From owner-freebsd-bugs@FreeBSD.ORG Wed Sep 21 21:20:09 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2B7C716A420 for ; Wed, 21 Sep 2005 21:20:09 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 95A2E43D4C for ; Wed, 21 Sep 2005 21:20:06 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j8LLK6w1077258 for ; Wed, 21 Sep 2005 21:20:06 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j8LLK6aO077257; Wed, 21 Sep 2005 21:20:06 GMT (envelope-from gnats) Resent-Date: Wed, 21 Sep 2005 21:20:06 GMT Resent-Message-Id: <200509212120.j8LLK6aO077257@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Pieter de Boer Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 900B016A41F for ; Wed, 21 Sep 2005 21:17:21 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 445A943D45 for ; Wed, 21 Sep 2005 21:17:21 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j8LLHKQ7069714 for ; Wed, 21 Sep 2005 21:17:20 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id j8LLHKUC069713; Wed, 21 Sep 2005 21:17:20 GMT (envelope-from nobody) Message-Id: <200509212117.j8LLHKUC069713@www.freebsd.org> Date: Wed, 21 Sep 2005 21:17:20 GMT From: Pieter de Boer To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: kern/86429: if_tap doesn't filter frames not destined for itself X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Sep 2005 21:20:09 -0000 >Number: 86429 >Category: kern >Synopsis: if_tap doesn't filter frames not destined for itself >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Sep 21 21:20:06 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Pieter de Boer >Release: 6.0-BETA4 >Organization: >Environment: FreeBSD edinburgh 6.0-BETA4 FreeBSD 6.0-BETA4 #2: Sat Sep 17 18:01:08 CEST 2005 pieter@edinburgh:/usr/obj/usr/src/sys/kernel-31-07-2005 i386 >Description: The tap-driver doesn't filter incoming ethernet frames with a different unicast destination mac address than it's own mac address. The frames are sent up to the IP-stack, which may route them when forwarding is turned on. In my case leading to the system doing arp who-has on the destination IP-address in the ethernet frame, because the kernel wants to route the packet. On a virtual internet-exchange (www.virt-ix.net) using tap-tunnels this leads to a packet storm. >How-To-Repeat: Set up a ethernet tunnel using vtund/openvpn, configure two ethernet-addresses on both ends. On one system (A), turn on IP forwarding. On system B, create a static ARP entry for an address in the subnet, with a non-existent MAC address (like de:ad:ba:be:ca:fe). Run tcpdump on system B(!) and ping from system B to the IP address with the fake MAC address. See how system A does an arp request for the destination IP address because it wants to route it. This indicates the frame was wrongly pushed to the IP stack. >Fix: Adding an extra check to if_tap.c fixes this bug. The following patch works on my system. --- if_tap.c.orig Wed Sep 7 21:12:10 2005 +++ if_tap.c Thu Sep 8 22:05:46 2005 @@ -801,6 +801,7 @@ struct uio *uio; int flag; { + struct ether_header *eh; struct tap_softc *tp = dev->si_drv1; struct ifnet *ifp = tp->tap_ifp; struct mbuf *m; @@ -825,6 +826,21 @@ } m->m_pkthdr.rcvif = ifp; + + /* Check length first */ + if (m->m_len < sizeof(struct ether_header)) { + m_freem(m); + return(0); + } + + /* Only pass it up to the ether_input() layer if it's meant for us. */ + eh = mtod(m, struct ether_header *); + if (eh && (ifp->if_flags & IFF_PROMISC) == 0 && bcmp(eh->ether_dhost, + IFP2ENADDR(ifp), ETHER_ADDR_LEN) && + (eh->ether_dhost[0] & 1) == 0) { + m_freem(m); + return(0); + } /* Pass packet up to parent. */ (*ifp->if_input)(ifp, m); >Release-Note: >Audit-Trail: >Unformatted: