upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-11 09:41:03 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

ng_nat: avoid panic if attached directly to ng_ether and got short packet

Browse source 
From the beginning, ng_nat safely assumed cleansed traffic
because of limited ways it could be attached to NETGRAPH:
ng_ipfw or ng_ppp only.

Now as it may be attached with ng_ether too, the assumption proven wrong.
Add needed check to the ng_nat. Thanks for markj for debugging this.

PR:		243096
Submitted by:	Lutz Donnerhacke <lutz@donnerhacke.de>
Reported by:	Robert James Hernandez <rob@sarcasticadmin.com>
Reviewed by:	markj and others
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D23091
This commit is contained in:
Eugene Grosbein 2020-02-12 00:31:00 +00:00
parent f976241773
commit 49f384cb47
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
sys/netgraph/ng_nat.c
View file

@ -806,11 +806,16 @@ ng_nat_rcvdata(hook_p hook, item_p item )
panic("Corrupted priv->dlt: %u", priv->dlt);
}
if (m->m_pkthdr.len < ipofs + sizeof(struct ip))
goto send; /* packet too short to hold IP */
c = (char *)mtodo(m, ipofs);
ip = (struct ip *)mtodo(m, ipofs);
KASSERT(m->m_pkthdr.len == ipofs + ntohs(ip->ip_len),
("ng_nat: ip_len != m_pkthdr.len"));
if (ip->ip_v != IPVERSION)
goto send; /* other IP version, let it pass */
if (m->m_pkthdr.len < ipofs + ntohs(ip->ip_len))
goto send; /* packet too short (i.e. fragmented or broken) */
/*
* We drop packet when: