nrf802154: Validate frame length before dst filter by bergzand · Pull Request #11191 · RIOT-OS/RIOT

bergzand · 2019-03-14T17:58:49Z

Contribution description

This PR adds a length check to the received frame. This prevents the destination filter check in the driver from reading beyond the received frame length. This increases the time spent in the receive part of the interrupt by 0.875µs (from 6.75µs to 7.625µs).

Also requesting a review from @miri64 and @haukepetersen as they probably also have an opinion on the additional check here.

Testing procedure

Basic receive validation should be enough.
Before this PR it should have been possible to trigger a netif receive operation on an incorrect frame after a valid frame was received.

Issues/PRs references

None

miri64

My opinion is that any incoming data should be checked for its length ;-). However, I'm not sure that your solution guarantees that.

cpu/nrf52/radio/nrf802154/nrf802154.c

ghost

Just some suggestions.
But I have a more basic question: Could this filtering go into /drivers/netdev_ieee802154?

cpu/nrf52/radio/nrf802154/nrf802154.c

ghost · 2019-04-05T09:37:19Z

cpu/nrf52/radio/nrf802154/nrf802154.c

+        return false;
+    }
+    size_t expected_len = ieee802154_get_frame_hdr_len(&rxbuf[1]);
+    if (!expected_len) {


Could go into the last return.
Also, I'd prefer comparison with zero since its not a bool, but its fine to me if you like writing it this way.

Agreed, I agree with your suggestion to compare with zero to increase readability. I'll also try to make the set of checks a bit more readable with some comments :)

bergzand · 2019-04-05T09:55:09Z

But I have a more basic question: Could this filtering go into /drivers/netdev_ieee802154?

I think so, I have to check if I can simply extend the functions or have to change the API slightly.

ghost · 2019-04-05T10:05:28Z

I discussed this with Martine before, and she mentioned, that rxbuf[0] or anything similar might not be available for other drivers. I think this could be investigated and the decision should be based on that.

Anyway, just tested sending, obviously still works. I did not try to break it, because i had no idea how to easily send an invalid frame.

ghost · 2019-04-15T09:26:13Z

@bergzand small reminder

ghost · 2019-04-29T08:37:18Z

Hey, @bergzand do you still work on this PR?

bergzand · 2019-05-06T07:38:47Z

Hey @SemjonKerner, sorry for the delays. I don't really have time to work on this at the moment but I haven't forgotten about this PR.

bergzand · 2019-05-28T18:55:52Z

@SemjonKerner Thanks for the patience here. I've refactored this PR a bit to a generic data frame validation function called by the nrf802514 radio code. Let me know what you think.

ghost · 2019-05-29T10:55:32Z

Oh, can you pls rebase. Throws some gcc changes that are fixed in master.

bergzand · 2019-05-29T12:31:49Z

Rebased!

ghost · 2019-05-31T16:18:02Z

LGTM, but i can't test it today. I'd like to run it once, before merging. I guess it's alright for you to wait a few more days.?

ghost · 2019-06-03T10:22:27Z

So, uhm.. I was just checking out this PR and started a udp server on my nrf52840dk. But I cannot receive packets from samr21-xpro to nrf52840dk. Sending from nrf52840dk to samr21-xpro works. So reception is somehow broken now.

EDIT: On master everything is fine.

ghost

Please make sure the return values of the filter function are correct.

ghost · 2019-06-03T10:48:45Z

drivers/netdev_ieee802154/netdev_ieee802154.c

+        (frame_len > expected_len) &&
+        ((*mhr & IEEE802154_FCF_TYPE_MASK) == IEEE802154_FCF_TYPE_DATA) &&
+        (netdev_ieee802154_dst_filter(dev, mhr) == 0)) {
+        return 0;


Okay, I think you mixed up the return values.

ghost · 2019-06-03T10:49:17Z

drivers/netdev_ieee802154/netdev_ieee802154.c

+                                        const uint8_t *mhr, size_t frame_len)
+{
+    if (frame_len < IEEE802154_FCF_LEN) {
+        return 1;


