DHCP unpack issue

[zmw12306]

Closing this for now, will reopen if the problem still persists

I am using the latest version 0.12.0, but still having issue.
if File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/dhcp.py", line 181, in unpackOptions:
value = self.unpack(format, options[i+2:i+2+size])
then I have:

Traceback (most recent call last):
  File "/home/youwei/XDiff/Impacket/DHCPOption.py", line 35, in <module>
    dhcp_packet_decoded = dhcp_decoder.decode(dhcp_packet)
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/ImpactDecoder.py", line 969, in decode
    if dhcp.DhcpPacket(aBuffer[off:])['cookie'] == dhcp.DhcpPacket.MAGIC_NUMBER:
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/dhcp.py", line 150, in __init__
    structure.Structure.__init__(self, data, alignment)
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/structure.py", line 91, in __init__
    self.fromString(data)
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/structure.py", line 156, in fromString
    self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/structure.py", line 311, in unpack
    return eval(dataClassOrCode, {}, fields)
  File "<string>", line 1, in <module>
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/dhcp.py", line 181, in unpackOptions
    value = self.unpack(format, options[i+2:i+2+size])
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/structure.py", line 386, in unpack
    return dataClassOrCode(data)
  File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/six.py", line 644, in b
    return s.encode("latin-1")
AttributeError: ("'bytearray' object has no attribute 'encode'", "When unpacking field 'options | _ | b''[:0]'"). Did you mean: 'decode'?

if I changed File "/home/youwei/.local/share/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/dhcp.py", line 181, in unpackOptions into (https://github.com/fortra/impacket/pull/1858/files):
value = self.unpack(format, bytes(options[i+2:i+2+size])), I get:

struct.error: ('unpack requires a buffer of 4 bytes', "When unpacking field 'options | _ | b''[:0]'")

Here is my code:

import struct
from impacket import ImpactDecoder
from impacket import dhcp
import socket

# Basic DHCP packet construction
dhcp_packet = (
    b'\x01'              # Message type: Boot Request (1 byte)
    b'\x01'              # Hardware type: Ethernet (1 byte)
    b'\x06'              # Hardware address length: 6 (1 byte)
    b'\x00'              # Hops: 0 (1 byte)
    b'\x39\x03\xF3\x26'  # Transaction ID: Random (4 bytes)
    b'\x00\x00'          # Seconds elapsed: 0 (2 bytes)
    b'\x80\x00'          # Flags: 0x8000 (Broadcast) (2 bytes)
    b'\x00\x00\x00\x00'  # Client IP address: 0.0.0.0 (4 bytes)
    b'\x00\x00\x00\x00'  # Your (client) IP address: 0.0.0.0 (4 bytes)
    b'\x00\x00\x00\x00'  # Next server IP address: 0.0.0.0 (4 bytes)
    b'\x00\x00\x00\x00'  # Relay agent IP address: 0.0.0.0 (4 bytes)
    b'\x00\x26\x9e\x04\x0a\x5b'  # Client MAC address (6 bytes)
    b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'  # Client hardware address padding (10 bytes)
    b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'  # Server name padding (64 bytes)
    b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'   # Boot filename padding (128 bytes)
    b'\x63\x82\x53\x63'  # Magic cookie: DHCP (4 bytes)
    # DHCP Options:
    b'\x35\x01\x01'
    b'\x32\x04\xc0\xa8\x01\x64'
    b'\x33\x04\x01\xa8\x01\x64'      # Option: (53) DHCP Message Type (Discover) (3 bytes)
    # b'\x3d\x07\x01\x00\x26\x9e\x04\x0a\x5b'  # Option: (61) Client identifier (7 bytes)
    b'\x37\x01\x03\x01\x06'  # Option: (55) Parameter Request List (5 bytes)
    # b'\xff'              # End Option (1 byte)
)


dhcp_decoder = ImpactDecoder.BootpDecoder()
dhcp_packet_decoded = dhcp_decoder.decode(dhcp_packet)
print(dhcp_packet_decoded)

# # Decode the DHCP message from the UDP packet
# dhcp_decoder = ImpactDecoder.DHCPDecoder()
# dhcp_packet_decoded = dhcp_decoder.decode(dhcp_packet)

