From nobody Thu Jul 23 12:41:14 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h5W2M2kJMz6ll2R for ; Thu, 23 Jul 2026 12:41:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h5W2L3V4zz43xJ for ; Thu, 23 Jul 2026 12:41:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784810474; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iQ27Y8pTXzQ7VbSFX3NGDUQPHgYQyeG2Iz9B9w5dcU8=; b=wQ74kZKZzWk+ahiGgC/+dth2Xp0YEKt9L1p+zzE7Buiqk9oJJHT11BsZ6CH3SEr0gJPNDm E/ERtPnvgUVD2JRzVF+waE4YhocSDviDp43LFD/YbfMNbJOhbOF6X0ARYaU08/SwVy03He TyvqqFWNM+dMONmAQi62LzWYIlyNfAgfWNHBoAWFOG/uGAcrnezerMBEsLAW+yC5Q3F6// hEv4o6y3YO9FF19i1yMbTv4cxaMx5uJNAsErM3Nv8iAkzyx6nHmRYakr6q3/YTBqkacKMC oXucYjFS+GAxJ9nDTsOesVRyxRMpg1mf3++9z75VfOE2g3dnqo9k3ThoVg7QVg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784810474; a=rsa-sha256; cv=none; b=neoPn2/fG/6Sf/9GTbtq0XV5it3E9ovMIWtyS1Wlj4K96nHa7gVDgwG3dD/Q8WWo3JgGQr liDKtAdfzhpRq0IQZa+HqELzn2KNUPX+HyvDoKueNCni+FeMNF71P5ZKKBkWGRZEHVB5dc 8dNT6X2TM3GAf8YohmbjOOAJc8S+rEpw1wrM2p76VcxR4V+nKEU9GGWXnrql9Qn6QeFC0M jNOj1C2zgyiV+hj2lVA0FK4W1YldtDzx38PvvGmPbysewXOuQtMZS5zY0wHUngF8w8G0bn DfksuRKRBz9gyhM6OFrVf1snmnd1qVvRDr61UZpNwsLyLzbQXqbdymlkXtGuhQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784810474; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iQ27Y8pTXzQ7VbSFX3NGDUQPHgYQyeG2Iz9B9w5dcU8=; b=q3sijTR66O/Ecd6gApSe90MgjECK3T+EXF0ufqizegqsNw5Oi8NYzSQP+1Iz3vgG7/TpcQ toa9OnG4f2pkkScX0ATElGc38ALctJUgzI8sV0m4EAJkiNahM0ypzGwzG2MSS1Ll19qqJV APbKu0qudxr7tK94ruGY6+9+CJ7bC2Pgdcv7bWKlSPtGZeOnbYIToNmORi0qh5cv3SCZ5W KKANQb6Q6JUbNoy4Yhd8u9zN/6kOhqVHvOdZFdTaJ89gtgb27veemgqKiF+uIf4OnOR2ST KwlUrdU/CYqcgjKidDHqsF28fuqftxPPXnsRJkuSmd8f5rEf3WAndCLYL4QJGQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h5W2L1qY2z15NG for ; Thu, 23 Jul 2026 12:41:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1be5d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 23 Jul 2026 12:41:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 145541d4ed79 - main - pf(4) fix NULL pointer dereference in outbound packet path. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 145541d4ed7923dc87e7e1a2e6864d123f81f4d2 Auto-Submitted: auto-generated Date: Thu, 23 Jul 2026 12:41:14 +0000 Message-Id: <6a620bea.1be5d.2b439300@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=145541d4ed7923dc87e7e1a2e6864d123f81f4d2 commit 145541d4ed7923dc87e7e1a2e6864d123f81f4d2 Author: Kristof Provost AuthorDate: 2026-07-23 09:06:01 +0000 Commit: Kristof Provost CommitDate: 2026-07-23 11:27:36 +0000 pf(4) fix NULL pointer dereference in outbound packet path. Outbound packet which matches rule with source limiter attached, for example: source limiter "crash" id 1 entries 10000 limit 1000 pass out from any to any source limiter "crash" keep state triggers a NULL pointer dereference. The issue was kindly reported and initial version of fix submitted by SecBuddyF, Tencent KeenLab. The submitted diff fixed the issue for failing look up by destination address in outbound packet. dlg@ also pointed out the change should be further improved so NULL pointer dereference is avoided when rule uses nat-to/rdr-to option. OK dlg@ Obtained from: OpenBSD, sashan , f0f215c11e Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 13 ++++++++++-- tests/sys/netpfil/pf/limiters.sh | 46 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 57 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 10e73ce1e7b9..7dc9d59e8300 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -3134,14 +3134,23 @@ pf_remove_state(struct pf_kstate *s) case PF_STATE_LINK_TYPE_SOURCELIM: { struct pf_sourcelim *srlim; struct pf_source key, *sr; + int sidx, kidx; + + if (s->direction == PF_IN) { + sidx = 0; + kidx = PF_SK_WIRE; + } else { + sidx = 1; + kidx = PF_SK_STACK; + } srlim = pf_sourcelim_find(s->sourcelim); KASSERT(srlim != NULL, ("pf_state %p pfl %p cannot find sourcelim %u", s, pfl, s->sourcelim)); - pf_source_key(srlim, &key, s->key[PF_SK_WIRE]->af, - &s->key[PF_SK_WIRE]->addr[0 /* XXX or 1? */]); + pf_source_key(srlim, &key, s->key[kidx]->af, + &s->key[kidx]->addr[sidx]); sr = pf_source_find(srlim, &key); KASSERT(sr != NULL, diff --git a/tests/sys/netpfil/pf/limiters.sh b/tests/sys/netpfil/pf/limiters.sh index f576955e5640..c8ecc517e26c 100644 --- a/tests/sys/netpfil/pf/limiters.sh +++ b/tests/sys/netpfil/pf/limiters.sh @@ -306,6 +306,51 @@ source_basic_cleanup() pft_cleanup } +atf_test_case "out" "cleanup" +out_head() +{ + atf_set descr 'Test limiters on outbound rules' + atf_set require.user root +} + +out_body() +{ + pft_init + + epair=$(vnet_mkepair) + + ifconfig ${epair}a 192.0.2.2/24 up + ifconfig ${epair}a inet alias 192.0.2.3/24 up + + vnet_mkjail alcatraz ${epair}b + jexec alcatraz ifconfig ${epair}b 192.0.2.1/24 up + + # Sanity check + atf_check -s exit:0 -o ignore \ + ping -S 192.0.2.2 -c 1 192.0.2.1 + atf_check -s exit:0 -o ignore \ + ping -S 192.0.2.3 -c 1 192.0.2.1 + + jexec alcatraz pfctl -e + + # Allow up to one source for ICMP. + pft_set_rules alcatraz \ + "set timeout icmp.error 120" \ + "source limiter \"crash\" id 1 entries 10000 limit 1000" \ + "block out proto icmp" \ + "pass out from any to any source limiter \"crash\" keep state" + + atf_check -s exit:0 -o ignore \ + ping -S 192.0.2.2 -c 2 192.0.2.1 + + jexec alcatraz pfctl -Fs +} + +out_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "state_basic" @@ -313,4 +358,5 @@ atf_init_test_cases() atf_add_test_case "state_block" atf_add_test_case "state_multiple" atf_add_test_case "source_basic" + atf_add_test_case "out" }