Shouldn't this be zero?
ae120c5#diff-864e98442504008c9fad4791703b0e35R144

fjmolinas · 2020-08-27T11:23:01Z

ping @bergzand! :)

MrKevinWeiss · 2021-06-24T11:22:05Z

Ping, also #16576 is touching this.

ghost · 2021-06-25T06:51:47Z

This PR can likely be closed with the same argumentation as in #11150.

ghost · 2021-08-08T14:56:42Z

@benpicco this one can be closed as well.
#11150 (comment)

bergzand added Type: bug The issue reports a bug / The PR fixes a bug (including spelling errors) Area: drivers Area: Device drivers CI: ready for build If set, CI server will compile all applications for all available boards for the labeled PR labels Mar 14, 2019

bergzand added this to the Release 2019.04 milestone Mar 14, 2019

bergzand requested review from a user, haukepetersen and miri64 March 14, 2019 17:58

miri64 reviewed Mar 14, 2019

View reviewed changes

cpu/nrf52/radio/nrf802154/nrf802154.c Outdated Show resolved Hide resolved

ghost suggested changes Apr 5, 2019

View reviewed changes

ghost added the Reviewed: 3-testing The PR was tested according to the maintainer guidelines label Apr 5, 2019

miri64 modified the milestones: Release 2019.04, Release 2019.07 May 7, 2019

bergzand added 4 commits May 29, 2019 14:30

nrf802154: Validate frame length before dst filter

ee2a715

fixup! nrf802154: Validate frame length before dst filter

ae120c5

netdev_ieee802154: Add data frame validation filter

38e88d1

fixup! fixup! nrf802154: Validate frame length before dst filter

8e8b011

bergzand force-pushed the pr/nrf802154/recv_len_check branch from e216a1f to 8e8b011 Compare May 29, 2019 12:31

ghost added Reviewed: 4-code-style The adherence to coding conventions by the PR were reviewed according to the maintainer guidelines and removed Reviewed: 3-testing The PR was tested according to the maintainer guidelines labels May 31, 2019

ghost suggested changes Jun 3, 2019

View reviewed changes

MrKevinWeiss modified the milestones: Release 2019.07, Release 2019.10 Jul 16, 2019

MrKevinWeiss added this to the Release 2021.07 milestone Jun 22, 2021

jia200x mentioned this pull request Jun 24, 2021

ieee802154: migrate netdev_ieee802154_dst_filter to a common ieee802154 #16576

Merged

MrKevinWeiss removed this from the Release 2021.07 milestone Jul 15, 2021

benpicco closed this Aug 8, 2021

Conversation

bergzand commented Mar 14, 2019

Contribution description

Testing procedure

Issues/PRs references

Uh oh!

miri64 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ghost Apr 5, 2019

Choose a reason for hiding this comment

Uh oh!

bergzand Apr 5, 2019

Choose a reason for hiding this comment

Uh oh!

bergzand commented Apr 5, 2019

Uh oh!

ghost commented Apr 5, 2019

Uh oh!

ghost commented Apr 15, 2019

Uh oh!

ghost commented Apr 29, 2019

Uh oh!

bergzand commented May 6, 2019

Uh oh!

bergzand commented May 28, 2019

Uh oh!

ghost commented May 29, 2019

Uh oh!

bergzand commented May 29, 2019

Uh oh!

ghost commented May 31, 2019

Uh oh!

ghost commented Jun 3, 2019 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost Jun 3, 2019

Choose a reason for hiding this comment

Uh oh!

ghost Jun 3, 2019

Choose a reason for hiding this comment

Uh oh!

fjmolinas commented Aug 27, 2020

Uh oh!

MrKevinWeiss commented Jun 24, 2021

Uh oh!

ghost commented Jun 25, 2021

Uh oh!

ghost commented Aug 8, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ghost commented Jun 3, 2019 •

edited by ghost

Loading