From owner-freebsd-bugs@FreeBSD.ORG Wed Oct 12 08:00:23 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2B7B016A41F for ; Wed, 12 Oct 2005 08:00:23 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8DDF843D48 for ; Wed, 12 Oct 2005 08:00:22 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j9C80M9q050487 for ; Wed, 12 Oct 2005 08:00:22 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j9C80MMA050483; Wed, 12 Oct 2005 08:00:22 GMT (envelope-from gnats) Resent-Date: Wed, 12 Oct 2005 08:00:22 GMT Resent-Message-Id: <200510120800.j9C80MMA050483@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Rickard Lind Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 48D9916A41F for ; Wed, 12 Oct 2005 07:54:14 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1703843D46 for ; Wed, 12 Oct 2005 07:54:14 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j9C7sD7B098624 for ; Wed, 12 Oct 2005 07:54:13 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id j9C7sDOZ098623; Wed, 12 Oct 2005 07:54:13 GMT (envelope-from nobody) Message-Id: <200510120754.j9C7sDOZ098623@www.freebsd.org> Date: Wed, 12 Oct 2005 07:54:13 GMT From: Rickard Lind To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: kern/87306: IP_PORTRANGE_HIGH causes bad UDP checksum X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Oct 2005 08:00:23 -0000 >Number: 87306 >Category: kern >Synopsis: IP_PORTRANGE_HIGH causes bad UDP checksum >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Oct 12 08:00:22 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Rickard Lind >Release: 5.4 >Organization: NTier Solutions >Environment: FreeBSD nevermind 5.4-RELEASE FreeBSD 5.4-RELEASE #0: Sun May 8 10:21:06 UTC 2005 root@harlow.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: Due to a mixup of two fields, setting the socket option IP_PORTRANGE_HIGH on a UDP socket in order to bind a high (random) port affects the checksum calculation such that the resulting checksum is incorrect. >How-To-Repeat: Create a UDP (SOCK_DGRAM) socket. Set the IP_PORTRANGE_HIGH socket option. Bind with a zero port. Send some data to another host. Ethereal on the receiveing host reports the UDP checksum as incorrect. >Fix: The problem is that the flag INP_ONESBCAST has the same value (0x10) as the flag INP_HIGHPORT in sys/netinet/in_pcb.h, and INP_ONESBCAST is tested against the inp_flags field (in sys/netinet/udp_usrreq.c and sys/netinet/raw_ip.c) when it SHOULD be tested against the inp_vflag field. This causes the checksum calculation on line 867 in udp_usrreq.c to use the broadcast address leading to an incorrect checksum. >Release-Note: >Audit-Trail: >Unformatted: