Re: IPFW2 layer2 filtering broken - PATCH
On Mon, Jan 24, 2005 at 11:12:11AM -0800, Jeffrey Hsu wrote:
> This is an interface problem. When ether_ipfw_chk() does not modify the
> mbuf, the recomputed eh pointer is incorrect because the mbuf has already
> been adjusted. An ugly workaround is something like
>
> if (IPFW_LOADED && ether_ipfw != 0) {
> + struct mbuf *n = m;
> +
> if (!ether_ipfw_chk(&m, NULL, &rule, eh, FALSE)) {
> m_freem(m);
> return;
> }
> - eh = mtod(m, struct ether_header *);
> + if (m != n)
> + eh = mtod(m, struct ether_header *);
> }
>
> Alternatively, we could change the 4th parameter to ether_ipfw_chk()
> to &eh and update it inside ether_ipfw_chk().
I'm not even sure if that is enough. The problem is that
ehter_ipfw_chk does an m_pullup. That can return a new mbuf.
So far so bad. The first problem is that the ether header might
be part of the old mbuf, but is not copied because of the m_adj
done earlier. This is a race condition. The second problem is that
ether header might really be outside the mbuf, in which case the
modifiction is just lost.
As a solution, ether_ipfw_chk has to update the eh pointer itself
and deal with the case of eh being part of the header. Do we care
enough about a few cycles? If not, we could just copy the ether header
into a temporary buffer, do the m_pullup and copy it into the new
mbuf if necessary.
Joerg
討論串 (同標題文章)
完整討論串 (本文為第 6 之 8 篇)：