From sblank@tiscali.de  Tue Dec  3 04:38:45 2002
Return-Path: <sblank@tiscali.de>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8672037B401
	for <FreeBSD-gnats-submit@freebsd.org>; Tue,  3 Dec 2002 04:38:45 -0800 (PST)
Received: from ally.privat.de (core116-d2.dialo.tiscali.de [62.246.116.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DEDE643ECF
	for <FreeBSD-gnats-submit@freebsd.org>; Tue,  3 Dec 2002 04:38:43 -0800 (PST)
	(envelope-from sblank@tiscali.de)
Received: by ally.privat.de (Postfix, from userid 1000)
	id 49C9F2999; Tue,  3 Dec 2002 13:38:06 +0100 (CET)
Message-Id: <20021203123806.49C9F2999@ally.privat.de>
Date: Tue,  3 Dec 2002 13:38:06 +0100 (CET)
From: Sascha Blank <sblank@tiscali.de>
Reply-To: Sascha Blank <sblank@tiscali.de>
To: FreeBSD-gnats-submit@freebsd.org
Subject: ipfw2 logs wrong port number when forwarding a packet
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         45964
>Category:       kern
>Synopsis:       ipfw2 logs wrong port number when forwarding a packet
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    maxim
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Dec 03 04:40:01 PST 2002
>Closed-Date:    Mon Dec 23 02:05:22 PST 2002
>Last-Modified:  Mon Dec 23 02:05:22 PST 2002
>Originator:     Sascha Blank
>Release:        FreeBSD 4.7-STABLE i386
>Organization:
none
>Environment:

System: FreeBSD ally.privat.de 4.7-STABLE FreeBSD 4.7-STABLE #3: Tue Dec 3
12:41:08 CET 2002 sblank@ally.privat.de:/disc2/obj/disc2/src/sys/ALLY i386

# ident /usr/src/sys/netinet/ip_fw2.c

/usr/src/sys/netinet/ip_fw2.c:
     $FreeBSD: src/sys/netinet/ip_fw2.c,v 1.6.2.7 2002/11/21 01:27:30 luigi Exp $

>Description:

I have the following rule in my ipfw.rules file:

	add fwd 127.0.0.1,3128 log tcp from any to any http

But whenever a packet is triggered by this rule something like this gets
logged:

	Dec  3 12:32:21 ally /kernel: ipfw: 80 Forward to 127.0.0.1:14348 TCP
	62.246.116.240:1423 216.136.204.117:80 out via tun0

As you can see the port number that this packet is forwarded to is incorrect:
it should read 3128 instead of 14348.

Fortunately this is only a logging problem caused by some inappropriate network
byte order swapping:

	 3128 = 0x0C38
	14348 = 0x380C

A comparison of the logging routine in ip_fw.c (starting at line 541) with
ip_fw2.c (starting at line 483) shows that the latter has a ntohs() call where
the former hasn't.

>How-To-Repeat:

See above.

>Fix:

The following fix works for me as this log line shows:

	Dec  3 13:06:02 ally /kernel: ipfw: 20 Forward to 127.0.0.1:3128 TCP
	62.246.116.185:1207 204.152.184.116:80 out via tun0

*** /usr/src/sys/netinet/ip_fw2.c.orig	Thu Nov 21 10:51:30 2002
--- /usr/src/sys/netinet/ip_fw2.c	Tue Dec  3 12:39:41 2002
***************
*** 488,494 ****
  				inet_ntoa(sa->sa.sin_addr));
  			if (sa->sa.sin_port)
  				snprintf(SNPARGS(action2, len), ":%d",
! 					ntohs(sa->sa.sin_port));
  			}
  			break;
  		default:
--- 488,494 ----
  				inet_ntoa(sa->sa.sin_addr));
  			if (sa->sa.sin_port)
  				snprintf(SNPARGS(action2, len), ":%d",
! 					sa->sa.sin_port);
  			}
  			break;
  		default:
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->patched 
State-Changed-By: maxim 
State-Changed-When: Sun Dec 15 02:01:17 PST 2002 
State-Changed-Why:  
Fixed in rev. 1.20 src/sys/netinet/ip_fw2.c. Thanks! 


Responsible-Changed-From-To: freebsd-bugs->maxim 
Responsible-Changed-By: maxim 
Responsible-Changed-When: Sun Dec 15 02:01:17 PST 2002 
Responsible-Changed-Why:  
Will MFC the fix in one week. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=45964 
State-Changed-From-To: patched->closed 
State-Changed-By: maxim 
State-Changed-When: Mon Dec 23 02:03:00 PST 2002 
State-Changed-Why:  
Fixed in rev. 1.20 and rev. 1.6.2.8 src/sys/netinet/ip_fw2.c in -CURRENT 
and -STABLE. Thanks for the patch! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=45964 
>Unformatted:
