irdma: improve validation checks further

[rscheff]

Summary

Verify  various IP header fields
Check that no no extention headers (IPv6) are present
Check that no IPv4 options are present

[rscheff]

• fix typo

[markj]

sys/dev/irdma/irdma_utils.c

1525

Isn't this check redundant? The check below for iphlen != (iph->ip_hl << 2) will catch this case too: iphlen is either 20 or 40, so if iph->ip_hl < 5, then iph->ip_hl << 2 must be less than 20.

[markj]

sys/dev/irdma/irdma_utils.c

1614

Why isn't it necessary to patch this function as well?

[rscheff]

sys/dev/irdma/irdma_utils.c

1525

The issue is that iphlen is not extracted from the actual packets, but populated just by assuming the header is either IPv4 or IPv6; IP headers are variable length with IPv4. iph->ip_hl is the data extracted from the actual header. And with IPv6, one can use extention headers between the IP and TCP header, to dynamically shift the actual TCP (and iWARP) offset around.

These are representing valid uses of IP, and while it is maybe possible the firmware filters this out, ensuring the conformaty in the slow path here seems prudent.

1614

Fixed in D58323, thx.

[markj]

sys/dev/irdma/irdma_utils.c

1523

Do we need to check that the received buffer is large enough to contain an IP header, before we start dereferencing iph?