Re: serious flaw exposed via filters (fwd)

Igor V. Semenyuk (iga@sovam.com)
Tue, 17 Sep 1996 14:49:35 +0400 (MSD)

>
> Once upon a time Igor V. Semenyuk shaped the electrons to say...
> >add route 192.168.2.0 192.168.1.1 5
> >set netmask 192.168.2.0 255.255.255.255
> >
> >would create a route to 192.168.2.0/24
>
> This is just plain wrong - you *MUST SET NETMASKS FIRST!* That is a
> cardinal rule. If you use the netmask table, ALL NETMASKS MUST BE SET
> ***BEFORE*** SETTING THE ROUTE.
>

Ok, ok. Just wish that had been clearly stated in manual or somewhere else.
Now we have the only way to add the route (of course it's an "add netmask",
not "set netmask", the latter will change ether0 netmask!).

add netmask 192.168.2.0 255.255.255.255
add route 192.168.2.0 192.168.1.1 5

Oops, we have /32 route, not /24, so all packets to "disconnected" addresses
will loop over our WAN.

Please advise how we can avoid it (this is what it is all about in the
first place - to avoid routing loops). I hope I made it clear RIP is
not an option here (as well as proxy ARP).

BTW, back to your cardinal rule. The following sequence of commands
does not violate it:

add netmask 192.168.2.0 255.255.255.0
add route 192.168.2.0 192.168.1.1 5
del netmask 192.168.2.0 255.255.255.0
add netmask 192.168.2.0 255.255.255.255

What will happen then?

>
> Same deal. It would have the same effect if we set it on the route
> commands as if you set it in the netmask table. If you use the netmask

That's correct. Only having the mask on the route commands is more
intuitive (virtualy all routers as well as hosts have this form of
the command).

> table correctly it works the same way. And since we do not yet support
> VLSM, allowing it on route commands would be worse.

But you plan to support it in the future version (with OSPF), don't you?

>
> 'add route 199.224.12.3/25 200.1.3.4 1'
> 'add route 199.224.12.49/27 200.4.5.8 1'
>
> Which netmask is used? You can only set one for the entire network,
> and you have just set two.

Take a look at my example above. What will happen if I omit "del netmask"
command? ComOS silently(!) replace the old entry with the new one.
Since there's no VLSM support currently the easiest way is to issue
an error or warning message if a route with a different netmask already
exists for a given network.

-- 
Igor V. Semenyuk                    Internet: iga@sovam.com
SOVAM Teleport                      Phone:    +7 095 258 4170
Moscow, Russia                      Fax:      +7 095 258 4133