Bug 58927

Summary: Verification of reverse path in ip_fw2.c causes problems
Product: Base System Reporter: Vlad Manilici <vman>
Component: kernAssignee: Andre Oppermann <andre>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 5.1-RELEASE   
Hardware: Any   
OS: Any   

Description Vlad Manilici 2003-11-04 16:20:25 UTC
If the direct and reverse route run over different gateways, not
response packet is accepted. This may cause problems with certain
ISPs (as mine).

Fix: 

1. Shorthand: put the interface in promiscuous mode (tcpdump).
2. Elaborate: edit /usr/src/sys/netinet/ip_fw2.c and eliminate
   verify_rev_path() and all calls to it.

***** Complaint

Please restart the Web Interface to GNATS. Users with FreeBSD
machines isolated in intranets etc. may have problems with
send-pr(1)

Cheers,
Vlad
How-To-Repeat: 
Use a host with 2 NICs, and different direct and reverse routes.
Traffic will be "swallowed".
Comment 1 Vlad Manilici 2003-11-05 10:39:45 UTC
Hi,

It seems that not the reverse path check is the problem, but the
kernel. Disabling thins check, and testing with "normal" traffic
(i.e., same direct and reverse path) brings nothing. I should't
have blamed my ISP and this check so quick :). He still has the
same IP on 2 different MACs on his Cisco, s.t. I send to one of
them (as configured in ARP) and receive from the other. But this
strange stuff is a digression :-).

Again, my NIC card (3Com 905c-tx) accepts traffic destined to it
only when in promiscuous mode. I use the nr. 1 fix. The 2.nd is
false.

When I boot my old 4.7 partition, I am able to use the card as
normal. Thus, I strongly suspect the 5.1 kernel...

Also note that 5.1 actually did function on my system correctly.
After this problem first occured, I bought another NIC of the same
type (3C905C-TX), and changed it. The problem persists. Might
there be something wrong with the PCI controller/motherboard?

Still, shouldn't the kernel properly detect deffective hardware?

As a reference, my boot messages:

Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 5.1-RELEASE-p10 #12: Wed Nov  5 11:25:18 CET 2003
    root@:/usr/obj/usr/src/sys/K2
Preloaded elf kernel "/boot/kernel/kernel" at 0xc04e9000.
Preloaded elf module "/boot/kernel/acpi.ko" at 0xc04e921c.
Timecounter "i8254"  frequency 1193182 Hz
Timecounter "TSC"  frequency 999723311 Hz
CPU: AMD Athlon(tm) Processor (999.72-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x642  Stepping = 2
  Features=0x183f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR>
  AMD Features=0xc0440000<RSVD,AMIE,DSP,3DNow!>
real memory  = 268353536 (255 MB)
avail memory = 255213568 (243 MB)
Pentium Pro MTRR support enabled
npx0: <math processor> on motherboard
npx0: INT 16 interface
acpi0: <ASUS   A7V     > on motherboard
pcibios: BIOS version 2.10
Using $PIR table, 9 entries at 0xc00f1720
acpi0: power button is handled as a fixed feature programming model.
Timecounter "ACPI-fast"  frequency 3579545 Hz
acpi_timer0: <24-bit timer at 3.579545MHz> port 0xe408-0xe40b on acpi0
acpi_cpu0: <CPU> on acpi0
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
agp0: <VIA 82C8363 (Apollo KT133A) host to PCI bridge> mem 0xe4000000-0xe7ffffff at device 0.0 on pci0
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1: <display, VGA> at device 0.0 (no driver attached)
isab0: <PCI-ISA bridge> at device 4.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <VIA 82C686A UDMA66 controller> port 0xd800-0xd80f at device 4.1 on pci0
ata0: at 0x1f0 irq 14 on atapci0
ata1: at 0x170 irq 15 on atapci0
uhci0: <VIA 83C572 USB controller> port 0xd400-0xd41f irq 9 at device 4.2 on pci0
usb0: <VIA 83C572 USB controller> on uhci0
usb0: USB revision 1.0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
ums0: Logitech USB Mouse, rev 1.10/6.20, addr 2, iclass 3/1
ums0: 4 buttons and Z dir.
uhci1: <VIA 83C572 USB controller> port 0xd000-0xd01f irq 9 at device 4.3 on pci0
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0
uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhub1: port error, restarting port 1
uhub1: port error, giving up port 1
ulpt0: Hewlett-Packard DeskJet 845C, rev 1.10/1.00, addr 2, iclass 7/1
ulpt0: using bi-directional mode
uhub2: ALCOR Generic USB Hub, class 9/0, rev 1.10/1.00, addr 3
uhub2: 4 ports with 4 removable, self powered
pcm0: <Creative CT5880-C> port 0xa400-0xa43f irq 9 at device 9.0 on pci0
pcm0: <TriTech TR28602 AC97 Codec>
xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0xa000-0xa07f mem 0xde800000-0xde80007f irq 5 at device 10.0 on pci0
xl0: Ethernet address: 00:04:75:f8:d6:4a
miibus0: <MII bus> on xl0
ukphy0: <Generic IEEE 802.3u media interface> on miibus0
ukphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
bktr0: <BrookTree 878> mem 0xe1000000-0xe1000fff irq 9 at device 13.0 on pci0
bktr0: Hauppauge Model 44804 C148
bktr0: Warning - Unknown Hauppauge Tuner 0x30
bktr0: Hauppauge WinCast/TV, Philips PAL I tuner.
pci0: <multimedia> at device 13.1 (no driver attached)
atapci1: <Promise PDC20265 UDMA100 controller> port 0x8400-0x843f,0x8800-0x8803,0x9000-0x9007,0x9400-0x9403,0x9800-0x9807 mem 0xde000000-0xde01ffff irq 10 at device 17.0 on pci0
ata2: at 0x9800 on atapci1
ata3: at 0x9000 on atapci1
fdc0: <Enhanced floppy controller (i82077, NE72065 or clone)> port 0x3f7,0x3f2-0x3f5 irq 6 drq 2 on acpi0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
ppc0 port 0x778-0x77b,0x378-0x37f irq 7 drq 3 on acpi0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
ppbus0: <Parallel port bus> on ppc0
sio0 port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A
sio1 port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
kbd0 at atkbd0
orm0: <Option ROMs> at iomem 0xd4000-0xd47ff,0xd0000-0xd1fff,0xcc000-0xcffff,0xc0000-0xc9fff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <10 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounters tick every 10.000 msec
ipfw2 initialized, divert disabled, rule-based forwarding enabled, default to deny, logging unlimited
acpi_cpu: throttling enabled, 16 steps (100% to 6.2%), currently 100.0%
ad4: 78167MB <Maxtor 6Y080P0> [158816/16/63] at ata2-master UDMA100
ad5: 28629MB <ST330620A> [58168/16/63] at ata2-slave UDMA100
acd0: DVD-ROM <Memorex DVD-MAXX 1648 AJ> at ata1-master PIO4
acd1: CD-RW <CD-R/RW RW7120A> at ata1-slave PIO4
Mounting root from ufs:/dev/ad4s3a
xl0: promiscuous mode enabled

And my kernel configuration file:

# $Id: K2,v 1.7 2003/11/05 10:19:00 root Exp $

machine			i386
cpu				I686_CPU
ident			K2

# Debugging for use in -current
#makeoptions		DEBUG=-g		#Build kernel with gdb(1) debug symbols
#options 		DDB				#Enable the kernel debugger
#options 		INVARIANTS		#Enable calls of extra sanity checking
options 		INVARIANT_SUPPORT#Extra sanity checks of internal structures, required by INVARIANTS
#options 		WITNESS			#Enable checks to detect deadlocks and cycles
#options 		WITNESS_SKIPSPIN#Don't run witness on spinlocks for speed

options 		SCHED_4BSD		#4BSD scheduler
options 		INET			#InterNETworking
#options 		INET6			#IPv6 communications protocols
options 		FFS				#Berkeley Fast Filesystem
options 		SOFTUPDATES		#Enable FFS soft updates support
options 		UFS_ACL			#Support for access control lists
options 		UFS_DIRHASH		#Improve performance on big directories
options 		NFSCLIENT		#Network Filesystem Client
options 		NFSSERVER		#Network Filesystem Server
options 		MSDOSFS			#MSDOS Filesystem
options 		CD9660			#ISO 9660 Filesystem
options			EXT2FS			#Linux ext2. No module?
options 		PROCFS			#Process filesystem
options 		PSEUDOFS		#Pseudo-filesystem framework
options 		COMPAT_43		#Compatible with BSD 4.3 [KEEP THIS!]
options 		COMPAT_FREEBSD4	#Compatible with FreeBSD4
options 		KTRACE			#ktrace(1) support
options 		SYSVSHM			#SYSV-style shared memory
options 		SYSVMSG			#SYSV-style message queues
options 		SYSVSEM			#SYSV-style semaphores
options 		_KPOSIX_PRIORITY_SCHEDULING #Posix P1003_1B real-time extensions
options 		KBD_INSTALL_CDEV#install a CDEV entry in /dev