# # Print the decoded DHCP packet
# print(dhcp_packet_decoded.getOptionValue('message-type'))
# print(dhcp_packet_decoded.getOptionValue('client-id'))
# print(dhcp_packet_decoded.getOptionValue('parameter-request-list'))


def construct_dhcp_discover_packet():
    # Define the magic cookie and the DHCP options for the packet
    magic_cookie = 0x63825363  # Standard DHCP magic cookie
    dhcp_options = [
        ('message-type', 1),  # DHCP Discover (message type 1)
        ('requested-ip', 0xc0a80164),  # Requested IP address (192.168.1.100)
    ]

    # Create a DhcpPacket object
    dhcp_packet = dhcp.DhcpPacket()

    # Set the magic cookie
    dhcp_packet.fields['cookie'] = magic_cookie

    # Set and pack the DHCP options
    dhcp_packet.fields['options'] = dhcp_packet.packOptions(dhcp_options)



    # Return the packed packet
    return dhcp_packet.fields['options']

# Example usage
packed_dhcp_discover = construct_dhcp_discover_packet()
print(f"Packed DHCP Discover: {packed_dhcp_discover}")

Originally posted by @zmw12306 in #1820

[zmw12306]

I also test with the latest unreleased version: package impacket 0.13.0.dev0+20250220.93348.6315ebd5, installed using Python 3.10.12

from impacket import IP6, ImpactDecoder, ICMP6, dhcp

# Basic DHCP packet construction
dhcp_packet = (
    b'\x01'              # Message type: Boot Request (1 byte)
    b'\x01'              # Hardware type: Ethernet (1 byte)
    b'\x06'              # Hardware address length: 6 (1 byte)
    b'\x00'              # Hops: 0 (1 byte)
    b'\x39\x03\xF3\x26'  # Transaction ID: Random (4 bytes)
    b'\x00\x00'          # Seconds elapsed: 0 (2 bytes)
    b'\x80\x00'          # Flags: 0x8000 (Broadcast) (2 bytes)
    b'\x00\x00\x00\x00'  # Client IP address: 0.0.0.0 (4 bytes)
    b'\x00\x00\x00\x00'  # Your (client) IP address: 0.0.0.0 (4 bytes)
    b'\x00\x00\x00\x00'  # Next server IP address: 0.0.0.0 (4 bytes)
    b'\x00\x00\x00\x00'  # Relay agent IP address: 0.0.0.0 (4 bytes)
    b'\x00\x26\x9e\x04\x0a\x5b'  # Client MAC address (6 bytes)
    b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'  # Client hardware address padding (10 bytes)
    b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'  # Server name padding (64 bytes)
    b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'   # Boot filename padding (128 bytes)
    b'\x63\x82\x53\x63'  # Magic cookie: DHCP (4 bytes)
    # DHCP Options:
    b'\x35\x01\x01'
    b'\x32\x04\xc0\xa8\x01\x64'
    b'\x33\x04\x01\xa8\x01\x64'      # Option: (53) DHCP Message Type (Discover) (3 bytes)
    # b'\x3d\x07\x01\x00\x26\x9e\x04\x0a\x5b'  # Option: (61) Client identifier (7 bytes)
    b'\x37\x01\x03\x01\x06'  # Option: (55) Parameter Request List (5 bytes)
    # b'\xff'              # End Option (1 byte)
)


dhcp_decoder = ImpactDecoder.BootpDecoder()
dhcp_packet_decoded = dhcp_decoder.decode(dhcp_packet)
print(dhcp_packet_decoded)

# # Decode the DHCP message from the UDP packet
# dhcp_decoder = ImpactDecoder.DHCPDecoder()
# dhcp_packet_decoded = dhcp_decoder.decode(dhcp_packet)

# # Print the decoded DHCP packet
# print(dhcp_packet_decoded.getOptionValue('message-type'))
# print(dhcp_packet_decoded.getOptionValue('client-id'))
# print(dhcp_packet_decoded.getOptionValue('parameter-request-list'))


def construct_dhcp_discover_packet():
    # Define the magic cookie and the DHCP options for the packet
    magic_cookie = 0x63825363  # Standard DHCP magic cookie
    dhcp_options = [
        ('message-type', 1),  # DHCP Discover (message type 1)
        ('requested-ip', 0xc0a80164),  # Requested IP address (192.168.1.100)
    ]

    # Create a DhcpPacket object
    dhcp_packet = dhcp.DhcpPacket()

    # Set the magic cookie
    dhcp_packet.fields['cookie'] = magic_cookie

    # Set and pack the DHCP options
    dhcp_packet.fields['options'] = dhcp_packet.packOptions(dhcp_options)



    # Return the packed packet
    return dhcp_packet.fields['options']

# Example usage
packed_dhcp_discover = construct_dhcp_discover_packet()
print(f"Packed DHCP Discover: {packed_dhcp_discover}")

still have the error:

