[ipsec] bug report: possible memory overwrite for IPv6 IPsec

2008-04-07 Thread blue
Dear all: struct secashead defined in keydb.h line 89: /* Security Association Data Base */ struct secashead { LIST_ENTRY(secashead) chain; struct secasindex saidx; struct secident *idents;/* source identity */ struct secident *identd;/* destination identity */

[ipsec] KEY_FREESAV() in FreeBSD-Release7.0

2008-04-07 Thread blue
Dear all: About the KEY_FREESAV() in key_checkrequest() in key.c: line 806: if (isr->sav != NULL) { KEY_FREESAV(&isr->sav); isr->sav = NULL; } The codes are only going to free the sav used LAST TIME. For outgoing SA entries, the reference count will be always 2, instead of 1

Re: arplookup 10.0.0.68 failed: host is not on local network

2008-04-07 Thread Andriy Gapon
on 07/04/2008 15:59 Bill Moran said the following: > In response to Andriy Gapon <[EMAIL PROTECTED]>: > >> My message log is spammed with thousands of the messages like quoted >> below to the extent that this could be considered some form of an attack. >> kernel: arplookup 10.0.0.68 failed: host i

Re: arplookup 10.0.0.68 failed: host is not on local network

2008-04-07 Thread Bill Moran
In response to Andriy Gapon <[EMAIL PROTECTED]>: > My message log is spammed with thousands of the messages like quoted > below to the extent that this could be considered some form of an attack. > kernel: arplookup 10.0.0.68 failed: host is not on local network > kernel: arplookup 10.0.0.6 failed

Current problem reports assigned to freebsd-net@FreeBSD.org

2008-04-07 Thread FreeBSD bugmaster
Current FreeBSD problem reports Critical problems Serious problems S Tracker Resp. Description o kern/35442 net[sis] [patch] Problem transmitting runts in if_sis dri a kern/38554 netchang

Re: Initialising networking protocol

2008-04-07 Thread Rui Paulo
On Sun, Apr 06, 2008 at 04:20:26AM +0100, Bruce M. Simpson wrote: > Julian Elischer wrote: >>> >>> Seen ayame? http://www.ayame.org/ >> >> looks like a stalled affort.. things stop in 2002 > > [greater-than] From what I've read of the code, it seems close to KAME and > BSD style, and could actu

ipfw uid/gid to match listening TCP sockets?

2008-04-07 Thread Yar Tikhiy
Hi there, Our ipfw currently doesn't seem to match this host's traffic by uid/gid if the traffic goes to a listening TCP socket. E.g., if one tries to allow passive data connections to a local anonymous FTP server as follows, it won't work: ipfw add 1 allow tcp from any to me dst-por