upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-08 16:22:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf: invert direction for inner icmp state lookups

Browse source 
(e.g. traceroute with icmp)
ok henning, jsing

Also extend the test case to cover this scenario.

PR:		280701
Obtained from:	OpenBSD
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2024-08-14 11:29:30 +02:00
parent 8c44df321c
commit 89f6723288
3 changed files with 17 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
sys/netpfil/pf/pf.c
View file

@ -348,7 +348,7 @@ static int pf_test_state_udp(struct pf_kstate **,
int pf_icmp_state_lookup(struct pf_state_key_cmp *,
struct pf_pdesc *, struct pf_kstate **, struct mbuf *,
int, struct pfi_kkif *, u_int16_t, u_int16_t,
int, int *, int);
int, int *, int, int);
static int pf_test_state_icmp(struct pf_kstate **,
struct pfi_kkif *, struct mbuf *, int,
void *, struct pf_pdesc *, u_short *);
@ -6639,7 +6639,8 @@ pf_multihome_scan_asconf(struct mbuf *m, int start, int len,
int
pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
struct pf_kstate **state, struct mbuf *m, int direction, struct pfi_kkif *kif,
u_int16_t icmpid, u_int16_t type, int icmp_dir, int *iidx, int multi)
u_int16_t icmpid, u_int16_t type, int icmp_dir, int *iidx, int multi,
int inner)
{
key->af = pd->af;
key->proto = pd->proto;
@ -6676,7 +6677,8 @@ pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
/* Is this ICMP message flowing in right direction? */
if ((*state)->rule.ptr->type &&
(((*state)->direction == direction) ?
(((!inner && (*state)->direction == direction) ||
(inner && (*state)->direction != direction)) ?
PF_IN : PF_OUT) != icmp_dir) {
if (V_pf_status.debug >= PF_DEBUG_MISC) {
printf("pf: icmp type %d in wrong direction (%d): ",
@ -6734,7 +6736,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
*/
ret = pf_icmp_state_lookup(&key, pd, state, m, pd->dir,
kif, virtual_id, virtual_type, icmp_dir, &iidx,
PF_ICMP_MULTI_NONE);
PF_ICMP_MULTI_NONE, 0);
if (ret >= 0) {
if (ret == PF_DROP && pd->af == AF_INET6 &&
icmp_dir == PF_OUT) {
@ -6742,7 +6744,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
PF_STATE_UNLOCK((*state));
ret = pf_icmp_state_lookup(&key, pd, state, m,
pd->dir, kif, virtual_id, virtual_type,
icmp_dir, &iidx, multi);
icmp_dir, &iidx, multi, 0);
if (ret >= 0)
return (ret);
} else
@ -6826,6 +6828,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
int off2 = 0;
pd2.af = pd->af;
pd2.dir = pd->dir;
/* Payload packet is from the opposite direction. */
pd2.sidx = (pd->dir == PF_IN) ? 1 : 0;
pd2.didx = (pd->dir == PF_IN) ? 0 : 1;
@ -7147,10 +7150,9 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
pf_icmp_mapping(&pd2, iih->icmp_type,
&icmp_dir, &multi, &virtual_id, &virtual_type);
pd2.dir = icmp_dir;
ret = pf_icmp_state_lookup(&key, &pd2, state, m,
pd2.dir, kif, virtual_id, virtual_type,
icmp_dir, &iidx, PF_ICMP_MULTI_NONE);
icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
if (ret >= 0)
return (ret);
@ -7203,10 +7205,9 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
pf_icmp_mapping(&pd2, iih->icmp6_type,
&icmp_dir, &multi, &virtual_id, &virtual_type);
pd2.dir = icmp_dir;
ret = pf_icmp_state_lookup(&key, &pd2, state, m,
pd->dir, kif, virtual_id, virtual_type,
icmp_dir, &iidx, PF_ICMP_MULTI_NONE);
icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
if (ret >= 0) {
if (ret == PF_DROP && pd->af == AF_INET6 &&
icmp_dir == PF_OUT) {
@ -7215,7 +7216,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pfi_kkif *kif,
ret = pf_icmp_state_lookup(&key, pd,
state, m, pd->dir, kif,
virtual_id, virtual_type,
icmp_dir, &iidx, multi);
icmp_dir, &iidx, multi, 1);
if (ret >= 0)
return (ret);
} else

4
tests/sys/netpfil/pf/icmp.sh
View file

@ -108,7 +108,9 @@ ttl_exceeded_body()
jexec nat pfctl -e
pft_set_rules nat \
"nat on ${epair_int}b from 198.51.100.0/24 -> (${epair_int}b)" \
"pass"
"block" \
"pass inet proto udp" \
"pass inet proto icmp icmp-type { echoreq }"
# Sanity checks
atf_check -s exit:0 -o ignore \

4
tests/sys/netpfil/pf/icmp6.sh
View file

@ -120,7 +120,9 @@ ttl_exceeded_body()
jexec nat pfctl -e
pft_set_rules nat \
"nat on ${epair_int}b from 2001:db8:3::/64 -> (${epair_int}b:0)" \
"pass"
"block" \
"pass inet6 proto udp" \
"pass inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv, echoreq }"
# Sanity checks
atf_check -s exit:0 -o ignore \