[src/netbsd-8]: src/sys/netinet Pull up following revision(s) (requested by m...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/486032b9f152
branches:  netbsd-8
changeset: 319697:486032b9f152
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Jun 07 16:05:09 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #837):

        sys/netinet/udp_usrreq.c: revision 1.237

Fix three pretty bad mistakes in NAT-T:

 * If we got a keepalive packet, we need to call m_freem, not m_free.
   Here the next mbufs in the chain are not freed. Seems easy to remotely
   DoS the system by sending fragmented keepalives in a loop.

 * If !ipsec_used, free the mbuf.

 * In udp_input, we need to update 'uh', because udp4_realinput may have
   modified the chain. Perhaps we also need to re-enforce alignment, so
   add an XXX.

diffstat:

 sys/netinet/udp_usrreq.c |  17 +++++++++++++----
 1 files changed, 13 insertions(+), 4 deletions(-)

diffs (53 lines):

diff -r eca0e9c4b4bf -r 486032b9f152 sys/netinet/udp_usrreq.c
--- a/sys/netinet/udp_usrreq.c  Thu Jun 07 16:02:16 2018 +0000
+++ b/sys/netinet/udp_usrreq.c  Thu Jun 07 16:05:09 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: udp_usrreq.c,v 1.233.4.2 2018/04/09 13:34:10 bouyer Exp $      */
+/*     $NetBSD: udp_usrreq.c,v 1.233.4.3 2018/06/07 16:05:09 martin Exp $      */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -66,7 +66,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.233.4.2 2018/04/09 13:34:10 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.233.4.3 2018/06/07 16:05:09 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -410,7 +410,15 @@
                 */
                return;
        }
+
        ip = mtod(m, struct ip *);
+       IP6_EXTHDR_GET(uh, struct udphdr *, m, iphlen, sizeof(struct udphdr));
+       if (uh == NULL) {
+               UDP_STATINC(UDP_STAT_HDROPS);
+               return;
+       }
+       /* XXX Re-enforce alignment? */
+
 #ifdef INET6
        if (IN_MULTICAST(ip->ip_dst.s_addr) || n == 0) {
                struct sockaddr_in6 src6, dst6;
@@ -1287,7 +1295,7 @@
 
        /* Ignore keepalive packets */
        if ((len == 1) && (*(unsigned char *)data == 0xff)) {
-               m_free(m);
+               m_freem(m);
                *mp = NULL; /* avoid any further processiong by caller ... */
                return 1;
        }
@@ -1368,7 +1376,8 @@
 
        if (ipsec_used)
                ipsec4_common_input(m, iphdrlen, IPPROTO_ESP);
-       /* XXX: else */
+       else
+               m_freem(m);
 
        /* We handled it, it shouldn't be handled by UDP */
        *mp = NULL; /* avoid free by caller ... */