From nobody Mon Jan 5 20:02:54 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dlQFq1n8Gz6Myjh for ; Mon, 05 Jan 2026 20:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dlQFp4Tk1z3Jql for ; Mon, 05 Jan 2026 20:02:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1767643374; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0ocj1DyUh3+86oXcribbrpJ+fl8+jdA6Sg3u3V7Lovs=; b=wjJ6hXt67gaBR1uRxqPvQSCNNm3eEZENgiMZ+PlE0/b2YZgbpOeiOhNvJGPe6Kkeg7EkQl G3ysTyFlVB99YDUmzcyBUGVzK5UuncisnvSoU4dk6vC58vJldgoDjbpjpY6bS3eyRSiIKE z6bQy1ek88tesqfqBS/JGTdEvTMjb0spAqUr/GFJdUxmsqMvXLoRpRL8IE0clXi66lnPVk md+HZfDwiJMqR1PHxbpYDRTrBaxSEKt4o3aIgNJoG9KjgzKNceyyL2M21drH5V178iiiUd b2l8mZ+phL6bxqX9UMdapEbDee1+CqTTf4ET3nBXKDnNlK3M1boPBNrVT/gw3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1767643374; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0ocj1DyUh3+86oXcribbrpJ+fl8+jdA6Sg3u3V7Lovs=; b=ngr5mOwBBnqyz6reboTXELjWyFcdoitzaf2sdlG4phaGhfF/TiCo5kdSKEiByofqjaGv5i QfQp7XU09mZxYdwvADE580lSdSOYfwM3wBRVV7QY4A1oBaDUsvZHgRr4Y1SAIVlCE/oMKL ALtu4oStBPIC7sf7oM3zBqAluU0C8LqftGanFi7jBwrnLqEDBTf5777eeNDKUGw0SlgEv5 Vgrdy6nkQe6szCChN1zliJQFXaEd2mjmH0mtwLPGh2BONdq2odlMTSNZvSztDufNx1WehC VPZRJwWrA7xoZZqgvyTOi+BQ4Tk4VKy2xRFHR+N5mNqLnK2/v+fYNEsVRGOcOw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1767643374; a=rsa-sha256; cv=none; b=Ec+6sTbntdcd3sjnBW/nzf31Wl+nZSsq5h+RLxoEbp0tF+s42Ck3TyIx759dgnX9DSszVT X83LVMRy3y9GcHBl2QR2DHwoPvVMVj1nU2hhxBjO/U9EFa04XR7vtSp3SURhFospIpWDkm doU9VjiaeY/JSuNESolQ6yQETEGD2ZNHh+s+Y0LVD8e3+QfWpmuS4c+rcpVmLI8mfDwis3 La1ffgnDoXw4HTJXRrGh+9cvCApED9LLgrcdyi/oxnhgb91BMYLqm17LUSPyiqZ+2EXpTh epSAywqkv5f6/AMQIV13gar9itkDbvMx3qOwgUjTRbDZTw5gDOxK6xYp7xUriQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dlQFp447Yzbbs for ; Mon, 05 Jan 2026 20:02:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3fea2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 05 Jan 2026 20:02:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: 75fbf1d27b6d - stable/13 - ipfilter: Verify ipnat on entry into kernel List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 75fbf1d27b6d00fb12e22b41d22b43c4279fd77d Auto-Submitted: auto-generated Date: Mon, 05 Jan 2026 20:02:54 +0000 Message-Id: <695c18ee.3fea2.30274ce6@gitrepo.freebsd.org> The branch stable/13 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=75fbf1d27b6d00fb12e22b41d22b43c4279fd77d commit 75fbf1d27b6d00fb12e22b41d22b43c4279fd77d Author: Cy Schubert AuthorDate: 2025-11-03 04:59:15 +0000 Commit: Cy Schubert CommitDate: 2026-01-05 03:40:10 +0000 ipfilter: Verify ipnat on entry into kernel The ipnat struct is built by ipnat(8), specifically ipnat_y.y when parsing the ipnat configuration file (typically ipnat.conf). ipnat contains a variable length string field at the end of the struct. This data field, called in_names, may contain various text strings such as NIC names. There is no upper bound limit to the length of strings as long as the in_namelen length field specifies the length of in_names within the ipnat structure and in_size specifies the size of the ipnat structure itself. Reported by: Ilja Van Sprundel Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53843 (cherry picked from commit 821774dfbdaa12ef072ff7eaea8f9966a7e63935) --- sbin/ipf/libipf/interror.c | 6 +++++ sys/netpfil/ipfilter/netinet/ip_nat.c | 42 ++++++++++++++++++++++++++++++++++- 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/sbin/ipf/libipf/interror.c b/sbin/ipf/libipf/interror.c index 1fe58fd56197..5619b24200d7 100644 --- a/sbin/ipf/libipf/interror.c +++ b/sbin/ipf/libipf/interror.c @@ -363,6 +363,12 @@ log" }, { 60074, "unknown next address type (ipv6)" }, { 60075, "one object at a time must be copied" }, { 60076, "NAT ioctl denied in jail without VNET" }, + { 60077, "in_names offset is wrapped negative" }, + { 60078, "in_names larger than in_namelen" }, + { 60079, "ipnat larger than in_size" }, + { 60080, "ipnat and in_namelen mismatch in_size" }, + { 60081, "ip_names runs off the end of ipnat" }, + { 60082, "in_namelen too large" }, /* -------------------------------------------------------------------------- */ { 70001, "incorrect object size to get pool stats" }, { 70002, "could not malloc memory for new pool node" }, diff --git a/sys/netpfil/ipfilter/netinet/ip_nat.c b/sys/netpfil/ipfilter/netinet/ip_nat.c index 8b343acf1211..1bad910d1db1 100644 --- a/sys/netpfil/ipfilter/netinet/ip_nat.c +++ b/sys/netpfil/ipfilter/netinet/ip_nat.c @@ -978,9 +978,13 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, int mode, int uid, void *ctx) { ipf_nat_softc_t *softn = softc->ipf_nat_soft; - int error = 0, ret, arg, getlock; + int error = 0, ret, arg, getlock, interr, i; + int interr_tbl[3] = { 60077, 60081, 60078 }; ipnat_t *nat, *nt, *n; ipnat_t natd; + char *name; + size_t v_in_size, v_element_size; + int v_rem_namelen, v_in_toend; SPL_INT(s); #if !SOLARIS && defined(_KERNEL) @@ -1031,6 +1035,16 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, error = EINVAL; goto done; } + if (sizeof(natd) + natd.in_namelen != natd.in_size) { + IPFERROR(60080); + error = EINVAL; + goto done; + } + if (natd.in_namelen < 0 || natd.in_namelen > softc->ipf_max_namelen) { + IPFERROR(60082); + error = EINVAL; + goto done; + } KMALLOCS(nt, ipnat_t *, natd.in_size); if (nt == NULL) { IPFERROR(60070); @@ -1045,6 +1059,32 @@ ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, nat = nt; } + /* + * Validate the incoming ipnat_t. + */ + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_ifnames[0])) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + if (nat->in_ifnames[0] != nat->in_ifnames[1]) { + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_ifnames[1])) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + } + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_plabel)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + if ((interr = ipf_check_names_string(nat->in_names, nat->in_namelen, nat->in_pconfig)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto done; + } + /* * For add/delete, look to see if the NAT entry is * already present