FreeBSD Bugzilla – Attachment 13174 Details for
Bug 25195
a attacker can make ICMP messages apply to all sessions.
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
file.diff
file.diff (text/plain), 3.54 KB, created by
jesper
on 2001-02-18 20:50:01 UTC
(
hide
)
Description:
file.diff
Filename:
MIME Type:
Creator:
jesper
Created:
2001-02-18 20:50:01 UTC
Size:
3.54 KB
patch
obsolete
>diff -ru sys/netinet.old/in_pcb.c sys/netinet/in_pcb.c >--- sys/netinet.old/in_pcb.c Sun Feb 18 19:28:38 2001 >+++ sys/netinet/in_pcb.c Sun Feb 18 21:03:13 2001 >@@ -671,7 +671,8 @@ > * a valid TCP sequence number for the session. > */ > void >-in_pcbnotify(head, dst, fport_arg, laddr, lport_arg, cmd, notify, tcp_sequence, tcp_seq_check) >+in_pcbnotify(head, dst, fport_arg, laddr, lport_arg, cmd, notify, tcp_sequence, >+ tcp_seq_check, wild_match) > struct inpcbhead *head; > struct sockaddr *dst; > u_int fport_arg, lport_arg; >@@ -680,6 +681,7 @@ > void (*notify) __P((struct inpcb *, int)); > u_int32_t tcp_sequence; > int tcp_seq_check; >+ int wild_match; > { > register struct inpcb *inp, *oinp; > struct in_addr faddr; >@@ -700,9 +702,7 @@ > * deliver only to that socket. > */ > if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) { >- fport = 0; >- lport = 0; >- laddr.s_addr = 0; >+ wild_match = IN_PCBNOTIFY_WILDCARD; > if (cmd != PRC_HOSTDEAD) > notify = in_rtchange; > } >@@ -715,11 +715,10 @@ > continue; > } > #endif >- if (inp->inp_faddr.s_addr != faddr.s_addr || >- inp->inp_socket == 0 || >- (lport && inp->inp_lport != lport) || >- (laddr.s_addr && inp->inp_laddr.s_addr != laddr.s_addr) || >- (fport && inp->inp_fport != fport)) { >+ if (inp->inp_faddr.s_addr != faddr.s_addr || inp->inp_socket == 0 || >+ (wild_match == IN_PCBNOTIFY_NOT_WILDCARD && >+ (inp->inp_lport != lport || inp->inp_laddr.s_addr != laddr.s_addr || >+ inp->inp_fport != fport))) { > inp = LIST_NEXT(inp, inp_list); > continue; > } >@@ -733,7 +732,6 @@ > * and TCP port numbers. > */ > if ((tcp_seq_check == 1) && (tcp_seq_vs_sess(inp, tcp_sequence) == 0)) { >- inp = LIST_NEXT(inp, inp_list); > break; > } > oinp = inp; >diff -ru sys/netinet.old/in_pcb.h sys/netinet/in_pcb.h >--- sys/netinet.old/in_pcb.h Sun Feb 18 19:28:38 2001 >+++ sys/netinet/in_pcb.h Sun Feb 18 20:42:57 2001 >@@ -291,7 +291,9 @@ > int, struct ifnet *)); > void in_pcbnotify __P((struct inpcbhead *, struct sockaddr *, > u_int, struct in_addr, u_int, int, void (*)(struct inpcb *, int), >- u_int32_t, int)); >+ u_int32_t, int, int)); >+#define IN_PCBNOTIFY_NOT_WILDCARD 0 >+#define IN_PCBNOTIFY_WILDCARD 1 > void in_pcbrehash __P((struct inpcb *)); > int in_setpeeraddr __P((struct socket *so, struct sockaddr **nam)); > int in_setsockaddr __P((struct socket *so, struct sockaddr **nam)); >diff -ru sys/netinet.old/tcp_subr.c sys/netinet/tcp_subr.c >--- sys/netinet.old/tcp_subr.c Sun Feb 18 19:28:38 2001 >+++ sys/netinet/tcp_subr.c Sun Feb 18 20:46:58 2001 >@@ -1033,9 +1033,11 @@ > if (tcp_seq_check == 1) > tcp_sequence = ntohl(th->th_seq); > in_pcbnotify(&tcb, sa, th->th_dport, ip->ip_src, th->th_sport, >- cmd, notify, tcp_sequence, tcp_seq_check); >+ cmd, notify, tcp_sequence, tcp_seq_check, >+ IN_PCBNOTIFY_NOT_WILDCARD); > } else >- in_pcbnotify(&tcb, sa, 0, zeroin_addr, 0, cmd, notify, 0, 0); >+ in_pcbnotify(&tcb, sa, 0, zeroin_addr, 0, cmd, notify, 0, >+ 0, IN_PCBNOTIFY_WILDCARD); > } > > #ifdef INET6 >diff -ru sys/netinet.old/udp_usrreq.c sys/netinet/udp_usrreq.c >--- sys/netinet.old/udp_usrreq.c Sun Feb 18 19:28:38 2001 >+++ sys/netinet/udp_usrreq.c Sun Feb 18 20:46:05 2001 >@@ -512,9 +512,10 @@ > if (ip) { > uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2)); > in_pcbnotify(&udb, sa, uh->uh_dport, ip->ip_src, uh->uh_sport, >- cmd, udp_notify, 0, 0); >+ cmd, udp_notify, 0, 0, IN_PCBNOTIFY_NOT_WILDCARD); > } else >- in_pcbnotify(&udb, sa, 0, zeroin_addr, 0, cmd, udp_notify, 0, 0); >+ in_pcbnotify(&udb, sa, 0, zeroin_addr, 0, cmd, udp_notify, 0, >+ 0, IN_PCBNOTIFY_WILDCARD); > } > > static int
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 25195
: 13174