summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sys/netgraph/ng_UI.c3
-rw-r--r--sys/netgraph/ng_frame_relay.c2
-rw-r--r--sys/netgraph/ng_lmi.c5
-rw-r--r--sys/netgraph/ng_pppoe.c3
-rw-r--r--sys/netgraph/ng_rfc1490.c3
-rw-r--r--sys/netgraph/ng_vjc.c51
-rw-r--r--sys/netgraph/ng_vjc.h9
7 files changed, 44 insertions, 32 deletions
diff --git a/sys/netgraph/ng_UI.c b/sys/netgraph/ng_UI.c
index 7295b4a..48078d9 100644
--- a/sys/netgraph/ng_UI.c
+++ b/sys/netgraph/ng_UI.c
@@ -178,7 +178,8 @@ ng_UI_rcvdata(hook_p hook, struct mbuf *m, meta_p meta)
if (hook == priv->downlink) {
u_char *start, *ptr;
- if (!m || !(m = m_pullup(m, MAX_ENCAPS_HDR)))
+ if (!m || (m->m_len < MAX_ENCAPS_HDR
+ && !(m = m_pullup(m, MAX_ENCAPS_HDR))))
ERROUT(ENOBUFS);
ptr = start = mtod(m, u_char *);
diff --git a/sys/netgraph/ng_frame_relay.c b/sys/netgraph/ng_frame_relay.c
index 995b769..97ba1a5 100644
--- a/sys/netgraph/ng_frame_relay.c
+++ b/sys/netgraph/ng_frame_relay.c
@@ -434,7 +434,7 @@ ngfrm_decode(node_p node, struct mbuf *m, meta_p meta)
int error = 0;
int ctxnum;
- if ((m = m_pullup(m, 4)) == NULL) {
+ if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
error = ENOBUFS;
goto out;
}
diff --git a/sys/netgraph/ng_lmi.c b/sys/netgraph/ng_lmi.c
index a404998..239bc57 100644
--- a/sys/netgraph/ng_lmi.c
+++ b/sys/netgraph/ng_lmi.c
@@ -577,8 +577,9 @@ nglmi_rcvdata(hook_p hook, struct mbuf *m, meta_p meta)
log(LOG_WARNING, "nglmi: packetlen (%d) too big\n", packetlen);
goto drop;
}
- if ((m = m_pullup(m, packetlen)) == NULL) {
- log(LOG_WARNING, "nglmi: m_pullup failed for %d bytes\n", packetlen);
+ if (m->m_len < packetlen && (m = m_pullup(m, packetlen)) == NULL) {
+ log(LOG_WARNING,
+ "nglmi: m_pullup failed for %d bytes\n", packetlen);
NG_FREE_META(meta);
return (0);
}
diff --git a/sys/netgraph/ng_pppoe.c b/sys/netgraph/ng_pppoe.c
index 65115ef..3f0ff68 100644
--- a/sys/netgraph/ng_pppoe.c
+++ b/sys/netgraph/ng_pppoe.c
@@ -1144,7 +1144,8 @@ AAA
* wants us to offer service.
*/
neg = sp->neg;
- m_pullup(m, sizeof(*wh)); /* Checks length */
+ if (m->m_len < sizeof(*wh))
+ m_pullup(m, sizeof(*wh));
if (m == NULL) {
LEAVE(ENOBUFS);
}
diff --git a/sys/netgraph/ng_rfc1490.c b/sys/netgraph/ng_rfc1490.c
index 3649476..6bbdc41 100644
--- a/sys/netgraph/ng_rfc1490.c
+++ b/sys/netgraph/ng_rfc1490.c
@@ -226,7 +226,8 @@ ng_rfc1490_rcvdata(hook_p hook, struct mbuf *m, meta_p meta)
if (hook == priv->downlink) {
u_char *start, *ptr;
- if (!m || !(m = m_pullup(m, MAX_ENCAPS_HDR)))
+ if (!m || (m->m_len < MAX_ENCAPS_HDR
+ && !(m = m_pullup(m, MAX_ENCAPS_HDR))))
ERROUT(ENOBUFS);
ptr = start = mtod(m, u_char *);
diff --git a/sys/netgraph/ng_vjc.c b/sys/netgraph/ng_vjc.c
index 9755bd4..a7f0ec2 100644
--- a/sys/netgraph/ng_vjc.c
+++ b/sys/netgraph/ng_vjc.c
@@ -97,7 +97,7 @@ static int ng_vjc_rcvdata(hook_p hook, struct mbuf *m, meta_p t);
static int ng_vjc_disconnect(hook_p hook);
/* Helper stuff */
-static struct mbuf *pulluphdrs(struct mbuf *m);
+static struct mbuf *ng_vjc_pulluphdrs(struct mbuf *m);
/* Node type descriptor */
static struct ng_type typestruct = {
@@ -191,18 +191,24 @@ ng_vjc_rcvmsg(node_p node, struct ng_mesg *msg,
switch (msg->header.typecookie) {
case NGM_VJC_COOKIE:
switch (msg->header.cmd) {
- case NGM_VJC_CONFIG:
+ case NGM_VJC_SET_CONFIG:
{
struct ngm_vjc_config *const c =
(struct ngm_vjc_config *) msg->data;
- if (msg->header.arglen != sizeof(*c)
- || c->numChannels > NG_VJC_MAX_CHANNELS
- || c->numChannels < NG_VJC_MIN_CHANNELS)
+ if (msg->header.arglen != sizeof(*c))
ERROUT(EINVAL);
- if (priv->conf.enabled && c->enabled)
+ if ((priv->conf.enableComp || priv->conf.enableDecomp)
+ && (c->enableComp || c->enableDecomp))
ERROUT(EALREADY);
- if (c->enabled != 0) {
+ if (c->enableComp) {
+ if (c->numChannels > NG_VJC_MAX_CHANNELS
+ || c->numChannels < NG_VJC_MIN_CHANNELS)
+ ERROUT(EINVAL);
+ } else {
+ c->numChannels = NG_VJC_MAX_CHANNELS;
+ }
+ if (c->enableComp != 0 || c->enableDecomp != 0) {
bzero(&priv->slc, sizeof(priv->slc));
sl_compress_init(&priv->slc, c->numChannels);
}
@@ -260,12 +266,12 @@ ng_vjc_rcvdata(hook_p hook, struct mbuf *m, meta_p meta)
if (hook == priv->ip) { /* outgoing packet */
u_int type;
- if (!priv->conf.enabled) /* compression not enabled */
+ if (!priv->conf.enableComp) /* compression not enabled */
type = TYPE_IP;
else {
struct ip *ip;
- if ((m = pulluphdrs(m)) == NULL)
+ if ((m = ng_vjc_pulluphdrs(m)) == NULL)
ERROUT(ENOBUFS);
ip = mtod(m, struct ip *);
type = (ip->ip_p == IPPROTO_TCP) ?
@@ -291,15 +297,15 @@ ng_vjc_rcvdata(hook_p hook, struct mbuf *m, meta_p meta)
u_char *hdr;
struct mbuf *mp;
- /* Are we initialized? */
- if (!priv->conf.enabled) {
+ /* Are we decompressing? */
+ if (!priv->conf.enableDecomp) {
m_freem(m);
m = NULL;
ERROUT(ENETDOWN);
}
/* Uncompress packet to reconstruct TCP/IP header */
- if (!(m = m_pullup(m, MAX_VJHEADER)))
+ if (m->m_len < MAX_VJHEADER && !(m = m_pullup(m, MAX_VJHEADER)))
ERROUT(ENOBUFS);
vjlen = sl_uncompress_tcp_core(mtod(m, u_char *),
m->m_len, m->m_pkthdr.len, TYPE_COMPRESSED_TCP,
@@ -342,18 +348,18 @@ compfailmem:
m = mp;
hook = priv->ip;
} else if (hook == priv->vjuncomp) { /* incoming uncompressed pkt */
- u_int hlen;
u_char *hdr;
+ u_int hlen;
- /* Are we initialized? */
- if (!priv->conf.enabled) {
+ /* Are we decompressing? */
+ if (!priv->conf.enableDecomp) {
m_freem(m);
m = NULL;
ERROUT(ENETDOWN);
}
/* Run packet through uncompressor */
- if ((m = pulluphdrs(m)) == NULL)
+ if ((m = ng_vjc_pulluphdrs(m)) == NULL)
ERROUT(ENOBUFS);
if (sl_uncompress_tcp_core(mtod(m, u_char *),
m->m_len, m->m_pkthdr.len, TYPE_UNCOMPRESSED_TCP,
@@ -410,29 +416,30 @@ ng_vjc_disconnect(hook_p hook)
************************************************************************/
/*
- * Pull up the full IP and TCP headers of a packet. This is optimized
- * for the common case of standard length headers. If packet is not
+ * Pull up the full IP and TCP headers of a packet. If packet is not
* a TCP packet, just pull up the IP header.
*/
static struct mbuf *
-pulluphdrs(struct mbuf *m)
+ng_vjc_pulluphdrs(struct mbuf *m)
{
struct ip *ip;
struct tcphdr *tcp;
int ihlen, thlen;
- if ((m = m_pullup(m, sizeof(*ip) + sizeof(*tcp))) == NULL)
+ if (m->m_len < sizeof(*ip) && !(m = m_pullup(m, sizeof(*ip))))
return (NULL);
ip = mtod(m, struct ip *);
if (ip->ip_p != IPPROTO_TCP)
return (m);
- if ((ihlen = (ip->ip_hl << 2)) != sizeof(*ip)) {
+ ihlen = ip->ip_hl << 2;
+ if (m->m_len < ihlen + sizeof(*tcp)) {
if (!(m = m_pullup(m, ihlen + sizeof(*tcp))))
return (NULL);
ip = mtod(m, struct ip *);
}
tcp = (struct tcphdr *) ((u_char *) ip + ihlen);
- if ((thlen = (tcp->th_off << 2)) != sizeof(*tcp))
+ thlen = tcp->th_off << 2;
+ if (m->m_len < ihlen + thlen)
m = m_pullup(m, ihlen + thlen);
return (m);
}
diff --git a/sys/netgraph/ng_vjc.h b/sys/netgraph/ng_vjc.h
index 5067f6a..5dc2297 100644
--- a/sys/netgraph/ng_vjc.h
+++ b/sys/netgraph/ng_vjc.h
@@ -45,7 +45,7 @@
/* Node type name and magic cookie */
#define NG_VJC_NODE_TYPE "vjc"
-#define NGM_VJC_COOKIE 868219207
+#define NGM_VJC_COOKIE 868219208
/* Hook names */
#define NG_VJC_HOOK_IP "ip" /* normal IP traffic */
@@ -59,14 +59,15 @@
/* Configure struct */
struct ngm_vjc_config {
- u_char enabled; /* Enable compression/decompression */
- u_char numChannels; /* Number of outgoing channels */
+ u_char enableComp; /* Enable compression */
+ u_char enableDecomp; /* Enable decompression */
+ u_char numChannels; /* Number of compression channels */
u_char compressCID; /* OK to compress outgoing CID's */
};
/* Netgraph commands */
enum {
- NGM_VJC_CONFIG, /* Supply a struct ngm_vjc_config */
+ NGM_VJC_SET_CONFIG, /* Supply a struct ngm_vjc_config */
NGM_VJC_GET_STATE, /* Returns current struct slcompress */
NGM_VJC_CLR_STATS, /* Clears statistics counters */
NGM_VJC_RECV_ERROR, /* Indicate loss of incoming frame */
OpenPOWER on IntegriCloud