The raw ip input functions are called from several places. Use the

address family passed down with pr_input to check that the correct
one is used.
OK florian@

diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index f19ed9f..8f7fba3 100644 (file)
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: raw_ip.c,v 1.98 2017/04/14 20:46:31 bluhm Exp $       */
+/*     $OpenBSD: raw_ip.c,v 1.99 2017/04/17 21:10:03 bluhm Exp $       */
 /*     $NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $     */
 
 /*
@@ -125,6 +125,8 @@ rip_input(struct mbuf **mp, int *offp, int proto, int af)
        struct counters_ref ref;
        uint64_t *counters;
 
+       KASSERT(af == AF_INET);
+
        ripsrc.sin_addr = ip->ip_src;
        TAILQ_FOREACH(inp, &rawcbtable.inpt_queue, inp_queue) {
                if (inp->inp_socket->so_state & SS_CANTRCVMORE)

diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
index 5f83fb9..d3a8265 100644 (file)
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: raw_ip6.c,v 1.109 2017/04/14 20:46:31 bluhm Exp $     */
+/*     $OpenBSD: raw_ip6.c,v 1.110 2017/04/17 21:10:03 bluhm Exp $     */
 /*     $KAME: raw_ip6.c,v 1.69 2001/03/04 15:55:44 itojun Exp $        */
 
 /*
@@ -125,6 +125,8 @@ rip6_input(struct mbuf **mp, int *offp, int proto, int af)
        struct sockaddr_in6 rip6src;
        struct mbuf *opts = NULL;
 
+       KASSERT(af == AF_INET6);
+
        rip6stat_inc(rip6s_ipackets);
 
        /* Be proactive about malicious use of IPv4 mapped address */