Dest address gets corrupted

[Rainer Salminen]

Hi
 
I suspect a bug.
If incoming packet contains IP header, then outgoing packet has source address as destination address causing either use of loopback interface or a failed ARP request.
 
The reason is that in function ip_output_if_opt() (in file ip.c) parameter dest points to source ip address after source and destination addresses are swapped.
The line causing error is in bold below.
 
 
 /* Should the IP header be generated or is it already included in p? */
  if (dest != IP_HDRINCL) {
 ....
   if (ip_addr_isany(src)) {
      ip_addr_set(&(iphdr->src), &(netif->ip_addr));
    } else {
      ip_addr_set(&(iphdr->src), src);
    }
    IPH_CHKSUM_SET(iphdr, 0);
#if CHECKSUM_GEN_IP
    IPH_CHKSUM_SET(iphdr, inet_chksum(iphdr, ip_hlen));
#endif
  } else {
    /* IP header already included in p */
    iphdr = p->payload;
    dest = &(iphdr->dest);
  }
 
The simplest fix is to move
 
dest = &(iphdr->dest);
 
out of else branch so that it applies also to then -part.

 

 

Can you confirm the bug and the fix?
 
 
Regards,
 
  RS

 

_______________________________________________
lwip-users mailing list
lwip-users@...
http://lists.nongnu.org/mailman/listinfo/lwip-users

[Rainer Salminen]

Hi again

 

Bolding seemed to disappear in the mailing list archive display.

The error line is " ip_addr_set(&(iphdr->src), src);".

So this line makes dest to point to iphdr->src, which later brings problems.

 

RS

2009/11/5 Rainer Salminen <rainer.salminen@...>

Hi
 
I suspect a bug.
If incoming packet contains IP header, then outgoing packet has source address as destination address causing either use of loopback interface or a failed ARP request.
 
The reason is that in function ip_output_if_opt() (in file ip.c) parameter dest points to source ip address after source and destination addresses are swapped.
The line causing error is in bold below.
 
 
 /* Should the IP header be generated or is it already included in p? */
  if (dest != IP_HDRINCL) {
 ....
   if (ip_addr_isany(src)) {
      ip_addr_set(&(iphdr->src), &(netif->ip_addr));
    } else {
      ip_addr_set(&(iphdr->src), src);
    }
    IPH_CHKSUM_SET(iphdr, 0);
#if CHECKSUM_GEN_IP
    IPH_CHKSUM_SET(iphdr, inet_chksum(iphdr, ip_hlen));
#endif
  } else {
    /* IP header already included in p */
    iphdr = p->payload;
    dest = &(iphdr->dest);
  }
 
The simplest fix is to move
 
dest = &(iphdr->dest);
 
out of else branch so that it applies also to then -part.

 

 

Can you confirm the bug and the fix?
 
 
Regards,
 
  RS

 

_______________________________________________
lwip-users mailing list
lwip-users@...
http://lists.nongnu.org/mailman/listinfo/lwip-users

[Kieran Mansley]

On Thu, 2009-11-05 at 20:39 +0200, Rainer Salminen wrote:
> If incoming packet contains IP header, then outgoing packet has source
> address as destination address causing either use of loopback
> interface or a failed ARP request.

Can you explain a bit more about how you reproduce this problem?  Are
you perhaps referring to an ICMP request, or is it more general than
that?

Kieran



_______________________________________________
lwip-users mailing list
lwip-users@...
http://lists.nongnu.org/mailman/listinfo/lwip-users

[Rainer Salminen]

I use udp_echo() from here:

 

http://cvs.savannah.gnu.org/viewvc/contrib/ports/unix/proj/unixsim/apps/udpecho.c?revision=1.4&root=lwip&view=markup

 

I have tested this using WIN32/MSC9 port and with my ARM7 -based "toy" system.

 

What happens in ip_output_if_opt() is that

 

- pbuf *p points to incoming message

- dest points to (correctly) to original source address in p (, which will be  a new destination)

- ip header addresses are swapped:

   -- ip_addr_set(&(iphdr->dest), dest) makes iphdr->dest to point to original source

   -- ip_addr_set(&(iphdr->src), src) makes iphdr->src to point our own ip

- but dest has not changed and it points still to the same address, where original source was but which now contains a new src address (our own ip)

 

Fix is to set

 

dest = &(iphdr->dest);

 

 

Rainer

 

 

2009/11/6 Kieran Mansley <kieran@...>

On Thu, 2009-11-05 at 20:39 +0200, Rainer Salminen wrote:
> If incoming packet contains IP header, then outgoing packet has source
> address as destination address causing either use of loopback
> interface or a failed ARP request.

Can you explain a bit more about how you reproduce this problem?  Are
you perhaps referring to an ICMP request, or is it more general than
that?

Kieran

_______________________________________________
lwip-users mailing list
lwip-users@...
http://lists.nongnu.org/mailman/listinfo/lwip-users

_______________________________________________
lwip-users mailing list
lwip-users@...
http://lists.nongnu.org/mailman/listinfo/lwip-users