Module Name: src
Committed By: maxv
Date: Wed Apr 11 05:59:43 UTC 2018
Modified Files:
src/sys/netinet: ip_mroute.c
Log Message:
Add XXX.
To generate a diff of this commit:
cvs rdiff -u -r1.155 -r1.156 src/sys/netinet/ip_mroute.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netinet/ip_mroute.c
diff -u src/sys/netinet/ip_mroute.c:1.155 src/sys/netinet/ip_mroute.c:1.156
--- src/sys/netinet/ip_mroute.c:1.155 Wed Mar 21 14:23:54 2018
+++ src/sys/netinet/ip_mroute.c Wed Apr 11 05:59:42 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_mroute.c,v 1.155 2018/03/21 14:23:54 roy Exp $ */
+/* $NetBSD: ip_mroute.c,v 1.156 2018/04/11 05:59:42 maxv Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -93,7 +93,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.155 2018/03/21 14:23:54 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.156 2018/04/11 05:59:42 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -1279,6 +1279,12 @@ ip_mforward(struct mbuf *m, struct ifnet
log(LOG_DEBUG, "ip_mforward: src %x, dst %x, ifp %p\n",
ntohl(ip->ip_src.s_addr), ntohl(ip->ip_dst.s_addr), ifp);
+ /*
+ * XXX XXX: Why do we check [1] against IPOPT_LSRR? Because we
+ * expect [0] to be IPOPT_NOP, maybe? In all cases that doesn't
+ * make a lot of sense, a forged packet can just put two IPOPT_NOPs
+ * followed by one IPOPT_LSRR, and bypass the check.
+ */
if (ip->ip_hl < (IP_HDR_LEN + TUNNEL_LEN) >> 2 ||
((u_char *)(ip + 1))[1] != IPOPT_LSRR) {
/*
