At Wed, 29 Aug 2007 00:28:47 +0900,
jinmei wrote:
>
> At Tue, 28 Aug 2007 19:49:11 +0800,
> blue <[EMAIL PROTECTED]> wrote:
>
> > According to the GDB backtrace, I think this is what I am talking about.
> >
> > Besides, this would result in infinite loop just by looking at the
> > codes. However, the author seems knowing the problem, too. The comments
> > in esp6_ctlinput() point out:
> > /*
> > * Although pfctlinput2 will call esp6_ctlinput(), there is
> > * no possibility of an infinite loop of function calls,
> > * because we don't pass the inner IPv6 header.
> > */
> >
> > I am not sure what the description means. The behavior of
> > esp6_ctlinput() is the same in HEAD, too.
>
> This means that variable 'ip6' should be NULL for the second time
> esp6_ctlinput() is called in the esp_input.c ("non-FAST" IPSEC)
> version. It prevents the function calls from making an infinite loop.
>
> On the other hand, the ipsec_input.c (FAST_IPSEC) version only seems
> to check ip6ctlparam * ('d') is NULL, making the infinite sequence of
> calls possible.
I am now going over the code that Jinmei-san has kindly pointed out
and will attempt a patch soon. I am also hoping to develop a reliable
way to trigger this bug, based on the report from Pawel Worach on
[EMAIL PROTECTED]
Best,
George
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
