −0 src/include/lwip/pbuf.h
+2 −0 src/include/lwip/prot/icmp6.h
+2 −0 src/include/lwip/prot/ip6.h
+1 −1 src/netif/lowpan6.c
+1 −1 src/netif/lowpan6_ble.c
+6 −0 src/netif/ppp/pppos.c
+1 −1 src/netif/zepif.c
+1 −0 test/unit/Filelists.cmake
+2 −1 test/unit/Filelists.mk
+43 −25 test/unit/core/test_ip4_route.c
+4 −0 test/unit/lwip_unittests.c
+6 −0 test/unit/lwipopts.h
+64 −0 test/unit/ppp/test_pppos.c
+13 −0 test/unit/ppp/test_pppos.h
+10 −11 test/unit/tcp/test_tcp_state.c
1 change: 1 addition & 0 deletions components/lwip/port/esp32/include/lwipopts.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1007,6 +1007,7 @@
#define ESP_LWIP_SELECT 1
#define ESP_LWIP_LOCK 1
#define ESP_THREAD_PROTECTION 1
#define ESP_IP_FORWARD 1

#ifdef CONFIG_LWIP_IPV6_AUTOCONFIG
#define ESP_IPV6_AUTOCONFIG CONFIG_LWIP_IPV6_AUTOCONFIG
Expand Down

0 comments on commit 47414ef

Please sign in to comment.