kern/60304: IPFW2 does not send unreach port in certain cases

[Dmitry Sivachenko]

>Number:         60304
>Category:       kern
>Synopsis:       IPFW2 does not send unreach port in certain cases
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Dec 16 09:20:23 PST 2003
>Closed-Date:
>Last-Modified:
>Originator:     Dmitry Sivachenko
>Release:        FreeBSD 4.9-RELEASE i386
>Organization:
>Environment:
System: FreeBSD tear.demos.su 4.9-RELEASE FreeBSD 4.9-RELEASE #7: Tue Dec 16 19:58:40 MSK 2003 mitya at tear.demos.su:/usr/src/sys/compile/TEAR i386


	
>Description:

ipfw2 does not send unreach port ICMP message in certain cases.

>How-To-Repeat:

configure IP address on your machine: X.Y.Z.231 (the last byte is important,
see below).
Add the following rule:
00100 unreach port udp from any to X.Y.Z.231


execute 'traceroute X.Y.Z.231' from another machine.  You'll see '*' instead
of the last hop.

This happens when the last byte of IP-address corresponds to the first byte
of network class D.

>Fix:

--- /tmp/ip_fw2.c       Tue Dec 16 20:08:37 2003
+++ ip_fw2.c    Tue Dec 16 20:09:04 2003
@@ -1969,7 +1969,7 @@
                                    (proto != IPPROTO_ICMP ||
                                     is_icmp_query(ip)) &&
                                    !(m->m_flags & (M_BCAST|M_MCAST)) &&
-                                   !IN_MULTICAST(dst_ip.s_addr)) {
+                                   !IN_MULTICAST(ntohl(dst_ip.s_addr))) {
                                        send_reject(args, cmd->arg1,
                                            offset,ip_len);
                                        m = args->m;

>Release-Note:
>Audit-Trail:
>Unformatted: