upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf: verify SCTP v_tag before updating connection state

Browse source 
Make it harder to manipulate the firewall state by verifying the v tag before we
update states.

MFC after:	2 weeks
Sponsored by:	Orange Business Services

(cherry picked from commit 4713d2fd5663eb64aa582dabced21d253c901a66)
This commit is contained in:
Kristof Provost 2025-01-06 10:06:58 +01:00 committed by Franco Fichtner
parent 0f09722c20
commit efd622d007
1 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
sys/netpfil/pf/pf.c
View file

@ -6227,6 +6227,13 @@ pf_test_state_sctp(struct pf_kstate **state, struct pfi_kkif *kif,
return (PF_DROP);
}
if (src->scrub != NULL) {
if (src->scrub->pfss_v_tag == 0) {
src->scrub->pfss_v_tag = pd->hdr.sctp.v_tag;
} else if (src->scrub->pfss_v_tag != pd->hdr.sctp.v_tag)
return (PF_DROP);
}
/* Track state. */
if (pd->sctp_flags & PFDESC_SCTP_INIT) {
if (src->state < SCTP_COOKIE_WAIT) {
@ -6267,13 +6274,6 @@ pf_test_state_sctp(struct pf_kstate **state, struct pfi_kkif *kif,
(*state)->timeout = PFTM_SCTP_CLOSED;
}
if (src->scrub != NULL) {
if (src->scrub->pfss_v_tag == 0) {
src->scrub->pfss_v_tag = pd->hdr.sctp.v_tag;
} else if (src->scrub->pfss_v_tag != pd->hdr.sctp.v_tag)
return (PF_DROP);
}
(*state)->expire = time_uptime;
/* translate source/destination address, if necessary */