Wed 14 Oct 2009 08:07:33 AM UTC, comment #5:
This item has been reassigned from the project The GNU Hurd patch tracker to your tracker.
The original report is still available at patch #6851
Following are the information included in the original report:
[field #0] Item ID: 6851 [field #1] Group ID: 30 [field #2] Open/Closed: Open [field #3] Severity: 3 - Normal [field #4] Privacy: Public [field #9] Category: GNU Mach [field #10] Submitted by: zhengda [field #11] Assigned to: zhengda [field #12] Submitted on: Sun 21 Jun 2009 03:36:19 AM CEST [field #13] Summary: fix a bug in BPF [field #14] Original Submission: The packet data passed to BPF should exclude the packet_header.
The amount of a packet that returns to the user space should include packet_header. [field #16] Item Group: None [field #17] Status: Done [field #18] Component Version: None [field #19] Operating System: None [field #20] Reproducibility: None [field #21] Size (loc): None [field #22] Fixed Release: None [field #23] Planned Release: None [field #24] Effort: 0.00 [field #28] Priority: 5 - Normal [field #31] Percent Complete: 0% [field #33] Release: None [field #58] Custom Select Box #1: None [field #59] Custom Select Box #2: None [field #60] Custom Select Box #3: None [field #61] Custom Select Box #4: None [field #62] Custom Select Box #5: None [field #63] Custom Select Box #6: None [field #64] Custom Select Box #7: None [field #65] Custom Select Box #8: None [field #66] Custom Select Box #9: None [field #67] Custom Select Box #10: None
|
Wed 29 Jul 2009 09:04:49 AM UTC, comment #3:
> The packet delivered from gnumach should have the packet header. NPF returns the packet_header and pfinet always assumes that the packet from gnumach has the packet_header.
OK, I understand that, and it is fine, but is there a specific reason to send package_header to user-space? (That is, if it's not required, then we should perhaps change pfinet and net_filter to not handle it?) If I understand the code correctly, packets that go from pfinet to the kernel to be sent out, do not contain the packet_header, but packets that go from the kernel to pfinet do contain the packet_header. Why this asymmetry? Perhaps I fail to understand what this packet_header is actually good for. (All that is unrelated to this bug report, of course, but while we're at it...)
> For your first question, the return value of net_do_filter is boolean, i.e., it can only be passed or not passed, but bpf_do_filter returns the size of the data that passes the filter.
OK, I see. The code could be written in a way that this is more obvious... (15 years old code, I know.)
My question also was whether net_do_filter should be changed to not handle the packet_header-part of the packet, as that is not related to the actual packet data (as I understand it), and thus should not be involved in deciding whether to allow or deny a given packet. (That's also unrelated to this bug report.)
Given the same instructions as in bug #20612, please install this patch. (And then we can think about the other issues I'm talking above.)
|
Wed 29 Jul 2009 08:15:10 AM UTC, comment #2:
The packet delivered from gnumach should have the packet header. NPF returns the packet_header and pfinet always assumes that the packet from gnumach has the packet_header.
For your first question, the return value of net_do_filter is boolean, i.e., it can only be passed or not passed, but bpf_do_filter returns the size of the data that passes the filter.
bpf_do_filter(infp, net_kmsg(kmsg)->packet + sizeof(struct packet_header), count, net_kmsg(kmsg)->header, ifp->if_header_size, &hash_headp, &entp) is simply wrong because the length of the packet data passed to bpf_do_filter isn't 'count' any more.
|