From ff46a2a32a11dc1c1884d134ef12ad7a3c50635d Mon Sep 17 00:00:00 2001
From: maxv <maxv@NetBSD.org>
Date: Wed, 21 Feb 2018 16:08:55 +0000
Subject: [PATCH] Extend these #ifdef notyet. The m_copydata's in these
 branches are wrong, we are not guaranteed to have enough room for another
 struct ip, and we may crash here. Triggerable remotely, but after
 authentication, by sending an AH packet that has a one-byte-sized IPIP
 payload.

---
 sys/netipsec/ipsec_input.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
index 1f0b7b5a3689..5b732c1f28fa 100644
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec_input.c,v 1.56 2018/02/08 20:57:41 maxv Exp $	*/
+/*	$NetBSD: ipsec_input.c,v 1.57 2018/02/21 16:08:55 maxv Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec_input.c,v 1.2.4.2 2003/03/28 20:32:53 sam Exp $	*/
 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
 
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.56 2018/02/08 20:57:41 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_input.c,v 1.57 2018/02/21 16:08:55 maxv Exp $");
 
 /*
  * IPsec input processing.
@@ -384,14 +384,15 @@ cantpull:
 
 	prot = ip->ip_p;
 
+#ifdef notyet
 	/* IP-in-IP encapsulation */
 	if (prot == IPPROTO_IPIP) {
 		struct ip ipn;
 
 		/* ipn will now contain the inner IPv4 header */
+		/* XXX: check m_pkthdr.len */
 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip), &ipn);
 
-#ifdef notyet
 		/* XXX PROXY address isn't recorded in SAH */
 		/*
 		 * Check that the inner source address is the same as
@@ -420,7 +421,6 @@ cantpull:
 			error = EACCES;
 			goto bad;
 		}
-#endif /*XXX*/
 	}
 #if INET6
 	/* IPv6-in-IP encapsulation. */
@@ -428,9 +428,9 @@ cantpull:
 		struct ip6_hdr ip6n;
 
 		/* ip6n will now contain the inner IPv6 header. */
+		/* XXX: check m_pkthdr.len */
 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr), &ip6n);
 
-#ifdef notyet
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
@@ -458,9 +458,9 @@ cantpull:
 			error = EACCES;
 			goto bad;
 		}
-#endif /*XXX*/
 	}
 #endif /* INET6 */
+#endif /* notyet */
 
 	key_sa_recordxfer(sav, m);		/* record data transfer */