TCP/IP option data aligement issue cause system broken
1 Problem Description
The field reports show that xxx panel will lockup and then reboot while doing security port scan by nmap.
2 Root Cause
After analysis, this problem happens at all panel versions, standalone/networking panel, and happens at other scanning tools (e.g. Tenable Nessus).
The investigation shows that, the problem was caused by unaligned data access during TCP timestamps option parsing in Linux kernel. The reason can be summarized below:
1) The ARMv5 or earlier MCU (likes xxx MCU S3C44B0X ARM7TDMI is belong to ARMv4T), who had limited abilities to access memory that was not aligned on a word (four byte) boundary. According to S3C44B0 datasheet (see page 89 Address Alignment), the MCU is going to ABORT mode which cause the system crash.
2) In Linux TCP option parsing, the handling did not consider the data unaligned in timestamp option, but TCP options are not guaranteed to be aligned at all.
According to the Linux debug output information when TCP package with timestamps options: The timestamps hold address (register: R8) is 0x0DB074E2, which is not multiple 4(word), the Linux kernel error information is: Unhandled fault: alignment exception (13).
1) TCP package by nmap
2) Linux debug output
3 Solution
The solution is get word value byte one byte when the address is unaligned, which is come from official Linux kernel patch (see appendix). The change is only applied for TCP/IP option parsing and without side effect. The solution had been successfully verified by prototype.
4 Appendix
The patch is come from Linux official, the link is https://archive.org/details/git-history-of-linux.
TCP/IP option data aligement issue cause system broken的更多相关文章
- TCP/IP OPTION字段
0x01 简介 TCP头部和IPV4头部除了固定的20字节外,都设置了 OPTION 字段用于存储自定义的数据,因为TCP头部和IPV4的报文长度字段均为4字节,所表示的最大值为15, 乘4,报文头部 ...
- [转] TCP/IP原理、基础以及在Linux上的实现
导言:本篇作为理论基础,将向我们讲述TCP/IP的基本原理以及重要的协议细节,并在此基础上介绍了TCP/IP在LINUX上的实现. OSI参考模型及TCP/IP参考模型 OSI模型(open syst ...
- TCP/IP协议族基本知识
常见的网络拓扑 两台主机通信的过程:应用进程产生消息,经由主机的 TCP/IP 协议栈发送到局域网(LAN),最后经过广域网(目前最大的广域网的因特网)中的网络设备(路由器)传给目的主机所在的局域网( ...
- Direct hosting of SMB over TCP/IP
http://support.microsoft.com/kb/204279 System TipThis article applies to a different version of Wind ...
- TCP/IP Four Layer Protocol Format Learning
相关学习资料 tcp-ip详解卷1:协议.pdf 目录 . 引言 . 应用层 . 传输层 . 网络层 0. 引言 协议中的网络字节序问题 在学习协议格式之前,有一点必须明白,否则我们在观察抓包数据的时 ...
- 计算机网络及TCP/IP知识点(全面,慢慢看)
TCP/IP网络知识点总结 一.总述 1.定义:计算机网络是一些互相连接的.自治的计算机的集合.因特网是网络的网络. 2.分类: 根据作用范围分类: 广域网 WAN (Wide Area Networ ...
- LINUX 中的 TCP/IP协议 参数详解
Ipsysctl tutorial 1.0.4 Prev Chapter 3. IPv4 variable reference Next https://www.frozentux.net/ipsys ...
- TCP/IP网络知识点总结
学完了计算机网络是时候整理一篇总结了,温故知新.注意:这篇博客很长长长(2.5万字+50图). TCP/IP网络知识点总结 一.总述 1.定义:计算机网络是一些互相连接的.自治的计算机的集合.因特网是 ...
- Introduction Sockets to Programming in C using TCP/IP
Introduction Computer Network: hosts, routers, communication channels Hosts run applications Routers ...
随机推荐
- 十三. Python基础(13)--生成器进阶
十三. Python基础(13)--生成器进阶 1 ● send()方法 generator.send(value) Resumes the execution, and "sends&qu ...
- Spring实现Ioc的多种方式--控制反转、依赖注入、xml配置的方式实现IoC、对象作用域
Spring实现Ioc的多种方式 一.IoC基础 1.1.概念: 1.IoC 控制反转(Inversion of Control) IoC是一种设计思想. 2.DI 依赖注入 依赖注入是实现IoC的一 ...
- SharePoint Framework 把你的客户端web部件部署到经典的SharePoint页面
博客地址:http://blog.csdn.net/FoxDave 本节介绍如何把客户端web部件部署到SharePoint服务端页面.我们将继续使用之前的工程. 将HelloWorld的web部 ...
- python 爬虫数据准换时间格式
timeStamp = 1381419600 dateArray = datetime.datetime.utcfromtimestamp(timeStamp) otherStyleTime = da ...
- 2019-03-28-day021-抽象类与接口类
今日内容 type和class 继承 抽象类 接口类 多态 java 鸭子类型 pickle模块 collections.namedtuple type和class ##type ##class pr ...
- 堆&栈
Java内存分为两种:堆内存和栈内存. 一些基本类型的变量和对象的引用变量都是在函数的栈内存中分配.当超过变量的作用域后,java会自动释放掉为该变量分配的内存空间.堆内存用于存放由new创建的对象和 ...
- 【转载】 5G+边缘计算,着眼可见的未来 【边缘计算】
原文地址: https://www.cnblogs.com/upyun/p/10641489.html ------------------------------------------------ ...
- 【摄像头】Global Shutter(全局快门)与Rolling Shutter(卷帘快门)的区别与比较
由于红外补光灯的爆闪,所以一般DMS会用global shutter的sensor,而不是rolling shutter的. 参考 1. Global Shutter(全局快门)与Rolling Sh ...
- JAVA基础部分复习(一、8中基础类型,以及String相关内容)
以下是关于java中8种基本类型的介绍说明: package cn.review.day01; /** * java基础复习,8种数据类型 * (byte,short,long,int,double, ...
- flask中的request和response
1.request 1.request的常用成员 1.scheme : 获取请求方案(协议) 2.method : 获取本期请求的请求方式(重点) 3.args : 获取使用get请求方式提交的数据 ...