[src/trunk]: src/sys/netinet Fix three pretty bad mistakes in NAT-T:

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/664657dc3637
branches:  trunk
changeset: 829662:664657dc3637
user:      maxv <maxv%NetBSD.org@localhost>
date:      Thu Feb 08 06:50:38 2018 +0000

description:
Fix three pretty bad mistakes in NAT-T:

 * If we got a keepalive packet, we need to call m_freem, not m_free.
   Here the next mbufs in the chain are not freed. Seems easy to remotely
   DoS the system by sending fragmented keepalives in a loop.

 * If !ipsec_used, free the mbuf.

 * In udp_input, we need to update 'uh', because udp4_realinput may have
   modified the chain. Perhaps we also need to re-enforce alignment, so
   add an XXX.

diffstat:

 sys/netinet/udp_usrreq.c |  17 +++++++++++++----
 1 files changed, 13 insertions(+), 4 deletions(-)

diffs (53 lines):

diff -r 4f56f9965ea0 -r 664657dc3637 sys/netinet/udp_usrreq.c
--- a/sys/netinet/udp_usrreq.c  Thu Feb 08 03:27:50 2018 +0000
+++ b/sys/netinet/udp_usrreq.c  Thu Feb 08 06:50:38 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: udp_usrreq.c,v 1.236 2017/12/11 05:47:18 ryo Exp $     */
+/*     $NetBSD: udp_usrreq.c,v 1.237 2018/02/08 06:50:38 maxv Exp $    */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -66,7 +66,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.236 2017/12/11 05:47:18 ryo Exp $");
+__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.237 2018/02/08 06:50:38 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -405,7 +405,15 @@
                 */
                return;
        }
+
        ip = mtod(m, struct ip *);
+       IP6_EXTHDR_GET(uh, struct udphdr *, m, iphlen, sizeof(struct udphdr));
+       if (uh == NULL) {
+               UDP_STATINC(UDP_STAT_HDROPS);
+               return;
+       }
+       /* XXX Re-enforce alignment? */
+
 #ifdef INET6
        if (IN_MULTICAST(ip->ip_dst.s_addr) || n == 0) {
                struct sockaddr_in6 src6, dst6;
@@ -1279,7 +1287,7 @@
 
        /* Ignore keepalive packets */
        if ((len == 1) && (*(unsigned char *)data == 0xff)) {
-               m_free(m);
+               m_freem(m);
                *mp = NULL; /* avoid any further processiong by caller ... */
                return 1;
        }
@@ -1360,7 +1368,8 @@
 
        if (ipsec_used)
                ipsec4_common_input(m, iphdrlen, IPPROTO_ESP);
-       /* XXX: else */
+       else
+               m_freem(m);
 
        /* We handled it, it shouldn't be handled by UDP */
        *mp = NULL; /* avoid free by caller ... */