Reject malformed tunnel packets

[avzamelek]

Summary

This PR prevents malformed IP_TUNNEL_APP payloads from crashing the IP tunnel packet-filtering path.

The tunnel previously assumed every incoming payload was a complete IPv4 packet and indexed packet fields directly. A short, truncated, or non-bytes payload could therefore raise an IndexError or formatting/type error while being processed.

Root cause

Tunnel._shouldFilterPacket() reads IPv4 and transport-layer fields at fixed offsets:

• IPv4 protocol byte: offset 9
• Source and destination addresses: offsets 12–19
• ICMP type/code: offsets 20–21
• UDP/TCP source and destination ports: offsets 20–23

Before this change, there was no validation that:

1. the payload was bytes-like;
2. it contained the minimum 20-byte IPv4 header; or
3. ICMP, UDP, and TCP payloads contained enough transport-header bytes for the fields being read.

As a result, an incomplete payload received from the mesh could cause an exception in the tunnel receive path instead of being discarded safely.

Changes

• Reject non-bytes/bytearray payloads.
• Reject packets shorter than the 20-byte IPv4 header.
• Reject ICMP, UDP, and TCP packets shorter than the required first four transport-header bytes.
• Log rejected packets at warning level without including packet contents.
• Add regression coverage for:
  • empty payloads;
  • undersized IPv4 headers;
  • non-bytes payloads;
  • truncated ICMP, UDP, and TCP packets.

Security impact

Mesh payloads should be treated as untrusted input. This change prevents malformed tunnel traffic from triggering an uncaught exception in the packet filtering code, improving resilience against accidental corruption and malformed traffic from remote nodes.

This does not alter handling of valid tunnel packets or change the existing protocol/port blacklist behavior.

Validation

pytest meshtastic/tests/test_tunnel.py -m unit -q
11 passed, 9 deselected

[coderabbitai]

📝 Walkthrough

Walkthrough

The tunnel packet filter now validates payload types and lengths before accessing headers. New tests cover malformed and truncated inputs and verify filtering plus warning logs.

Changes

Tunnel packet validation

Layer / File(s)	Summary
Defensive packet filtering and coverage meshtastic/tunnel.py, meshtastic/tests/test_tunnel.py	_shouldFilterPacket rejects invalid or insufficiently sized payloads, including truncated ICMP, UDP, and TCP packets, while tests verify ignored results and warning logs.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: rejecting malformed tunnel packets.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}