NetBSD Problem Report #8640

Received: (qmail 23920 invoked from network); 17 Oct 1999 22:02:34 -0000
Message-Id: <19991018000224.G27673@acm.org>
Date: Mon, 18 Oct 1999 00:02:24 +0200
From: Feico Dillema <dillema@acm.org>
Reply-To: feico@pasta.cs.uit.no
To: gnats-bugs@gnats.netbsd.org
Subject: Relay loop in faithd(8)
X-Send-Pr-Version: 3.95

>Number:         8640
>Category:       bin
>Synopsis:       faithd enters relay loop for IPv4 connections
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    itojun
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 17 15:03:00 +0000 1999
>Closed-Date:    Wed Jan 05 13:11:16 +0000 2000
>Last-Modified:  Wed Jan 05 13:11:35 +0000 2000
>Originator:     Feico Dillema
>Release:        Sun Oct 17 1999
>Organization:
University of Tromso
>Environment:
System: NetBSD server6 1.4K NetBSD 1.4K (PASTA.v6) #2: Tue Sep 28 01:46:29 CEST 1999 root@server6:/usr/src/sys/arch/i386/compile/PASTA.v6 i386

>Description:

When faithd(8) is used to relay connections *and* to
accept connections for local service it will enter
a relay loop if the target address is an IPv4 address.

>How-To-Repeat:

Example:
	say, machine has local IPv4 address A.B.C.D,
	and a faithd is started on it for e.g. telnet as:

	faithd telnet /usr/libexec/telnetd telnetd

Now a `telnet A.B.C.D` to this machine makes faithd enter a relay loop
due to fact that it sees an incoming connection for the IPV4MAPPED 
address: ::ffff:A.B.C.D. Instead of starting a local telnetd to serve
the request, it translates ::ffff:A.B.C.D into IPv4 address A.B.C.D 
and relays the connection this address. This relayed connection to
A.B.C.D is comes into faithd again as ::ffff:A.B.C.D, which repeats
the relay process untill the kernel runs out of proc-table entries.

>Fix:

The following little patch adds support for IPv4 Mapped Addresses
to src/usr.sbin/faith/faithd.c and avoids the relay loop:

--- faithd.c.orig       Sun Oct 17 23:41:04 1999
+++ faithd.c    Sun Oct 17 23:42:06 1999
@@ -508,14 +508,14 @@
        struct sockaddr_in *sin4;

        for (p = myaddrs; p; p = p->next) {
+               struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst;
+               struct sockaddr_in *dst4 = (struct sockaddr_in *)dst;
                sin6 = (struct sockaddr_in6 *)p->addr;
                sin4 = (struct sockaddr_in *)p->addr;

                /* ugly! */
                if (p->addr->sa_len == dst->sa_len
                 && p->addr->sa_family == dst->sa_family) {
-                       struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst;
-                       struct sockaddr_in *dst4 = (struct sockaddr_in *)dst;

                        switch (dst->sa_family) {
                        case AF_INET6:
@@ -526,6 +526,18 @@
                        case AF_INET:
                                if (sin4->sin_addr.s_addr == dst4->sin_addr.s_addr)
                                return 0;
+                               break;
+                       }
+               }
+               else { /* probably even uglier ? */
+
+                        switch (dst->sa_family) {
+                        case AF_INET6:
+                                if (IN6_IS_ADDR_V4MAPPED(&(dst6->sin6_addr))) 
+                                        if (sin4->sin_addr.s_addr == dst6->sin6_addr.s6_addr32[3])
+                                                return 0;      
+                                break;
+                       default:
                                break;
                        }
                }
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: bin-bug-people->itojun 
Responsible-Changed-By: itojun 
Responsible-Changed-When: Sun Dec 19 07:26:12 PST 1999 
Responsible-Changed-Why:  
i'll be committing a fix when cvs.netbsd.org becomes reachable from me. 
State-Changed-From-To: open->feedback 
State-Changed-By: itojun 
State-Changed-When: Sun Dec 19 21:41:57 PST 1999 
State-Changed-Why:  
committed a fix (different from one attached). 
State-Changed-From-To: feedback->closed 
State-Changed-By: itojun 
State-Changed-When: Wed Jan 5 05:11:16 PST 2000 
State-Changed-Why:  
it seem to work fine.  i'll close it. 
>Unformatted:

Home	PR Database Search