Date: Thu, 21 May 2026 21:20:05 +0000 From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 64327f769cee - main - pf: fix incorrect table decoding in netlink Message-ID: <6a0f7705.1d8e4.4e2eb214@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=64327f769cee0c26e1b81e6195a5092498b10403 commit 64327f769cee0c26e1b81e6195a5092498b10403 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-05-21 08:13:24 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-05-21 21:19:49 +0000 pf: fix incorrect table decoding in netlink We used nla_p_table for pfr_table structures, but this netlink decoder was intended for pfioc_table and decoded an extra field, outside of pfr_table. This allowed userspace to write (slightly) outside of pfr_table. Use a separate nlattr_parser for pfr_table. PR: 295218 Reported by: Robert Morris <rtm@lcs.mit.edu> MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf_nl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index d1beb7681c21..0e1c77864615 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2189,7 +2189,14 @@ nlattr_get_pfr_addr(struct nlattr *nla, struct nl_pstate *npt, const void *arg, return (0); } -NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_table); +#define _OUT(_field) offsetof(struct pfr_table, _field) +static const struct nlattr_parser nla_p_pfrtable[] = { + { .type = PF_T_ANCHOR, .off = _OUT(pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, + { .type = PF_T_NAME, .off = _OUT(pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, + { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrt_flags), .cb = nlattr_get_uint32 }, +}; +#undef _OUT +NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_pfrtable); #define _OUT(_field) offsetof(struct nl_parsed_table_addrs, _field) static const struct nlattr_parser nla_p_table_addr[] = {home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a0f7705.1d8e4.4e2eb214>