# Enable Linux ABI emulation
options         COMPAT_LINUX

device			isa
device			pci

device			ata
device			atadisk			# ATA disk drives
device			atapicd			# ATAPI CDROM drives
options 		ATA_STATIC_ID	#Static device numbering
device			fdc			# Floppy drives

# atkbdc0 controls both the keyboard and the PS/2 mouse
device			atkbdc			# AT keyboard controller
device			atkbd			# AT keyboard
#device			psm				# PS/2 mouse
device			vga				# VGA video card driver
device			splash			# Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device			sc
options 		MAXCONS=10		# number of virtual consoles
options 		SC_HISTORY_SIZE=1000	# number of history buffer lines
options 		SC_NORM_ATTR="(FG_GREEN|BG_BLACK)"
options 		SC_NORM_REV_ATTR="(FG_BLACK|BG_GREEN)"
options 		SC_KERNEL_CONS_ATTR="(FG_RED|BG_BLACK)"
options 		SC_KERNEL_CONS_REV_ATTR="(FG_BLACK|BG_RED)"

# sound
device			pcm

# Floating point support - do not disable.
device			npx

# Serial (COM) ports
device			sio				# 8250, 16[45]50 based serial ports

# Parallel port
device			ppc
device			ppbus			# Parallel port bus (required)

# Ether
device			miibus			# MII bus support
device			xl				# 3Com 3c90x (``Boomerang'', ``Cyclone'')

# Pseudo devices - the number indicates how many units to allocate.
device			random			# Entropy device
device			loop			# Network loopback
device			ether			# Ethernet support
device			ppp				# Kernel PPP
device			tun				# Packet tunnel.
device			pty				# Pseudo-ttys (telnet etc)
device			bpf				# Berkeley packet filter
device			md				# Memory/malloc disk
device			agp				# AGP GART support

# usb
device			uhci			# UHCI PCI->USB interface
device			usb				# USB Bus (required)
#device			uvisor			# USB Palms
#device			ucom			# USB to com
device			ugen			# Generic
device			ums				# Mouse
device			ulpt			# Printer

# umass
device			scbus			# SCSI bus (required)
device			da				# Direct Access (disks)
device			umass			# Disks/Mass storage - Requires scbus and da
device			pass			# Passthrough device (direct SCSI access)

# firewall
options			IPFIREWALL		# firewall
options			IPFIREWALL_VERBOSE #enable logging to syslogd(8)

# bktr
device			smbus
device			iicbus
device			iicbb
device			bktr			# Hauppauge WinTV Card
options			BROOKTREE_SYSTEM_DEFAULT=BROOKTREE_PAL
options			BKTR_GPIO_ACCESS

I'd be grateful for any help :)

Cheers,
Vlad

................................................................................
    Vlad Manilici                               vman@tmok.com
Comment 2 Maxim Konovalov 2003-11-05 16:59:16 UTC
By guess:

	sysctl net.inet.ip.check_interface=0

?

-- 
Maxim Konovalov, maxim@macomnet.ru, maxim@FreeBSD.org
Comment 3 Vlad Manilici 2003-11-05 21:33:32 UTC
Hi Maxim,

On 05.11.|19:59, Maxim Konovalov wrote:
>       sysctl net.inet.ip.check_interface=0

Did so, with no effect on my "promiscuous" problem. Thanks anyway.

One more detail: without promiscuous, the interface still gets traffic 
directed to the broadcast Ethernet address. But not to itself. I
observed this using "tcpdump -p". 

Vlad
Comment 4 Andre Oppermann freebsd_committer freebsd_triage 2003-12-27 17:02:36 UTC
Responsible Changed
From-To: freebsd-bugs->andre

Take over.
Comment 5 Andre Oppermann freebsd_committer freebsd_triage 2003-12-30 13:58:43 UTC
State Changed
From-To: open->feedback

Problem is believed to be fixed.  Waiting for Originator to confirm.
Comment 6 oppermann 2003-12-30 13:58:43 UTC
Vlad,

could you check FreeBSD 5.2RC2 or -CURRENT again?

It is believed that this bug has been fixed in sys/netinet/ip_fw2.c
rev 1.50 on Nov.27 2003.

-- 
Andre
Comment 7 Andre Oppermann freebsd_committer freebsd_triage 2004-03-22 22:35:18 UTC
State Changed
From-To: feedback->closed

Originator reports the patch fixed the problem in his setup.