>Number:         23549
>Category:       bin
>Synopsis:       rarpd doesn't delete incomplete ARP entries
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 23 14:13:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     Ben Harris
>Release:        1.6.1
>Organization:
>Environment:
NetBSD viking 1.6.1 NetBSD 1.6.1 (VIKING) #2: Wed Jun  4 13:59:27 BST 2003
bjh21@viking:/usr/src/sys/arch/macppc/compile/VIKING macppc

>Description:
When rarpd responds to a RARP request, it also adds an entry to the
server's ARP table for the client.  This seems to be necessary for clients
that aren't clever enough to respond to ARP themselves, such as the boot
ROM on my SPARCstation SLC.  If there's an (incomplete) ARP entry listed
for the client (if, for instance, the server has tried to communicate with
the client for some other reason), rarpd seems not to delete it.

>How-To-Repeat:
Make an incomplete ARP entry (e.g. by pinging the client), then try to
boot the client.  Notice that it won't boot until the incomplete ARP entry
is deleted (e.g. by using "arp -d").

>Fix:
mkarp.c needs to be made cleverer.  I had a look, but the current state of
the code scared me.


>Release-Note:
>Audit-Trail:
>Unformatted: