[src/netbsd-3-0]: src/sys/netinet6 Pull up revision 1.150 (requested by adria...

[jdc <jdc%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/dc7d79633c46
branches:  netbsd-3-0
changeset: 579506:dc7d79633c46
user:      jdc <jdc%NetBSD.org@localhost>
date:      Fri Oct 03 09:21:02 2008 +0000

description:
Pull up revision 1.150 (requested by adrianp in ticket #1966).

Fix for CVE-2008-3530 from matt@
Implement improved checking for MTU values on ICMP 'Packet Too Big Messages'

diffstat:

 sys/netinet6/icmp6.c |  21 +++++++++++++++++++--
 1 files changed, 19 insertions(+), 2 deletions(-)

diffs (49 lines):

diff -r 60153ba08ce8 -r dc7d79633c46 sys/netinet6/icmp6.c
--- a/sys/netinet6/icmp6.c      Thu Sep 18 19:31:50 2008 +0000
+++ b/sys/netinet6/icmp6.c      Fri Oct 03 09:21:02 2008 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: icmp6.c,v 1.108 2005/01/17 10:16:07 itojun Exp $       */
+/*     $NetBSD: icmp6.c,v 1.108.8.1 2008/10/03 09:21:02 jdc Exp $      */
 /*     $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.108 2005/01/17 10:16:07 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.108.8.1 2008/10/03 09:21:02 jdc Exp $");
 
 #include "opt_inet.h"
 #include "opt_ipsec.h"
@@ -515,6 +515,9 @@
        case ICMP6_PACKET_TOO_BIG:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig);
 
+               /*
+                * MTU is checked in icmp6_mtudisc.
+                */
                code = PRC_MSGSIZE;
 
                /*
@@ -1108,6 +1111,20 @@
        struct sockaddr_in6 sin6;
 
        /*
+        * The MTU should not be less than the minimal IPv6 MTU except for the
+        * hack in ip6_output/ip6_setpmtu where we always include a frag header.
+        * In that one case, the MTU might be less than 1280.  
+        */
+       if (__predict_false(mtu < IPV6_MMTU - sizeof(struct ip6_frag))) {
+               /* is the mtu even sane? */
+               if (mtu < sizeof(struct ip6_hdr) + sizeof(struct ip6_frag) + 8)
+                       return;
+               if (!validated)
+                       return;
+               mtu = IPV6_MMTU - sizeof(struct ip6_frag);
+       }
+
+       /*
         * allow non-validated cases if memory is plenty, to make traffic
         * from non-connected pcb happy.
         */