Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
src: Introduce a m_verify_packet function, that verifies the mbu...
details: https://anonhg.NetBSD.org/src/rev/4546fec1fd4a
branches: trunk
changeset: 318194:4546fec1fd4a
user: maxv <maxv%NetBSD.org@localhost>
date: Sun Apr 15 07:35:49 2018 +0000
description:
Introduce a m_verify_packet function, that verifies the mbuf chain of a
packet to ensure it is not malformed. Call this function in "points of
interest", that are the IPv4/IPv6/IPsec entry points. There could be more.
We use M_VERIFY_PACKET(m), declared under DIAGNOSTIC only.
This function should not be called everywhere, especially not in places
that temporarily manipulate (and clobber) the mbuf structure; once they're
done they put the mbuf back in a correct format.
diffstat:
sys/kern/uipc_mbuf.c | 65 ++++++++++++++++++++++++++++++++++++++++++++-
sys/netinet/ip_input.c | 6 ++-
sys/netinet6/ip6_input.c | 6 ++-
sys/netipsec/ipsec_input.c | 8 ++++-
sys/sys/mbuf.h | 9 +++++-
5 files changed, 85 insertions(+), 9 deletions(-)
diffs (206 lines):
diff -r 53a16b6fda23 -r 4546fec1fd4a sys/kern/uipc_mbuf.c
--- a/sys/kern/uipc_mbuf.c Sun Apr 15 03:25:25 2018 +0000
+++ b/sys/kern/uipc_mbuf.c Sun Apr 15 07:35:49 2018 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: uipc_mbuf.c,v 1.187 2018/04/10 16:12:30 maxv Exp $ */
+/* $NetBSD: uipc_mbuf.c,v 1.188 2018/04/15 07:35:49 maxv Exp $ */
/*
* Copyright (c) 1999, 2001 The NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_mbuf.c,v 1.187 2018/04/10 16:12:30 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_mbuf.c,v 1.188 2018/04/15 07:35:49 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_mbuftrace.h"
@@ -1888,6 +1888,67 @@
}
#endif /* defined(MBUFTRACE) */
+#ifdef DIAGNOSTIC
+/*
+ * Verify that the mbuf chain is not malformed. Used only for diagnostic.
+ * Panics on error.
+ */
+void
+m_verify_packet(struct mbuf *m)
+{
+ struct mbuf *n = m;
+ char *low, *high, *dat;
+ int totlen = 0, len;
+
+ if (__predict_false((m->m_flags & M_PKTHDR) == 0)) {
+ panic("%s: mbuf doesn't have M_PKTHDR", __func__);
+ }
+
+ while (n != NULL) {
+ if (__predict_false(n->m_type == MT_FREE)) {
+ panic("%s: mbuf already freed (n = %p)", __func__, n);
+ }
+ if (__predict_false((n != m) && (n->m_flags & M_PKTHDR) != 0)) {
+ panic("%s: M_PKTHDR set on secondary mbuf", __func__);
+ }
+ if (__predict_false(n->m_nextpkt != NULL)) {
+ panic("%s: m_nextpkt not null (m_nextpkt = %p)",
+ __func__, n->m_nextpkt);
+ }
+
+ dat = n->m_data;
+ len = n->m_len;
+
+ if (n->m_flags & M_EXT) {
+ low = n->m_ext.ext_buf;
+ high = low + n->m_ext.ext_size;
+ } else if (n->m_flags & M_PKTHDR) {
+ low = n->m_pktdat;
+ high = low + MHLEN;
+ } else {
+ low = n->m_dat;
+ high = low + MLEN;
+ }
+ if (__predict_false(dat + len <= dat)) {
+ panic("%s: incorrect length (len = %d)", __func__, len);
+ }
+ if (__predict_false((dat < low) || (dat + len > high))) {
+ panic("%s: m_data not in packet"
+ "(dat = %p, len = %d, low = %p, high = %p)",
+ __func__, dat, len, low, high);
+ }
+
+ totlen += len;
+ n = n->m_next;
+ }
+
+ if (__predict_false(totlen != m->m_pkthdr.len)) {
+ panic("%s: inconsistent mbuf length (%d != %d)", __func__,
+ totlen, m->m_pkthdr.len);
+ }
+}
+#endif
+
/*
* Release a reference to the mbuf external storage.
