 @@ -1,14 +1,14 @@
-/*	$NetBSD: xform_ah.c,v 1.37.6.3 2018/02/15 16:50:01 martin Exp $	*/
+/*	$NetBSD: xform_ah.c,v 1.37.6.4 2018/03/13 17:18:12 snj Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/xform_ah.c,v 1.1.4.1 2003/01/24 05:11:36 sam Exp $	*/
 /*	$OpenBSD: ip_ah.c,v 1.63 2001/06/26 06:18:58 angelos Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
+ *
 @@ -29,27 +29,27 @@
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_ah.c,v 1.37.6.3 2018/02/15 16:50:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_ah.c,v 1.37.6.4 2018/03/13 17:18:12 snj Exp $");
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/syslog.h>
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
 @@ -488,74 +488,65 @@ ah_massage_headers(struct mbuf **m0, int
 				    skip - sizeof(struct ip6_hdr), ptr);
 				alloc = 1;
 			} else {
 				/* No need to allocate memory. */
 				ptr = mtod(m, unsigned char *) +
 				    sizeof(struct ip6_hdr);
 				alloc = 0;
+			}
 		} else
 			break;
 		nxt = ip6.ip6_nxt & 0xff; /* Next header type. */
-		for (off = 0; off < skip - sizeof(struct ip6_hdr);)
+		for (off = 0; off < skip - sizeof(struct ip6_hdr);) {
 			int noff;
 			switch (nxt) {
 			case IPPROTO_HOPOPTS:
 			case IPPROTO_DSTOPTS:
-				ip6e = (struct ip6_ext *) (ptr + off);
+				ip6e = (struct ip6_ext *)(ptr + off);
 				noff = off + ((ip6e->ip6e_len + 1) << 3);
 				/* Sanity check. */
 				if (noff > skip - sizeof(struct ip6_hdr)) {
 					goto error6;
+				}
 				/*
-				 * Process the mutable/immutable
+				 * Zero out mutable options.
 				 * options -- borrows heavily from the
 				 * KAME code.
 				 */
 				for (count = off + sizeof(struct ip6_ext);
-				     count < off + ((ip6e->ip6e_len + 1) << 3);) {
+				     count < noff;) {
 					if (ptr[count] == IP6OPT_PAD1) {
 						count++;
-						continue; /* Skip padding. */
+						continue;
 					/* Sanity check. */
 					if (count > off +
 					    ((ip6e->ip6e_len + 1) << 3)) {
 						m_freem(m);
 						/* Free, if we allocated. */
 						if (alloc)
 							free(ptr, M_XDATA);
 						return EINVAL;
+					}
 					ad = ptr[count + 1] + 2;
-					/* If mutable option, zeroize. */
+					if (count + ad > noff) {
-					if (ptr[count] & IP6OPT_MUTABLE)
+						goto error6;
 						memcpy(ptr + count, ipseczeroes,
 						    ad);
 					if (ptr[count] & IP6OPT_MUTABLE) {
 						memset(ptr + count, 0, ad);
+					}
 					count += ad;
+				}
-					/* Sanity check. */
+				if (count != noff) {
-					if (count >
+					goto error6;
 					    skip - sizeof(struct ip6_hdr)) {
 						m_freem(m);
 						/* Free, if we allocated. */
 						if (alloc)
 							free(ptr, M_XDATA);
 						return EINVAL;
+				}
 				/* Advance. */
 				off += ((ip6e->ip6e_len + 1) << 3);
 				nxt = ip6e->ip6e_nxt;
 				break;
 			case IPPROTO_ROUTING:
 				/*
 				 * Always include routing headers in
 				 * computation.
