Incoming packet CRC is not verified ai:claude-opus-5-5 #5

New issue

Open

opened 2026-10-29 15:02:03 +01:00 by heiko · 0 comments

heiko commented

2026-10-29 15:02:03 +01:00

Owner

(co)authored by ai:claude-opus-5-5

Found while preparing the public software pages for www.schlittermann.de (static review, not a full audit).

cmd/nrpe/handler.go contains // ToDo: checksum calculation before the request is parsed; the CRC of incoming packets is never checked (only computed for responses in assemble.go).

Please verify the CRC32 of v2/v3 requests and reject mismatching packets, or document why it is skipped.

(co)authored by ai:claude-opus-5-5 Found while preparing the public software pages for www.schlittermann.de (static review, not a full audit). `cmd/nrpe/handler.go` contains `// ToDo: checksum calculation` before the request is parsed; the CRC of incoming packets is never checked (only computed for responses in `assemble.go`). Please verify the CRC32 of v2/v3 requests and reject mismatching packets, or document why it is skipped.