Date: Sat, 23 Feb 2002 07:25:20 -0800 From: "Crist J. Clark" <crist.clark@attbi.com> To: Ruslan Ermilov <ru@FreeBSD.ORG> Cc: net@FreeBSD.ORG Subject: Re: TCP Connections to a Broadcast Address Message-ID: <20020223072520.J16048@blossom.cjclark.org> In-Reply-To: <20020223124535.GB52291@sunbay.com>; from ru@FreeBSD.ORG on Sat, Feb 23, 2002 at 02:45:35PM %2B0200 References: <20020222022626.A83807@blossom.cjclark.org> <20020223115033.GB47437@sunbay.com> <20020223042828.E16048@blossom.cjclark.org> <20020223124535.GB52291@sunbay.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Feb 23, 2002 at 02:45:35PM +0200, Ruslan Ermilov wrote: [snip] > Router B: if0 (192.168.1.1/24) and if1 (192.168.4.1/24) > Router A: if0 (192.168.1.2/24) > > On router A: route add -net 192.168.4 192.168.1.1, telnet 192.168.4.255. > > Or even simpler: > > Router: if0 (192.168.1.1/24 and 192.168.100.1/24) > Host: if0 (192.168.1.2, default gateway 192.168.1.1) Did 192.168.4.1/24 just become 192.168.100.1/24? > On host: > > $ ping 192.168.100.255 > PING 192.168.100.255 (192.168.100.255): 56 data bytes > 64 bytes from 192.168.100.1: icmp_seq=0 ttl=64 time=0.245 ms > 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.207 ms > 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.207 ms > ^C > --- 192.168.100.255 ping statistics --- > 3 packets transmitted, 3 packets received, 0% packet loss > round-trip min/avg/max/stddev = 0.207/0.220/0.245/0.018 ms > $ telnet 192.168.100.255 25 > Trying 192.168.100.255... > Connected to 192.168.100.255. > Escape character is '^]'. > 220 my.router.local.net ESMTP Sendmail 8.11.6/8.11.2; Sat, 23 Feb 2002 14:39:21 +0200 (EET) I can't reproduce this. I was only ever able to connect to the broadcast on the local interface. On victim "router (192.168.64.50):" $ netstat -rn -f inet Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.64.254 UGSc 14 1768 dc0 127.0.0.1 127.0.0.1 UH 1 137708 lo0 172.16 link#3 UC 3 0 ep0 172.16.0.1 0:20:af:17:f:11 UHLW 0 2 lo0 192.168.64 link#1 UC 6 0 dc0 192.168.64.50 0:4:5a:40:d9:e5 UHLW 11 5310274 lo0 192.168.64.60 0:c0:f0:5a:6c:a UHLW 4 11416791 dc0 514 On attacker "host (192.168.64.60):" $ netstat -rn -f Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.64.254 UGSc 1 0 dc0 127 127.0.0.1 UGSc 0 0 lo0 127.0.0.1 127.0.0.1 UH 1 1776 lo0 172.16 192.168.64.50 UGSc 1 4 dc0 192.168.64 link#1 UC 3 0 dc0 192.168.64.50 0:4:5a:40:d9:e5 UHLW 6 1318188 dc0 1003 Now on "host," $ ping 172.16.0.1 PING 172.16.0.1 (172.16.0.1): 56 data bytes 64 bytes from 172.16.0.1: icmp_seq=0 ttl=64 time=0.518 ms 64 bytes from 172.16.0.1: icmp_seq=1 ttl=64 time=0.541 ms ^C --- 172.16.0.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.518/0.530/0.541/0.011 ms This works fine as expected with the weak-ES model. But for me, $ ping 172.16.255.255 PING 172.16.255.255 (172.16.255.255): 56 data bytes ^C --- 172.16.255.255 ping statistics --- 4 packets transmitted, 0 packets received, 100% packet loss $ telnet 172.16.255.255 Trying 172.16.255.255... telnet: connect to address 172.16.255.255: Operation timed out telnet: Unable to connect to remote host I can't reach the broadcast on the other interface. The "router" is FreeBSD 4.5-RELEASE without any patches. I'm not sure what I might be doing wrong. If you are correct, and you can cross interfaces, this is a much bigger problem. I didn't mention it in your first mail, but the in_broadcast() function as used in the patch you sent is different than the current implementation. in_broadacast() currently takes an address and an interface. If you are correct, we'd have to loop through the interface list... which makes this uglier. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020223072520.J16048>