d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bridged packets are supplied to the firewall with their IP header

Browse Source 
in network byte order, but icmp_error() expects the IP header to
be in host order and the code here did not perform the necessary
swapping for the bridged case. This bug causes an "icmp_error: bad
length" panic when certain length IP packets (e.g. ip_len == 0x100)
are rejected by the firewall with an ICMP response.

MFC after:	3 days
This commit is contained in:
Ian Dowse 2002-12-27 17:43:25 +00:00
parent 03a585553a
commit ed1a13b18f
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/netinet/ip_fw.c
View File

@ -1236,7 +1236,6 @@ ip_fw_chk(struct ip_fw_args *args)
/* Check if rule only valid for bridged packets */
if ((f->fw_flg & IP_FW_BRIDGED) != 0 && !(BRIDGED))
continue;
#undef BRIDGED
if (oif) {
/* Check direction outbound */
@ -1628,6 +1627,11 @@ ip_fw_chk(struct ip_fw_args *args)
&& (proto != IPPROTO_ICMP || is_icmp_query(ip))
&& !((*m)->m_flags & (M_BCAST|M_MCAST))
&& !IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
/* Must convert to host order for icmp_error() etc. */
if (BRIDGED) {
ip->ip_len = ntohs(ip->ip_len);
ip->ip_off = ntohs(ip->ip_off);
}
switch (f->fw_reject_code) {
case IP_FW_REJECT_RST:
{
@ -1670,6 +1674,7 @@ ip_fw_chk(struct ip_fw_args *args)
* Finally, drop the packet.
*/
return(IP_FW_PORT_DENY_FLAG);
#undef BRIDGED
}
/*

10
sys/netinet/ip_fw2.c
View File

@ -1136,9 +1136,15 @@ static void
send_reject(struct ip_fw_args *args, int code, int offset, int ip_len)
{
if (code != ICMP_REJECT_RST) /* Send an ICMP unreach */
if (code != ICMP_REJECT_RST) { /* Send an ICMP unreach */
/* We need the IP header in host order for icmp_error(). */
if (args->eh != NULL) {
struct ip *ip = mtod(args->m, struct ip *);
ip->ip_len = ntohs(ip->ip_len);
ip->ip_off = ntohs(ip->ip_off);
}
icmp_error(args->m, ICMP_UNREACH, code, 0L, 0);
else if (offset == 0 && args->f_id.proto == IPPROTO_TCP) {
} else if (offset == 0 && args->f_id.proto == IPPROTO_TCP) {
struct tcphdr *const tcp =
L3HDR(struct tcphdr, mtod(args->m, struct ip *));
if ( (tcp->th_flags & TH_RST) == 0)