From nobody Mon Jan 5 20:01:24 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dlQD45JC8z6MyPW for ; Mon, 05 Jan 2026 20:01:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dlQD41bV3z3FpS for ; Mon, 05 Jan 2026 20:01:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1767643284; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3AF2EOk/b2NVNCS6C9ziJRbXLsWZkMKxcx9JGuLhywQ=; b=q1+HLJ2BkhxcIg+BNSouNpUHm0J/eD3s/DGZcl6tvA9kXs7CHVG1NO2ZQtSk58cXerCQbL p/QIfNcTdvLpek6c4Uv5FZJqdUaXBNEQFRRRlRUiow4JdK2ycPdziyXkridiC+44i58Kri Jfo7Mh6L7UbIGJ9vOrMfuFNbNjh4Dhp9JhkXI2LtnV3npL0UJokKlpIUmsGn+DgDyI9cJy gv0Bzty2EG20j+IHY55X7fdBrM18etWRN3fPtzL+86vctnqlXRhtyp8UEwND57F07EJCDf VBgqNpA93WyC9q+dKV2uEku689RJx9pRBJEkYRh4Ffy0zifjPQ4Lkrmy3MKcHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1767643284; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3AF2EOk/b2NVNCS6C9ziJRbXLsWZkMKxcx9JGuLhywQ=; b=NkWdIYeBhs4cC+MfK+vKtA0gWN48WJWpsRsao/kTCvBpTCmUoOy41aEJRrkEX6MCGcVzYc stNsr0obtfygEtkkv7yx49s+VfhT7PxiI9DUn6gT5RBk8xRJaj7JLQQo5yJi5R1cy7TX+B ccbtGdF0g0iXy3o6k0QAOMWUc2/iRi4GzbDA2pRL4QKnjIFhCOAXx18yYGT+9NJ1GYCdEG keYshEZBg+9bTgQ3RSsHrGTXquUmbCKpFNQHaKOO5GUp9kMc4uTweEluB/NwrVv5cyDTBF XDF8IPB30iB3piNoqVSJDvzBFVKeo4zscQhF8et/dGDEkkXSdkDTs1eMu4JJcg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1767643284; a=rsa-sha256; cv=none; b=EThYsBog5XGexBpxKnusazCQHlBBMxC32Ns5YBCk0hKSDPlAOxfaCGZoXzVP9GNbzb8IV6 P998fJM124b2Yp7A37ZOWhvJVZ+lrT1ZBV/X+p8gpPqC1PtXSjc1LFsfrTiwIILzyRSnSG lf/EScxZf1FHLxKtgJACi5xJpoj5ffynUYAOIA42lcfEsbhMUkDXQkqR9SeW8kYLpd92QD POvG5KWJsADYc0RRfVM+0KC23bgY/0ZcojxDyCl7ubqcqU9oSeI/SehTQpSkhCX/kWTYi6 9eEzIyqs0XiqEFg7djK7K/ZQ4tOLozEjEuR5h9VJAAUkpEtzeTFD8tx+hCCHcQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dlQD4189czbmX for ; Mon, 05 Jan 2026 20:01:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 8660 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 05 Jan 2026 20:01:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: b94fbf89ef71 - stable/14 - ipfilter: Verify ipnat on entry into kernel List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: b94fbf89ef715a1caaba27311e165a43b0a49f67 Auto-Submitted: auto-generated Date: Mon, 05 Jan 2026 20:01:24 +0000 Message-Id: <695c1894.8660.697eb3bc@gitrepo.freebsd.org> The branch stable/14 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=b94fbf89ef715a1caaba27311e165a43b0a49f67 commit b94fbf89ef715a1caaba27311e165a43b0a49f67 Author: Cy Schubert AuthorDate: 2025-11-03 04:59:15 +0000 Commit: Cy Schubert CommitDate: 2026-01-05 20:00:55 +0000 ipfilter: Verify ipnat on entry into kernel The ipnat struct is built by ipnat(8), specifically ipnat_y.y when parsing the ipnat configuration file (typically ipnat.conf). ipnat contains a variable length string field at the end of the struct. This data field, called in_names, may contain various text strings such as NIC names. There is no upper bound limit to the length of strings as long as the in_namelen length field specifies the length of in_names within the ipnat structure and in_size specifies the size of the ipnat structure itself. Reported by: Ilja Van Sprundel Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53843 (cherry picked from commit 821774dfbdaa12ef072ff7eaea8f9966a7e63935) --- sbin/ipf/libipf/interror.c | 6 +++++ sys/netpfil/ipfilter/netinet/ip_nat.c | 42 ++++++++++++++++++++++++++++++++++- 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/sbin/ipf/libipf/interror.c b/sbin/ipf/libipf/interror.c index e094dac7fc08..dcc12f244691 100644 --- a/sbin/ipf/libipf/interror.c +++ b/sbin/ipf/libipf/interror.c @@ -363,6 +363,12 @@ log" }, { 60074, "unknown next address type (ipv6)" }, { 60075, "one object at a time must be copied" }, { 60076, "NAT ioctl denied in jail without VNET" }, + { 60077, "in_names offset is wrapped negative" }, + { 60078, "in_names larger than in_namelen" }, + { 60079, "ipnat larger than in_size" }, + { 60080, "ipnat and in_namelen mismatch in_size" }, + { 60081, "ip_names runs off the end of ipnat" }, + { 60082, "in_namelen too large" }, /* -------------------------------------------------------------------------- */ { 70001, "incorrect object size to get pool stats" }, { 70002, "could not malloc memory for new pool node" }, diff --git a/sys/netpfil/ipfilter/netinet/ip_nat.c b/sys/netpfil/ipfilter/netinet/ip_nat.c index 3f8f3c2a342c..1281e557df86 100644 --- a/sys/netpfil/ipfilter/netinet/ip_nat.c +++ b/sys/netpfil/ipfilter/netinet/ip_nat.c @@ -978,9 +978,13 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, int mode, int uid, void *ctx) { ipf_nat_softc_t *softn = softc->ipf_nat_soft; - int error = 0, ret, arg, getlock; + int error = 0, ret, arg, getlock, interr, i; + int interr_tbl[3] = { 60077, 60081, 60078 }; ipnat_t *nat, *nt, *n; ipnat_t natd; + char *name; + size_t v_in_size, v_element_size; + int v_rem_namelen, v_in_toend; SPL_INT(s); #if !SOLARIS && defined(_KERNEL) @@ -1031,6 +1035,16 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, error = EINVAL; goto done; } + if (sizeof(natd) + natd.in_namelen != natd.in_size) { + IPFERROR(60080); + error = EINVAL; + goto done; + } + if (natd.in_namelen < 0 || natd.in_namelen > softc->ipf_max_namelen) { + IPFERROR(60082); + error = EINVAL; + goto done; + } KMALLOCS(nt, ipnat_t *, natd.in_size); if (nt == NULL) { IPFERROR(60070); @@ -1045,6 +1059,32 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, nat = nt; } + /* + * Validate the incoming ipnat_t. + */ + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_ifnames[0])) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + if (nat->in_ifnames[0] != nat->in_ifnames[1]) { + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_ifnames[1])) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + } + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_plabel)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_pconfig)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + /* * For add/delete, look to see if the NAT entry is * already present