diff options
| author | Teddy Engel <engel.teddy@gmail.com> | 2026-06-02 16:24:57 +0000 |
|---|---|---|
| committer | Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> | 2026-06-22 22:15:36 +0000 |
| commit | 2e6b22abf44d99b84abf17fe25ca2e8f89716c04 (patch) | |
| tree | 72cee743bece366b07afd590c822685cb065b793 | |
| parent | 635ad6f2ec97e9c6b1f15620cd5ee84eb632082f (diff) | |
ipfw/nat64: Fix type confusion panic when using wrong NAT64 instance type
Add etlv type validation to ipfw_nat64clat() and ipfw_nat64stl() to
verify that the retrieved instance is actually a nat64clat instance
before use.
All NAT64 instance types share the same srvstate[] array but have
different struct layouts.
Without type validation, using the wrong instance type with
a handler causes type confusion and kernel panic.
Signed-off-by: Teddy Engel <engel.teddy@gmail.com>
PR: 292023
Reviewed by: pouria
Pull Request: https://github.com/freebsd/freebsd-src/pull/2259
| -rw-r--r-- | sys/netpfil/ipfw/nat64/nat64clat.c | 3 | ||||
| -rw-r--r-- | sys/netpfil/ipfw/nat64/nat64stl.c | 3 |
2 files changed, 4 insertions, 2 deletions
diff --git a/sys/netpfil/ipfw/nat64/nat64clat.c b/sys/netpfil/ipfw/nat64/nat64clat.c index c458f85755d3..15d052549792 100644 --- a/sys/netpfil/ipfw/nat64/nat64clat.c +++ b/sys/netpfil/ipfw/nat64/nat64clat.c @@ -214,7 +214,8 @@ ipfw_nat64clat(struct ip_fw_chain *chain, struct ip_fw_args *args, if (cmd->opcode != O_EXTERNAL_ACTION || insntod(cmd, kidx)->kidx != V_nat64clat_eid || icmd->opcode != O_EXTERNAL_INSTANCE || - (cfg = NAT64_LOOKUP(chain, icmd)) == NULL) + (cfg = NAT64_LOOKUP(chain, icmd)) == NULL || + cfg->no.etlv != IPFW_TLV_NAT64CLAT_NAME) return (0); switch (args->f_id.addr_type) { diff --git a/sys/netpfil/ipfw/nat64/nat64stl.c b/sys/netpfil/ipfw/nat64/nat64stl.c index c1ca2dfd5e13..305ba1e9e8dc 100644 --- a/sys/netpfil/ipfw/nat64/nat64stl.c +++ b/sys/netpfil/ipfw/nat64/nat64stl.c @@ -217,7 +217,8 @@ ipfw_nat64stl(struct ip_fw_chain *chain, struct ip_fw_args *args, if (cmd->opcode != O_EXTERNAL_ACTION || insntod(cmd, kidx)->kidx != V_nat64stl_eid || icmd->opcode != O_EXTERNAL_INSTANCE || - (cfg = NAT64_LOOKUP(chain, icmd)) == NULL) + (cfg = NAT64_LOOKUP(chain, icmd)) == NULL || + cfg->no.etlv != IPFW_TLV_NAT64STL_NAME) return (0); switch (args->f_id.addr_type) { |