Module Name: src
Committed By: martin
Date: Thu Mar 23 12:06:49 UTC 2023
Modified Files:
src/sys/netinet6 [netbsd-9]: ip6_output.c raw_ip6.c
Log Message:
Pull up following revision(s) (requested by ozaki-r in ticket #1615):
sys/netinet6/raw_ip6.c: revision 1.183 (via patch)
sys/netinet6/ip6_output.c: revision 1.233
in6: reject setting negative values but -1 via setsockopt(IPV6_CHECKSUM)
Same as OpenBSD.
in6: make sure a user-specified checksum field is within a packet
>From OpenBSD
To generate a diff of this commit:
cvs rdiff -u -r1.220 -r1.220.2.1 src/sys/netinet6/ip6_output.c
cvs rdiff -u -r1.175 -r1.175.4.1 src/sys/netinet6/raw_ip6.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netinet6/ip6_output.c
diff -u src/sys/netinet6/ip6_output.c:1.220 src/sys/netinet6/ip6_output.c:1.220.2.1
--- src/sys/netinet6/ip6_output.c:1.220 Wed May 15 02:59:18 2019
+++ src/sys/netinet6/ip6_output.c Thu Mar 23 12:06:49 2023
@@ -1,4 +1,4 @@
-/* $NetBSD: ip6_output.c,v 1.220 2019/05/15 02:59:18 ozaki-r Exp $ */
+/* $NetBSD: ip6_output.c,v 1.220.2.1 2023/03/23 12:06:49 martin Exp $ */
/* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */
/*
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.220 2019/05/15 02:59:18 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.220.2.1 2023/03/23 12:06:49 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -1957,8 +1957,12 @@ ip6_raw_ctloutput(int op, struct socket
error = sockopt_getint(sopt, &optval);
if (error)
break;
- if ((optval % 2) != 0) {
- /* the API assumes even offset values */
+ if (optval < -1 ||
+ (optval > 0 && (optval % 2) != 0)) {
+ /*
+ * The API assumes non-negative even offset
+ * values or -1 as a special value.
+ */
error = EINVAL;
} else if (so->so_proto->pr_protocol ==
IPPROTO_ICMPV6) {
Index: src/sys/netinet6/raw_ip6.c
diff -u src/sys/netinet6/raw_ip6.c:1.175 src/sys/netinet6/raw_ip6.c:1.175.4.1
--- src/sys/netinet6/raw_ip6.c:1.175 Mon Feb 25 06:49:44 2019
+++ src/sys/netinet6/raw_ip6.c Thu Mar 23 12:06:49 2023
@@ -1,4 +1,4 @@
-/* $NetBSD: raw_ip6.c,v 1.175 2019/02/25 06:49:44 maxv Exp $ */
+/* $NetBSD: raw_ip6.c,v 1.175.4.1 2023/03/23 12:06:49 martin Exp $ */
/* $KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $ */
/*
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.175 2019/02/25 06:49:44 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.175.4.1 2023/03/23 12:06:49 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_ipsec.h"
@@ -204,7 +204,16 @@ rip6_input(struct mbuf **mp, int *offp,
continue;
if (in6p->in6p_cksum != -1) {
RIP6_STATINC(RIP6_STAT_ISUM);
- if (in6_cksum(m, proto, *offp,
+ /*
+ * Although in6_cksum() does not need the position of
+ * the checksum field for verification, enforce that it
+ * is located within the packet. Userland has given
+ * a checksum offset, a packet too short for that is
+ * invalid. Avoid overflow with user supplied offset.
+ */
+ if (m->m_pkthdr.len < *offp + 2 ||
+ m->m_pkthdr.len - *offp - 2 < in6p->in6p_cksum ||
+ in6_cksum(m, proto, *offp,
m->m_pkthdr.len - *offp)) {
RIP6_STATINC(RIP6_STAT_BADSUM);
continue;
@@ -472,7 +481,7 @@ rip6_output(struct mbuf *m, struct socke
off = offsetof(struct icmp6_hdr, icmp6_cksum);
else
off = in6p->in6p_cksum;
- if (plen < off + 1) {
+ if (plen < 2 || plen - 2 < off) {
error = EINVAL;
goto bad;
}
