From nobody Tue Jan 14 10:37:59 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YXQZJ2zKGz5kVNF; Tue, 14 Jan 2025 10:38:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YXQZH4G2zz3BxZ; Tue, 14 Jan 2025 10:37:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736851079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=l2zeX2ajslPsJk2/IHwO9J/r8ELFeEtSY+ZDAPsW+EM=; b=bIr+YUQcDrP2+fxs1sHy7/LWCUvP1IhUrGW9+0a/5CRvrvN+ON8b5RDWEixHMXzdV35kTa 9rSejGrYaj/jj07pZOZTA48VbnqEb0Qk56nqZKsqwlrozh9PdN0wdb5Xfh0lDxrCC61QFJ HPPBy2mfpF02G2kZhx2JB2Jsh1BKfwjHDK/VaekQ16D3BeLSgCQRMBoiCCfFQWHzK1Htc2 bzf2vdmKC+6jVutzQ8E/HiU2jAfANPlcUsB/XZpNh0JiN7wIv2Mzk3N/OhC/wtCLnhOU80 NLL+tFmmqz1w51sVRU0QIkPMza8ZFkI0def2MVzy9COHyHqYuCsGHMjGop4Mpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736851079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=l2zeX2ajslPsJk2/IHwO9J/r8ELFeEtSY+ZDAPsW+EM=; b=g2bL8nHrXwW+LFZwd3Jpu/prNe8vjeLdC7dAo7LG7LHyW01NAHt+CpBxf6bYrfSAMSnhw4 +ooYjTNxFMGvZS0bg+cLSodqhfDFhRcVQ0maDlJ6WxH7J3llO/aigIwlF3yV+MZ4Jd0gdH 38jLiRLfuwP1wRSCFo6tH/r3shQnFR8cOOGZbvvfWpxLFl9HPrGrf8hTmpCRrSfiiD+Nla Tr08SKBaqoNg92M2/ZNtuzW8FoUCQS4+VcLAtGx7WC7fbCDlpOchYdT4YHs0k2tlGyN1wB sfrLXrGaDweL9YWTlNBpCk5lcZhI9G4QAFkH4Ll/NaZKHtRVzjRGj63PtJZ5gw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1736851079; a=rsa-sha256; cv=none; b=cnXzP95XIcWwGUFrOPBhiv+HvgFtttD7JKAoH3ajfMUlDZcWmOrFYwBPAAsKI41eB5FDfP Z0TJVJL8DvPD/k5tW2QkmYXETK8/cZlr3XIhJUjb5crXpl+IgiFyE9Qntmd+3mciPuAuOO bKqjQ7aBtzOqyi0w65eHS2O092/T9+Ncj1ajh6sOO1eme3wptXxI+c3Vap82joNPNAuCRh tXqBpkdzNpqpC12VgoZ3WZpKZsKFr5tYewsxPPanhMTF5d5j52BQ3nXmZvuBeJILw8yoji gj/Vnyv1Xrq7964C6L2R/pI2gwutWiapbmm6B26yJhXLkaIZJ3zah+PxvETBKQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YXQZH3sSXz1C6W; Tue, 14 Jan 2025 10:37:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50EAbxjZ048360; Tue, 14 Jan 2025 10:37:59 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50EAbxUL048357; Tue, 14 Jan 2025 10:37:59 GMT (envelope-from git) Date: Tue, 14 Jan 2025 10:37:59 GMT Message-Id: <202501141037.50EAbxUL048357@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 3b79f6d2d394 - main - pf: do not keep state when dropping overlapping IPv6 fragments List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3b79f6d2d39405bcac395dc036ceb6f8fd09ce99 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=3b79f6d2d39405bcac395dc036ceb6f8fd09ce99 commit 3b79f6d2d39405bcac395dc036ceb6f8fd09ce99 Author: Kristof Provost AuthorDate: 2025-01-09 13:11:11 +0000 Commit: Kristof Provost CommitDate: 2025-01-14 08:54:20 +0000 pf: do not keep state when dropping overlapping IPv6 fragments ok sperreault@ Obtained from: OpenBSD, bluhm , cd45765685 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf_norm.c | 30 ++++++++---------------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index 45e56edc34fe..9f1eaf7c4d76 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -606,15 +606,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent, return (frag); } - if (TAILQ_EMPTY(&frag->fr_queue)) { - /* - * Overlapping IPv6 fragments have been detected. Do not - * reassemble packet but also drop future fragments. - * This will be done for this ident/src/dst combination - * until fragment queue timeout. - */ - goto drop_fragment; - } + KASSERT(!TAILQ_EMPTY(&frag->fr_queue), ("!TAILQ_EMPTY()->fr_queue")); /* Remember maximum fragment len for refragmentation. */ if (frent->fe_len > frag->fr_maxlen) @@ -651,7 +643,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent, uint16_t precut; if (frag->fr_af == AF_INET6) - goto flush_fragentries; + goto free_fragment; precut = prev->fe_off + prev->fe_len - frent->fe_off; if (precut >= frent->fe_len) { @@ -715,21 +707,15 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent, return (frag); -flush_fragentries: +free_fragment: /* - * RFC5722: When reassembling an IPv6 datagram, if one or - * more its constituent fragments is determined to be an - * overlapping fragment, the entire datagram (and any constituent - * fragments, including those not yet received) MUST be - * silently discarded. + * RFC 5722, Errata 3089: When reassembling an IPv6 datagram, if one + * or more its constituent fragments is determined to be an overlapping + * fragment, the entire datagram (and any constituent fragments) MUST + * be silently discarded. */ DPFPRINTF(("flush overlapping fragments\n")); - while ((prev = TAILQ_FIRST(&frag->fr_queue)) != NULL) { - TAILQ_REMOVE(&frag->fr_queue, prev, fr_next); - - m_freem(prev->fe_m); - uma_zfree(V_pf_frent_z, prev); - } + pf_free_fragment(frag); bad_fragment: REASON_SET(reason, PFRES_FRAG);