src: Add XXX.

[Repository Conversion <srcmastr%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4c5ab37bd21c
branches:  trunk
changeset: 318045:4c5ab37bd21c
user:      maxv <maxv%NetBSD.org@localhost>
date:      Wed Apr 11 05:59:42 2018 +0000
description:
Add XXX.

diffstat:

 sys/netinet/ip_mroute.c |  10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diffs (31 lines):

diff -r d21757ae0169 -r 4c5ab37bd21c sys/netinet/ip_mroute.c
--- a/sys/netinet/ip_mroute.c   Wed Apr 11 05:38:47 2018 +0000
+++ b/sys/netinet/ip_mroute.c   Wed Apr 11 05:59:42 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_mroute.c,v 1.155 2018/03/21 14:23:54 roy Exp $      */
+/*     $NetBSD: ip_mroute.c,v 1.156 2018/04/11 05:59:42 maxv Exp $     */
 
 /*
  * Copyright (c) 1992, 1993
@@ -93,7 +93,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.155 2018/03/21 14:23:54 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.156 2018/04/11 05:59:42 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -1279,6 +1279,12 @@
                log(LOG_DEBUG, "ip_mforward: src %x, dst %x, ifp %p\n",
                    ntohl(ip->ip_src.s_addr), ntohl(ip->ip_dst.s_addr), ifp);
 
+       /*
+        * XXX XXX: Why do we check [1] against IPOPT_LSRR? Because we
+        * expect [0] to be IPOPT_NOP, maybe? In all cases that doesn't
+        * make a lot of sense, a forged packet can just put two IPOPT_NOPs
+        * followed by one IPOPT_LSRR, and bypass the check.
+        */
        if (ip->ip_hl < (IP_HDR_LEN + TUNNEL_LEN) >> 2 ||
            ((u_char *)(ip + 1))[1] != IPOPT_LSRR) {
                /*