*
diff -r 53a16b6fda23 -r 4546fec1fd4a sys/netinet/ip_input.c
--- a/sys/netinet/ip_input.c Sun Apr 15 03:25:25 2018 +0000
+++ b/sys/netinet/ip_input.c Sun Apr 15 07:35:49 2018 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_input.c,v 1.379 2018/04/11 08:11:20 maxv Exp $ */
+/* $NetBSD: ip_input.c,v 1.380 2018/04/15 07:35:49 maxv Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.379 2018/04/11 08:11:20 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.380 2018/04/15 07:35:49 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -766,6 +766,8 @@
hlen = ip->ip_hl << 2;
}
+ M_VERIFY_PACKET(m);
+
#ifdef IPSEC
/*
* Enforce IPsec policy checking if we are seeing last header.
diff -r 53a16b6fda23 -r 4546fec1fd4a sys/netinet6/ip6_input.c
--- a/sys/netinet6/ip6_input.c Sun Apr 15 03:25:25 2018 +0000
+++ b/sys/netinet6/ip6_input.c Sun Apr 15 07:35:49 2018 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: ip6_input.c,v 1.196 2018/04/11 07:55:19 maxv Exp $ */
+/* $NetBSD: ip6_input.c,v 1.197 2018/04/15 07:35:49 maxv Exp $ */
/* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */
/*
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.196 2018/04/11 07:55:19 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.197 2018/04/15 07:35:49 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_gateway.h"
@@ -748,6 +748,8 @@
goto bad;
}
+ M_VERIFY_PACKET(m);
+
/*
* protection against faulty packet - there should be
* more sanity checks in header chain processing.
diff -r 53a16b6fda23 -r 4546fec1fd4a sys/netipsec/ipsec_input.c
--- a/sys/netipsec/ipsec_input.c Sun Apr 15 03:25:25 2018 +0000
+++ b/sys/netipsec/ipsec_input.c Sun Apr 15 07:35:49 2018 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: ipsec_input.c,v 1.62 2018/02/26 09:04:29 maxv Exp $ */
+/* $NetBSD: ipsec_input.c,v 1.63 2018/04/15 07:35:49 maxv Exp $ */
/* $FreeBSD: src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $ */
/* $OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $ */
@@ -39,7 +39,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.62 2018/02/26 09:04:29 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.63 2018/04/15 07:35:49 maxv Exp $");
/*
* IPsec input processing.
@@ -456,6 +456,8 @@
#endif /* INET6 */
#endif /* notyet */
+ M_VERIFY_PACKET(m);
+
key_sa_recordxfer(sav, m); /* record data transfer */
if ((inetsw[ip_protox[prot]].pr_flags & PR_LASTHDR) != 0 &&
@@ -667,6 +669,8 @@
goto bad;
}
+ M_VERIFY_PACKET(m);
+
/*
* Protection against faulty packet - there should be
* more sanity checks in header chain processing.
diff -r 53a16b6fda23 -r 4546fec1fd4a sys/sys/mbuf.h
--- a/sys/sys/mbuf.h Sun Apr 15 03:25:25 2018 +0000
+++ b/sys/sys/mbuf.h Sun Apr 15 07:35:49 2018 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: mbuf.h,v 1.185 2018/04/13 08:44:41 maxv Exp $ */
+/* $NetBSD: mbuf.h,v 1.186 2018/04/15 07:35:49 maxv Exp $ */
/*
* Copyright (c) 1996, 1997, 1999, 2001, 2007 The NetBSD Foundation, Inc.
@@ -704,6 +704,12 @@
(m)->m_type = t; \
} while (/* CONSTCOND */ 0)
+#ifdef DIAGNOSTIC
+#define M_VERIFY_PACKET(m) m_verify_packet(m)
+#else
+#define M_VERIFY_PACKET(m) /* nothing */
+#endif
+
/* length to m_copy to copy all */
#define M_COPYALL -1
@@ -864,6 +870,7 @@
int m_makewritable(struct mbuf **, int, int, int);
struct mbuf *m_getcl(int, int, int);
void m_copydata(struct mbuf *, int, int, void *);
+void m_verify_packet(struct mbuf *);
struct mbuf *m_free(struct mbuf *);
void m_freem(struct mbuf *);
void m_reclaim(void *, int);
Home |
Main Index |
Thread Index |
Old Index