ipfilter: Validate length before checksum

[cy]

Summary

Validate the length of the packet listed in the mbuf is the same as
the calculated packet length. If not reject the packet and bump the
bad packet stat.

PR: 295198
MFC after: 3 days

[markj]

I ran this through the test suite and didn't see any problems, so it's ok with me. I wasn't able to reproduce the crash consistently before, only quite rarely, so it's hard to say that the problem is fixed for sure.

At a glance it's not clear to me that fin->fin_m is always going to have a mbuf header, i.e., that fin->fin_m->m_pkthdr will be valid.

[cy]

In D57095#1308692, @markj wrote:

I ran this through the test suite and didn't see any problems, so it's ok with me. I wasn't able to reproduce the crash consistently before, only quite rarely, so it's hard to say that the problem is fixed for sure.

At a glance it's not clear to me that fin->fin_m is always going to have a mbuf header, i.e., that fin->fin_m->m_pkthdr will be valid.

It may not always have an mbuf header. That field is set to NULL when ipfilter creates its own packet. This is why the test for fin->fin_m != NULL. Otherwise a packet header will always be present. This has been running on my internet gateway for over a week.

[cy]

Apply markj's suggestion, test for valid packet header.