Re: truncated-ip 4.1.32_rc5 (wrong IP header byte swapping?)

[Darren Reed]

Jim Klimov wrote:
> Hello all,
>
> When IPF 4.1.32_rc5 module is loaded on Solaris 10u6 x86_64
> (even with empty rule files), the host running ipf drops out
> of traceroute's (UDP as well as ICMP ones)).
>
> My take (explained in detail below) is that this is because
> of some issues with byte-swapping in IP header.
>
> I haven't yet witnessed the likes of this error, so I guessed
> it's a relatively new regression. However I confirmed it also
> happens on IPF 4.1.29 on Solaris 10u4 x86_64.

I suspect that this is going to be a Solaris 10, update 4 and onwards
issue...

Try the patch below...

Darren


Index: solaris.c
===================================================================
RCS file: /devel/CVS/IP-Filter/solaris.c,v
retrieving revision 2.73.2.18
diff -u -r2.73.2.18 solaris.c
--- solaris.c   19 Aug 2008 05:35:29 -0000      2.73.2.18
+++ solaris.c   30 Apr 2009 10:04:00 -0000
@@ -644,6 +644,7 @@
 {
        hook_pkt_event_t *hpe;
        qpktinfo_t qpi;
+       ushort_t swap;
        int out, hlen;
        ip_t *ip;
 
@@ -666,8 +667,10 @@
        ip = hpe->hpe_hdr;
        if (ip->ip_v == 4) {
                hlen = ip->ip_hl << 2;
-               ip->ip_off = ntohs(ip->ip_off);
-               ip->ip_len = ntohs(ip->ip_len);
+               swap = ntohs(ip->ip_off);
+               ip->ip_off = swap;
+               swap = ntohs(ip->ip_len);
+               ip->ip_len = swap;
        } else {
                hlen = sizeof(ip6_t);
        }
@@ -676,8 +679,10 @@
                return -1;
        ip = hpe->hpe_hdr;
        if (ip->ip_v == 4) {
-               ip->ip_off = htons(ip->ip_off);
-               ip->ip_len = htons(ip->ip_len);
+               swap = htons(ip->ip_off);
+               ip->ip_off = swap;
+               swap = htons(ip->ip_len);
+               ip->ip_len = swap;
        }
        return 0;
 }