From owner-freebsd-bugs Sun Jan 19 7:30:10 2003 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F3FBF37B401 for ; Sun, 19 Jan 2003 07:30:06 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 57F7043F1E for ; Sun, 19 Jan 2003 07:30:06 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.6/8.12.6) with ESMTP id h0JFU6NS091856 for ; Sun, 19 Jan 2003 07:30:06 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.6/8.12.6/Submit) id h0JFU6Pm091855; Sun, 19 Jan 2003 07:30:06 -0800 (PST) Date: Sun, 19 Jan 2003 07:30:06 -0800 (PST) Message-Id: <200301191530.h0JFU6Pm091855@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: Hiten Pandya Subject: Re: misc/44361: possible raw socket bug Reply-To: Hiten Pandya Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org The following reply was made to PR misc/44361; it has been noted by GNATS. From: Hiten Pandya To: Kelly Yancey , bug-followup@FreeBSD.ORG Cc: alfred@FreeBSD.ORG Subject: Re: misc/44361: possible raw socket bug Date: Sun, 19 Jan 2003 15:25:50 +0000 This is a multi-part message in MIME format. --------------030508090504070801080703 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit --- Kelly Yancey wrote: > On Sat, 18 Jan 2003, Alfred Perlstein wrote: > > : It appears that we expect the ip_len and ip_off feilds to : > be sent in host byte order as the stack will fix it to : > network byte order in ip_output. : : Is this a bug or feature? > :) > > Both, no? :) It's a bug documented in Stevens TCP/IP > Illustrated 2 as being around since 4.4BSD, but I would expect > that fixing it would break a good bit. On the other hand, it > is supposedly fixed in OpenBSD. We should follow the OpenBSD behaviour [1], which is what the submitter has told us (using ntohs() for both ip_len, and ip_off). It was fixed 5 years ago in OpenBSD by deraadt@. Doing some research shows that NetBSD use HTONS(), because of an mbuf optimization they made [2] (it was fixed 5 months ago in their raw_ip.c); I.e. they convert m->m_pkthdr.len to host order for ip_len, and htons(0) for ip_off: \begin{verbatim} /* From: NetBSD src/sys/netinet/raw_ip.c */ ip->ip_off = htons(0); /* ... */ ip->ip_len = htons(m->m_pkthdr.len); /* XXX userland passes ip_len and ip_off in host order */ if (m->m_pkthdr.len != ip->ip_len) { m_freem(m); return (EINVAL); } HTONS(ip->ip_len); HTONS(ip->ip_off); \end{verbatim} For the reference, two Problem Reports were submitted to NetBSD for this same problem. [3] I have attached a fix to HEAD with this mail. It should be MFC'ed, if possible. It is also available from: http://www.unixdaemons.com/~hiten/work/diffs/netinet+ip_fields-fix.patch Reference: [1] - diff(1) rev. 1.8 and 1.9 of OpenBSD raw_ip.c [2] - diff(1) rev. 1.61 and 1.62 of NetBSD raw_ip.c [3] - NetBSD PR: 17867 and 10195 Index: sys/netinet/raw_ip.c =================================================================== RCS file: /home/ncvs/src/sys/netinet/raw_ip.c,v retrieving revision 1.108 diff -u -r1.108 raw_ip.c --- sys/netinet/raw_ip.c 2003/01/18 01:10:55 1.108 +++ sys/netinet/raw_ip.c 2003/01/19 15:15:09 @@ -302,6 +302,8 @@ return(EMSGSIZE); } ip = mtod(m, struct ip *); + ntohs(ip->ip_len); + ntohs(ip->ip_off); /* don't allow both user specified and setsockopt options, and don't allow packet length sizes that will crash */ if (((ip->ip_hl != (sizeof (*ip) >> 2)) Cheers. -- Hiten Pandya http://www.unixdaemons.com/~hiten hiten@uk.FreeBSD.org, hiten@unixdaemons.com --------------030508090504070801080703 Content-Type: text/plain; name="netinet+ip_fields-fix.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="netinet+ip_fields-fix.patch" Index: sys/netinet/raw_ip.c =================================================================== RCS file: /home/ncvs/src/sys/netinet/raw_ip.c,v retrieving revision 1.108 diff -u -r1.108 raw_ip.c --- sys/netinet/raw_ip.c 2003/01/18 01:10:55 1.108 +++ sys/netinet/raw_ip.c 2003/01/19 15:15:09 @@ -302,6 +302,8 @@ return(EMSGSIZE); } ip = mtod(m, struct ip *); + ntohs(ip->ip_len); + ntohs(ip->ip_off); /* don't allow both user specified and setsockopt options, and don't allow packet length sizes that will crash */ if (((ip->ip_hl != (sizeof (*ip) >> 2)) --------------030508090504070801080703-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message