Skip to content

pfroute: filter out routing messages with RTF_LLDATA - #5168

Open
evverx wants to merge 1 commit into
secdev:masterfrom
evverx:rtf_lldata
Open

pfroute: filter out routing messages with RTF_LLDATA#5168
evverx wants to merge 1 commit into
secdev:masterfrom
evverx:rtf_lldata

Conversation

@evverx

@evverx evverx commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

those routing messages contain MAC addresses and end up without source candidates. Without this patch scapy fails with

>>> sr1(IPv6()/UDP(dport=5353)/DNS(qd=[DNSQR(qname='vbox.local',qtype='ALL')]))
...
File ~/scapy/scapy/layers/inet6.py:341, in IPv6.route(self)
    339 if isinstance(dst, (Gen, list)):
    340     dst = next(iter(dst))
--> 341 return conf.route6.route(dst, dev=scope)

File ~/scapy/scapy/route6.py:273, in Route6.route(self, dst, dev, verbose)
    271     if in6_isincluded(dst, p, plen):
    272         paths.append((plen, me, (iface, cset, gw)))
--> 273     elif (in6_ismlladdr(dst) and in6_islladdr(p) and in6_islladdr(cset[0])):  # noqa: E501
    274         paths.append((plen, me, (iface, cset, gw)))
    276 if not paths:

IndexError: list index out of range
>>> sr1(IPv6(dst='fe80::2%wm0')/ICMPv6EchoRequest())
Begin emission
ERROR: --- Error sending packets
Traceback (most recent call last):
  File "/root/scapy/scapy/sendrecv.py", line 280, in _sndrcv_snd
    self.hsent.setdefault(p.hashret(), []).append(p)
                          ~~~~~~~~~^^
  File "/root/scapy/scapy/layers/inet6.py", line 440, in hashret
    ss = inet_pton(socket.AF_INET6, ss)
  File "/root/scapy/scapy/pton_ntop.py", line 92, in inet_pton
    return socket.inet_pton(af, addr)
           ~~~~~~~~~~~~~~~~^^^^^^^^^^
OSError: illegal IP address string passed to inet_pton

those routing messages contain MAC addresses and end up without source
candidates. Without this patch scapy fails with
```
>>> sr1(IPv6()/UDP(dport=5353)/DNS(qd=[DNSQR(qname='vbox.local',qtype='ALL')]))
...
File ~/scapy/scapy/layers/inet6.py:341, in IPv6.route(self)
    339 if isinstance(dst, (Gen, list)):
    340     dst = next(iter(dst))
--> 341 return conf.route6.route(dst, dev=scope)

File ~/scapy/scapy/route6.py:273, in Route6.route(self, dst, dev, verbose)
    271     if in6_isincluded(dst, p, plen):
    272         paths.append((plen, me, (iface, cset, gw)))
--> 273     elif (in6_ismlladdr(dst) and in6_islladdr(p) and in6_islladdr(cset[0])):  # noqa: E501
    274         paths.append((plen, me, (iface, cset, gw)))
    276 if not paths:

IndexError: list index out of range
```
```
>>> sr1(IPv6(dst='fe80::2%wm0')/ICMPv6EchoRequest())
Begin emission
ERROR: --- Error sending packets
Traceback (most recent call last):
  File "/root/scapy/scapy/sendrecv.py", line 280, in _sndrcv_snd
    self.hsent.setdefault(p.hashret(), []).append(p)
                          ~~~~~~~~~^^
  File "/root/scapy/scapy/layers/inet6.py", line 440, in hashret
    ss = inet_pton(socket.AF_INET6, ss)
  File "/root/scapy/scapy/pton_ntop.py", line 92, in inet_pton
    return socket.inet_pton(af, addr)
           ~~~~~~~~~~~~~~~~^^^^^^^^^^
OSError: illegal IP address string passed to inet_pton
```

AI-Assisted: no
@codecov

codecov Bot commented Sep 11, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.82%. Comparing base (190b4ba) to head (5946a21).

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5168   +/-   ##
=======================================
  Coverage   80.81%   80.82%           
=======================================
  Files         390      390           
  Lines       97736    97740    +4     
=======================================
+ Hits        78986    78994    +8     
+ Misses      18750    18746    -4     
Files with missing lines Coverage Δ
scapy/arch/bpf/pfroute.py 92.73% <100.00%> (+0.08%) ⬆️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@evverx

evverx commented Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Also with this patch applied the following tests no longer fail on NetBSD

###(003)=[failed] HSRP V2 with IPv6 and default text auth - build & dissection
###(051)=[failed] Layer binding
###(109)=[failed] ICMPv6MRD_Advertisement - Basic Dissection and overloading mechanisms
###(112)=[failed] ICMPv6MRD_Solicitation - Basic Dissection and overloading mechanisms
###(115)=[failed] ICMPv6MRD_Termination - Basic Dissection and overloading mechanisms
###(172)=[failed] ICMPv6ND_NS - IPv6 layer fields overloading
###(177)=[failed] ICMPv6ND_NS - IPv6 layer fields overloading
###(419)=[failed] Test NDP_Attack_Fake_Router
###(000)=[failed] ICMPv6NDOptRsaSig build and dissection
###(001)=[failed] ICMPv6NDOptCGA build and dissection
###(002)=[failed] ICMPv6NDOptTmstp build and dissection
###(003)=[failed] ICMPv6NDOptNonce build and dissection

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant