[src/netbsd-7-0]: src/sys/netinet Pull up following revision(s) (requested by...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/da68fac0dde1
branches:  netbsd-7-0
changeset: 319682:da68fac0dde1
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Jun 07 05:03:26 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #1607):

        sys/netinet/udp_usrreq.c: revision 1.237 (via patch)

Fix three pretty bad mistakes in NAT-T:

 * If we got a keepalive packet, we need to call m_freem, not m_free.
   Here the next mbufs in the chain are not freed. Seems easy to remotely
   DoS the system by sending fragmented keepalives in a loop.

 * If !ipsec_used, free the mbuf.

 * In udp_input, we need to update 'uh', because udp4_realinput may have
   modified the chain. Perhaps we also need to re-enforce alignment, so
   add an XXX.

diffstat:

 sys/netinet/udp_usrreq.c |  17 +++++++++++++----
 1 files changed, 13 insertions(+), 4 deletions(-)

diffs (53 lines):

diff -r ce4fc3b01789 -r da68fac0dde1 sys/netinet/udp_usrreq.c
--- a/sys/netinet/udp_usrreq.c  Wed Jun 06 14:51:16 2018 +0000
+++ b/sys/netinet/udp_usrreq.c  Thu Jun 07 05:03:26 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: udp_usrreq.c,v 1.217 2014/08/09 05:33:01 rtr Exp $     */
+/*     $NetBSD: udp_usrreq.c,v 1.217.6.1 2018/06/07 05:03:26 martin Exp $      */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -66,7 +66,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.217 2014/08/09 05:33:01 rtr Exp $");
+__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.217.6.1 2018/06/07 05:03:26 martin Exp $");
 
 #include "opt_inet.h"
 #include "opt_compat_netbsd.h"
@@ -395,7 +395,15 @@
                 */
                return;
        }
+
        ip = mtod(m, struct ip *);
+       IP6_EXTHDR_GET(uh, struct udphdr *, m, iphlen, sizeof(struct udphdr));
+       if (uh == NULL) {
+               UDP_STATINC(UDP_STAT_HDROPS);
+               return;
+       }
+       /* XXX Re-enforce alignment? */
+
 #ifdef INET6
        if (IN_MULTICAST(ip->ip_dst.s_addr) || n == 0) {
                struct sockaddr_in6 src6, dst6;
@@ -1301,7 +1309,7 @@
 
        /* Ignore keepalive packets */
        if ((len == 1) && (*(unsigned char *)data == 0xff)) {
-               m_free(m);
+               m_freem(m);
                *mp = NULL; /* avoid any further processiong by caller ... */
                return 1;
        }
@@ -1383,7 +1391,8 @@
 #ifdef IPSEC
        if (ipsec_used)
                ipsec4_common_input(m, iphdrlen, IPPROTO_ESP);
-       /* XXX: else */
+       else
+               m_freem(m);
 #else
        esp4_input(m, iphdrlen);
 #endif