upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf: handle divert packets

Browse source 
In a divert setup pf_test_state() may return PF_PASS, but not set the state
pointer. We didn't handle that, and as a result crashed immediately afterwards
trying to dereference that NULL state pointer.

Add a test case to provoke the problem.

PR:		260867
MFC after:	2 weeks
Submitted by:	Phil Budne <phil.budne@gmail.com>
Sponsored by:	Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 66f2f1c83247f05a3a599d7e88c7e7efbedd16b5)
This commit is contained in:
Kristof Provost 2025-11-15 14:44:54 +01:00 committed by Franco Fichtner
parent 9fd95726b1
commit abdb9fc652
2 changed files with 54 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
sys/netpfil/pf/pf.c
View file

@ -8645,10 +8645,12 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
goto done;
action = pf_test_state_tcp(&s, kif, m, off, h, &pd, &reason);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule.ptr;
a = s->anchor.ptr;
if (s != NULL) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule.ptr;
a = s->anchor.ptr;
}
} else if (s == NULL) {
/* Validate remote SYN|ACK, re-create original SYN if
* valid. */
@ -8708,10 +8710,12 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
}
action = pf_test_state_udp(&s, kif, m, off, h, &pd);
if (action == PF_PASS) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule.ptr;
a = s->anchor.ptr;
if (s != NULL) {
if (V_pfsync_update_state_ptr != NULL)
V_pfsync_update_state_ptr(s);
r = s->rule.ptr;
a = s->anchor.ptr;
}
} else if (s == NULL)
action = pf_test_rule(&r, &s, kif, m, off, &pd,
&a, &ruleset, inp);

44
tests/sys/netpfil/pf/divert-to.sh
View file

@ -509,6 +509,47 @@ ipfwon_in_dn_in_div_in_out_dn_out_div_out_cleanup()
pft_cleanup
}
atf_test_case "pr260867" "cleanup"
pr260867_head()
{
atf_set descr 'Test for the loop reported in PR260867'
atf_set require.user root
}
pr260867_body()
{
pft_init
divert_init
epair=$(vnet_mkepair)
ifconfig ${epair}a 192.0.2.1/24 up
vnet_mkjail alcatraz ${epair}b
jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up
# Sanity check
atf_check -s exit:0 -o ignore ping -c3 192.0.2.2
jexec alcatraz /usr/sbin/inetd -p ${PWD}/inetd-echo.pid $(atf_get_srcdir)/echo_inetd.conf
jexec alcatraz $(atf_get_srcdir)/../common/divapp 1001 divert-back &
jexec alcatraz pfctl -e
pft_set_rules alcatraz \
"pass in on ${epair}b proto tcp from any to port 7 divert-to 0.0.0.0 port 1001"
reply=$(echo "foo" | nc -N 192.0.2.2 7)
if ["${reply}" != "foo" ];
then
atf_fail "Did not receive echo reply"
fi
}
pr260867_cleanup()
{
pft_cleanup
}
atf_init_test_cases()
{
atf_add_test_case "ipfwoff_in_div"
@ -524,6 +565,5 @@ atf_init_test_cases()
atf_add_test_case "ipfwoff_in_div_in_fwd_out_div_out"
atf_add_test_case "ipfwon_in_div_in_fwd_out_div_out"
atf_add_test_case "ipfwoff_in_dn_in_div_in_out_dn_out_div_out"
atf_add_test_case "ipfwon_in_dn_in_div_in_out_dn_out_div_out"
atf_add_test_case "pr260867"
}