net: fix OOB reads and unbounded growth in IPv6 net-channel classifier and DHCPv6 client

Security hardening for the two network-reachable memory-safety issues in the
new IPv6/DHCPv6 code (found in audit):

1. classify_ipv6_tcp() OOB read (core/net_channel.cc). ip6_lasthdr_nofrag only
   guarantees the base IPv6 header + extension headers fit; it did NOT
   guarantee a full TCP header is present and contiguous, yet the code then
   dereferenced tcp_hdr (th_flags at +13, ports at +0..3) on the lock-free RX
   fast path. A crafted IPv6/TCP frame (short, or with extension headers
   pushing the L4 offset toward the end, or split across a mergeable-buffer
   mbuf chain via GRO/jumbo) could read out of bounds in the driver softirq.
   Require nxt_off + sizeof(tcphdr) <= mh_len before touching the TCP header;
   otherwise fall through to the slow path (tcp_input), which pulls up.

2. DHCPv6 parse() OOB read across an mbuf chain (bsd/porting/dhcp6.cc). The
   option walk bounded off against pkthdr.len (whole chain) while reading via
   mtod (first mbuf only); udp6_input makes only the UDP header contiguous. A
   malicious on-link DHCPv6 server (DHCPv6 is unauthenticated; the client is
   auto-started on a Managed-flag RA) sending a >4 KiB reply on a jumbo/GRO
   link becomes an mbuf chain and the walk reads past the first mbuf. Clamp
   blen to the contiguous first-mbuf length (a well-formed reply is far smaller
   than one RX buffer).

3. DHCPv6 unbounded state growth (DoS). process_packet() parsed every packet
   even when BOUND, and parse() appended to _dns/_server_duid, so an on-link
   attacker who observed our SOLICIT xid could spray REPLYs and grow those
   without bound. Ignore packets outside SOLICITING/REQUESTING, and reset the
   per-reply learned state only after the xid matches (so a spoofed packet
   cannot wipe good state and repeated replies do not accumulate).

Verified: IPv6 loopback + dual-stack TCP smoke still passes.

Author: gburd

bsd/porting/dhcp6.cc

@@ -272,7 +272,18 @@ bool dhcp6_interface_state::parse(struct mbuf* m, msg_type& out_type)
     if (payload_off <= 0)
         payload_off = sizeof(struct ip6_hdr) + sizeof(struct udphdr);
     u8* p = mtod(m, u8*) + payload_off;
-    int blen = m->M_dat.MH.MH_pkthdr.len - payload_off;
+    // udp6_input only makes the UDP header contiguous, not the DHCPv6 body.
+    // pkthdr.len covers the whole mbuf chain, but p points into the FIRST
+    // mbuf, so bound the option walk by the contiguous first-mbuf length, not
+    // the chain total - otherwise a >4 KiB reply (jumbo / host GRO -> mbuf
+    // chain from a malicious on-link DHCPv6 server) would make the walk read
+    // past this mbuf.  A well-formed DHCPv6 reply is far smaller than one RX
+    // buffer, so clamping to the contiguous region loses nothing legitimate.
+    int chain_len = m->M_dat.MH.MH_pkthdr.len - payload_off;
+    int contig_len = (int)m->m_hdr.mh_len - payload_off;
+    int blen = (chain_len < contig_len) ? chain_len : contig_len;
+    if (blen < 0)
+        blen = 0;
     if (blen < 4)
         return false;
 
@@ -281,6 +292,12 @@ bool dhcp6_interface_state::parse(struct mbuf* m, msg_type& out_type)
     if (xid != _xid)
         return false;   // not our transaction
 
+    // Only after confirming this reply is for our transaction do we reset the
+    // per-reply learned state, so a non-matching (e.g. spoofed) packet cannot
+    // wipe good state, and repeated matching replies do not accumulate.
+    _dns.clear();
+    _have_addr = false;
+
     int off = 4;
     while (off + 4 <= blen) {
         u16 code = get16(p + off);
@@ -358,6 +375,14 @@ void dhcp6_interface_state::bind_address()
 
 void dhcp6_interface_state::process_packet(struct mbuf* m)
 {
+    // Only process replies while we are actually soliciting/requesting. Once
+    // bound (or before we start), ignore unsolicited packets: otherwise an
+    // on-link attacker who observed our SOLICIT's transaction id could spray
+    // crafted REPLYs, each of which parse() would append to _dns/_server_duid,
+    // growing them without bound (memory DoS).
+    if (_state != DH6_SOLICITING && _state != DH6_REQUESTING) {
+        return;
+    }
     msg_type t;
     if (!parse(m, t))
         return;

core/net_channel.cc

@@ -285,6 +285,19 @@ net_channel* classifier::classify_ipv6_tcp(mbuf* m, ip6_hdr *ip_hdr, size_t ip_l
         return nullptr;
     }
 
+    // ip6_lasthdr_nofrag only guarantees the base IPv6 header (and any
+    // extension headers) fit; it does NOT guarantee a full TCP header is
+    // present and contiguous in this mbuf.  A crafted frame (short, or with
+    // extension headers pushing nxt_off toward the end, or split across an
+    // mbuf chain) could otherwise make the tcp_hdr dereferences below read out
+    // of bounds on the lock-free RX fast path.  Require the TCP header to lie
+    // wholly within the contiguous first mbuf before touching it; anything
+    // else falls through to the slow path (tcp_input), which pulls up.
+    if (nxt_off < 0 ||
+        (size_t)nxt_off + sizeof(struct tcphdr) > (size_t)m->m_hdr.mh_len) {
+        return nullptr;
+    }
+
     auto tcp_hdr = reinterpret_cast<tcphdr*>(start + nxt_off);
     if (tcp_hdr->th_flags & (TH_SYN | TH_FIN | TH_RST)) {
 	    return nullptr;