Fix sending of TCP segments when IP level options are specified

[tuexen]

Summary

When bringing in TCP over UDP support, the length of IP level options was considered when locating the transport header. This was incorrect and is fixed by this patch.

This issue was detected by syzkaller.

[rscheff]

Where are the ip options accounted for, then? Is the mbuf already adjusted to no longer contain ipoptions by that time (not familiar with IP level processing).

[tuexen]

In D30358#681969, @rscheff wrote:

Where are the ip options accounted for, then? Is the mbuf already adjusted to no longer contain ipoptions by that time (not familiar with IP level processing).

It is used to ensure that the TCP/IP packet honours the MSS.

[rscheff]

discussed in transport call.

[markj]

Seems ok to me.

sys/netinet/tcp_output.c

1166

This code is duplicated 6 times across the various TCP stacks. Could we lift it into a subroutine as a follow-up change?

[tuexen]

sys/netinet/tcp_output.c

1166

This is true for more than this. For RACK/BBR there are common functions, but not so much for the base stack and the optional ones.

[tuexen]

Commited in https://cgit.FreeBSD.org/src/commit/?id=500eb6dd80404ea512e31a8f795c73cb802c9c64.