[src/netbsd-7-0]: src/sys/netipsec Pull up following revision(s) (requested b...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/630e608f7236
branches:  netbsd-7-0
changeset: 801454:630e608f7236
user:      snj <snj%NetBSD.org@localhost>
date:      Sat Mar 03 20:24:53 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #1577):
        sys/netipsec/ipsec_input.c: 1.57 1.58
        sys/netipsec/ipsec_input.c: 1.57
Extend these #ifdef notyet. The m_copydata's in these branches are wrong,
we are not guaranteed to have enough room for another struct ip, and we
may crash here. Triggerable remotely, but after authentication, by sending
an AH packet that has a one-byte-sized IPIP payload.
Argh, in my previous commit in this file I forgot to fix the IPv6
entry point; apply the same fix there.

diffstat:

 sys/netipsec/ipsec_input.c |  21 ++++++++++-----------
 1 files changed, 10 insertions(+), 11 deletions(-)

diffs (113 lines):

diff -r 69fdb0469926 -r 630e608f7236 sys/netipsec/ipsec_input.c
--- a/sys/netipsec/ipsec_input.c        Sun Feb 25 23:35:25 2018 +0000
+++ b/sys/netipsec/ipsec_input.c        Sat Mar 03 20:24:53 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ipsec_input.c,v 1.32 2014/03/08 12:18:04 ozaki-r Exp $ */
+/*     $NetBSD: ipsec_input.c,v 1.32.8.1 2018/03/03 20:24:53 snj Exp $ */
 /*     $FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $ */
 /*     $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $        */
 
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.32 2014/03/08 12:18:04 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.32.8.1 2018/03/03 20:24:53 snj Exp $");
 
 /*
  * IPsec input processing.
@@ -324,14 +324,15 @@
        ip->ip_len = htons(m->m_pkthdr.len);
        prot = ip->ip_p;
 
+#ifdef notyet
        /* IP-in-IP encapsulation */
        if (prot == IPPROTO_IPIP) {
                struct ip ipn;
 
                /* ipn will now contain the inner IPv4 header */
+               /* XXX: check m_pkthdr.len */
                m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), &ipn);
 
-#ifdef notyet
                /* XXX PROXY address isn't recorded in SAH */
                /*
                 * Check that the inner source address is the same as
@@ -359,7 +360,6 @@
                        error = EACCES;
                        goto bad;
                }
-#endif /*XXX*/
        }
 #if INET6
        /* IPv6-in-IP encapsulation. */
@@ -367,9 +367,9 @@
                struct ip6_hdr ip6n;
 
                /* ip6n will now contain the inner IPv6 header. */
+               /* XXX: check m_pkthdr.len */
                m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), &ip6n);
 
-#ifdef notyet
                /*
                 * Check that the inner source address is the same as
                 * the proxy address, if available.
@@ -395,9 +395,9 @@
                        error = EACCES;
                        goto bad;
                }
-#endif /*XXX*/
        }
 #endif /* INET6 */
+#endif /* notyet */
 
        /*
         * Record what we've done to the packet (under what SA it was
@@ -643,15 +643,16 @@
        /* Save protocol */
        m_copydata(m, protoff, 1, &prot);
 
+#ifdef notyet
 #ifdef INET
        /* IP-in-IP encapsulation */
        if (prot == IPPROTO_IPIP) {
                struct ip ipn;
 
                /* ipn will now contain the inner IPv4 header */
+               /* XXX: check m_pkthdr.len */
                m_copydata(m, skip, sizeof(struct ip), &ipn);
 
-#ifdef notyet
                /*
                 * Check that the inner source address is the same as
                 * the proxy address, if available.
@@ -675,18 +676,16 @@
                        error = EACCES;
                        goto bad;
                }
-#endif /*XXX*/
        }
 #endif /* INET */
-
        /* IPv6-in-IP encapsulation */
        if (prot == IPPROTO_IPV6) {
                struct ip6_hdr ip6n;
 
                /* ip6n will now contain the inner IPv6 header. */
+               /* XXX: check m_pkthdr.len */
                m_copydata(m, skip, sizeof(struct ip6_hdr), &ip6n);
 
-#ifdef notyet
                /*
                 * Check that the inner source address is the same as
                 * the proxy address, if available.
@@ -711,8 +710,8 @@
                        error = EACCES;
                        goto bad;
                }
-#endif /*XXX*/
        }
+#endif /* notyet */
 
        /*
         * Record what we've done to the packet (under what SA it was