Date: Mon, 3 Apr 2006 18:37:22 GMT From: Qiao Yang <qyang@stbernard.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/95277: IP Encapsulation mask_match() returns wrong results Message-ID: <200604031837.k33IbMhv044847@www.freebsd.org> Resent-Message-ID: <200604031840.k33IeGxZ041395@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 95277
>Category: kern
>Synopsis: IP Encapsulation mask_match() returns wrong results
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Apr 03 18:40:16 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Qiao Yang
>Release: 5.4
>Organization:
St Bernard Software
>Environment:
>Description:
As documented in the code,
/*
* We prioritize the matches by using bit length of the
* matches. mask_match() and user-supplied matching function
* should return the bit length of the matches (for example,
* if both src/dst are matched for IPv4, 64 should be returned).
* 0 or negative return value means "it did not match".
*/
But in mask_match(), it use "struct sockaddr" to do byte-array comparison when applying the network mask. The problem is that this mask is applied to the whole 'struct sockaddr' data structure. Because 'struct sockaddr' includes both sa_len and sa_family, the result match_len will not be 0 even when the network mask is 0.0.0.0. And, if both src/dst are matched for IPv4, 88 instead of 64 is returned.
This causes problem for protocols which want to set 0.0.0.0 netmask on the tunnel end.
>How-To-Repeat:
Just read the code.
>Fix:
When doing byte-array comparison, use sockaddr.sa_data instead of sockaddr.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200604031837.k33IbMhv044847>