Bug 162926 - [ipfilter] Infinite loop in ipfilter with fragmented IPv6 traffic
Summary: [ipfilter] Infinite loop in ipfilter with fragmented IPv6 traffic
Status: Closed Feedback Timeout
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: Cy Schubert
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-11-28 16:00 UTC by Paul
Modified: 2019-03-22 00:45 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Paul 2011-11-28 16:00:20 UTC
When receiving the following packet, ipfilter enters a loop in the frpr_ipv6hdr function making the whole system unresponsive. More recent versions of FreeBSD (e.g. 8.x) seem to be affected as they are using the same version of ipfilter.

# tcpdump -n -X -r AC_458632.pak
reading from file AC_458632.pak, link-type EN10MB (Ethernet)
01:00:00.000453 IP6 truncated-ip6 - 32724 bytes missing!:: > 80::: frag (0|32760) AH(spi=0x00000000,seq=0x33000000): HBH AH(spi=0x00000000,seq=0x0): HBH [|HBH]
        0x0000:  6000 0000 8000 2c00 0000 0000 0000 0000  `.....,.........
        0x0010:  0000 0000 0000 0000 0080 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0000 3300 0004 0000 0000  ........3.......
        0x0030:  0000 0000 0000 0000 3300 0000 0000 0000  ........3.......
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0050:  0000 0000            

The problem seems to have been corrected in ipfilter 4.1.31.

Fix: 

Install ipfilter v4.1.31.
How-To-Repeat: enable ipfilter.
enable ipv6 and ipv6 forwarding.
send packet through filter.
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2011-11-28 20:13:21 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-net

Over to maintainer(s).
Comment 2 Cy Schubert freebsd_committer freebsd_triage 2013-07-03 06:22:40 UTC
Responsible Changed
From-To: freebsd-net->cy

Mine.
Comment 3 Cy Schubert freebsd_committer freebsd_triage 2016-04-20 03:25:34 UTC
Is this still an issue under FreeBSD 10.3 or 11.0 (ipfilter 5.1.2)?
Comment 4 Cy Schubert freebsd_committer freebsd_triage 2019-03-22 00:45:37 UTC
Timeout.