Date: Wed, 19 Feb 2025 13:34:55 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 86f2641b99f0 - main - pf: fix icmp-in-icmp handling with if-bound states Message-ID: <202502191334.51JDYtVa062694@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=86f2641b99f01eb8e8191c4435f22c17433b0c2f commit 86f2641b99f01eb8e8191c4435f22c17433b0c2f Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2025-02-19 12:28:33 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-02-19 13:34:45 +0000 pf: fix icmp-in-icmp handling with if-bound states When we receive an ICMP packet containing another ICMP packet we look up the original ICMP state. This is done through a second struct pf_pdesc ('pd2'), containing relevant information (i.e. addresses, type, id, ..). pd2 did not contain the network interface ('kif'), leading to state lookup failures. This only affected if-bound mode, because floating states match all interfaces. Set kif in pd2. Extend the icmp.py:test_fragmentation_needed test case to use if-bound mode. It already checked that we handled icmp-in-icmp correctly. PR: 284866 MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 1 + tests/sys/netpfil/pf/icmp.py | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 9b1a2f6a1bac..e8b7a071a3c9 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -7792,6 +7792,7 @@ pf_test_state_icmp(struct pf_kstate **state, struct pf_pdesc *pd, pd2.sidx = (pd->dir == PF_IN) ? 1 : 0; pd2.didx = (pd->dir == PF_IN) ? 0 : 1; pd2.m = pd->m; + pd2.kif = pd->kif; switch (pd->af) { #ifdef INET case AF_INET: diff --git a/tests/sys/netpfil/pf/icmp.py b/tests/sys/netpfil/pf/icmp.py index 6ab649f62be7..232c56a23dbf 100644 --- a/tests/sys/netpfil/pf/icmp.py +++ b/tests/sys/netpfil/pf/icmp.py @@ -53,6 +53,7 @@ class TestICMP(VnetTestTemplate): ToolsHelper.print_output("/sbin/pfctl -e") ToolsHelper.pf_rules([ "set reassemble yes", + "set state-policy if-bound", "block", "pass inet proto icmp icmp-type echoreq", ])
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202502191334.51JDYtVa062694>