diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2026-05-04 16:08:35 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2026-05-12 07:54:38 +0000 |
| commit | 8d583858e499dcc23a1c7b6b9c80e2e84f245d04 (patch) | |
| tree | 9ea872e4994bbb88f5d72cd0546a4f9be1631308 | |
| parent | 302545bcbc1c81076123cb69a12a5514661972df (diff) | |
pfsync: reject invalid SCTP states
SCTP states should always have a src scrub object associated with them.
Crafted pfsync packets might not have this, leading to us derferencing a
NULL pointer on cleanup.
Validate the pfsync state insertion packet to make sure this is correct.
PR: 294989
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit bf6d00afdb6171ba04a1c5a7fde904cde87d212d)
| -rw-r--r-- | sys/netpfil/pf/if_pfsync.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index 6b828989c54d..10883e233b03 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -706,6 +706,13 @@ pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version) (st->act.rtableid >= 0 && st->act.rtableid < rt_numfibs))) goto cleanup; + if (sks->proto == IPPROTO_SCTP && st->src.scrub == NULL) { + if (V_pf_status.debug >= PF_DEBUG_MISC) + printf("%s: invalid SCTP state from creator id: %08x\n", __func__, + ntohl(sp->pfs_1301.creatorid)); + goto cleanup; + } + st->id = sp->pfs_1301.id; st->creatorid = sp->pfs_1301.creatorid; pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src); |