Re: FreeBSD 5 ip_gre and netisr_enable=1

From: Andre Oppermann (andre_at_freebsd.org)
Date: 08/25/05

  • Next message: Gary D. Margiotta: "Aggregate network interfaces" 
    Date: Thu, 25 Aug 2005 23:09:51 +0200
To: Max Laier <max@love2party.net>

    Max Laier wrote:
    >
    > On Thursday 25 August 2005 22:10, ming fu wrote:
    > > Hi,
    > >
    > > This problem exit in some old gre.c (not a part of official freebsd) to
    > > handle wccp packets. A carefully crafted packet can cause it to deplete
    > > kernel stack and casuing a panic. It can crash a 4.2 kernel with about
    > > 200-300 repeated ip+gre header.
    > >
    > > I believe the problem appears on FreeBSD 5 with ip_gre() and
    > > net.isr.enable = 1. It probably easier to crash a 5.x because more calls
    > > are involved in FreeBSD 5 than 4.x, thus more stack can be consumed with
    > > the same repetition of headers.
    > >
    > > when a GRE packet gets into the ip_gre2(), its gre header is stripped
    > > and sent to netisr_dispatch() for ip_input() processing again. In case,
    > > the net.isr.enable is 1, the packet will be delivered to ip_input
    > > directly instead of put in the queue.
    > >
    > > If someone create a packet consists of repeated ip and gre header,
    > >
    > > ip hdr : gre hdr : ip hdr : gre hdr : ...... repeat a few
    > > hundred times.
    > >
    > > it can cause a loop around
    > > ip_gre->ip_gre2->netisr_dispatch->ip_input->ip_gre ..., not too
    > > difficult to deplete the kernel stack.
    > >
    > > It only takes 24 bytes to force the kernel to go one round through these
    > > calls.
    > >
    > > Any suggestion of how to fix this?
    > >
    > > send the gre stripped packet to netisr_queue() is an easy, albeit slow
    > > solution.
    > >
    > > I fix the older gre.c file by making sure the inner packet is not a GRE
    > > before deliver to ip_input. However, it was ugly to parse the inner
    > > header of in ip_gre2().
    >
    > You could use an mbuf_tag to keep track of recursion in the same way it is
    > done in gif. There is certainly some overhead involved as well, however.

    Or set "m->m_pkthdr.rcvif = self" in gre_output() and in gre_input() check
    for (m->m_pkthdr.rcvif != self). 

    -- 
Andre
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Gary D. Margiotta: "Aggregate network interfaces"

    Relevant Pages

    • Re: xPC Binary Fifo Problem
      ... In general you'll be looking for one of the headers ... packet could trigger the code to think that it was the ... header of a different command. ... The problem I'm encountering is that the binary header FIFO ...
      (comp.soft-sys.matlab)
    • Re: xPC Binary Fifo Problem
      ... packet could trigger the code to think that it was the ... header of a different command. ... The problem I'm encountering is that the binary header FIFO ... under the serial system has problems with headers that start ...
      (comp.soft-sys.matlab)
    • Re: Is a HTTP header a clear text?
      ... getting the HTTP headers which is supposed to be clear text we're ... This is the whole captured packet we got by writing it in a file using ... tcp headers. ...
      (comp.os.linux.networking)
    • Re: How to get a tcp/ucp port in im driver without copying all packet content?
      ... NdisGetDataBuffer makes parsing the headers easier by copying them to a contiguous buffer -if- necessary. ... NDIS does not ... I check the packet in the way that copy each packet ... Basically the function would walk the MDL chain until it found the MDL ...
      (microsoft.public.development.device.drivers)
    • Re: Capturing Raw packets
      ... it can be separated by a several chained ethernet devices... ... NIC in the chain to accept the packet from Tx and pass it on, ... the packets and will take care of stripping them from the headers. ... to invent your own ethernet type (i.e. the 13th and 14th bytes of the ...
      (comp.unix.programmer)