[src/trunk]: src/sys/netinet Kick fragments that would introduce several !MFF...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0b624b6a7c6f
branches:  trunk
changeset: 433501:0b624b6a7c6f
user:      maxv <maxv%NetBSD.org@localhost>
date:      Mon Sep 17 08:11:27 2018 +0000

description:
Kick fragments that would introduce several !MFFs in a reassembly chain.

The problem arises if we receive three fragments of the kind

        3.  A -> has MFF
        1.  B -> doesn't have MFF
        2.  C -> doesn't have MFF

Because of the received order B->C->A, we don't see that B is !MFF, and
therefore that there is a problem in this chain.

Now we do two checks, and drop us if:

 * there is a fragment preceding us, and this fragment is !MFF, or
 * there is a fragment following us, and we are !MFF

Spotted a long time ago.

diffstat:

 sys/netinet/ip_reass.c |  28 +++++++++++++++++++++-------
 1 files changed, 21 insertions(+), 7 deletions(-)

diffs (65 lines):

diff -r 45c5a2d359f2 -r 0b624b6a7c6f sys/netinet/ip_reass.c
--- a/sys/netinet/ip_reass.c    Mon Sep 17 06:01:36 2018 +0000
+++ b/sys/netinet/ip_reass.c    Mon Sep 17 08:11:27 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_reass.c,v 1.19 2018/09/17 06:01:36 maxv Exp $       */
+/*     $NetBSD: ip_reass.c,v 1.20 2018/09/17 08:11:27 maxv Exp $       */
 
 /*
  * Copyright (c) 1982, 1986, 1988, 1993
@@ -46,7 +46,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_reass.c,v 1.19 2018/09/17 06:01:36 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_reass.c,v 1.20 2018/09/17 08:11:27 maxv Exp $");
 
 #include <sys/param.h>
 #include <sys/types.h>
@@ -287,9 +287,13 @@
        }
 
        /*
-        * If there is a preceding segment, it may provide some of our
-        * data already.  If so, drop the data from the incoming segment.
-        * If it provides all of our data, drop us.
+        * Look at the preceding segment.
+        *
+        * If it provides some of our data already, in part or entirely, trim
+        * us or drop us.
+        *
+        * If a preceding segment exists, and was marked as the last segment,
+        * drop us.
         */
        if (p != NULL) {
                i = p->ipqe_off + p->ipqe_len - ipqe->ipqe_off;
@@ -302,10 +306,17 @@
                        ipqe->ipqe_len = ipqe->ipqe_len - i;
                }
        }
+       if (p != NULL && !p->ipqe_mff) {
+               goto dropfrag;
+       }
 
        /*
-        * While we overlap succeeding segments trim them or, if they are
-        * completely covered, dequeue them.
+        * Look at the segments that follow.
+        *
+        * If we cover them, in part or entirely, trim them or dequeue them.
+        *
+        * If a following segment exists, and we are marked as the last
+        * segment, drop us.
         */
        while (q != NULL) {
                i = ipqe->ipqe_off + ipqe->ipqe_len - q->ipqe_off;
@@ -326,6 +337,9 @@
                ip_nfrags--;
                q = nq;
        }
+       if (q != NULL && !ipqe->ipqe_mff) {
+               goto dropfrag;
+       }
 
 insert:
        /*