Hi,
Attached is a patch which tells our IPv4 fast-forwarding path to drop
directed broadcast packets. The checks originally put in ip_fastfwd.c
can deal only with undirected broadcasts.
Whilst this patch doesn't mitigate the resulting CPU consumption, it
does the right thing by letting the FIB deal with the hard work of
determining whether or not a given destination address is for a
broadcast destination.
Normally, RTF_BROADCAST is set on routes which were added as a result of
a call to arpresolve() to resolve the broadcast address, and thus
in_addroute(). This is fine and covers the case where the directed
broadcast address is known to the router -- which is what we want 99% of
the time.
The fix in PR 98799 is not the right fix: in_broadcast() can potentially
return an IPv4 destination address as not being a broadcast address,
because it only walks the address list hung off the single ifnet pointer
provided.
We perform a route lookup anyway, so let the FIB do the work.
To detect directed broadcasts being propagated beyond a single hop would
require cooperation from a routing daemon which is smart enough to set
RTF_BROADCAST on the routes which it pushes to the kernel FIB for the
network prefixes it learns; the router has to have topology information
before it can do anything, otherwise, it's just another IPv4 address.
Regards,
BMS
Index: ip_fastfwd.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_fastfwd.c,v
retrieving revision 1.37
diff -u -p -r1.37 ip_fastfwd.c
--- ip_fastfwd.c 17 Aug 2006 00:37:03 -0000 1.37
+++ ip_fastfwd.c 3 Feb 2007 06:11:08 -0000
@@ -418,9 +418,11 @@ passin:
ifp = ro.ro_rt->rt_ifp;
/*
- * Immediately drop blackholed traffic.
+ * Immediately drop blackholed traffic, and directed broadcasts
+ * for either the all-ones or all-zero subnet addresses on
+ * locally attached networks.
*/
- if (ro.ro_rt->rt_flags & RTF_BLACKHOLE)
+ if ((ro.ro_rt->rt_flags & (RTF_BLACKHOLE|RTF_BROADCAST)) != 0)
goto drop;
/*
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
