>Number:         7589
>Category:       kern
>Synopsis:       machine responds to wrong IP address
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun May 16 08:35:00 1999
>Last-Modified:
>Originator:     Jens A Nilsson
>Organization:

>Release:        NetBSD 1.4
>Environment:
System: NetBSD subzero 1.4 NetBSD 1.4 (SUBZERO) #4: Sun May 16 16:37:58 CEST 1999 jens@subzero:/home/jens/netsys/sys-1.4/arch/i386/compile/SUBZERO i386


>Description:
I found a strange error in the 1.4 release. When I send pings for
130.240.16.109 through the machine, it responds to the ping even
though it's supposed to just route it. A funny thing with this
response is that the source IP is 127.0.0.1. The problem is that
the INADDR_TO_IA macro in netinet/in_var.h is broken.
>How-To-Repeat:
Set a route for 130.240.16.109 to a NetBSD 1.4 machine, it is possible
that there need to be some interfaces unconfigured on the 1.4 machine.
lo0 need to be configured to 127.0.0.1 also.
>Fix:
Change INADDR_TO_IA to:

#define INADDR_TO_IA(addr, ia) \
	/* struct in_addr addr; */ \
	/* struct in_ifaddr *ia; */ \
{ \
	for (ia = IN_IFADDR_HASH((addr).s_addr).lh_first; \
	    ia != NULL && ( \
		!in_hosteq(ia->ia_addr.sin_addr, (addr)) || \
		(ia->ia_ifp->if_flags & IFF_UP) == 0); \
	ia = ia->ia_hash.le_next) \
	continue; \
}

It's how the macro is used in ip_input.c that causes this behavior.

I'm not completely satisfied with that solution, I have a feeling
that something else is wrong too, because I have only found one IP
address that triggers the bug and that's 130.240.16.109.  I'm sure
that there are more but I can't see the pattern.
>Audit-Trail:
>Unformatted: