diff options
| author | kbyanc <kbyanc@FreeBSD.org> | 2002-05-07 22:14:06 +0000 |
|---|---|---|
| committer | kbyanc <kbyanc@FreeBSD.org> | 2002-05-07 22:14:06 +0000 |
| commit | cc607e6c2d164e9cb79d2fdec151a8c3a151be83 (patch) | |
| tree | 1011805115056aee5a327edbdc2edbd88f8dd3e5 /sys/net/if_iso88025subr.c | |
| parent | 890d39a38cddebc8d4ce58feba2c0be1ee5e44f6 (diff) | |
| download | FreeBSD-src-cc607e6c2d164e9cb79d2fdec151a8c3a151be83.zip FreeBSD-src-cc607e6c2d164e9cb79d2fdec151a8c3a151be83.tar.gz | |
Move ISO88025 source routing information into sockaddr_dl's sdl_data
field. This returns the sdl_data field to a variable-length field. More
importantly, this prevents a easily-reproduceable data-corruption bug when
the interface name plus the hardware address exceed the sdl_data field's
original 12 byte limit. However, token-ring interfaces may still overflow
the new sdl_data field's 46 byte limit if the interface name exceeds 6
characters (since 6 characters for interface name plus 6 for hardware
address plus 34 for source routing = the size of sdl_data). Further
refinements could overcome this limitation but would break binary
compatibility; this commit only addresses fixing the bug for
commonly-occuring cases without breaking binary compatibility with the
intention that the functionality can be MFC'ed to -stable.
See message ID's (both send to -arch):
20020421013332.F87395-100000@gateway.posi.net
20020430181359.G11009-300000@gateway.posi.net
for a more thorough description of the bug addressed and how to
reproduce it.
Approved by: silence on -arch and -net
Sponsored by: NTT Multimedia Communications Labs
MFC after: 1 week
Diffstat (limited to 'sys/net/if_iso88025subr.c')
| -rw-r--r-- | sys/net/if_iso88025subr.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/sys/net/if_iso88025subr.c b/sys/net/if_iso88025subr.c index f23f5ee..afb6f4e 100644 --- a/sys/net/if_iso88025subr.c +++ b/sys/net/if_iso88025subr.c @@ -253,8 +253,8 @@ iso88025_output(ifp, m, dst, rt0) /* Calculate routing info length based on arp table entry */ if (rt && (sdl = (struct sockaddr_dl *)rt->rt_gateway)) - if (sdl->sdl_rcf != NULL) - rif_len = TR_RCF_RIFLEN(sdl->sdl_rcf); + if (SDL_ISO88025(sdl)->trld_rcf != NULL) + rif_len = TR_RCF_RIFLEN(SDL_ISO88025(sdl)->trld_rcf); /* Generate a generic 802.5 header for the packet */ gen_th.ac = TR_AC; @@ -264,9 +264,10 @@ iso88025_output(ifp, m, dst, rt0) if (rif_len) { gen_th.iso88025_shost[0] |= TR_RII; if (rif_len > 2) { - gen_th.rcf = sdl->sdl_rcf; + gen_th.rcf = SDL_ISO88025(sdl)->trld_rcf; (void)memcpy((caddr_t)gen_th.rd, - (caddr_t)sdl->sdl_route, rif_len - 2); + (caddr_t)SDL_ISO88025(sdl)->trld_route, + rif_len - 2); } } |
