>Number:         3712
>Category:       kern
>Synopsis:       icmpstat.icps_badlen should be imcremented for ICMP_MASKREQ
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jun  5 07:35:01 1997
>Last-Modified:
>Originator:     Koji Imada - je4owb/2
>Organization:
Mathematics Group of Graduate School of Human
	Infomatics, Nagoya University, Japan.
>Release:        970523
>Environment:
	
System: NetBSD bimota 1.2E NetBSD 1.2E (BIMOTA) #39: Sun Jun 1 01:19:25 JST 1997 koji@bimota:/mnt2/NetBSD/work/src-ufs-mod/sys/arch/i386/compile/BIMOTA i386


>Description:
	When handling icmp request, icmpstat.icps_badlen should be
	incremented for bad length of ICMP_MASKREQ.

	This is described in "TCP/IP Illustrated vol. 2" p.319.
>How-To-Repeat:
	The codes said all.
>Fix:
	apply following patch

Index: sys/netinet/ip_icmp.c
===================================================================
RCS file: /mnt2/NetBSD/cvsroot/netbsd/sys/netinet/ip_icmp.c,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 ip_icmp.c
--- ip_icmp.c	1997/04/01 07:17:21	1.1.1.2
+++ ip_icmp.c	1997/06/04 21:52:17
@@ -343,8 +343,10 @@
 		 * We are not able to respond with all ones broadcast
 		 * unless we receive it over a point-to-point interface.
 		 */
-		if (icmplen < ICMP_MASKLEN)
+		if (icmplen < ICMP_MASKLEN) {
+			icmpstat.icps_badlen++;		  
 			break;
+		}
 		if (ip->ip_dst.s_addr == INADDR_BROADCAST ||
 		    in_nullhost(ip->ip_dst))
 			icmpdst.sin_addr = ip->ip_src;

>Audit-Trail:
>Unformatted: