From owner-freebsd-bugs Fri Dec 4 03:39:22 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id DAA20390 for freebsd-bugs-outgoing; Fri, 4 Dec 1998 03:39:22 -0800 (PST) (envelope-from owner-freebsd-bugs@FreeBSD.ORG) Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id DAA20383 for ; Fri, 4 Dec 1998 03:39:21 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: (from Unknown UID 563@localhost) by freefall.freebsd.org (8.8.8/8.8.5) id DAA12257; Fri, 4 Dec 1998 03:40:01 -0800 (PST) Received: from gjp.erols.com (alex-va-n008c079.moon.jic.com [206.156.18.89]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id DAA20352 for ; Fri, 4 Dec 1998 03:38:21 -0800 (PST) (envelope-from gjp@gjp.erols.com) Received: (from gjp@localhost) by gjp.erols.com (8.9.1/8.8.7) id GAA61194; Fri, 4 Dec 1998 06:38:06 -0500 (EST) (envelope-from gjp) Message-Id: <199812041138.GAA61194@gjp.erols.com> Date: Fri, 4 Dec 1998 06:38:06 -0500 (EST) From: gpalmer@FreeBSD.ORG Reply-To: gpalmer@FreeBSD.ORG To: FreeBSD-gnats-submit@FreeBSD.ORG X-Send-Pr-Version: 3.2 Subject: bin/8962: natd core dump Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >Number: 8962 >Category: bin >Synopsis: natd code dump >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Dec 4 03:40:00 PST 1998 >Last-Modified: >Originator: Gary Palmer >Organization: FreeBSD >Release: FreeBSD 3.0-CURRENT i386 >Environment: FreeBSD 3.0, Nov 21 vintage, 2 ethernets (one internal for private LAN, one to cablemodem provider). Running natd on the external interface for NAT functions. >Description: It seems natd coredumps occasionally on my machine. Backtrace: root@gjp:/usr/bin> gdb /usr/sbin/natd /natd.core GDB is free software and you are welcome to distribute copies of it under certain conditions; type "show copying" to see the conditions. There is absolutely no warranty for GDB; type "show warranty" for details. GDB 4.16 (i386-unknown-freebsd), Copyright 1996 Free Software Foundation, Inc... Core was generated by `natd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libalias.so.2...done. Reading symbols from /usr/lib/libc.so.3...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x280aca64 in bcmp () (gdb) bt #0 0x280aca64 in bcmp () #1 0x8089000 in ?? () #2 0x280570dd in AliasHandleResource (count=1, q=0x804c58d, nbtarg=0xefbfd680) at alias_nbt.c:487 #3 0x2805721a in AliasHandleUdpNbtNS (pip=0x804c564, link=0x8083e00, alias_address=0xefbfd6c4, alias_port=0xefbfd6c2, original_address=0xefbfd6c8, original_port=0x804c57a) at alias_nbt.c:564 #4 0x2805627e in UdpAliasIn (pip=0x804c564) at alias.c:620 #5 0x280569da in PacketAliasIn (ptr=0x804c564 "E", maxpacketsize=65535) at alias.c:1042 #6 0x804972e in DoAliasing (fd=3) at natd.c:485 #7 0x80492ed in main (argc=4, argv=0xefbfd87c) at natd.c:278 #8 0x8048e72 in _start () (gdb) up #1 0x8089000 in ?? () (gdb) up #2 0x280570dd in AliasHandleResource (count=1, q=0x804c58d, nbtarg=0xefbfd680) at alias_nbt.c:487 487 q = (NBTNsResource *)AliasHandleResourceNB( q, nbtarg ); (gdb) list 482 #endif 483 484 /* Type and Class filed */ 485 switch ( ntohs(q->type) ) { 486 case RR_TYPE_NB: 487 q = (NBTNsResource *)AliasHandleResourceNB( q, nbtarg ); 488 break; 489 case RR_TYPE_A: 490 q = (NBTNsResource *)AliasHandleResourceA( q, nbtarg ); 491 break; (gdb) print q $1 = (NBTNsResource *) 0x8089000 (gdb) print *q Cannot access memory at address 0x8089000. (gdb) up #3 0x2805721a in AliasHandleUdpNbtNS (pip=0x804c564, link=0x8083e00, alias_address=0xefbfd6c4, alias_port=0xefbfd6c2, original_address=0xefbfd6c8, original_port=0x804c57a) at alias_nbt.c:564 564 p = AliasHandleResource(ntohs(nsh->nscount), (NBTNsResource *)p, &nbtarg ); (gdb) list 559 p = AliasHandleResource(ntohs(nsh->ancount), (NBTNsResource *)p, &nbtarg ); 560 } 561 562 /* Authority Resource Recodrs */ 563 if (ntohs(nsh->nscount) !=0 ) { 564 p = AliasHandleResource(ntohs(nsh->nscount), (NBTNsResource *)p, &nbtarg ); 565 } 566 567 /* Additional Resource Recodrs */ 568 if (ntohs(nsh->arcount) !=0 ) { (gdb) print p $2 = (unsigned char *) 0xc07d
(gdb) print nbtarg $3 = {oldaddr = {s_addr = 4279409870}, oldport = 35072, newaddr = { s_addr = 4279409870}, newport = 35072, uh_sum = 0x804c57e} (gdb) print nsh No symbol "nsh" in current context. (gdb) print p $4 = (unsigned char *) 0xc07d
(gdb) up #4 0x2805627e in UdpAliasIn (pip=0x804c564) at alias.c:620 620 AliasHandleUdpNbtNS(pip, link, (gdb) list 615 { 616 AliasHandleUdpNbt(pip, link, &original_address, ud->uh_dport); 617 } else if (ntohs(ud->uh_dport) == NETBIOS_NS_PORT_NUMBER 618 || ntohs(ud->uh_sport) == NETBIOS_NS_PORT_NUMBER ) 619 { 620 AliasHandleUdpNbtNS(pip, link, 621 &alias_address, 622 &alias_port, 623 &original_address, 624 &ud->uh_dport ); (gdb) print pip $5 = (struct ip *) 0x804c564 (gdb) print *pip $6 = {ip_hl = 5, ip_v = 4, ip_tos = 0 '\000', ip_len = 24576, ip_id = 10, ip_off = 0, ip_ttl = 128 '\200', ip_p = 17 '\021', ip_sum = 51053, ip_src = { s_addr = 2383584462}, ip_dst = {s_addr = 4279409870}} (gdb) print link $7 = (struct alias_link *) 0x8083e00 (gdb) print *link $8 = {src_addr = {s_addr = 4279409870}, dst_addr = {s_addr = 2383584462}, alias_addr = {s_addr = 4279409870}, src_port = 35072, dst_port = 35072, alias_port = 35072, link_type = 2, flags = 0, timestamp = 912770349, expire_time = 60, sockfd = -1, start_point_out = 76, start_point_in = 3351, next_out = 0x8084f00, last_out = 0x0, next_in = 0x0, last_in = 0x0, data = { frag_ptr = 0x8085100 "Î\234\022ÿÎ\234\022\013Î\234\022ÿ", frag_addr = { s_addr = 134762752}, tcp = 0x8085100}} (gdb) print alias_address $9 = {s_addr = 4279409870} (gdb) print alias_port $10 = 35072 (gdb) print original_address $11 = {s_addr = 4279409870} (gdb) print ud $12 = (struct udphdr *) 0x804c578 (gdb) print *ud $13 = {uh_sport = 35072, uh_dport = 35072, uh_ulen = 19456, uh_sum = 49277} (gdb) up #5 0x280569da in PacketAliasIn (ptr=0x804c564 "E", maxpacketsize=65535) at alias.c:1042 1042 iresult = UdpAliasIn(pip); (gdb) list 1037 { 1038 case IPPROTO_ICMP: 1039 iresult = IcmpAliasIn(pip); 1040 break; 1041 case IPPROTO_UDP: 1042 iresult = UdpAliasIn(pip); 1043 break; 1044 case IPPROTO_TCP: 1045 iresult = TcpAliasIn(pip); 1046 break; (gdb) list 1037 { 1038 case IPPROTO_ICMP: 1039 iresult = IcmpAliasIn(pip); 1040 break; 1041 case IPPROTO_UDP: 1042 iresult = UdpAliasIn(pip); 1043 break; 1044 case IPPROTO_TCP: 1045 iresult = TcpAliasIn(pip); 1046 break; (gdb) print pip $14 = (struct ip *) 0x804c564 (gdb) print *pip $15 = {ip_hl = 5, ip_v = 4, ip_tos = 0 '\000', ip_len = 24576, ip_id = 10, ip_off = 0, ip_ttl = 128 '\200', ip_p = 17 '\021', ip_sum = 51053, ip_src = { s_addr = 2383584462}, ip_dst = {s_addr = 4279409870}} At a guess, this seems to be a netbios broadcast packet coming in from the cablesystem. (gdb) printf "0x%x", pip->ip_dst->s_addr 0xff129cce (aka 206.156.18.255) (gdb) printf "0x%x", pip->ip_src->s_addr 0x8e129cce (aka 206.156.18.142) >How-To-Repeat: Unknown what specifically triggers the coredump. I can't be the only one running on a cableplant with lots of NetBIOS broadcasts... >Fix: Unknown at this time. Filter NetBIOS in the kernel? >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message