Recursion error: maximum recursion depth exceeded with scapy 2.4.3 on Fedora Linux

[william-stearns]

I'm able to reproduce this with scapy 2.4.3 on Fedora Linux. I have a pcap file containing ipv4 tcp port 53 packets that when run through passer ( https://github.com/activecm/passer/ ) gives the following:

Traceback (most recent call last):
File "/home/wstearns/med/programming/passer/passer.py", line 2428, in
sniff(store=0, offline=work_filename, filter=cl_args['bpf'], prn=lambda x: processpacket(x))
File "/usr/lib/python3.5/site-packages/scapy/sendrecv.py", line 972, in sniff
sniffer._run(*args, **kwargs)
File "/usr/lib/python3.5/site-packages/scapy/sendrecv.py", line 925, in _run
session.on_packet_received(p)
File "/usr/lib/python3.5/site-packages/scapy/sessions.py", line 47, in on_packet_received
result = self.prn(pkt)
File "/home/wstearns/med/programming/passer/passer.py", line 2428, in
sniff(store=0, offline=work_filename, filter=cl_args['bpf'], prn=lambda x: processpacket(x))
File "/home/wstearns/med/programming/passer/passer.py", line 1714, in processpacket
if p.getlayer(Raw):
File "/usr/lib/python3.5/site-packages/scapy/packet.py", line 1148, in getlayer
_subclass=_subclass, **flt)
File "/usr/lib/python3.5/site-packages/scapy/packet.py", line 1148, in getlayer
_subclass=_subclass, **flt)
File "/usr/lib/python3.5/site-packages/scapy/packet.py", line 1148, in getlayer
_subclass=_subclass, **flt)
...
File "/usr/lib/python3.5/site-packages/scapy/packet.py", line 1148, in getlayer
_subclass=_subclass, **flt)
File "/usr/lib/python3.5/site-packages/scapy/packet.py", line 1148, in getlayer
_subclass=_subclass, **flt)
File "/usr/lib/python3.5/site-packages/scapy/packet.py", line 1115, in getlayer
if isinstance(cls, int):
RecursionError: maximum recursion depth exceeded while calling a Python object

Command line used:
passer.py -r scapy243.recursion_issue.notudp.port53.notip6.pcap >/dev/null

For reference:

• I also have a second pcap with ipv6 tcp port 53 packets that causes the same crash.
• Simply feeding that same pcap file into a python/scapy script that does a "sniff(...)" of the packets and doesn't do anything with them does not crash scapy with this error. (Let me know if you'd like a copy of that script)
• To reproduce, you'll need passer.py and passer_lib.py in the same directory - both can be downloaded from https://github.com/activecm/passer/ . You'll also need the ipaddress and pytz libraries.
  Please let me know if I can provide anything else to reproduce this.

scapy243.recursion_issue.notudp.port53.notip6.pcap.zip

Originally posted by @william-stearns in #1552 (comment)

[william-stearns]

It's too early to be certain, but running passer with a filter that drops tcp port 53 packets (-b 'not tcp port 53') appears to allow passer to run much longer that it would have otherwise. (Please don't take this as claiming that the only source of this problem is TCP port 53 packets).

[guedou]

Here is a way to extract the packet that triggers the issue tcpdump -r scapy243.recursion_issue.notudp.port53.notip6.pcap -w issues/issue_2406.pcap -c 11924,11925. It is available in issue_2406.pcap.gz.

To reproduce, do:

p = rdpcap("issue_2406.pcap")[0]
p[Raw]

I will provide a fix.

[william-stearns]

Thank you!

…

On Sat, Jan 11, 2020 at 6:29 AM Guillaume Valadon ***@***.***> wrote: Here is a way to extract the packet that triggers the issue tcpdump -r scapy243.recursion_issue.notudp.port53.notip6.pcap -w issues/issue_2406.pcap -c 11924,11925. It is available in issue_2406.pcap.gz <https://github.com/secdev/scapy/files/4049266/issue_2406.pcap.gz>. To reproduce, do: p = rdpcap("issue_2406.pcap")[0] p[Raw] I will provide a fix. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2406?email_source=notifications&email_token=AA272WONNFBBUZKZ6SXR5ZTQ5GUQBA5CNFSM4KFK6ESKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIV732Q#issuecomment-573308394>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA272WNYIPJPYDTA2TPCQDDQ5GUQBANCNFSM4KFK6ESA> .

[guedou]

This issue is caused by two distinct problems:

1. Scapy does not check the length of the DNS message over TCP and generates a malformed message
2. getlayer() does not work fine with deep recursions

[guedou]

See #2408 for the first fix.

[guedou]

See #2411 for the second fix.

[guedou]

#2411 won't be merged. The main issue was already fixed and merged.