[dependabot]

Bumps github.com/gopacket/gopacket from 1.7.4 to 1.7.7.

Release notes

Sourced from github.com/gopacket/gopacket's releases.

v1.7.7

Security release. Upgrade if you decode untrusted traffic or reassemble TCP streams from it.

Security fixes

The last seven fixes from Anthropic's automated vulnerability scanner batch. Each one let a sender hide traffic from a monitor that a receiving host would act on.

• TCP: a segment with a bad option length (zero, short, past the option area, or a multipath option of the wrong size) now decodes like a host reads it: options stop there, the segment and its payload stay. It used to fail the layer, so reassembly never saw the segment.
• sFlow: the cursor moves to each sample's and record's declared end when that lies further on inside the datagram, so bytes padded into a sample no longer read as the next sample and hide the ones behind it. Lengths that disagree with the content, which real agents send, are still tolerated.
• EthernetCTP: a skip count past the end of the data is an error instead of a wrong layer.
• DNS over TCP: the two-byte message length in front of each message is stripped when decoding a packet; a pipelined second message is the layer's payload. The layer's own DecodeFromBytes is unchanged, so a DecodingLayerParser behaves as before.
• TLS: a ClientHello split over several handshake records in the same data is reassembled and decoded, so the server name is reported. A hello continued in another segment is still skipped.
• Modbus: every ADU in a segment gets its own layer; an ADU cut short by segmentation stays the last layer's payload, as before.
• DHCPv4: options continued in the file and sname fields (option overload) are decoded and appended to Options. Serializing the layer writes them with those fields, not twice.

Behaviour changes

• A TCP segment with a bad option length no longer carries a decode failure or the truncated flag.
• gopacket.NewPacket on a TCP port 53 segment yields the DNS message behind its length prefix; before, it decoded from the first byte.

v1.7.6

Security release. Upgrade if you decode untrusted traffic, reassemble TCP streams or IP fragments from untrusted traffic, or read capture files from untrusted sources.

Security fixes

One hundred and thirty-six Medium and Low reports from Anthropic's automated vulnerability scanner, plus two from independent reporters. Advisories follow.

Crashes and resource exhaustion in packet decoding

• CDP: address entries, IP prefixes, power TLVs and EnergyWise sub-TLVs are bounds-checked. Crafted lengths used to panic, dereference nil or allocate quadratically, also on 32-bit builds.
• RadioTap: every field is bounds-checked before it is read; the present bitmap, vendor namespaces and the driver padding of short 802.11 frames no longer panic, and headers over 64 KiB decode.
• OSPF, LLDP, BFD, USB, Prism, DHCPv6 and TLS ClientHello: declared lengths that exceed the data or wrap a 16-bit sum return an error instead of panicking.
• DHCPv4: serializing a message over 64 KiB no longer panics. DHCPv6: String() on a large option request is linear.
• SIP: folded headers are unfolded before parsing, which was quadratic; a Content-Length near the 32-bit limit no longer panics on 32-bit builds.
• VerifyChecksums is bounded on deeply nested tunnels and decodes a lazy packet before checking it. ComputeChecksum no longer overflows on jumbograms.
• An empty raw IP record and a pooled packet whose decoder reads past its length no longer panic or read the previous packet.

Bytes leaking between packets

• DHCPv4, DHCPv6, DNS and GRE: SerializeTo zeroes every fixed-width field, so a reused buffer no longer carries the previous packet's bytes.
• TLS: a reused layer no longer keeps earlier packets' records, and with them their buffers, alive.
• NextPacket copies ancillary data, so packets no longer report the latest packet's VLAN.

Misdecoded or hidden traffic

• Tunnels and link layers: GUE (header length in words, variants other than 0 rejected, control messages kept as payload), GRE (Ack bit only in version 1, ERSPAN Type I), GTPv1-U (extension header flag), GTPv2 (version check, message length), Geneve version, VXLAN group policy flag, PPPoE session frames with a non-zero code, 802.1Q tags followed by an 802.3 length, Linux cooked captures of LLC frames, 802.11 vendor information elements.
• IPv4: options of length 2, source-routed checksums, TSO packets over 64 KiB, padding on serialize, IPv6 extension protocol numbers no longer decoded as IPv6 headers.
• IPv6: Hop-by-Hop bounded by the payload length, options bounded by their header, routing headers of every type, jumbograms, Pad1 on serialize and at the end of a header, tunnelled hop-by-hop headers.
• Application protocols: SIP (compact headers, tabs around colons, lower-case versions, GetHeader across both forms), DNS (A and AAAA record lengths), Diameter (unpadded last AVP, several messages per segment), CIP (request path, 16-bit and 32-bit segments), EtherNet/IP (item walk, message length), RADIUS, EAP and EAPOL lengths, SCTP (chunk padding, unknown chunks, bad heartbeat parameters), TCP multipath options on serialize, MLDv2 query codes and short queries, IGMPv3 auxiliary data, ICMPv6 echo payload, BFD trailing bytes, DHCPv6 DUIDs.

IP defragmentation

• IPv4: fragment lists are keyed on the protocol, DF-flagged fragments are reassembled, fragments beyond the final one, overlaps and contradictory ends are refused like a receiver does, repeats are ignored, the overrun check no longer wraps, offsets up to 8189 are accepted, fragments shorter than their length are refused, and the reassembled length includes the header.
• IPv6: lists are keyed on the address pair, atomic fragments are returned at once, overlaps and oversized or unaligned fragments are dropped, the Next Header comes from the first fragment, completed packets are removed, and duplicates no longer reset the age.

... (truncated)

Commits

• dc050b6 layers: honour DHCPv4 Option Overload
• d245cf4 layers: decode every Modbus ADU of a segment
• 029a9e8 layers: decode a ClientHello split over TLS records
• ed582fd layers: strip the length prefix of DNS over TCP
• cf3e4bc layers: reject an EthernetCTP skip count past the data
• 8e603b4 layers: step over sFlow sample and record padding
• 65b2660 layers: keep a TCP segment with a bad option length
• 1b0470b layers: let a parser stop at an IPv6 fragment
• 47fd395 pcapgo: cover truncated snoop and short drop count
• 47b5e55 gopacket: copy ancillary data in NextPacket
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign memodi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a netobserv member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.