[src/netbsd-7-0]: src/sys/netinet Pull up following revision(s) (requested by...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4b4dd12bc7f7
branches:  netbsd-7-0
changeset: 801431:4b4dd12bc7f7
user:      martin <martin%NetBSD.org@localhost>
date:      Fri Feb 09 14:06:25 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #1563):
        sys/netinet/ip_input.c: revision 1.366 (via patch)

Disable ip_allowsrcrt and ip_forwsrcrt. Enabling them by default was a
completely dumb idea, because they have security implications.

By sending an IPv4 packet containing an LSRR option, an attacker will
cause the system to forward the packet to another IPv4 address - and
this way he white-washes the source of the packet.

It is also possible for an attacker to reach hidden networks: if a server
has a public address, and a private one on an internal network (network
which has several internal machines connected), the attacker can send a
packet with:
        source = 0.0.0.0
        destination = public address of the server
        LSRR first address = address of a machine on the internal network
And the packet will be forwarded, by the server, to the internal machine,
in some cases even with the internal IP address of the server as a source.

diffstat:

 sys/netinet/ip_input.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (31 lines):

diff -r e8e58b52e9a4 -r 4b4dd12bc7f7 sys/netinet/ip_input.c
--- a/sys/netinet/ip_input.c    Fri Feb 02 13:07:09 2018 +0000
+++ b/sys/netinet/ip_input.c    Fri Feb 09 14:06:25 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_input.c,v 1.319 2014/06/16 00:33:39 ozaki-r Exp $   */
+/*     $NetBSD: ip_input.c,v 1.319.6.1 2018/02/09 14:06:25 martin Exp $        */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.319 2014/06/16 00:33:39 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.319.6.1 2018/02/09 14:06:25 martin Exp $");
 
 #include "opt_inet.h"
 #include "opt_compat_netbsd.h"
@@ -157,10 +157,10 @@
 #define        IPSENDREDIRECTS 1
 #endif
 #ifndef IPFORWSRCRT
-#define        IPFORWSRCRT     1       /* forward source-routed packets */
+#define        IPFORWSRCRT     0       /* forward source-routed packets */
 #endif
 #ifndef IPALLOWSRCRT
-#define        IPALLOWSRCRT    1       /* allow source-routed packets */
+#define        IPALLOWSRCRT    0       /* allow source-routed packets */
 #endif
 #ifndef IPMTUDISC
 #define IPMTUDISC      1