kern/156180: ipfw checks TCP options on non-contiguous header

[Karim Fodil-Lemelin]

>Number:         156180
>Category:       kern
>Synopsis:       ipfw checks TCP options on non-contiguous header
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 04 19:20:09 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Karim Fodil-Lemelin
>Release:        CURRENT
>Organization:
>Environment:
>Description:
When using tcpopt_match in ipfw there is no guarantee that the TCP option space matched is not bogus.

This is because the case IPPROTO_TCP does not do an m_pullup on the entire IP+TCP+TCP option header.
>How-To-Repeat:

>Fix:
The attached patch will call m_pullup on the TCP option space if it wasn't done already.

Patch attached with submission follows:

Index: netinet/ipfw/ip_fw2.c
===================================================================
--- netinet/ipfw/ip_fw2.c	(revision 219967)
+++ netinet/ipfw/ip_fw2.c	(working copy)
@@ -949,6 +949,11 @@
 
 			case IPPROTO_TCP:
 				PULLUP_TO(hlen, ulp, struct tcphdr);
+				/* kfl: check 'contiguousity' of the option space */
+				if (m->m_len < (hlen + (TCP(ulp)->th_off << 2))) {
+				  if ((m = m_pullup(m, hlen+(TCP(ulp)->th_off << 2))) == NULL)
+				    goto pullup_failed;
+				}
 				dst_port = TCP(ulp)->th_dport;
 				src_port = TCP(ulp)->th_sport;
 				/* save flags for dynamic rules */
@@ -1117,6 +1122,11 @@
 			switch (proto) {
 			case IPPROTO_TCP:
 				PULLUP_TO(hlen, ulp, struct tcphdr);
+				/* kfl: check 'contiguousity' of the option space */
+				if (m->m_len < (hlen + (TCP(ulp)->th_off << 2))) {
+				  if ((m = m_pullup(m, hlen+(TCP(ulp)->th_off << 2))) == NULL)
+				    goto pullup_failed;
+				}
 				dst_port = TCP(ulp)->th_dport;
 				src_port = TCP(ulp)->th_sport;
 				/* save flags for dynamic rules */


>Release-Note:
>Audit-Trail:
>Unformatted: