Bug 54309 - TCP Packet of 64K-1 crashes FreeBSD4.8
Summary: TCP Packet of 64K-1 crashes FreeBSD4.8
Status: Closed Feedback Timeout
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 4.8-RELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-net (Nobody)
URL:
Keywords: crash, needs-qa
Depends on:
Blocks:
 
Reported: 2003-07-10 09:20 UTC by Nigel Horne
Modified: 2018-11-06 14:14 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nigel Horne 2003-07-10 09:20:21 UTC
        A simple perl program (see attached) causes a kernel page fault

Fix: 

-- 
Nigel Horne. Arranger, Composer, Conductor, Typesetter.
Owner of the brass band group of the Internet. ICQ#20252325
njh@bandsman.co.uk http://www.bandsman.co.uk/music.htm
How-To-Repeat: #!/usr/bin/perl -wT

# To be run as root under FreeBSD
# First do: ipfw add divert 9999 tcp from any to <ip> 3994
# Where <ip> is the IP address of the prodigy, e.g. 192.168.3.40
# You may need to reconfigure BSD first to support ipfw:
# options         IPFIREWALL
# options         IPDIVERT
# options         IPFIREWALL_FORWARD
# options         IPFIREWALL_VERBOSE
# options         IPFIREWALL_VERBOSE_LIMIT=100
# options         IPFIREWALL_DEFAULT_TO_ACCEPT
# options         IPFILTER
# options         IPFILTER_LOG
# options         TCPDEBUG
# options         TCP_DROP_SYNFIN
# options         ICMP_BANDLIM
# options         DUMMYNET
# options         IPSTEALTH
#
# Then try telnet 192.168.3.40 3994, sit back and watch the output

use strict;
use Net::Divert;
use NetPacket::IP;
use NetPacket::TCP;

my $ipFilter = Net::Divert->new('dev.gsec1.local', 9999);

$ipFilter->getPackets(\&handler);

sub handler {
        my($packet, $fwtag) = @_;

        my $ip = NetPacket::IP->decode($packet);

        if($ip->{proto} == NetPacket::IP->IP_PROTO_TCP) {
                my $tcp = NetPacket::TCP->decode($ip->{data});

                print "source " . $tcp->{src_port} . " dest " . 
$tcp->{dest_port} . "\n";

                # $tcp->{flags} |= SYN;
                # $tcp->{flags} &= ~ACK;

                # $tcp->{seqnum} = 0;

                $tcp->{data} = 'x' x 65535;

                $ip->{data} = $tcp->encode($ip);

                $packet = $ip->encode;

        }
        $ipFilter->putPacket($packet, $fwtag);
}
Comment 1 silby freebsd_committer freebsd_triage 2003-07-11 07:10:57 UTC
Responsible Changed
From-To: freebsd-bugs->silby

I'd better look at this...
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2015-11-12 01:27:44 UTC
Reassign to the wild with permission of assignee.

To submitter: is this report still valid?
Comment 3 Eugene Grosbein freebsd_committer freebsd_triage 2018-02-02 22:15:50 UTC
Is this problem still relevant to any supported version of FreeBSD?