Date: Thu, 23 Jul 2026 12:41:14 +0000 From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 145541d4ed79 - main - pf(4) fix NULL pointer dereference in outbound packet path. Message-ID: <6a620bea.1be5d.2b439300@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=145541d4ed7923dc87e7e1a2e6864d123f81f4d2 commit 145541d4ed7923dc87e7e1a2e6864d123f81f4d2 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-07-23 09:06:01 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-07-23 11:27:36 +0000 pf(4) fix NULL pointer dereference in outbound packet path. Outbound packet which matches rule with source limiter attached, for example: source limiter "crash" id 1 entries 10000 limit 1000 pass out from any to any source limiter "crash" keep state triggers a NULL pointer dereference. The issue was kindly reported and initial version of fix submitted by SecBuddyF, Tencent KeenLab. The submitted diff fixed the issue for failing look up by destination address in outbound packet. dlg@ also pointed out the change should be further improved so NULL pointer dereference is avoided when rule uses nat-to/rdr-to option. OK dlg@ Obtained from: OpenBSD, sashan <sashan@openbsd.org>, f0f215c11e Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 13 ++++++++++-- tests/sys/netpfil/pf/limiters.sh | 46 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 10e73ce1e7b9..7dc9d59e8300 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -3134,14 +3134,23 @@ pf_remove_state(struct pf_kstate *s) case PF_STATE_LINK_TYPE_SOURCELIM: { struct pf_sourcelim *srlim; struct pf_source key, *sr; + int sidx, kidx; + + if (s->direction == PF_IN) { + sidx = 0; + kidx = PF_SK_WIRE; + } else { + sidx = 1; + kidx = PF_SK_STACK; + } srlim = pf_sourcelim_find(s->sourcelim); KASSERT(srlim != NULL, ("pf_state %p pfl %p cannot find sourcelim %u", s, pfl, s->sourcelim)); - pf_source_key(srlim, &key, s->key[PF_SK_WIRE]->af, - &s->key[PF_SK_WIRE]->addr[0 /* XXX or 1? */]); + pf_source_key(srlim, &key, s->key[kidx]->af, + &s->key[kidx]->addr[sidx]); sr = pf_source_find(srlim, &key); KASSERT(sr != NULL, diff --git a/tests/sys/netpfil/pf/limiters.sh b/tests/sys/netpfil/pf/limiters.sh index f576955e5640..c8ecc517e26c 100644 --- a/tests/sys/netpfil/pf/limiters.sh +++ b/tests/sys/netpfil/pf/limiters.sh @@ -306,6 +306,51 @@ source_basic_cleanup() pft_cleanup } +atf_test_case "out" "cleanup" +out_head() +{ + atf_set descr 'Test limiters on outbound rules' + atf_set require.user root +} + +out_body() +{ + pft_init + + epair=$(vnet_mkepair) + + ifconfig ${epair}a 192.0.2.2/24 up + ifconfig ${epair}a inet alias 192.0.2.3/24 up + + vnet_mkjail alcatraz ${epair}b + jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up + + # Sanity check + atf_check -s exit:0 -o ignore \ + ping -S 192.0.2.2 -c 1 192.0.2.1 + atf_check -s exit:0 -o ignore \ + ping -S 192.0.2.3 -c 1 192.0.2.1 + + jexec alcatraz pfctl -e + + # Allow up to one source for ICMP. + pft_set_rules alcatraz \ + "set timeout icmp.error 120" \ + "source limiter \"crash\" id 1 entries 10000 limit 1000" \ + "block out proto icmp" \ + "pass out from any to any source limiter \"crash\" keep state" + + atf_check -s exit:0 -o ignore \ + ping -S 192.0.2.2 -c 2 192.0.2.1 + + jexec alcatraz pfctl -Fs +} + +out_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "state_basic" @@ -313,4 +358,5 @@ atf_init_test_cases() atf_add_test_case "state_block" atf_add_test_case "state_multiple" atf_add_test_case "source_basic" + atf_add_test_case "out" }home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a620bea.1be5d.2b439300>