Date: Thu, 28 May 2026 11:37:33 +0000 From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 45aaba521c3b - stable/15 - pf: fix incorrect table decoding in netlink Message-ID: <6a1828fd.3f9a4.542e9e5d@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=45aaba521c3b7abd39dc9e8f5ed0e9521fee57c3 commit 45aaba521c3b7abd39dc9e8f5ed0e9521fee57c3 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-05-21 08:13:24 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-05-28 11:36:43 +0000 pf: fix incorrect table decoding in netlink We used nla_p_table for pfr_table structures, but this netlink decoder was intended for pfioc_table and decoded an extra field, outside of pfr_table. This allowed userspace to write (slightly) outside of pfr_table. Use a separate nlattr_parser for pfr_table. PR: 295218 Reported by: Robert Morris <rtm@lcs.mit.edu> MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 64327f769cee0c26e1b81e6195a5092498b10403) --- sys/netpfil/pf/pf_nl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 168c6ac63d90..c09b204bcc66 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2138,7 +2138,14 @@ nlattr_get_pfr_addr(struct nlattr *nla, struct nl_pstate *npt, const void *arg, return (0); } -NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_table); +#define _OUT(_field) offsetof(struct pfr_table, _field) +static const struct nlattr_parser nla_p_pfrtable[] = { + { .type = PF_T_ANCHOR, .off = _OUT(pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, + { .type = PF_T_NAME, .off = _OUT(pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, + { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrt_flags), .cb = nlattr_get_uint32 }, +}; +#undef _OUT +NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_pfrtable); #define _OUT(_field) offsetof(struct nl_parsed_table_addrs, _field) static const struct nlattr_parser nla_p_table_addr[] = {home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a1828fd.3f9a4.542e9e5d>