From 719b7f439c1c8c76d0573b34daa329061c9ad8a6 Mon Sep 17 00:00:00 2001
From: srdusr <99972264+srdusr@users.noreply.github.com>
Date: Fri, 29 May 2026 22:56:00 +0200
Subject: Fix IPv4/IPv6 fragment continuation data being decoded as fake
 transport headers

A real correctness bug, not just missing visibility: a non-first
fragment's payload is pure continuation data with no TCP/UDP/ICMP
header in it at all, but it was being handed to the transport parsers
unconditionally, which could misread arbitrary payload bytes as port
numbers, sequence numbers, etc. and print a plausible-looking but
entirely fake decode.

IPv4 gained identification/more_fragments/fragment_offset fields; a
nonzero offset now stops summarize_packet before transport dispatch,
reporting the fragment instead. IPv6 expresses fragmentation as an
extension header instead, so the fix lives in
walk_ipv6_extension_headers(): it already walked past Fragment
headers, but never checked the offset before continuing on as if a
transport header followed - the same bug, reached through a
different path. Fixed with an ESP-style hard stop on a nonzero offset.

Caught and fixed a second bug while writing the first fix, before it
ever ran: the fragment's Identification field was a loop-local
variable, discarded the moment the walk continued past a *first*
fragment (offset zero) to keep decoding the real payload underneath --
every later return reported no fragment id even though one applied.
Fixed by hoisting it to a variable that persists across iterations,
the same category of mistake as an earlier IGMPv3 bug.

Fuzzed afterward regardless (fuzz_ipv4, fuzz_ipv6, fuzz_summarize,
~16.8M combined runs) - clean. Live-verified with a real 4000-byte
ping to the local gateway over the actual 1500-MTU interface: both
directions fragmented into 3 pieces each, the first decoded normally
with a fragmentation note, and the continuation fragments correctly
showed only fragment metadata, no fake ICMP decode attempted.
---
 tests/test_net.cpp | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

(limited to 'tests/test_net.cpp')

diff --git a/tests/test_net.cpp b/tests/test_net.cpp
index 2702758..64db07f 100644
--- a/tests/test_net.cpp
+++ b/tests/test_net.cpp
@@ -134,6 +134,37 @@ TEST_CASE("parse_ipv4 honors IHL > 5 (options present)") {
     CHECK(ip->payload.empty());
 }
 
+TEST_CASE("parse_ipv4 decodes an unfragmented packet with fragment_offset zero") {
+    std::vector<unsigned char> bytes(20, 0);
+    bytes[0] = 0x45;
+    auto ip = parse_ipv4(bytes);
+    REQUIRE(ip.has_value());
+    CHECK_FALSE(ip->header.more_fragments);
+    CHECK(ip->header.fragment_offset == 0);
+}
+
+TEST_CASE("parse_ipv4 decodes the identification field and More Fragments flag") {
+    std::vector<unsigned char> bytes(20, 0);
+    bytes[0] = 0x45;
+    bytes[4] = 0x12; bytes[5] = 0x34;  // identification = 0x1234
+    bytes[6] = 0x20; bytes[7] = 0x00;  // flags: MF=1, fragment_offset=0 (first fragment)
+    auto ip = parse_ipv4(bytes);
+    REQUIRE(ip.has_value());
+    CHECK(ip->header.identification == 0x1234);
+    CHECK(ip->header.more_fragments);
+    CHECK(ip->header.fragment_offset == 0);
+}
+
+TEST_CASE("parse_ipv4 decodes a nonzero fragment_offset in 8-byte units") {
+    std::vector<unsigned char> bytes(20, 0);
+    bytes[0] = 0x45;
+    bytes[6] = 0x00; bytes[7] = 0x08;  // fragment_offset = 8 (i.e. byte offset 64), MF=0 (last fragment)
+    auto ip = parse_ipv4(bytes);
+    REQUIRE(ip.has_value());
+    CHECK_FALSE(ip->header.more_fragments);
+    CHECK(ip->header.fragment_offset == 8);
+}
+
 TEST_CASE("parse_tcp decodes header fields and flags") {
     std::vector<unsigned char> bytes(20, 0);
     bytes[0] = 0x00; bytes[1] = 0x50;  // src port 80
-- 
cgit v1.2.3