a8fe77d877
In ip6_[direct_]input() we are looping over the extension headers to deal with the next header. We pass a pointer to an mbuf pointer to the handling functions. In certain cases the mbuf can be updated there and we need to pass the new one back. That missing in dest6_input() and route6_input(). In tcp6_input() we should also update it before we call tcp_input(). In addition to that mark the mbuf NULL all the times when we return that we are done with handling the packet and no next header should be checked (IPPROTO_DONE). This will eventually allow us to assert proper behaviour and catch the above kind of errors more easily, expecting *mp to always be set. This change is extracted from a larger patch and not an exhaustive change across the entire stack yet. PR: 240135 Reported by: prabhakar.lakhera gmail.com MFC after: 3 weeks Sponsored by: Netflix
134 lines
3.8 KiB
C
134 lines
3.8 KiB
C
/*-
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
*
|
|
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the name of the project nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* $KAME: dest6.c,v 1.59 2003/07/11 13:21:16 t-momose Exp $
|
|
*/
|
|
|
|
#include <sys/cdefs.h>
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
#include "opt_inet.h"
|
|
#include "opt_inet6.h"
|
|
|
|
#include <sys/param.h>
|
|
#include <sys/systm.h>
|
|
#include <sys/malloc.h>
|
|
#include <sys/mbuf.h>
|
|
#include <sys/domain.h>
|
|
#include <sys/protosw.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/errno.h>
|
|
#include <sys/time.h>
|
|
#include <sys/kernel.h>
|
|
|
|
#include <net/if.h>
|
|
#include <net/if_var.h>
|
|
#include <net/route.h>
|
|
|
|
#include <netinet/in.h>
|
|
#include <netinet/in_var.h>
|
|
#include <netinet/ip6.h>
|
|
#include <netinet6/ip6_var.h>
|
|
#include <netinet/icmp6.h>
|
|
|
|
/*
|
|
* Destination options header processing.
|
|
*/
|
|
int
|
|
dest6_input(struct mbuf **mp, int *offp, int proto)
|
|
{
|
|
struct mbuf *m;
|
|
int off, dstoptlen, optlen;
|
|
struct ip6_dest *dstopts;
|
|
u_int8_t *opt;
|
|
|
|
m = *mp;
|
|
off = *offp;
|
|
|
|
/* validation of the length of the header */
|
|
#ifndef PULLDOWN_TEST
|
|
IP6_EXTHDR_CHECK(m, off, sizeof(*dstopts), IPPROTO_DONE);
|
|
dstopts = (struct ip6_dest *)(mtod(m, caddr_t) + off);
|
|
#else
|
|
IP6_EXTHDR_GET(dstopts, struct ip6_dest *, m, off, sizeof(*dstopts));
|
|
if (dstopts == NULL)
|
|
return IPPROTO_DONE;
|
|
#endif
|
|
dstoptlen = (dstopts->ip6d_len + 1) << 3;
|
|
|
|
#ifndef PULLDOWN_TEST
|
|
IP6_EXTHDR_CHECK(m, off, dstoptlen, IPPROTO_DONE);
|
|
dstopts = (struct ip6_dest *)(mtod(m, caddr_t) + off);
|
|
#else
|
|
IP6_EXTHDR_GET(dstopts, struct ip6_dest *, m, off, dstoptlen);
|
|
if (dstopts == NULL)
|
|
return IPPROTO_DONE;
|
|
#endif
|
|
off += dstoptlen;
|
|
dstoptlen -= sizeof(struct ip6_dest);
|
|
opt = (u_int8_t *)dstopts + sizeof(struct ip6_dest);
|
|
|
|
/* search header for all options. */
|
|
for (; dstoptlen > 0; dstoptlen -= optlen, opt += optlen) {
|
|
if (*opt != IP6OPT_PAD1 &&
|
|
(dstoptlen < IP6OPT_MINLEN || *(opt + 1) + 2 > dstoptlen)) {
|
|
IP6STAT_INC(ip6s_toosmall);
|
|
goto bad;
|
|
}
|
|
|
|
switch (*opt) {
|
|
case IP6OPT_PAD1:
|
|
optlen = 1;
|
|
break;
|
|
case IP6OPT_PADN:
|
|
optlen = *(opt + 1) + 2;
|
|
break;
|
|
default: /* unknown option */
|
|
optlen = ip6_unknown_opt(opt, m,
|
|
opt - mtod(m, u_int8_t *));
|
|
if (optlen == -1) {
|
|
*mp = NULL;
|
|
return (IPPROTO_DONE);
|
|
}
|
|
optlen += 2;
|
|
break;
|
|
}
|
|
}
|
|
|
|
*offp = off;
|
|
*mp = m;
|
|
return (dstopts->ip6d_nxt);
|
|
|
|
bad:
|
|
m_freem(m);
|
|
*mp = NULL;
|
|
return (IPPROTO_DONE);
|
|
}
|