From nobody Wed Nov 26 15:18:40 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dGjrJ4nG4z6JC3f for ; Wed, 26 Nov 2025 15:18:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dGjrJ2H2Lz3Ml4 for ; Wed, 26 Nov 2025 15:18:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1764170320; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hKLGr9WeGjkKsCsB7z2aKiKLzrOCaK7PLsoYVnkIieI=; b=XRXYQda+QCUpHyIOizJnoK/f/RUuInPoKUpqu9AFSgfeiFpT7HpTX8BAMYff0UD7jigUr7 f+D6R6EleAnzeNH1JNeNdhRDSb+o0eZwxhcAPjO3DFLVdbOA19hlntdhaMrBcmTwFU4k1X LTCHBgA2TX05TWy1R0GaFB14t7Uoc25uX+TihX6ws+Qk1s7Uw49LNztdNHh1PKR08dPCCz oPQXALalUcqDqrJOdjUgsqMOdSgeiZMm+xrXLywaH5Zc88mEACDmQGysyrYQal+AB6pWpL U2qqOiEjFe0hB5KJJdlyurI6acVQZCJY8L6jO1gRm5UYhX2MH+TcyoV+UsD4OA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1764170320; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hKLGr9WeGjkKsCsB7z2aKiKLzrOCaK7PLsoYVnkIieI=; b=NsmH/Mdvary5UbHnZUjRHtS85xauHY93Diqemh+Do1TUgOHLBHflS401x9k5in/UJ1XhBn Noy/Ywbihwle92j6YXuUbncfbP9NbwKcFvrMFzrlyhJ3+0O0GjzWsAtzBj1La5/LfqqDY4 227P3KClCEOfb4+yCcbLtmU3t3s0370gsnPw5/5ndFOADTwXK+FZW7VdrzZd0yB1+iNreh qNnyeIZ91yQtXW9ij23kJ01NC6CeqR2TkGyKz+Z4D05AtoKbAtz23+EkCCShBQDWjqhEkx Np0wBMZOAJvQgFfl5u0JAt+4NaIpaGIflKZnzyLezwsML4N2YYZHb5Mt7EAPcA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1764170320; a=rsa-sha256; cv=none; b=Dv5ie2W9+jRD5Y3lcFuAy5Jm37fimhWS1mlsjBwpo2S/McpP/J5IXTDcOi3w5OAdSPkXHG 5X3UoL/XLtupIq0ivN75akQnw+oa19J/pO724GdpmLAe9l+PlqlnIvk6s85WsRViF0uMyt dpb9yh1R3xfxVb0wS6uVNJmutx/bAfC2o1R343EtkIOllpSKCAlhzAO9i222cvjd/5kY8I yPCmvJGyOrUiAAdBOXKyhvL01X7KF/4DCJPY4dLkXj1iKYQdJ2ESNQvfLdaejZvB6/AzCp efmgUfQbgKuKiPlcVp/z+S1WSdndeWHSz1GH6CYJU0Rip3tU2JDZ6JdtorsZCA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dGjrJ1bZ6zrrf for ; Wed, 26 Nov 2025 15:18:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2d16b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 26 Nov 2025 15:18:40 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Cy Schubert Subject: git: 821774dfbdaa - main - ipfilter: Verify ipnat on entry into kernel List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 821774dfbdaa12ef072ff7eaea8f9966a7e63935 Auto-Submitted: auto-generated Date: Wed, 26 Nov 2025 15:18:40 +0000 Message-Id: <69271a50.2d16b.65aa5942@gitrepo.freebsd.org> The branch main has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=821774dfbdaa12ef072ff7eaea8f9966a7e63935 commit 821774dfbdaa12ef072ff7eaea8f9966a7e63935 Author: Cy Schubert AuthorDate: 2025-11-03 04:59:15 +0000 Commit: Cy Schubert CommitDate: 2025-11-26 15:16:47 +0000 ipfilter: Verify ipnat on entry into kernel The ipnat struct is built by ipnat(8), specifically ipnat_y.y when parsing the ipnat configuration file (typically ipnat.conf). ipnat contains a variable length string field at the end of the struct. This data field, called in_names, may contain various text strings such as NIC names. There is no upper bound limit to the length of strings as long as the in_namelen length field specifies the length of in_names within the ipnat structure and in_size specifies the size of the ipnat structure itself. Reported by: Ilja Van Sprundel Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53843 --- sbin/ipf/libipf/interror.c | 6 +++++ sys/netpfil/ipfilter/netinet/ip_nat.c | 42 ++++++++++++++++++++++++++++++++++- 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/sbin/ipf/libipf/interror.c b/sbin/ipf/libipf/interror.c index 4d48825bb3ad..6d5391f58ba2 100644 --- a/sbin/ipf/libipf/interror.c +++ b/sbin/ipf/libipf/interror.c @@ -363,6 +363,12 @@ log" }, { 60074, "unknown next address type (ipv6)" }, { 60075, "one object at a time must be copied" }, { 60076, "NAT ioctl denied in jail without VNET" }, + { 60077, "in_names offset is wrapped negative" }, + { 60078, "in_names larger than in_namelen" }, + { 60079, "ipnat larger than in_size" }, + { 60080, "ipnat and in_namelen mismatch in_size" }, + { 60081, "ip_names runs off the end of ipnat" }, + { 60082, "in_namelen too large" }, /* -------------------------------------------------------------------------- */ { 70001, "incorrect object size to get pool stats" }, { 70002, "could not malloc memory for new pool node" }, diff --git a/sys/netpfil/ipfilter/netinet/ip_nat.c b/sys/netpfil/ipfilter/netinet/ip_nat.c index 53c180cdfbca..44ab7e9283de 100644 --- a/sys/netpfil/ipfilter/netinet/ip_nat.c +++ b/sys/netpfil/ipfilter/netinet/ip_nat.c @@ -974,9 +974,13 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, int mode, int uid, void *ctx) { ipf_nat_softc_t *softn = softc->ipf_nat_soft; - int error = 0, ret, arg, getlock; + int error = 0, ret, arg, getlock, interr, i; + int interr_tbl[3] = { 60077, 60081, 60078 }; ipnat_t *nat, *nt, *n; ipnat_t natd; + char *name; + size_t v_in_size, v_element_size; + int v_rem_namelen, v_in_toend; SPL_INT(s); #if !SOLARIS && defined(_KERNEL) @@ -1027,6 +1031,16 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, error = EINVAL; goto done; } + if (sizeof(natd) + natd.in_namelen != natd.in_size) { + IPFERROR(60080); + error = EINVAL; + goto done; + } + if (natd.in_namelen < 0 || natd.in_namelen > softc->ipf_max_namelen) { + IPFERROR(60082); + error = EINVAL; + goto done; + } KMALLOCS(nt, ipnat_t *, natd.in_size); if (nt == NULL) { IPFERROR(60070); @@ -1041,6 +1055,32 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, nat = nt; } + /* + * Validate the incoming ipnat_t. + */ + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_ifnames[0])) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + if (nat->in_ifnames[0] != nat->in_ifnames[1]) { + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_ifnames[1])) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + } + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_plabel)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_pconfig)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + /* * For add/delete, look to see if the NAT entry is * already present