Fix some long standing bugs in writing to the BPF device attached to

a DLT_NULL interface. In particular:

        1) Consistently use type u_int32_t for the header of a
           DLT_NULL device - it continues to represent the address
           family as always.
        2) In the DLT_NULL case get bpf_movein to store the u_int32_t
           in a sockaddr rather than in the mbuf, to be consistent
           with all the DLT types.
        3) Consequently fix a bug in bpf_movein/bpfwrite which
           only permitted packets up to 4 bytes less than the MTU
           to be written.
        4) Fix all DLT_NULL devices to have the code required to
           allow writing to their bpf devices.
        5) Move the code to allow writing to if_lo from if_simloop
           to looutput, because it only applies to DLT_NULL devices
           but was being applied to other devices that use if_simloop
           possibly incorrectly.

PR:		82157
Submitted by:	Matthew Luckie <mjl@luckie.org.nz>
Approved by:	re (scottl)

2 files changed, 6 insertions, 9 deletions

diff --git a/sys/netgraph/ng_iface.c b/sys/netgraph/ng_iface.c
index 91b6a3d..b7c2314 100644
--- a/sys/netgraph/ng_iface.c
+++ b/sys/netgraph/ng_iface.c
@@ -352,6 +352,7 @@ ng_iface_output(struct ifnet *ifp, struct mbuf *m,
 	const priv_p priv = (priv_p) ifp->if_softc;
 	const iffam_p iffam = get_iffam_from_af(dst->sa_family);
 	int len, error = 0;
+	u_int32_t af;
 
 	/* Check interface flags */
 	if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) != (IFF_UP|IFF_RUNNING)) {
@@ -359,14 +360,10 @@ ng_iface_output(struct ifnet *ifp, struct mbuf *m,
 		return (ENETDOWN);
 	}
 
-	/* BPF writes need to be handled specially */
+	/* BPF writes need to be handled specially. */
 	if (dst->sa_family == AF_UNSPEC) {
-		if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL)
-			return (ENOBUFS);
-		dst->sa_family = (sa_family_t)*mtod(m, int32_t *);
-		m->m_data += 4;
-		m->m_len -= 4;
-		m->m_pkthdr.len -= 4;
+		bcopy(dst->sa_data, &af, sizeof(af));
+		dst->sa_family = af;
 	}
 
 	/* Berkeley packet filter */
@@ -508,7 +505,7 @@ ng_iface_constructor(node_p node)
 
 	/* Attach the interface */
 	if_attach(ifp);
-	bpfattach(ifp, DLT_NULL, sizeof(u_int));
+	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
 
 	/* Done */
 	return (0);
diff --git a/sys/netgraph/ng_sppp.c b/sys/netgraph/ng_sppp.c
index b46acbb..aeee31d 100644
--- a/sys/netgraph/ng_sppp.c
+++ b/sys/netgraph/ng_sppp.c
@@ -289,7 +289,7 @@ ng_sppp_constructor (node_p node)
 	/* Attach the interface */
 	sppp_attach (ifp);
 	if_attach (ifp);
-	bpfattach (ifp, DLT_NULL, sizeof(u_int));
+	bpfattach (ifp, DLT_NULL, sizeof(u_int32_t));
 
 	/* Done */
 	return (0);