From nobody Wed Jul 23 14:23:44 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bnGb55sKCz62P52; Wed, 23 Jul 2025 14:23:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bnGb51C7sz3pYJ; Wed, 23 Jul 2025 14:23:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753280625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tGqnqt0L0Mo+kpd6jca8kUAdL4BTOKtuJRu5qYv2sIQ=; b=aWDMnCelNJL4W7JA0vdlWTLeWN1F0r1lXW2VxmQ08iyVRLKYqSobda/jg68dyRY77Su+Cv /jK0EytZcYBPwe57p4jGmI9f8XV+RxP28gBz4zAn9GXYIt6nVMqdP0D1WSS8FdUs2u++9K yZrsLHWBm1/PSoaFiteW3fgYvRfNa9JqaJOe5zOpKdIEiUrM8jwuswXkoxEpOhMdJxoEQu HNLWBVzEhm9KRuB0bB/K4OL+1Sv/wAnUXoBHlKLmNROlXzEKAkxPAZBLEdEA+tCpX5Fx05 xISBGyp3CW+gbT6PW7XF6BHh2wWj+Vf0w4zbE3DTGhyxfMXZm50GWYnaylUooQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753280625; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tGqnqt0L0Mo+kpd6jca8kUAdL4BTOKtuJRu5qYv2sIQ=; b=FGwDh/r+vsTKG5tqAdV8M6SwWU6Nf+JNWcxm2AZmc5Bd69APTOlFqFYKi7110TvJScEm2K UGrlf6H7WHPMZ9S12wLETmfKdSepQmJCN5bT6Xyq0pMu5K8zK6nGxUTaW4Pg51dwOvZNxT b2xFNVdIRLAnUjcfw+F1c1shhZIHpO/1OaDT81UQ9E/qI9EmtYEzFrsfRUe1HUVnBcISOR gmylA/HOE6kTr/qiLhjkvwxcX5FQwNXPYJzWR2V0zyxSq5Oo8l+a5nGxxpTDVkBwGKimbb nyMVrUngfVgI240NHnEDXcYpqP1AeeJrWr83GEdw/dN+0rYCw6lYjqdTej5IAg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1753280625; a=rsa-sha256; cv=none; b=hje/T/9E66l97wcSYVfnUcqYp0nLTbAA4p+6J7x5tNaiTSZ8eyHg3x081CkQ+dT+NF6mOm dmF/x+LdLERIkbHcclAFVRO14ld5AXp1O6UKJIqs/cxVUTBWyT/tE1t7/gA4jRbmSQkCS6 lpqTUBWtSMweyW20am7AKhKQ/NCfUlDrw+VD2Dn9HoCOyQZmR5UcTB3s05+EG/0PlV0ezN Fd1m6XPKQ+IYUN/DiaTiFjdXkhORbUPAnroNDVuOBkTOYUsq8el0XLEPN3cIj8yWDqUgY+ Osi9jer5014PJa0Fn8qoVgJz+Yj9TDsFBW1BcNDwQxycN3u85FFSkgnO9UHwVg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bnGb50BBYz2FT; Wed, 23 Jul 2025 14:23:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 56NENiJb031077; Wed, 23 Jul 2025 14:23:44 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 56NENiIm031073; Wed, 23 Jul 2025 14:23:44 GMT (envelope-from git) Date: Wed, 23 Jul 2025 14:23:44 GMT Message-Id: <202507231423.56NENiIm031073@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 15fa3e7ec77e - main - pf: move IPv4 packet length check up List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 15fa3e7ec77e113de793ad23caa35dcbf6770c9d Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=15fa3e7ec77e113de793ad23caa35dcbf6770c9d commit 15fa3e7ec77e113de793ad23caa35dcbf6770c9d Author: Kristof Provost AuthorDate: 2025-07-15 14:40:21 +0000 Commit: Kristof Provost CommitDate: 2025-07-23 13:35:43 +0000 pf: move IPv4 packet length check up Perform this check ("Do we have enough data for the IP length?") so it happens before normalisation. Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 009f7e4d78b1..9517e9b8c9bc 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -10090,6 +10090,13 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0, return (-1); } + h = mtod(pd->m, struct ip *); + if (pd->m->m_pkthdr.len < ntohs(h->ip_len)) { + *action = PF_DROP; + REASON_SET(reason, PFRES_SHORT); + return (-1); + } + if (pf_normalize_ip(reason, pd) != PF_PASS) { /* We do IP header normalization and packet reassembly here */ *m0 = pd->m; @@ -10097,13 +10104,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0, return (-1); } *m0 = pd->m; - h = mtod(pd->m, struct ip *); - if (pd->m->m_pkthdr.len < ntohs(h->ip_len)) { - *action = PF_DROP; - REASON_SET(reason, PFRES_SHORT); - return (-1); - } if (pf_walk_header(pd, h, reason) != PF_PASS) { *action = PF_DROP;