diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2024-09-30 12:31:13 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2024-10-10 12:10:39 +0000 |
| commit | 7b033960e15a998a388b1e4e84be9169b7762470 (patch) | |
| tree | 9165bcc88c2d3c04f5c223d7e20a3cb4a100b872 | |
| parent | 5c3d74eca642220c1a6137528f66245b86d6939d (diff) | |
pf: stricter address family checks in icmp-in-icmp
If ipv4+icmp6 or ipv6+icmp packets were embedded into an icmp
payload, we missed to drop them. While there, also add a reason
to the corresponding check in pf_test().
ok mcbride@ claudio@
Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 7ce93f3346
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D46929
| -rw-r--r-- | sys/netpfil/pf/pf.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index aa63c2c1d390..891c490a0b1e 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -7342,6 +7342,11 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, case IPPROTO_ICMP: { struct icmp *iih = &pd2.hdr.icmp; + if (pd2.af != AF_INET) { + REASON_SET(reason, PFRES_NORM); + return (PF_DROP); + } + if (!pf_pull_hdr(m, off2, iih, ICMP_MINLEN, NULL, reason, pd2.af)) { DPFPRINTF(PF_DEBUG_MISC, @@ -7400,6 +7405,11 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, case IPPROTO_ICMPV6: { struct icmp6_hdr *iih = &pd2.hdr.icmp6; + if (pd2.af != AF_INET6) { + REASON_SET(reason, PFRES_NORM); + return (PF_DROP); + } + if (!pf_pull_hdr(m, off2, iih, sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) { DPFPRINTF(PF_DEBUG_MISC, @@ -9201,6 +9211,7 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0 case IPPROTO_ICMP: { if (af != AF_INET) { action = PF_DROP; + REASON_SET(&reason, PFRES_NORM); DPFPRINTF(PF_DEBUG_MISC, ("dropping IPv6 packet with ICMPv4 payload")); goto done; @@ -9220,6 +9231,7 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0 case IPPROTO_ICMPV6: { if (af != AF_INET6) { action = PF_DROP; + REASON_SET(&reason, PFRES_NORM); DPFPRINTF(PF_DEBUG_MISC, ("pf: dropping IPv4 packet with ICMPv6 payload\n")); goto done; |