Traceback (most recent call last):
  File "/usr/lib/python3.10/runpy.py", line 187, in _run_module_as_main
    mod_name, mod_spec, code = _get_module_details(mod_name, _Error)
  File "/usr/lib/python3.10/runpy.py", line 110, in _get_module_details
    __import__(pkg_name)
  File "/home/youwei/XDiff/Impacket/impacket/tests/ImpactPacket/test_DHCP.py", line 32, in <module>
    dhcp_packet_decoded = dhcp_decoder.decode(dhcp_packet)
  File "/home/youwei/XDiff/Impacket/impacket/impacket/ImpactDecoder.py", line 969, in decode
    if dhcp.DhcpPacket(aBuffer[off:])['cookie'] == dhcp.DhcpPacket.MAGIC_NUMBER:
  File "/home/youwei/XDiff/Impacket/impacket/impacket/dhcp.py", line 150, in __init__
    structure.Structure.__init__(self, data, alignment)
  File "/home/youwei/XDiff/Impacket/impacket/impacket/structure.py", line 91, in __init__
    self.fromString(data)
  File "/home/youwei/XDiff/Impacket/impacket/impacket/structure.py", line 156, in fromString
    self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])
  File "/home/youwei/XDiff/Impacket/impacket/impacket/structure.py", line 311, in unpack
    return eval(dataClassOrCode, {}, fields)
  File "<string>", line 1, in <module>
  File "/home/youwei/XDiff/Impacket/impacket/impacket/dhcp.py", line 181, in unpackOptions
    value = self.unpack(format, bytes(options[i+2:i+2+size]))
  File "/home/youwei/XDiff/Impacket/impacket/impacket/structure.py", line 389, in unpack
    return unpack(format, data)[0]
struct.error: ('unpack requires a buffer of 4 bytes', "When unpacking field 'options | _ | b''[:0]'")

[alexisbalbachan]

I think i found the cause of the issue while debugging the code; The parsing fails while processing the options list, specifically the Parameter Request List option.

This kind of option has following format: | Code=55 | Length (n) | Param 1 | Param 2 | ..... | Param n | with each param being 1 byte in length. (RFC 2132 section 9.8)

The buffer we're trying to decode specifies that the parameter request list (0x37) has just one (0x01) parameter (0x03): \x37\x01\x03...

So the line b'\x37\x01\x03\x01\x06' # Option: (55) Parameter Request List (5 bytes) is really b'\x37\x01\x03' # Option: (55) Parameter Request List (3 bytes)

The last 2 bytes are the ones that break the parsing:
x01\x06 is an incomplete (and invalid length?) option; Subnet Mask which should contain 4 bytes

So either the Parameter Request List option length is modified accordingly -> '\x37\x03\x03\x01\x06
OR we leave it with 1 element and instead modify the last option (Subnet Mask) to make it valid: \x01\x04\xXX\xXX\xXX\xXX

Both alternatives are working for me

[zmw12306]

What about incorporating length checking into the parsing code? If the value size does not align with the expected length, we can apply padding to prevent crashes or log an error instead of causing a system failure.

[alexisbalbachan]

We've been discussing this with the other maintainers, it is desirable to have a more defensive code (in the sense that it checks the validity of every kind of package while parsing them) in the long run, right now we're focusing on higher priority tasks.

One thing that can be done right now is to standardize the possible exceptions that the package decoder classes can raise when trying to decode a package (so instead of throwing random exceptions when the code eventually breaks trying to parse an invalid packet, it would only raise something like a DecoderException).

With that change the user can wrap the entire decoding sequence in a try/except DecoderException block and act accordingly (in your case, by padding zeroes to it or discarding that specific packet)

[zmw12306]

We've been discussing this with the other maintainers, it is desirable to have a more defensive code (in the sense that it checks the validity of every kind of package while parsing them) in the long run, right now we're focusing on higher priority tasks.

One thing that can be done right now is to standardize the possible exceptions that the package decoder classes can raise when trying to decode a package (so instead of throwing random exceptions when the code eventually breaks trying to parse an invalid packet, it would only raise something like a DecoderException).

With that change the user can wrap the entire decoding sequence in a try/except DecoderException block and act accordingly (in your case, by padding zeroes to it or discarding that specific packet)

That would be great! Thank you