From nobody Sun Jun 1 19:54:04 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4b9SNF4Wdqz5y5th; Sun, 01 Jun 2025 19:54:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4b9SND6tFzz3swh; Sun, 01 Jun 2025 19:54:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1748807645; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UVVqSi5xkitmStrsHHlCb7CtGXc33EG5gK8pxqBtkEM=; b=Na6nQNpJkPr2gGfQ7n48O2UfUycj9Dj8blTn/GfcRO1u9guMiTmUzEQ7i14c9o4sUfTGXQ SyJePpBWIfTaPTd1Vacfbz4vK8ybug0/06ZFLJobFbmbkZc+47DM3W4W2CW3bWaFG3cF0T VssIvkuddDRxRB3zi+i1QqCkTEpM4De6CAFkyd9FrElLByo5c65/Ef62S3uiIZG4qFV+mQ JX32nufgtJ9sYKHWqVjf2c9U/7Xc9TcefEQV0CY8/SVynn//WPN35DvH71H2UxR0BU6tXo e6EnkpIyXdk1BCBSulHXGypVDRICE3+ILBHxTZ3qe7q8291Ppfh8eXkoy0OLeg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1748807645; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UVVqSi5xkitmStrsHHlCb7CtGXc33EG5gK8pxqBtkEM=; b=uKrsBMlSB282MoJ1sw4wmN+1bHWNfPLMXV7SKIgMLL9vgtFW1dyOsKepBrcCaN4Ot8qz4H nVWd6zmkniIZv9/1W20hOdGette5GBZ8mQaehSIe7JTBIg/Fg9EbQHjze22n0GqVA6kWTK 59EcHyNck9SHxztdJcHIjYe5L1FVeR1nBifgqHTYrcE0DkGMb5saPUBH9oPXYaKeilHfTe +5T6EDQq0PI8upPHw4qhbuaLXXHlBewrsJqMIvF9tY+PyNxRU3D9j1gXDq8igH+5vp3sk/ FuplMgw3IJ4tBwzIBsi9ctcgK7Akgpn51qgN3tf5VcmR6jUIDGkaH6t1Z71UGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1748807645; a=rsa-sha256; cv=none; b=Pu5IN8eFFCPa1ouCcXl1R48Et8SyreksRMNwLiT1JTfREauli0jki/bVJtZy+L3sJb9qwh 28akiY359V+KvX9NL3gAdbnZqJTGbHSBjjL2C3dXqlj/ZtPXL5OjO/s8KXNdO04XqhkN0w 1DoS/ctcqJ7gNfdY+zCTXxOD8qH1/PIPkf2X6Mi6z9lErwq7AIEPSYi/i80wbhXS1OEu3f b8gxZig7WLK2wmfEgnJCOaenFhzQQJRIm3iEf19Qw5rz6p8rHvA5mk6mMuJwFD2zr42Vh7 SbWBFq7OCGIfN8Vtb82kAKrUmi+BBoHt17U76FsPdmq8PDEbjHtLeHrm02aKVw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4b9SND4tTDzf0K; Sun, 01 Jun 2025 19:54:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 551Js4wl046189; Sun, 1 Jun 2025 19:54:04 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 551Js4KT046186; Sun, 1 Jun 2025 19:54:04 GMT (envelope-from git) Date: Sun, 1 Jun 2025 19:54:04 GMT Message-Id: <202506011954.551Js4KT046186@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 226076aa20f3 - stable/14 - netinet6: Do not forward or send ICMPv6 messages to the unspec address List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 226076aa20f311f7c2d21aa862ce14441db5d078 Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=226076aa20f311f7c2d21aa862ce14441db5d078 commit 226076aa20f311f7c2d21aa862ce14441db5d078 Author: Mark Johnston AuthorDate: 2025-04-22 14:54:37 +0000 Commit: Mark Johnston CommitDate: 2025-06-01 19:53:29 +0000 netinet6: Do not forward or send ICMPv6 messages to the unspec address As in f7174eb2b4c4 ("netinet: Do not forward or ICMP response to INADDR_ANY"), the IPv6 stack should avoid sending packets to the unspecified address. In particular: - Make sure that we do not forward received packets to the unspecified address; the check in ip6_input() catches this in the common case, but after commit 40faf87894ff it's possible for a pfil hook to bypass this check and pass the packet to ip6_forward() using the PACKET_TAG_IPFORWARD tag. - Make sure that we do not reflect packets back to the unspecified address; RFC 4443 section 2.4 states that we must not generate error messages in response to packets from the unspecified address. Reviewed by: zlei, glebius Reported by: Franco Fichtner MFC after: 1 month Sponsored by: Klara, Inc. Sponsored by: OPNsense Differential Revision: https://reviews.freebsd.org/D49339 (cherry picked from commit b7a61e09e4ad5fda44b7f4b6fee14f1b53996b41) --- sys/netinet6/icmp6.c | 6 ++++++ sys/netinet6/ip6_forward.c | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c index 0a0ca80de721..8d6e04c926c7 100644 --- a/sys/netinet6/icmp6.c +++ b/sys/netinet6/icmp6.c @@ -2089,6 +2089,12 @@ icmp6_reflect(struct mbuf *m, size_t off) hlim = 0; srcp = NULL; + if (__predict_false(IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src))) { + nd6log((LOG_DEBUG, + "icmp6_reflect: source address is unspecified\n")); + goto bad; + } + /* * If the incoming packet was addressed directly to us (i.e. unicast), * use dst as the src for the reply. diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index 44a349d1750f..ad8c95c9363c 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -109,7 +109,8 @@ ip6_forward(struct mbuf *m, int srcrt) */ if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 || IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { IP6STAT_INC(ip6s_cantforward); /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */ if (V_ip6_log_cannot_forward && ip6_log_ratelimit()) {