Date: Tue, 12 May 2026 16:44:44 +0000 From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 8d583858e499 - stable/14 - pfsync: reject invalid SCTP states Message-ID: <6a0358fc.3ce12.672d0d5a@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/14 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=8d583858e499dcc23a1c7b6b9c80e2e84f245d04 commit 8d583858e499dcc23a1c7b6b9c80e2e84f245d04 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-05-04 16:08:35 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-05-12 07:54:38 +0000 pfsync: reject invalid SCTP states SCTP states should always have a src scrub object associated with them. Crafted pfsync packets might not have this, leading to us derferencing a NULL pointer on cleanup. Validate the pfsync state insertion packet to make sure this is correct. PR: 294989 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit bf6d00afdb6171ba04a1c5a7fde904cde87d212d) --- sys/netpfil/pf/if_pfsync.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index 6b828989c54d..10883e233b03 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -706,6 +706,13 @@ pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version) (st->act.rtableid >= 0 && st->act.rtableid < rt_numfibs))) goto cleanup; + if (sks->proto == IPPROTO_SCTP && st->src.scrub == NULL) { + if (V_pf_status.debug >= PF_DEBUG_MISC) + printf("%s: invalid SCTP state from creator id: %08x\n", __func__, + ntohl(sp->pfs_1301.creatorid)); + goto cleanup; + } + st->id = sp->pfs_1301.id; st->creatorid = sp->pfs_1301.creatorid; pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src);home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a0358fc.3ce12.672d0d5a>