
EtherSlip 11.8
2026-04-13

(Based on EtherSlip 11.7 from the Crynwr packet driver collection)

Files:

  00README.TXT - This file.
  COPYING.DOC  - GNU General Public License, Version 1.
  ETHERSL.COM  - A new compiled binary (version 11.8).
  ETHERSL.TXT  - An excerpt from INSTALL.DOC for EtherSlip.
  INSTALL.DOC  - Installation doc for the Crynwr packet driver collection.
  SLIPMERG.ASM - The source code with two bug fixes.


Greetings!

This new version of EtherSlip (version 11.8) fixes two bugs in version 11.7.

Bug 1: All incoming packets have an incorrect target MAC address.

  When queried the packet driver was reporting the simulated Ethernet MAC
  address as 00:02:12:00:56:34, but when delivering packets to the user
  program it was using 00:00:C4:C3:CC:C2 as the destination in the simulated
  Ethernet header.  Code that checks the Ethernet header for a matching
  destination address would reject the packet.

  I know this broke mTCP NetDrive; I don't know how many other things were
  broken as a result.  NetDrive might be overly picky, but still, it should
  match.

  In February 2024 I patched the original EtherSlip to get around this
  problem.  This version has the bug fixed in the source code.


Bug 2: Bad pointer used to copy a MAC address in a simulated ARP response.

  This bug is a little more terrifying, as it has the ability to corrupt
  random parts of memory.  I started searching for this bug when mTCP Telnet
  started reporting "** NULL assignment detected" only while using EtherSlip.

  ARP doesn't make sense on a SLIP connection, but it still has to be
  handled because the user program thinks it is using Ethernet.  EtherSlip
  has logic in it to intercept ARP requests from the user program and
  simulate a response.

  When setting up the Ethernet header for the simulated response the code
  copies the target MAC address of the ARP request into the destination
  MAC address of the simulated ARP response.  However, it uses the
  segment of the ARP request and the offset of the simulated ARP response
  buffer as the target of the copy, which is broken if the request and
  response buffers have different segments.  This causes the six bytes
  of MAC address to be written someplace where it doesn't belong,
  possibly causing data corruption or crashes.

  (I got lucky with Telnet reporting the problem; the MAC address was
  landing in a 32 byte reserved area that the compiler uses to catch
  programs writing to a NULL pointer.  Telnet itself was fine, but the
  compiler runtime was detecting the problem.)


Source code:

  While I could have just patched the existing binary to fix both bugs, I
  decided it was time to update the source code and rebuild it from scratch.
  SLIPMERG.ASM has the two fixes in it; the rest of the source code comes
  from the Crynwr packet driver archives.

  I used TASM 4.1 to build this binary.


Credits:

  I'm just fixing 30+ year old bugs as I find them.  Credit belongs to all
  of the people who made the Crynwr packet driver specification and driver
  collection possible decades ago.

  The full collection is still available today at http://crynwr.com/.



Michael Brutman
mbbrutman@gmail.com
2026-04-13
