From nobody Sat Nov 1 17:34:38 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4czQ2l1Rm1z6GHxt; Sat, 01 Nov 2025 17:34:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4czQ2k4yd4z40SW; Sat, 01 Nov 2025 17:34:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1762018478; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5ocwjZLqtZXk9wqqkWAW1V68B2IgdSl8lF8zrolBmgs=; b=ukDwyoKQZWgglpW6h1RTYYRIIGBFwrse3D8s5G+hm4ERF8SM7qgfVi2p2PYksXKWJoUAep jLYUY15bhfhl8QonMmRJtQksG7JNcITyHMca38ENUc3OOLZ0k0Z0lRrjcdCbRNNKWbkWVe X/dmESqRTtVHs/eS+kFv+qIzyJJk8l73fZy2U7SBxcUqBKI6Mp7w36YujKNUO2RjJ9F1yy akoDr/CRg7NHD8xJeCtYC6pQ+h1GjPp061fWt2pi9DcUIQvMTPtj0peZZtl2V47DNDxdoG 3eGXqdGSVPX0cI2h1hR/y8rfJq0YTqN8OldMSv9lSjzJc+gtjJIl0UCk9dI+MA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1762018478; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5ocwjZLqtZXk9wqqkWAW1V68B2IgdSl8lF8zrolBmgs=; b=VRxS7/d+n7GwnhBh39PEI8xuKr8B9AGpsl8n2VjjmZjzcFpA6X6nH7WMm/lCyREXVio6jn l9LUi3lPUPhfyHsQCLhFi61mtCG7MpQ4IJQ7yimvZ7dqVpFQjlOZ1V4dyNlsGgqwRZ1Wpy N4zMkvq8R0j+aU59dqIhu5UG/qKwdAH8aIVuXXZdPpqg6HoUYuaFwHg6nTCoRs6S69weOY SRhms1Lc2AavYFY3Q1WFyqDcxuIIr8Ru3Lod3UYGzgd+u+m+Nc0ntIDZlOUqFyvUsp3mfs A98QHUlpn3fuMyAbp5+s4Kyo5zdL/ho9cjcR0LulIpmGx0iLjNMoriTeZE9N5g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1762018478; a=rsa-sha256; cv=none; b=Bo+Hl0sZUxmt6/kLTg47oGOan7wPHSUck1//AFGAsDjP8bIe+B+OcsRLgA9NEd41/8m0OP +tYt9sKIo4v4mPYnoYvgrLNv+0tKbOvJs9auksNIU2c4Vy2mdghuG0pkskBbauQd+WtaVp ijwntbf9XYZDDvUBl39zZQ96WwxzgYx0nKZz6+b24Z9ZoxdKKSvtn29VurGETMd6uLL6Z8 TMwmvrb/epeEYpjciiX7kCL/wzJjQ5/laPXBqsBIDxmMuDdYp6Gzf01Khj7Rqf+P4gKuxn v4pbLsn8I/7Y6bhZab7AY7coqMs7FEDAryzXGO1QML6O5RISf4DWP0jXuEdetQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4czQ2k43k2zpXS; Sat, 01 Nov 2025 17:34:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 5A1HYcRX007250; Sat, 1 Nov 2025 17:34:38 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 5A1HYc7W007247; Sat, 1 Nov 2025 17:34:38 GMT (envelope-from git) Date: Sat, 1 Nov 2025 17:34:38 GMT Message-Id: <202511011734.5A1HYc7W007247@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kyle Evans Subject: git: c0382512bfce - main - ipfw: pmod: avoid further rule processing after tcp-mod failures List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c0382512bfce872102d213b9bc2550de0bc30b67 Auto-Submitted: auto-generated The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=c0382512bfce872102d213b9bc2550de0bc30b67 commit c0382512bfce872102d213b9bc2550de0bc30b67 Author: Kyle Evans AuthorDate: 2025-11-01 17:34:11 +0000 Commit: Kyle Evans CommitDate: 2025-11-01 17:34:11 +0000 ipfw: pmod: avoid further rule processing after tcp-mod failures m_pullup() here will have freed the mbuf chain, but we pass back an IP_FW_DENY without any signal that the outer loop should finish. Thus, rule processing continues without an mbuf and there's a chance that we conclude that the packet may pass (but there's no mbuf remaining) depending on the rules that follow it. PR: 284606 Reviewed by: ae MFC after: 1 week --- sys/netpfil/ipfw/pmod/tcpmod.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/sys/netpfil/ipfw/pmod/tcpmod.c b/sys/netpfil/ipfw/pmod/tcpmod.c index 0338dc792c64..50074ee98cca 100644 --- a/sys/netpfil/ipfw/pmod/tcpmod.c +++ b/sys/netpfil/ipfw/pmod/tcpmod.c @@ -57,7 +57,8 @@ VNET_DEFINE_STATIC(uint32_t, tcpmod_setmss_eid) = 0; #define V_tcpmod_setmss_eid VNET(tcpmod_setmss_eid) static int -tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) +tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss, + int *done) { struct mbuf *m; u_char *cp; @@ -72,8 +73,10 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) * TCP header with options. */ *mp = m = m_pullup(m, m->m_pkthdr.len); - if (m == NULL) + if (m == NULL) { + *done = 1; return (ret); + } } /* Parse TCP options. */ for (tlen -= sizeof(struct tcphdr), cp = (u_char *)(tcp + 1); @@ -114,7 +117,7 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) #ifdef INET6 static int -tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct ip6_hdr *ip6; struct ip6_hbh *hbh; @@ -142,13 +145,13 @@ tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET6 */ #ifdef INET static int -tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct tcphdr *tcp; struct ip *ip; @@ -162,7 +165,7 @@ tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET */ @@ -206,19 +209,23 @@ ipfw_tcpmod(struct ip_fw_chain *chain, struct ip_fw_args *args, switch (args->f_id.addr_type) { #ifdef INET case 4: - ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1), + done); break; #endif #ifdef INET6 case 6: - ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1), + done); break; #endif } /* * We return zero in both @ret and @done on success, and ipfw_chk() * will update rule counters. Otherwise a packet will not be matched - * by rule. + * by rule. We passed @done around above in case we hit a fatal error + * somewhere, we'll return non-zero but signal that rule processing + * cannot succeed. */ return (ret); }