From owner-cvs-all  Thu Mar  1 16:51:11 2001
Delivered-To: cvs-all@freebsd.org
Received: from ns.yogotech.com (ns.yogotech.com [206.127.123.66])
	by hub.freebsd.org (Postfix) with ESMTP
	id 9175F37B719; Thu,  1 Mar 2001 16:51:04 -0800 (PST)
	(envelope-from nate@yogotech.com)
Received: from nomad.yogotech.com (nomad.yogotech.com [206.127.123.131])
	by ns.yogotech.com (8.9.3/8.9.3) with ESMTP id RAA17685;
	Thu, 1 Mar 2001 17:50:58 -0700 (MST)
	(envelope-from nate@nomad.yogotech.com)
Received: (from nate@localhost)
	by nomad.yogotech.com (8.8.8/8.8.8) id RAA23577;
	Thu, 1 Mar 2001 17:50:58 -0700 (MST)
	(envelope-from nate)
From: Nate Williams <nate@yogotech.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15006.61041.727634.597339@nomad.yogotech.com>
Date: Thu, 1 Mar 2001 17:50:57 -0700 (MST)
To: Jonathan Lemon <jlemon@flugsvamp.com>
Cc: Nate Williams <nate@yogotech.com>,
	Jonathan Lemon <jlemon@FreeBSD.org>, cvs-committers@FreeBSD.org,
	cvs-all@FreeBSD.org
Subject: Re: cvs commit: src/sys/netinet ip_input.c
In-Reply-To: <20010301184258.T25974@prism.flugsvamp.com>
References: <200103012339.f21NdW309088@freefall.freebsd.org>
	<15006.60555.97100.465265@nomad.yogotech.com>
	<20010301184258.T25974@prism.flugsvamp.com>
X-Mailer: VM 6.75 under 21.1 (patch 12) "Channel Islands" XEmacs Lucid
Reply-To: nate@yogotech.com (Nate Williams)
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

> On Thu, Mar 01, 2001 at 05:42:51PM -0700, Nate Williams wrote:
> > > jlemon      2001/03/01 15:39:32 PST
> > > 
> > >   Modified files:        (Branch: RELENG_4)
> > >     sys/netinet          ip_input.c 
> > >   Log:
> > >   MFC: r1.156; verify incoming packet is arriving on correct interface.
> > 
> > Wasn't this determined to be buggy?
> 
> Um, no, not that I know of.

I'll resend the email that Don Lewis sent out right after your commit.

From: Don Lewis <Don.Lewis@tsc.tdk.com>
Sender: owner-cvs-committers@FreeBSD.org
To: Jonathan Lemon <jlemon@FreeBSD.org>, cvs-committers@FreeBSD.org,
        cvs-all@FreeBSD.org
Cc: freebsd-net@FreeBSD.org
Subject: Re: cvs commit: src/sys/netinet ip_input.c
Date: Tue, 27 Feb 2001 23:27:10 -0800

On Feb 27, 11:43am, Jonathan Lemon wrote:
} Subject: cvs commit: src/sys/netinet ip_input.c
} jlemon      2001/02/27 11:43:14 PST
} 
}   Modified files:
}     sys/netinet          ip_input.c 
}   Log:
}   When iterating over our list of interface addresses in order to determine
}   if an arriving packet belongs to us, also check that the packet arrived
}   through the correct interface.  Skip this check if the packet was locally
}   generated.
}   
}   Revision  Changes    Path
}   1.156     +19 -15    src/sys/netinet/ip_input.c
} 
}-- End of excerpt from Jonathan Lemon

This (at least the non-IPFIREWALL_FORWARD case) doesn't look right
to me.  If I have a server dual homed on two networks with the IP
addresses 192.168.1.1 and 192.168.2.1, and a client on the 192.168.1.0
network sends a packet to the 192.168.2.1 address to the 192.168.1.1
interface, it looks like the "ours" test will fail.  I suspect this
will cause the server to attempt to forward this packet out to the
192.168.2.0 network, if it has IP forwarding enabled.  On the other
hand, it looks like the server will accept a packet received on the
192.168.1.1 interface with the destination address 192.168.2.255.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message