Bogus KASSERT() in tcp_output()?

[Bjoern A. Zeeb]

On Tue, 1 Feb 2011, Lawrence Stewart wrote:

> On 02/01/11 04:17, John Baldwin wrote:
>> Somewhat related fallout to the bug reported on security@ recently, I think
>> this KASSERT() in tcp_output() is bogus:
>>
>>
>> 	KASSERT(len + hdrlen + ipoptlen == m_length(m, NULL),
>> 	    ("%s: mbuf chain shorter than expected", __func__));
>>
>> Specifically, just a few lines earlier in tcp_output() we set the packet
>> header length to just 'len + hdrlen':
>>
>> 	/*
>> 	 * Put TCP length in extended header, and then
>> 	 * checksum extended header and data.
>> 	 */
>> 	m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */
>>
>> Also, the ipoptions are stored in a separate mbuf chain in the in pcb
>> (inp_options) that is passed as a separate argument to ip_output().  Given
>> that, I would think that m_length() should not reflect ipoptlen since it
>> should not include IP options in that chain?
>>
>
> There is some relevant prior discussion on src-committers@ for r212803
> between Andre and Bjoern.

Yeah and I still have the temporary workaround from
http://p4web.freebsd.org/@@185095?ac=10

I think you are specifically refering to
http://lists.freebsd.org/pipermail/svn-src-head/2010-October/021814.html

I had been pinging people back then, but I am happy to see the
discussion about these TCP changes finally happing now.  I'll have to
swap thing back in completly - it's been more than three months. Let
me see later today.

/bz

-- 
Bjoern A. Zeeb                                 You have to have visions!
         <ks> Going to jail sucks -- <bz> All my daemons like it!
   http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails.html