Bug in ESP-IDF: MDNS, Wireshark and what does unicorns have to do with it

Hello. I am doing commercial development in IoT, we mainly use modules from Espressif - ESP8266 and ESP32.

As part of " dog food " we sometimes take our products home and use them in everyday life. And then, one day, one of the employees received a complaint: after installing a new test firmware on the device, his home network first began to severely glitch and freeze, and then the situation returned to normal, but our device was no longer visible either on the local network or in the cloud ...

There is some kind of collapse. But which one? On other networks, we did not observe such behavior, so it was decided to land a reconnaissance landing party in the person of me, equipped with everything necessary, to the officer.

Intelligence service

To begin with, I decided to collect the maximum amount of data about the situation in its terminal stage. Without rebooting the device, I started Wireshark in Monitor Mode, setting filtering on the device's MAC address. It turned out that the device is sure that its network is in order - it stubbornly sent some data to the router, but the router did not reply to it. Hmm, suspicious.

In the admin panel of the router, the device was also seen as connected. But why is there no feedback? I received an answer to this question when I decided to connect another device to the same router (more precisely, one of my devkits ), and removed filtering in Wireshark. It turns out that the router's MAC address has changed! Hmm, suspicious . It changed exactly one last bit, while the rest of the technique realized this substitution, but our device did not, and persistently sent data to the old poppy address, which, of course, no one was listening to.

, . . , MAC "" ? , MAC . " ", . , . , , Wireshark , .

- . , , . ... Wireshark . , - , , . , , , .

And the winner is... 99% MDNS. , , ( , " ", Amazon). ? - , "/" ( ) . , .

:

1. multicast- MDNS, .

2. collision-query- ANY "", , -, "".

3. collision-query- multicast-, .

4. advertise- PTR, SRV, TXT A/AAAA multicast- MDNS, , .

5. advertise- multicast-, .

6. 2-5 .

, - multicast . ? , , . .

diff. , , . , . ... , 0.9 0.10. ? ... , . , MDNS.

Debugger? printf!

? : mdns.c. _mdns_create_probe_packet. , ( ), #2917 mdns_parse_packet. . _mdns_check_txt_collision. : , advertise, TXT-, TXT. ! , . , .

size_t data_len = 1;
if (len == 1 && service->txt) {
  return -1;//we win
} else if (len > 1 && !service->txt) {
  return 1;//they win
} else if (len == 1 && !service->txt) {
  return 0;//same
}

data_len, TXT- service. - .

mdns_txt_linked_item_t * txt = service->txt;
while (txt) {
  data_len += 2 + strlen(service->txt->key) + strlen(service->txt->value);
  txt = txt->next;
}

if (len > data_len) {
  return 1;//they win
} else if (len < data_len) {
  return -1;//we win
}

, TXT , , .

uint8_t ours[len];
uint16_t index = 0;
char * tmp;

txt = service->txt;
while (txt) {
  tmp = (char *)malloc(2 + strlen(txt->key) + strlen(txt->value));
  if (tmp) {
    sprintf(tmp, "%s=%s", txt->key, txt->value);
    _mdns_append_string(ours, &index, tmp);
    free(tmp);
  } else {
    HOOK_MALLOC_FAILED;
    // continue
  }
  txt = txt->next;
}

int ret = memcmp(ours, data, len);
if (ret > 0) {
  return -1;//we win
} else if (ret < 0) {
  return 1;//they win
}
return 0;//same

TXT , ( ), .

? , . , printf.

"" , . ? "" ( 10 ) ""! .

mdns_txt_linked_item_t * txt = service->txt;
while (txt) {
  data_len += 2 + strlen(service->txt->key) + strlen(service->txt->value);
  txt = txt->next;
}

, linked-list. , key value... . service->txt? , ...

, - (, git blame, ), . ? : . TXT-, , , N. , , , - , . ? , MDNS... .

?

issue ESP-IDF , , .

: SDK? , ( - submodule). - , , ...? , , .

?

@Andrey2008 PVS-Studio. , PVS-Studio, . , , , ... - .