[src/netbsd-9]: src/sys/netinet6 Pull up following revision(s) (requested by ...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/392ac9470c0f
branches:  netbsd-9
changeset: 373985:392ac9470c0f
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Mar 23 12:06:49 2023 +0000

description:
Pull up following revision(s) (requested by ozaki-r in ticket #1615):

        sys/netinet6/raw_ip6.c: revision 1.183 (via patch)
        sys/netinet6/ip6_output.c: revision 1.233

in6: reject setting negative values but -1 via setsockopt(IPV6_CHECKSUM)
Same as OpenBSD.

in6: make sure a user-specified checksum field is within a packet
>From OpenBSD

diffstat:

 sys/netinet6/ip6_output.c |  12 ++++++++----
 sys/netinet6/raw_ip6.c    |  17 +++++++++++++----
 2 files changed, 21 insertions(+), 8 deletions(-)

diffs (78 lines):

diff -r 562d6bfb4efd -r 392ac9470c0f sys/netinet6/ip6_output.c
--- a/sys/netinet6/ip6_output.c Wed Mar 15 18:44:39 2023 +0000
+++ b/sys/netinet6/ip6_output.c Thu Mar 23 12:06:49 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip6_output.c,v 1.220 2019/05/15 02:59:18 ozaki-r Exp $ */
+/*     $NetBSD: ip6_output.c,v 1.220.2.1 2023/03/23 12:06:49 martin Exp $      */
 /*     $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $    */
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.220 2019/05/15 02:59:18 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.220.2.1 2023/03/23 12:06:49 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -1957,8 +1957,12 @@ ip6_raw_ctloutput(int op, struct socket 
                        error = sockopt_getint(sopt, &optval);
                        if (error)
                                break;
-                       if ((optval % 2) != 0) {
-                               /* the API assumes even offset values */
+                       if (optval < -1 ||
+                           (optval > 0 && (optval % 2) != 0)) {
+                               /*
+                                * The API assumes non-negative even offset
+                                * values or -1 as a special value.
+                                */
                                error = EINVAL;
                        } else if (so->so_proto->pr_protocol ==
                            IPPROTO_ICMPV6) {
diff -r 562d6bfb4efd -r 392ac9470c0f sys/netinet6/raw_ip6.c
--- a/sys/netinet6/raw_ip6.c    Wed Mar 15 18:44:39 2023 +0000
+++ b/sys/netinet6/raw_ip6.c    Thu Mar 23 12:06:49 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: raw_ip6.c,v 1.175 2019/02/25 06:49:44 maxv Exp $       */
+/*     $NetBSD: raw_ip6.c,v 1.175.4.1 2023/03/23 12:06:49 martin Exp $ */
 /*     $KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $        */
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.175 2019/02/25 06:49:44 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.175.4.1 2023/03/23 12:06:49 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ipsec.h"
@@ -204,7 +204,16 @@ rip6_input(struct mbuf **mp, int *offp, 
                        continue;
                if (in6p->in6p_cksum != -1) {
                        RIP6_STATINC(RIP6_STAT_ISUM);
-                       if (in6_cksum(m, proto, *offp,
+                       /*
+                        * Although in6_cksum() does not need the position of
+                        * the checksum field for verification, enforce that it
+                        * is located within the packet.  Userland has given
+                        * a checksum offset, a packet too short for that is
+                        * invalid.  Avoid overflow with user supplied offset.
+                        */
+                       if (m->m_pkthdr.len < *offp + 2 ||
+                           m->m_pkthdr.len - *offp - 2 < in6p->in6p_cksum ||
+                           in6_cksum(m, proto, *offp,
                            m->m_pkthdr.len - *offp)) {
                                RIP6_STATINC(RIP6_STAT_BADSUM);
                                continue;
@@ -472,7 +481,7 @@ rip6_output(struct mbuf *m, struct socke
                        off = offsetof(struct icmp6_hdr, icmp6_cksum);
                else
                        off = in6p->in6p_cksum;
-               if (plen < off + 1) {
+               if (plen < 2 || plen - 2 < off) {
                        error = EINVAL;
                        goto bad;
                }