diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2024-08-14 09:29:30 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2024-09-19 12:58:15 +0000 |
| commit | 9481d7a260822d20d60d582bfff20bdd754c49c5 (patch) | |
| tree | 1bf295817ff26cd46cba3d90b1378c92f758d13e | |
| parent | 0b3294327ae3f91c3638a985fe1513dee74a2582 (diff) | |
| download | src-9481d7a260822d20d60d582bfff20bdd754c49c5.tar.gz src-9481d7a260822d20d60d582bfff20bdd754c49c5.zip | |
pf: invert direction for inner icmp state lookups
(e.g. traceroute with icmp)
ok henning, jsing
Also extend the test case to cover this scenario.
Approved by: so
Security: FreeBSD-EN-24:16.pf
PR: 280701
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 89f6723288b0d27d3f14f93e6e83f672fa2b8aca)
(cherry picked from commit 46c4fc50d3012ca3c8756df243589add36b70830)
| -rw-r--r-- | sys/netpfil/pf/pf.c | 21 |
1 files changed, 11 insertions, 10 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index ac6c64ec1fa2..1cf13d4d642e 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -309,7 +309,7 @@ static int pf_test_state_udp(struct pf_kstate **, int pf_icmp_state_lookup(struct pf_state_key_cmp *, struct pf_pdesc *, struct pf_kstate **, struct mbuf *, int, struct pfi_kkif *, u_int16_t, u_int16_t, - int, int *, int); + int, int *, int, int); static int pf_test_state_icmp(struct pf_kstate **, struct pfi_kkif *, struct mbuf *, int, void *, struct pf_pdesc *, u_short *); @@ -6091,7 +6091,8 @@ pf_test_state_sctp(struct pf_kstate **state, struct pfi_kkif *kif, int pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd, struct pf_kstate **state, struct mbuf *m, int direction, struct pfi_kkif *kif, - u_int16_t icmpid, u_int16_t type, int icmp_dir, int *iidx, int multi) + u_int16_t icmpid, u_int16_t type, int icmp_dir, int *iidx, int multi, + int inner) { key->af = pd->af; key->proto = pd->proto; @@ -6128,7 +6129,8 @@ pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd, /* Is this ICMP message flowing in right direction? */ if ((*state)->rule.ptr->type && - (((*state)->direction == direction) ? + (((!inner && (*state)->direction == direction) || + (inner && (*state)->direction != direction)) ? PF_IN : PF_OUT) != icmp_dir) { if (V_pf_status.debug >= PF_DEBUG_MISC) { printf("pf: icmp type %d in wrong direction (%d): ", @@ -6186,7 +6188,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, */ ret = pf_icmp_state_lookup(&key, pd, state, m, pd->dir, kif, virtual_id, virtual_type, icmp_dir, &iidx, - PF_ICMP_MULTI_NONE); + PF_ICMP_MULTI_NONE, 0); if (ret >= 0) { if (ret == PF_DROP && pd->af == AF_INET6 && icmp_dir == PF_OUT) { @@ -6194,7 +6196,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, PF_STATE_UNLOCK((*state)); ret = pf_icmp_state_lookup(&key, pd, state, m, pd->dir, kif, virtual_id, virtual_type, - icmp_dir, &iidx, multi); + icmp_dir, &iidx, multi, 0); if (ret >= 0) return (ret); } else @@ -6278,6 +6280,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, int off2 = 0; pd2.af = pd->af; + pd2.dir = pd->dir; /* Payload packet is from the opposite direction. */ pd2.sidx = (pd->dir == PF_IN) ? 1 : 0; pd2.didx = (pd->dir == PF_IN) ? 0 : 1; @@ -6599,10 +6602,9 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, pf_icmp_mapping(&pd2, iih->icmp_type, &icmp_dir, &multi, &virtual_id, &virtual_type); - pd2.dir = icmp_dir; ret = pf_icmp_state_lookup(&key, &pd2, state, m, pd2.dir, kif, virtual_id, virtual_type, - icmp_dir, &iidx, PF_ICMP_MULTI_NONE); + icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1); if (ret >= 0) return (ret); @@ -6655,10 +6657,9 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, pf_icmp_mapping(&pd2, iih->icmp6_type, &icmp_dir, &multi, &virtual_id, &virtual_type); - pd2.dir = icmp_dir; ret = pf_icmp_state_lookup(&key, &pd2, state, m, pd->dir, kif, virtual_id, virtual_type, - icmp_dir, &iidx, PF_ICMP_MULTI_NONE); + icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1); if (ret >= 0) { if (ret == PF_DROP && pd->af == AF_INET6 && icmp_dir == PF_OUT) { @@ -6667,7 +6668,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif, ret = pf_icmp_state_lookup(&key, pd, state, m, pd->dir, kif, virtual_id, virtual_type, - icmp_dir, &iidx, multi); + icmp_dir, &iidx, multi, 1); if (ret >= 0) return (ret); } else |