Module Name:    src
Committed By:   snj
Date:           Mon Feb 26 00:29:27 UTC 2018

Modified Files:
        src/sys/netinet6 [netbsd-8]: route6.c

Log Message:
Pull up following revision(s) (requested by maxv in ticket #569):
        sys/netinet6/route6.c: 1.24-1.25
Fix the ICMP error code. rh was obtained via IP6_EXTHDR_GET, and it is not
guaranteed to be in the same mbuf as ip6, so computing the difference
between the pointers may result in a wrong offset.
ip6 is now unused, so remove it.
--
Remove this code, RH0 must be dropped, according to RFC5095. FreeBSD and
OpenBSD already do the same. Also, style, and remove useless includes.


To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.23.84.1 src/sys/netinet6/route6.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/netinet6/route6.c
diff -u src/sys/netinet6/route6.c:1.23 src/sys/netinet6/route6.c:1.23.84.1
--- src/sys/netinet6/route6.c:1.23	Tue Apr 15 03:57:04 2008
+++ src/sys/netinet6/route6.c	Mon Feb 26 00:29:27 2018
@@ -1,4 +1,4 @@
-/*	$NetBSD: route6.c,v 1.23 2008/04/15 03:57:04 thorpej Exp $	*/
+/*	$NetBSD: route6.c,v 1.23.84.1 2018/02/26 00:29:27 snj Exp $	*/
 /*	$KAME: route6.c,v 1.22 2000/12/03 00:54:00 itojun Exp $	*/
 
 /*
@@ -31,13 +31,11 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: route6.c,v 1.23 2008/04/15 03:57:04 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: route6.c,v 1.23.84.1 2018/02/26 00:29:27 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/mbuf.h>
-#include <sys/socket.h>
 #include <sys/systm.h>
-#include <sys/queue.h>
 
 #include <net/if.h>
 
@@ -46,23 +44,16 @@ __KERNEL_RCSID(0, "$NetBSD: route6.c,v 1
 #include <netinet/ip6.h>
 #include <netinet6/ip6_var.h>
 #include <netinet6/ip6_private.h>
-#include <netinet6/scope6_var.h>
 
 #include <netinet/icmp6.h>
 
-#if 0
-static int ip6_rthdr0(struct mbuf *, struct ip6_hdr *, struct ip6_rthdr0 *);
-#endif
-
 int
 route6_input(struct mbuf **mp, int *offp, int proto)
 {
-	struct ip6_hdr *ip6;
 	struct mbuf *m = *mp;
 	struct ip6_rthdr *rh;
 	int off = *offp, rhlen;
 
-	ip6 = mtod(m, struct ip6_hdr *);
 	IP6_EXTHDR_GET(rh, struct ip6_rthdr *, m, off, sizeof(*rh));
 	if (rh == NULL) {
 		IP6_STATINC(IP6_STAT_TOOSHORT);
@@ -70,41 +61,10 @@ route6_input(struct mbuf **mp, int *offp
 	}
 
 	switch (rh->ip6r_type) {
-#if 0
-	/*
-	 * See http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
-	 * for why IPV6_RTHDR_TYPE_0 is banned here.
-	 *
-	 * We return ICMPv6 parameter problem so that innocent people
-	 * (not an attacker) would notice about the use of IPV6_RTHDR_TYPE_0.
-	 * Since there's no amplification, and ICMPv6 error will be rate-
-	 * controlled, it shouldn't cause any problem.
-	 * If you are concerned about this, you may want to use the following
-	 * code fragment:
-	 *
-	 * case IPV6_RTHDR_TYPE_0:
-	 *	m_freem(m);
-	 *	return (IPPROTO_DONE);
-	 */
 	case IPV6_RTHDR_TYPE_0:
-		rhlen = (rh->ip6r_len + 1) << 3;
 		/*
-		 * note on option length:
-		 * maximum rhlen: 2048
-		 * max mbuf m_pulldown can handle: MCLBYTES == usually 2048
-		 * so, here we are assuming that m_pulldown can handle
-		 * rhlen == 2048 case.  this may not be a good thing to
-		 * assume - we may want to avoid pulling it up altogether.
+		 * RFC5095: RH0 must be treated as unrecognized.
 		 */
-		IP6_EXTHDR_GET(rh, struct ip6_rthdr *, m, off, rhlen);
-		if (rh == NULL) {
-			IP6_STATINC(IP6_STAT_TOOSHORT);
-			return IPPROTO_DONE;
-		}
-		if (ip6_rthdr0(m, ip6, (struct ip6_rthdr0 *)rh))
-			return (IPPROTO_DONE);
-		break;
-#endif
 	default:
 		/* unknown routing type */
 		if (rh->ip6r_segleft == 0) {
@@ -113,112 +73,10 @@ route6_input(struct mbuf **mp, int *offp
 		}
 		IP6_STATINC(IP6_STAT_BADOPTIONS);
 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
-			    (char *)&rh->ip6r_type - (char *)ip6);
-		return (IPPROTO_DONE);
+		    off + offsetof(struct ip6_rthdr, ip6r_type));
+		return IPPROTO_DONE;
 	}
 
 	*offp += rhlen;
-	return (rh->ip6r_nxt);
-}
-
-#if 0
-/*
- * Type0 routing header processing
- *
- * RFC2292 backward compatibility warning: no support for strict/loose bitmap,
- * as it was dropped between RFC1883 and RFC2460.
- */
-static int
-ip6_rthdr0(struct mbuf *m, struct ip6_hdr *ip6, 
-	struct ip6_rthdr0 *rh0)
-{
-	int addrs, index;
-	struct in6_addr *nextaddr, tmpaddr;
-	const struct ip6aux *ip6a;
-
-	if (rh0->ip6r0_segleft == 0)
-		return (0);
-
-	if (rh0->ip6r0_len % 2
-#ifdef COMPAT_RFC1883
-	    || rh0->ip6r0_len > 46
-#endif
-		) {
-		/*
-		 * Type 0 routing header can't contain more than 23 addresses.
-		 * RFC 2462: this limitation was removed since strict/loose
-		 * bitmap field was deleted.
-		 */
-		IP6_STATINC(IP6_STAT_BADOPTIONS);
-		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
-			    (char *)&rh0->ip6r0_len - (char *)ip6);
-		return (-1);
-	}
-
-	if ((addrs = rh0->ip6r0_len / 2) < rh0->ip6r0_segleft) {
-		IP6_STATINC(IP6_STAT_BADOPTIONS);
-		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
-			    (char *)&rh0->ip6r0_segleft - (char *)ip6);
-		return (-1);
-	}
-
-	index = addrs - rh0->ip6r0_segleft;
-	rh0->ip6r0_segleft--;
-	nextaddr = ((struct in6_addr *)(rh0 + 1)) + index;
-
-	/*
-	 * reject invalid addresses.  be proactive about malicious use of
-	 * IPv4 mapped/compat address.
-	 * XXX need more checks?
-	 */
-	if (IN6_IS_ADDR_MULTICAST(nextaddr) ||
-	    IN6_IS_ADDR_UNSPECIFIED(nextaddr) ||
-	    IN6_IS_ADDR_V4MAPPED(nextaddr) ||
-	    IN6_IS_ADDR_V4COMPAT(nextaddr)) {
-		p6stat[IP6_STAT_BADOPTIONS]++;
-		goto bad;
-	}
-	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
-	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) ||
-	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst) ||
-	    IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
-		IP6_STATINC(IP6_STAT_BADOPTIONS);
-		goto bad;
-	}
-
-	/*
-	 * Determine the scope zone of the next hop, based on the interface
-	 * of the current hop. [RFC4007, Section 9]
-	 * Then disambiguate the scope zone for the next hop (if necessary). 
-	 */
-	if ((ip6a = ip6_getdstifaddr(m)) == NULL)
-		goto bad;
-	if (in6_setzoneid(nextaddr, ip6a->ip6a_scope_id) != 0) {
-		IP6_STATINC(IP6_STAT_BADSCOPE);
-		goto bad;
-	}
-
-	/*
-	 * Swap the IPv6 destination address and nextaddr. Forward the packet.
-	 */
-	tmpaddr = *nextaddr;
-	*nextaddr = ip6->ip6_dst;
-	in6_clearscope(nextaddr); /* XXX */
-	ip6->ip6_dst = tmpaddr;
-
-#ifdef COMPAT_RFC1883
-	if (rh0->ip6r0_slmap[index / 8] & (1 << (7 - (index % 8))))
-		ip6_forward(m, IPV6_SRCRT_NEIGHBOR);
-	else
-		ip6_forward(m, IPV6_SRCRT_NOTNEIGHBOR);
-#else
-	ip6_forward(m, 1);
-#endif
-
-	return (-1);			/* m would be freed in ip6_forward() */
-
-  bad:
-	m_freem(m);
-	return (-1);
+	return rh->ip6r_nxt;
 }
-#endif

Reply via email to