Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 6 Oct 2014 17:08:20 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r272662 - stable/10/sys/netinet6
Message-ID:  <201410061708.s96H8K18091582@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: tuexen
Date: Mon Oct  6 17:08:19 2014
New Revision: 272662
URL: https://svnweb.freebsd.org/changeset/base/272662

Log:
  MFC r272404:
  Fix the checksum computation for UDPLite/IPv6. This requires the
  usage of a function computing the checksum only over a part of the function.
  Therefore introduce in6_cksum_partial() and implement in6_cksum() based
  on that.
  While there, ensure that the UDPLite packet contains at least enough bytes
  to contain the header.

Modified:
  stable/10/sys/netinet6/in6.h
  stable/10/sys/netinet6/in6_cksum.c
  stable/10/sys/netinet6/udp6_usrreq.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netinet6/in6.h
==============================================================================
--- stable/10/sys/netinet6/in6.h	Mon Oct  6 17:04:26 2014	(r272661)
+++ stable/10/sys/netinet6/in6.h	Mon Oct  6 17:08:19 2014	(r272662)
@@ -641,6 +641,8 @@ struct ip6_hdr;
 
 int	in6_cksum_pseudo(struct ip6_hdr *, uint32_t, uint8_t, uint16_t);
 int	in6_cksum(struct mbuf *, u_int8_t, u_int32_t, u_int32_t);
+int	in6_cksum_partial(struct mbuf *, u_int8_t, u_int32_t, u_int32_t,
+			  u_int32_t);
 int	in6_localaddr(struct in6_addr *);
 int	in6_localip(struct in6_addr *);
 int	in6_addrscope(struct in6_addr *);

Modified: stable/10/sys/netinet6/in6_cksum.c
==============================================================================
--- stable/10/sys/netinet6/in6_cksum.c	Mon Oct  6 17:04:26 2014	(r272661)
+++ stable/10/sys/netinet6/in6_cksum.c	Mon Oct  6 17:08:19 2014	(r272662)
@@ -145,9 +145,11 @@ in6_cksum_pseudo(struct ip6_hdr *ip6, ui
  * off is an offset where TCP/UDP/ICMP6 header starts.
  * len is a total length of a transport segment.
  * (e.g. TCP header + TCP payload)
+ * cov is the number of bytes to be taken into account for the checksum
  */
 int
-in6_cksum(struct mbuf *m, u_int8_t nxt, u_int32_t off, u_int32_t len)
+in6_cksum_partial(struct mbuf *m, u_int8_t nxt, u_int32_t off,
+    u_int32_t len, u_int32_t cov)
 {
 	struct ip6_hdr *ip6;
 	u_int16_t *w, scope;
@@ -215,9 +217,9 @@ in6_cksum(struct mbuf *m, u_int8_t nxt, 
 	}
 	w = (u_int16_t *)(mtod(m, u_char *) + off);
 	mlen = m->m_len - off;
-	if (len < mlen)
-		mlen = len;
-	len -= mlen;
+	if (cov < mlen)
+		mlen = cov;
+	cov -= mlen;
 	/*
 	 * Force to even boundary.
 	 */
@@ -273,7 +275,7 @@ in6_cksum(struct mbuf *m, u_int8_t nxt, 
 	 * Lastly calculate a summary of the rest of mbufs.
 	 */
 
-	for (;m && len; m = m->m_next) {
+	for (;m && cov; m = m->m_next) {
 		if (m->m_len == 0)
 			continue;
 		w = mtod(m, u_int16_t *);
@@ -290,12 +292,12 @@ in6_cksum(struct mbuf *m, u_int8_t nxt, 
 			sum += s_util.s;
 			w = (u_int16_t *)((char *)w + 1);
 			mlen = m->m_len - 1;
-			len--;
+			cov--;
 		} else
 			mlen = m->m_len;
-		if (len < mlen)
-			mlen = len;
-		len -= mlen;
+		if (cov < mlen)
+			mlen = cov;
+		cov -= mlen;
 		/*
 		 * Force to even boundary.
 		 */
@@ -343,7 +345,7 @@ in6_cksum(struct mbuf *m, u_int8_t nxt, 
 		} else if (mlen == -1)
 			s_util.c[0] = *(char *)w;
 	}
-	if (len)
+	if (cov)
 		panic("in6_cksum: out of data");
 	if (mlen == -1) {
 		/* The last mbuf has odd # of bytes. Follow the
@@ -355,3 +357,9 @@ in6_cksum(struct mbuf *m, u_int8_t nxt, 
 	REDUCE;
 	return (~sum & 0xffff);
 }
+
+int
+in6_cksum(struct mbuf *m, u_int8_t nxt, u_int32_t off, u_int32_t len)
+{
+	return (in6_cksum_partial(m, nxt, off, len, len));
+}

Modified: stable/10/sys/netinet6/udp6_usrreq.c
==============================================================================
--- stable/10/sys/netinet6/udp6_usrreq.c	Mon Oct  6 17:04:26 2014	(r272661)
+++ stable/10/sys/netinet6/udp6_usrreq.c	Mon Oct  6 17:08:19 2014	(r272662)
@@ -225,11 +225,16 @@ udp6_input(struct mbuf **mp, int *offp, 
 
 	nxt = ip6->ip6_nxt;
 	cscov_partial = (nxt == IPPROTO_UDPLITE) ? 1 : 0;
-	if (nxt == IPPROTO_UDPLITE && (ulen == 0 || ulen == plen)) {
+	if (nxt == IPPROTO_UDPLITE) {
 		/* Zero means checksum over the complete packet. */
 		if (ulen == 0)
 			ulen = plen;
-		cscov_partial = 0;
+		if (ulen == plen)
+			cscov_partial = 0;
+		if ((ulen < sizeof(struct udphdr)) || (ulen > plen)) {
+			/* XXX: What is the right UDPLite MIB counter? */
+			goto badunlocked;
+		}
 	}
 	if (nxt == IPPROTO_UDP && plen != ulen) {
 		UDPSTAT_INC(udps_badlen);
@@ -255,7 +260,7 @@ udp6_input(struct mbuf **mp, int *offp, 
 			    m->m_pkthdr.csum_data);
 		uh_sum ^= 0xffff;
 	} else
-		uh_sum = in6_cksum(m, nxt, off, ulen);
+		uh_sum = in6_cksum_partial(m, nxt, off, plen, ulen);
 
 	if (uh_sum != 0) {
 		UDPSTAT_INC(udps_badsum);
@@ -842,8 +847,8 @@ udp6_output(struct inpcb *inp, struct mb
 		ip6->ip6_dst	= *faddr;
 
 		if (cscov_partial) {
-			if ((udp6->uh_sum = in6_cksum(m, 0,
-			    sizeof(struct ip6_hdr), cscov)) == 0)
+			if ((udp6->uh_sum = in6_cksum_partial(m, nxt,
+			    sizeof(struct ip6_hdr), plen, cscov)) == 0)
 				udp6->uh_sum = 0xffff;
 		} else {
 			udp6->uh_sum = in6_cksum_pseudo(ip6, plen, nxt, 0);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201410061708.s96H8K18091582>