Validate sockaddr from userland in central functions. This results

in common checks for unix, inet, inet6 instead of partial checks
here and there.  Some checks are already done at a higher layer,
but better be paranoid with user input.
OK claudio@ millert@

5 files changed, 41 insertions, 50 deletions

diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index 4aa12f06985..71e58d18943 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in.c,v 1.139 2017/05/29 14:36:22 mpi Exp $	*/
+/*	$OpenBSD: in.c,v 1.140 2017/08/11 19:53:02 bluhm Exp $	*/
 /*	$NetBSD: in.c,v 1.26 1996/02/13 23:41:39 christos Exp $	*/
 
 /*
@@ -164,6 +164,24 @@ in_len2mask(struct in_addr *mask, int len)
 		p[i] = (0xff00 >> (len % 8)) & 0xff;
 }
 
+int
+in_nam2sin(const struct mbuf *nam, struct sockaddr_in **sin)
+{
+	struct sockaddr *sa = mtod(nam, struct sockaddr *);
+
+	if (nam->m_len < offsetof(struct sockaddr, sa_data))
+		return EINVAL;
+	if (sa->sa_family != AF_INET)
+		return EAFNOSUPPORT;
+	if (sa->sa_len != nam->m_len)
+		return EINVAL;
+	if (sa->sa_len != sizeof(struct sockaddr_in))
+		return EINVAL;
+	*sin = satosin(sa);
+
+	return 0;
+}
+
 /*
  * Generic internet control operations (ioctl's).
  */
diff --git a/sys/netinet/in.h b/sys/netinet/in.h
index 8d59a6a3e8c..68a3826459d 100644
--- a/sys/netinet/in.h
+++ b/sys/netinet/in.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in.h,v 1.123 2017/05/30 07:50:37 mpi Exp $	*/
+/*	$OpenBSD: in.h,v 1.124 2017/08/11 19:53:02 bluhm Exp $	*/
 /*	$NetBSD: in.h,v 1.20 1996/02/13 23:41:47 christos Exp $	*/
 
 /*
@@ -818,6 +818,7 @@ void	   in_proto_cksum_out(struct mbuf *, struct ifnet *);
 void	   in_ifdetach(struct ifnet *);
 int	   in_mask2len(struct in_addr *);
 void	   in_len2mask(struct in_addr *, int);
+int	   in_nam2sin(const struct mbuf *, struct sockaddr_in **);
 
 char	  *inet_ntoa(struct in_addr);
 int	   inet_nat64(int, const void *, void *, const void *, u_int8_t);
diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 481a374be81..6027e880629 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.c,v 1.223 2017/08/04 18:16:42 bluhm Exp $	*/
+/*	$OpenBSD: in_pcb.c,v 1.224 2017/08/11 19:53:02 bluhm Exp $	*/
 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
 
 /*
@@ -327,12 +327,9 @@ in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p)
 
 		if (nam) {
 			struct sockaddr_in6 *sin6;
-			sin6 = mtod(nam, struct sockaddr_in6 *);
-			if (nam->m_len != sizeof(struct sockaddr_in6))
-				return (EINVAL);
-			if (sin6->sin6_family != AF_INET6)
-				return (EAFNOSUPPORT);
 
+			if ((error = in6_nam2sin6(nam, &sin6)))
+				return (error);
 			if ((error = in6_pcbaddrisavail(inp, sin6, wild, p)))
 				return (error);
 			laddr = &sin6->sin6_addr;
@@ -346,12 +343,9 @@ in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p)
 
 		if (nam) {
 			struct sockaddr_in *sin;
-			sin = mtod(nam, struct sockaddr_in *);
-			if (nam->m_len != sizeof(*sin))
-				return (EINVAL);
-			if (sin->sin_family != AF_INET)
-				return (EAFNOSUPPORT);
 
+			if ((error = in_nam2sin(nam, &sin)))
+				return (error);
 			if ((error = in_pcbaddrisavail(inp, sin, wild, p)))
 				return (error);
 			laddr = &sin->sin_addr;
@@ -511,7 +505,7 @@ int
 in_pcbconnect(struct inpcb *inp, struct mbuf *nam)
 {
 	struct in_addr *ina = NULL;
-	struct sockaddr_in *sin = mtod(nam, struct sockaddr_in *);
+	struct sockaddr_in *sin;
 	int error;
 
 #ifdef INET6
@@ -521,13 +515,10 @@ in_pcbconnect(struct inpcb *inp, struct mbuf *nam)
 		panic("IPv6 pcb passed into in_pcbconnect");
 #endif /* INET6 */
 
-	if (nam->m_len != sizeof(*sin))
-		return (EINVAL);
-	if (sin->sin_family != AF_INET)
-		return (EAFNOSUPPORT);
+	if ((error = in_nam2sin(nam, &sin)))
+		return (error);
 	if (sin->sin_port == 0)
 		return (EADDRNOTAVAIL);
-
 	error = in_pcbselsrc(&ina, sin, inp);
 	if (error)
 		return (error);
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 8a14690911d..ebd835a929e 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.100 2017/06/26 09:32:32 mpi Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.101 2017/08/11 19:53:02 bluhm Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -434,16 +434,10 @@ rip_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 
 	case PRU_BIND:
 	    {
-		struct sockaddr_in *addr = mtod(nam, struct sockaddr_in *);
+		struct sockaddr_in *addr;
 
-		if (nam->m_len != sizeof(*addr)) {
-			error = EINVAL;
-			break;
-		}
-		if (addr->sin_family != AF_INET) {
-			error = EADDRNOTAVAIL;
+		if ((error = in_nam2sin(nam, &addr)))
 			break;
-		}
 		if (!((so->so_options & SO_BINDANY) ||
 		    addr->sin_addr.s_addr == INADDR_ANY ||
 		    addr->sin_addr.s_addr == INADDR_BROADCAST ||
@@ -457,16 +451,10 @@ rip_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 	    }
 	case PRU_CONNECT:
 	    {
-		struct sockaddr_in *addr = mtod(nam, struct sockaddr_in *);
+		struct sockaddr_in *addr;
 
-		if (nam->m_len != sizeof(*addr)) {
-			error = EINVAL;
+		if ((error = in_nam2sin(nam, &addr)))
 			break;
-		}
-		if (addr->sin_family != AF_INET) {
-			error = EAFNOSUPPORT;
-			break;
-		}
 		inp->inp_faddr = addr->sin_addr;
 		soisconnected(so);
 		break;
@@ -501,12 +489,15 @@ rip_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 			}
 			dst.sin_addr = inp->inp_faddr;
 		} else {
+			struct sockaddr_in *addr;
+
 			if (nam == NULL) {
 				error = ENOTCONN;
 				break;
 			}
-			dst.sin_addr =
-			    mtod(nam, struct sockaddr_in *)->sin_addr;
+			if ((error = in_nam2sin(nam, &addr)))
+				break;
+			dst.sin_addr = addr->sin_addr;
 		}
 #ifdef IPSEC
 		/* XXX Find an IPsec TDB */
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 9700554b3ab..486b8d176e0 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.238 2017/06/26 09:32:32 mpi Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.239 2017/08/11 19:53:02 bluhm Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -960,26 +960,16 @@ udp_output(struct inpcb *inp, struct mbuf *m, struct mbuf *addr,
 	}
 
 	if (addr) {
-		sin = mtod(addr, struct sockaddr_in *);
-
-		if (addr->m_len != sizeof(*sin)) {
-			error = EINVAL;
-			goto release;
-		}
-		if (sin->sin_family != AF_INET) {
-			error = EAFNOSUPPORT;
+		if ((error = in_nam2sin(addr, &sin)))
 			goto release;
-		}
 		if (sin->sin_port == 0) {
 			error = EADDRNOTAVAIL;
 			goto release;
 		}
-
 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
 			error = EISCONN;
 			goto release;
 		}
-
 		error = in_pcbselsrc(&laddr, sin, inp);
 		if (error)
 			goto release;