 				 */
+				{
 @@ -593,31 +584,33 @@ ah_massage_headers(struct mbuf **m0, int
 						rh0->ip6r0_segleft = 0;
+					}
 					/* advance */
 					off += ((ip6e->ip6e_len + 1) << 3);
 					nxt = ip6e->ip6e_nxt;
 					break;
+				}
 			default:
 				DPRINTF(("ah_massage_headers: unexpected "
 				    "IPv6 header type %d", off));
 error6:
 				if (alloc)
 					free(ptr, M_XDATA);
 				m_freem(m);
 				return EINVAL;
+			}
+		}
 		/* Copyback and free, if we allocated. */
 		if (alloc) {
 			m_copyback(m, sizeof(struct ip6_hdr),
 			    skip - sizeof(struct ip6_hdr), ptr);
 			free(ptr, M_XDATA);
+		}
 		break;
 #endif /* INET6 */
+	}
 	return 0;

 @@ -1,14 +1,14 @@
-/*	$NetBSD: xform_esp.c,v 1.40 2012/01/25 20:31:23 drochner Exp $	*/
+/*	$NetBSD: xform_esp.c,v 1.40.6.1 2018/03/13 17:18:12 snj Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/xform_esp.c,v 1.2.2.1 2003/01/24 05:11:36 sam Exp $	*/
 /*	$OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
 @@ -29,27 +29,27 @@
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.40 2012/01/25 20:31:23 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.40.6.1 2018/03/13 17:18:12 snj Exp $");
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/syslog.h>
 #include <sys/kernel.h>
 /*#include <sys/random.h>*/
 @@ -305,26 +305,30 @@ esp_input(struct mbuf *m, const struct s
 	struct cryptop *crp;
 	IPSEC_SPLASSERT_SOFTNET("esp_input");
 	IPSEC_ASSERT(sav != NULL, ("esp_input: null SA"));
 	IPSEC_ASSERT(sav->tdb_encalgxform != NULL,
 		("esp_input: null encoding xform"));
 	IPSEC_ASSERT((skip&3) == 0 && (m->m_pkthdr.len&3) == 0,
 		("esp_input: misaligned packet, skip %u pkt len %u",
 			skip, m->m_pkthdr.len));
 	/* XXX don't pullup, just copy header */
 	IP6_EXTHDR_GET(esp, struct newesp *, m, skip, sizeof (struct newesp));
 	if (esp == NULL) {
 		/* m already freed */
 		return EINVAL;
+	}
 	esph = sav->tdb_authalgxform;
 	espx = sav->tdb_encalgxform;
 	/* Determine the ESP header length */
 	if (sav->flags & SADB_X_EXT_OLD)
 		hlen = sizeof (struct esp) + sav->ivlen;
 	else
 		hlen = sizeof (struct newesp) + sav->ivlen;
 	/* Authenticator hash size */
 	alen = esph ? esph->authsize : 0;
 	/*

 @@ -1,14 +1,14 @@
-/*	$NetBSD: xform_ipip.c,v 1.28.14.1 2018/02/15 14:51:44 martin Exp $	*/
+/*	$NetBSD: xform_ipip.c,v 1.28.14.2 2018/03/13 17:18:12 snj Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $	*/
 /*	$OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
+ *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
+ *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
 @@ -29,27 +29,27 @@
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
+ *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.28.14.1 2018/02/15 14:51:44 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.28.14.2 2018/03/13 17:18:12 snj Exp $");
 /*
  * IP-inside-IP processing
  */
 #include "opt_inet.h"
 #ifdef __FreeBSD__
 #include "opt_inet6.h"
 #include "opt_random_ip_id.h"
 #endif /* __FreeBSD__ */
 #include <sys/param.h>
 #include <sys/systm.h>
 @@ -314,27 +314,28 @@ _ipip_input(struct mbuf *m, int iphlen,
 	 * this is as good as any a position.
 	 */
 	/* Some sanity checks in the inner IP header */
 	switch (v >> 4) {
 #ifdef INET
     	case 4:
                 ipo = mtod(m, struct ip *);
 		ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos);
                 break;
 #endif /* INET */
 #ifdef INET6
     	case 6:
-                ip6 = (struct ip6_hdr *) ipo;
+		ipo = NULL;
 		ip6 = mtod(m, struct ip6_hdr *);
 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 		ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
 		ip6->ip6_flow &= ~htonl(0xff << 20);
 		ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
                 break;
 #endif
 	default:
 		panic("ipip_input: unknown ip version %u (inner)", v>>4);
+	}
 	/* Check for local address spoofing. */
 	if ((m->m_pkthdr.rcvif == NULL ||
 	    !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) &&