Module Name: src Committed By: snj Date: Mon Feb 26 00:29:27 UTC 2018
Modified Files: src/sys/netinet6 [netbsd-8]: route6.c Log Message: Pull up following revision(s) (requested by maxv in ticket #569): sys/netinet6/route6.c: 1.24-1.25 Fix the ICMP error code. rh was obtained via IP6_EXTHDR_GET, and it is not guaranteed to be in the same mbuf as ip6, so computing the difference between the pointers may result in a wrong offset. ip6 is now unused, so remove it. -- Remove this code, RH0 must be dropped, according to RFC5095. FreeBSD and OpenBSD already do the same. Also, style, and remove useless includes. To generate a diff of this commit: cvs rdiff -u -r1.23 -r1.23.84.1 src/sys/netinet6/route6.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/netinet6/route6.c diff -u src/sys/netinet6/route6.c:1.23 src/sys/netinet6/route6.c:1.23.84.1 --- src/sys/netinet6/route6.c:1.23 Tue Apr 15 03:57:04 2008 +++ src/sys/netinet6/route6.c Mon Feb 26 00:29:27 2018 @@ -1,4 +1,4 @@ -/* $NetBSD: route6.c,v 1.23 2008/04/15 03:57:04 thorpej Exp $ */ +/* $NetBSD: route6.c,v 1.23.84.1 2018/02/26 00:29:27 snj Exp $ */ /* $KAME: route6.c,v 1.22 2000/12/03 00:54:00 itojun Exp $ */ /* @@ -31,13 +31,11 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: route6.c,v 1.23 2008/04/15 03:57:04 thorpej Exp $"); +__KERNEL_RCSID(0, "$NetBSD: route6.c,v 1.23.84.1 2018/02/26 00:29:27 snj Exp $"); #include <sys/param.h> #include <sys/mbuf.h> -#include <sys/socket.h> #include <sys/systm.h> -#include <sys/queue.h> #include <net/if.h> @@ -46,23 +44,16 @@ __KERNEL_RCSID(0, "$NetBSD: route6.c,v 1 #include <netinet/ip6.h> #include <netinet6/ip6_var.h> #include <netinet6/ip6_private.h> -#include <netinet6/scope6_var.h> #include <netinet/icmp6.h> -#if 0 -static int ip6_rthdr0(struct mbuf *, struct ip6_hdr *, struct ip6_rthdr0 *); -#endif - int route6_input(struct mbuf **mp, int *offp, int proto) { - struct ip6_hdr *ip6; struct mbuf *m = *mp; struct ip6_rthdr *rh; int off = *offp, rhlen; - ip6 = mtod(m, struct ip6_hdr *); IP6_EXTHDR_GET(rh, struct ip6_rthdr *, m, off, sizeof(*rh)); if (rh == NULL) { IP6_STATINC(IP6_STAT_TOOSHORT); @@ -70,41 +61,10 @@ route6_input(struct mbuf **mp, int *offp } switch (rh->ip6r_type) { -#if 0 - /* - * See http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf - * for why IPV6_RTHDR_TYPE_0 is banned here. - * - * We return ICMPv6 parameter problem so that innocent people - * (not an attacker) would notice about the use of IPV6_RTHDR_TYPE_0. - * Since there's no amplification, and ICMPv6 error will be rate- - * controlled, it shouldn't cause any problem. - * If you are concerned about this, you may want to use the following - * code fragment: - * - * case IPV6_RTHDR_TYPE_0: - * m_freem(m); - * return (IPPROTO_DONE); - */ case IPV6_RTHDR_TYPE_0: - rhlen = (rh->ip6r_len + 1) << 3; /* - * note on option length: - * maximum rhlen: 2048 - * max mbuf m_pulldown can handle: MCLBYTES == usually 2048 - * so, here we are assuming that m_pulldown can handle - * rhlen == 2048 case. this may not be a good thing to - * assume - we may want to avoid pulling it up altogether. + * RFC5095: RH0 must be treated as unrecognized. */ - IP6_EXTHDR_GET(rh, struct ip6_rthdr *, m, off, rhlen); - if (rh == NULL) { - IP6_STATINC(IP6_STAT_TOOSHORT); - return IPPROTO_DONE; - } - if (ip6_rthdr0(m, ip6, (struct ip6_rthdr0 *)rh)) - return (IPPROTO_DONE); - break; -#endif default: /* unknown routing type */ if (rh->ip6r_segleft == 0) { @@ -113,112 +73,10 @@ route6_input(struct mbuf **mp, int *offp } IP6_STATINC(IP6_STAT_BADOPTIONS); icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, - (char *)&rh->ip6r_type - (char *)ip6); - return (IPPROTO_DONE); + off + offsetof(struct ip6_rthdr, ip6r_type)); + return IPPROTO_DONE; } *offp += rhlen; - return (rh->ip6r_nxt); -} - -#if 0 -/* - * Type0 routing header processing - * - * RFC2292 backward compatibility warning: no support for strict/loose bitmap, - * as it was dropped between RFC1883 and RFC2460. - */ -static int -ip6_rthdr0(struct mbuf *m, struct ip6_hdr *ip6, - struct ip6_rthdr0 *rh0) -{ - int addrs, index; - struct in6_addr *nextaddr, tmpaddr; - const struct ip6aux *ip6a; - - if (rh0->ip6r0_segleft == 0) - return (0); - - if (rh0->ip6r0_len % 2 -#ifdef COMPAT_RFC1883 - || rh0->ip6r0_len > 46 -#endif - ) { - /* - * Type 0 routing header can't contain more than 23 addresses. - * RFC 2462: this limitation was removed since strict/loose - * bitmap field was deleted. - */ - IP6_STATINC(IP6_STAT_BADOPTIONS); - icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, - (char *)&rh0->ip6r0_len - (char *)ip6); - return (-1); - } - - if ((addrs = rh0->ip6r0_len / 2) < rh0->ip6r0_segleft) { - IP6_STATINC(IP6_STAT_BADOPTIONS); - icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, - (char *)&rh0->ip6r0_segleft - (char *)ip6); - return (-1); - } - - index = addrs - rh0->ip6r0_segleft; - rh0->ip6r0_segleft--; - nextaddr = ((struct in6_addr *)(rh0 + 1)) + index; - - /* - * reject invalid addresses. be proactive about malicious use of - * IPv4 mapped/compat address. - * XXX need more checks? - */ - if (IN6_IS_ADDR_MULTICAST(nextaddr) || - IN6_IS_ADDR_UNSPECIFIED(nextaddr) || - IN6_IS_ADDR_V4MAPPED(nextaddr) || - IN6_IS_ADDR_V4COMPAT(nextaddr)) { - p6stat[IP6_STAT_BADOPTIONS]++; - goto bad; - } - if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) || - IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst) || - IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) { - IP6_STATINC(IP6_STAT_BADOPTIONS); - goto bad; - } - - /* - * Determine the scope zone of the next hop, based on the interface - * of the current hop. [RFC4007, Section 9] - * Then disambiguate the scope zone for the next hop (if necessary). - */ - if ((ip6a = ip6_getdstifaddr(m)) == NULL) - goto bad; - if (in6_setzoneid(nextaddr, ip6a->ip6a_scope_id) != 0) { - IP6_STATINC(IP6_STAT_BADSCOPE); - goto bad; - } - - /* - * Swap the IPv6 destination address and nextaddr. Forward the packet. - */ - tmpaddr = *nextaddr; - *nextaddr = ip6->ip6_dst; - in6_clearscope(nextaddr); /* XXX */ - ip6->ip6_dst = tmpaddr; - -#ifdef COMPAT_RFC1883 - if (rh0->ip6r0_slmap[index / 8] & (1 << (7 - (index % 8)))) - ip6_forward(m, IPV6_SRCRT_NEIGHBOR); - else - ip6_forward(m, IPV6_SRCRT_NOTNEIGHBOR); -#else - ip6_forward(m, 1); -#endif - - return (-1); /* m would be freed in ip6_forward() */ - - bad: - m_freem(m); - return (-1); + return rh->ip6r_nxt; } -#endif