Skip to content

gopacket broken layer parsing in IP-in-IP (protocol 4) packets #13

@markzz

Description

@markzz

gopacket reads the second IPv4 layer always and this causes a few interesting cases

Case 1: The packet is fine, so gopacket reports the inner packet's source IP.
Case 2: The packet is malformed, so gopacket just barrels on through and reads the packet anyways as if it were correct (which creates some rather "interesting" results)

gopacket's decode function is not obvious and causes issues and may need some major rework.

There are two approaches, fix this or throw out every packet that has protocol type 4.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions