OSPF_DBDesc/OSPF_LSReq/OSPF_LSUpd/OSPF_LSAck fails if there is no underlayer

[nrathaus]

Brief description

OSPF_DBDesc (for example) assumes there is an underlayer (accesses the len) property

class OSPF_DBDesc(Packet):
    name = "OSPF Database Description"
    fields_desc = [ShortField("mtu", 1500),
                   OSPFOptionsField(),
                   FlagsField("dbdescr", 0, 8, ["MS", "M", "I", "R", "4", "3", "2", "1"]),  # noqa: E501
                   IntField("ddseq", 1),
                   PacketListField("lsaheaders", None, OSPF_LSA_Hdr,
                                   count_from=lambda pkt: None,
                                   length_from=lambda pkt: pkt.underlayer.len - 24 - 8)]  # noqa: E501

However, this isn't a requirement, a malformed (due to incomplete capture) may cause there to be no underlayer

Scapy version

master (ef72e1d)

Python version

3.10

Operating system

Ubuntu 24.02

Additional environment information

No response

How to reproduce

Easiest way to recreate recreate:

>>> load_contrib('ospf')
>>> packet = OSPF_DBDesc()
>>> packet.show2()
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/src/scapy/venv/lib/python3.10/site-packages/scapy/packet.py", line 1551, in show2
    return self.__class__(raw(self)).show(dump, indent, lvl, label_lvl)
  File "/src/scapy/venv/lib/python3.10/site-packages/scapy/base_classes.py", line 481, in __call__
    i.__init__(*args, **kargs)
  File "/src/scapy/venv/lib/python3.10/site-packages/scapy/packet.py", line 186, in __init__
    self.dissect(_pkt)
  File "/src/scapy/venv/lib/python3.10/site-packages/scapy/packet.py", line 1102, in dissect
    s = self.do_dissect(s)
  File "/src/scapy/venv/lib/python3.10/site-packages/scapy/packet.py", line 1040, in do_dissect
    s, fval = f.getfield(self, s)
  File "/src/scapy/venv/lib/python3.10/site-packages/scapy/fields.py", line 1789, in getfield
    len_pkt = self.length_from(pkt)
  File "/src/scapy/venv/lib/python3.10/site-packages/scapy/contrib/ospf.py", line 405, in <lambda>
    length_from=lambda pkt: pkt.underlayer.len - 24 - 8)]  # noqa: E501
AttributeError: 'NoneType' object has no attribute 'len'

It could be that this is "by design" i.e. it is not supposed to support this kind of packet building/dissecting

This issue may affect other Packets:

• mqtt
• ---mqttsn--- MQTTSN does it properly to make sure there is an underlayer
• ospf
• rsvp
• pcom

It seems some cases the code is more "protected", like in ppi.py and bluetooth.py:

    @staticmethod
    def length_from(pkt):
        if not pkt.underlayer:
            warning('Missing under-layer')
            return 0

        return pkt.underlayer.len

Sorry I cannot offer a fix - I do not know how to do the lambada check properly

Actual result

No response

Expected result

No response

Related resources

No response

[gpotter2]

Thanks for the report, this is fixed in #4871