From nobody Fri Jan 31 19:18:27 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Yl5K02KhZz5msN9; Fri, 31 Jan 2025 19:18:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Yl5K01X1gz3HNV; Fri, 31 Jan 2025 19:18:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738351108; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UzmwkqTL1qz+XK5CFfjhpdDTPebGioiEEX7oNhMQ/RE=; b=kXF6UuH6LJcSjwq2BuUGO43j5512qcejU6wUs6yQ7eZgX9MJbkGbeuAnfDczOWaomE9Ikq 8wekcri5xJgXaEZyZ2u2AJ6XDXFuH8UiN0QrqXetTfaudSAcMfIi6uGxH48+35N6IRDw7L vtAse8ZjfjeMXXQ4i93/7KqOEf73eRfo0HOfVO/pQW5blKDkDPtLl9hf43fCNXMNshnXVD McbcRNC534QqatjBW6BEHEGF1ekZSKMta6DvrsbdEosRFVRgamIaVfgRCt+2PMVVaLOfdD Y1im1m8WT4bzSuJeOX8HenvNLnJTw5VGjdgnxnWDdhaBNufRxFL+7zE+hOWyHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738351108; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UzmwkqTL1qz+XK5CFfjhpdDTPebGioiEEX7oNhMQ/RE=; b=LMIvHoNHz1p9P9tWXb/+Mp91Tz0YPogqf3kaJmWYcy5KxY0KUTA4d3gFCNVnLWO3L/YwZD kukJDvCKCHe+lrGyFfYqTrdMpiDgSIpT8vWToc4KNjeet1wwX6SIrJ/PxpsClHtB8noO0S ws1VX763lFprzr7dF2RvvdYhc59kn+famcORfbDRdh9XrAfdk0vXkM0tBpoWj5OuwEI0UJ M6Y0wjZw2DXeajGi/nbysgyKy5XxqQ/lw2TUxu+gjNY04HuS8+DWhvR7VnO4S0CQ74l0qR 35zqvOKoU3Fvlti8p00WOPDvH7RQArkQfUgbAXPDqF8h15Yq3V3pTjRrJPYaBA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1738351108; a=rsa-sha256; cv=none; b=NW217/EP0zVrm6UfFhOEq1FsxN9OGXlda+WEhDiQIi8y5OvSPbAXRfShjYMOaGI8l2Xglv xAoTKSMVxTD1B5cU56s4lKDa/fXIwoGE90yhcwUsOc8gWCcyy2UvAxEA0x2ME3RRmuHkIe YjplUyNYg568RWmrucJQKojfBeF5jGvnu5QdFxZUlFrbzRg77Rrz336YPA+9pMiTBYObgp o1NKGOQSAmnTJ4HdyRK4Mdd0MJBTHJeYKk32k4xDMtk+4UH1CZw4ezlwUGrmIADlmVXUIB In16vUEnmtN8M1CUVVXsPizpkcEWh4qlCKgav7zMf8v2cLMGNp849pX56G+xVw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Yl5K00jbLzWrN; Fri, 31 Jan 2025 19:18:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50VJIRGL094764; Fri, 31 Jan 2025 19:18:27 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50VJIR8E094761; Fri, 31 Jan 2025 19:18:27 GMT (envelope-from git) Date: Fri, 31 Jan 2025 19:18:27 GMT Message-Id: <202501311918.50VJIR8E094761@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c55f457df678 - stable/14 - ip: Defer checks for an unspecified dstaddr until after pfil hooks List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c55f457df6788fdaae244ab8ba87069bf5f2373f Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c55f457df6788fdaae244ab8ba87069bf5f2373f commit c55f457df6788fdaae244ab8ba87069bf5f2373f Author: Mark Johnston AuthorDate: 2025-01-16 15:46:37 +0000 Commit: Mark Johnston CommitDate: 2025-01-31 19:18:01 +0000 ip: Defer checks for an unspecified dstaddr until after pfil hooks To comply with Common Criteria certification requirements, it may be necessary to ensure that packets to 0.0.0.0/::0 are dropped and logged by the system firewall. Currently, such packets are dropped by ip_input() and ip6_input() before reaching pfil hooks; let's defer the checks slightly to give firewalls a chance to drop the packets themselves, as this gives better observability. Add some regression tests for this with pf+pflog. Note that prior to commit 713264f6b8b, v4 packets to the unspecified address were not dropped by the IP stack at all. Note that ip_forward() and ip6_forward() ensure that such packets are not forwarded; they are passed back unmodified. Add a regression test which ensures that such packets are visible to pflog. Reviewed by: glebius MFC after: 3 weeks Sponsored by: Klara, Inc. Sponsored by: OPNsense Differential Revision: https://reviews.freebsd.org/D48163 (cherry picked from commit 40faf87894ff67ffdf8126fce9bb438ddf61a26f) --- sys/netinet/ip_input.c | 16 +++++++++++----- sys/netinet6/ip6_fastfwd.c | 1 + sys/netinet6/ip6_input.c | 17 ++++++++++++++--- 3 files changed, 26 insertions(+), 8 deletions(-) diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index 1b080aa65e4e..6d8165003950 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -523,11 +523,6 @@ ip_input(struct mbuf *m) goto bad; } } - /* The unspecified address can appear only as a src address - RFC1122 */ - if (__predict_false(ntohl(ip->ip_dst.s_addr) == INADDR_ANY)) { - IPSTAT_INC(ips_badaddr); - goto bad; - } if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) { sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID); @@ -645,6 +640,17 @@ tooshort: } } passin: + /* + * The unspecified address can appear only as a src address - RFC1122. + * + * The check is deferred to here to give firewalls a chance to block + * (and log) such packets. ip_tryforward() will not process such + * packets. + */ + if (__predict_false(ntohl(ip->ip_dst.s_addr) == INADDR_ANY)) { + IPSTAT_INC(ips_badaddr); + goto bad; + } /* * Process options and, if not destined for us, diff --git a/sys/netinet6/ip6_fastfwd.c b/sys/netinet6/ip6_fastfwd.c index 08531cee05bf..0ed313bd49a5 100644 --- a/sys/netinet6/ip6_fastfwd.c +++ b/sys/netinet6/ip6_fastfwd.c @@ -107,6 +107,7 @@ ip6_tryforward(struct mbuf *m) IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) || IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) || + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) || IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || in6_localip(&ip6->ip6_dst)) return (m); diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c index c5b9f9202cea..b3f10ddc5ea7 100644 --- a/sys/netinet6/ip6_input.c +++ b/sys/netinet6/ip6_input.c @@ -623,10 +623,10 @@ ip6_input(struct mbuf *m) IP_PROBE(receive, NULL, NULL, ip6, rcvif, NULL, ip6); /* - * Check against address spoofing/corruption. + * Check against address spoofing/corruption. The unspecified address + * is checked further below. */ - if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { + if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) { /* * XXX: "badscope" is not very suitable for a multicast source. */ @@ -751,6 +751,17 @@ ip6_input(struct mbuf *m) } passin: + /* + * The check is deferred to here to give firewalls a chance to block + * (and log) such packets. ip6_tryforward() will not process such + * packets. + */ + if (__predict_false(IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst))) { + IP6STAT_INC(ip6s_badscope); + in6_ifstat_inc(rcvif, ifs6_in_addrerr); + goto bad; + } + /* * Disambiguate address scope zones (if there is ambiguity). * We first make sure that the original source or destination address