fix same-interface-out-as-in and packet gets corrupted bug noted by

james@oaktree.co.uk by re-working icmp embedded-packet code so that
ip_forward() m_copy()-aliased packet can be forwarded to ip_output and
icmp_error() safely, because no packet tweaking is needed before
calling icmp_error()

4 files changed, 10 insertions, 16 deletions

diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
index ba1071a6a94..59a1d73863e 100644
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_icmp.c,v 1.16 1999/01/08 11:35:09 deraadt Exp $	*/
+/*	$OpenBSD: ip_icmp.c,v 1.17 1999/09/23 07:20:35 deraadt Exp $	*/
 /*	$NetBSD: ip_icmp.c,v 1.19 1996/02/13 23:42:22 christos Exp $	*/
 
 /*
@@ -91,6 +91,8 @@ extern	struct protosw inetsw[];
 /*
  * Generate an error packet of type error
  * in response to bad packet ip.
+ *
+ * The ip packet inside has ip_off and ip_len in host byte order.
  */
 void
 icmp_error(n, type, code, dest, destifp)
@@ -116,7 +118,7 @@ icmp_error(n, type, code, dest, destifp)
 	 * Don't error if the old packet protocol was ICMP
 	 * error message, only known informational types.
 	 */
-	if (ntohs(oip->ip_off) &~ (IP_MF|IP_DF))
+	if (oip->ip_off &~ (IP_MF|IP_DF))
 		goto freeit;
 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
 	  n->m_len >= oiplen + ICMP_MINLEN &&
@@ -133,7 +135,7 @@ icmp_error(n, type, code, dest, destifp)
 	m = m_gethdr(M_DONTWAIT, MT_HEADER);
 	if (m == NULL)
 		goto freeit;
-	icmplen = oiplen + min(8, ntohs(oip->ip_len));
+	icmplen = oiplen + min(8, oip->ip_len);
 	m->m_len = icmplen + ICMP_MINLEN;
 	MH_ALIGN(m, m->m_len);
 	icp = mtod(m, struct icmp *);
@@ -158,9 +160,10 @@ icmp_error(n, type, code, dest, destifp)
 	}
 
 	icp->icmp_code = code;
+	HTONS(oip->ip_off);
+	HTONS(oip->ip_len);
 	bcopy((caddr_t)oip, (caddr_t)&icp->icmp_ip, icmplen);
 	nip = &icp->icmp_ip;
-	nip->ip_len = htons((u_int16_t)(ntohs(nip->ip_len) + oiplen));
 
 	m0.m_next = NULL;			/* correct nip->ip_sum */
 	m0.m_data = (char *)nip;
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 3c68442cbd6..27d271e8507 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_input.c,v 1.40 1999/04/23 15:18:03 provos Exp $	*/
+/*	$OpenBSD: ip_input.c,v 1.41 1999/09/23 07:20:35 deraadt Exp $	*/
 /*	$NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $	*/
 
 /*
@@ -1265,8 +1265,6 @@ ip_forward(m, srcrt)
 	}
 	HTONS(ip->ip_id);
 	if (ip->ip_ttl <= IPTTLDEC) {
-		HTONS(ip->ip_off);
-		HTONS(ip->ip_len);
 		icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, dest, 0);
 		return;
 	}
@@ -1285,8 +1283,6 @@ ip_forward(m, srcrt)
 
 		rtalloc(&ipforward_rt);
 		if (ipforward_rt.ro_rt == 0) {
-			HTONS(ip->ip_off);
-			HTONS(ip->ip_len);
 			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, dest, 0);
 			return;
 		}
@@ -1380,8 +1376,6 @@ ip_forward(m, srcrt)
 	}
 
 	ip = mtod(mcopy, struct ip *);
-	HTONS(ip->ip_off);
-	HTONS(ip->ip_len);
 	icmp_error(mcopy, type, code, dest, destifp);
 }
 
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 72021984766..aaa68c43380 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.18 1999/06/07 07:22:26 deraadt Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.19 1999/09/23 07:20:35 deraadt Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -154,7 +154,6 @@ rip_input(m, va_alist)
 			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PROTOCOL, 0, 0);
 		else
 			m_freem(m);
-		/* Perhaps should send an ICMP protocol unreachable here. */
 		ipstat.ips_noproto++;
 		ipstat.ips_delivered--;
 	}
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 498ac0e7cdb..d57e3faf7b3 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.26 1999/06/06 23:34:20 deraadt Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.27 1999/09/23 07:20:35 deraadt Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -485,9 +485,7 @@ udp_input(m, va_alist)
 				goto bad;
 			}
 			*ip = save_ip;
-			HTONS(ip->ip_len);
 			HTONS(ip->ip_id);
-			HTONS(ip->ip_off);
 			uh->uh_sum = savesum;
 #ifdef INET6
 			if (ipv6)