Date: Sat, 03 Feb 2007 06:16:55 +0000 From: Bruce M Simpson <bms@incunabulum.net> To: net@FreeBSD.org Subject: [PATCH] ip_fastfwd forwards directed broadcasts Message-ID: <45C428D7.20900@incunabulum.net>
next in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format. --------------070806030404070403060507 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi, Attached is a patch which tells our IPv4 fast-forwarding path to drop directed broadcast packets. The checks originally put in ip_fastfwd.c can deal only with undirected broadcasts. Whilst this patch doesn't mitigate the resulting CPU consumption, it does the right thing by letting the FIB deal with the hard work of determining whether or not a given destination address is for a broadcast destination. Normally, RTF_BROADCAST is set on routes which were added as a result of a call to arpresolve() to resolve the broadcast address, and thus in_addroute(). This is fine and covers the case where the directed broadcast address is known to the router -- which is what we want 99% of the time. The fix in PR 98799 is not the right fix: in_broadcast() can potentially return an IPv4 destination address as not being a broadcast address, because it only walks the address list hung off the single ifnet pointer provided. We perform a route lookup anyway, so let the FIB do the work. To detect directed broadcasts being propagated beyond a single hop would require cooperation from a routing daemon which is smart enough to set RTF_BROADCAST on the routes which it pushes to the kernel FIB for the network prefixes it learns; the router has to have topology information before it can do anything, otherwise, it's just another IPv4 address. Regards, BMS --------------070806030404070403060507 Content-Type: text/x-patch; name="dropbroadcasts.diff" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="dropbroadcasts.diff" Index: ip_fastfwd.c =================================================================== RCS file: /home/ncvs/src/sys/netinet/ip_fastfwd.c,v retrieving revision 1.37 diff -u -p -r1.37 ip_fastfwd.c --- ip_fastfwd.c 17 Aug 2006 00:37:03 -0000 1.37 +++ ip_fastfwd.c 3 Feb 2007 06:11:08 -0000 @@ -418,9 +418,11 @@ passin: ifp = ro.ro_rt->rt_ifp; /* - * Immediately drop blackholed traffic. + * Immediately drop blackholed traffic, and directed broadcasts + * for either the all-ones or all-zero subnet addresses on + * locally attached networks. */ - if (ro.ro_rt->rt_flags & RTF_BLACKHOLE) + if ((ro.ro_rt->rt_flags & (RTF_BLACKHOLE|RTF_BROADCAST)) != 0) goto drop; /* --------------070806030404070403060507--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45C428D7.20900>