Date: Mon, 4 Apr 2011 19:16:44 GMT From: Karim Fodil-Lemelin <fodillemlinkarim@gmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/156180: ipfw checks TCP options on non-contiguous header Message-ID: <201104041916.p34JGiXe053757@red.freebsd.org> Resent-Message-ID: <201104041920.p34JK9Vo078544@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 156180
>Category: kern
>Synopsis: ipfw checks TCP options on non-contiguous header
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Apr 04 19:20:09 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator: Karim Fodil-Lemelin
>Release: CURRENT
>Organization:
>Environment:
>Description:
When using tcpopt_match in ipfw there is no guarantee that the TCP option space matched is not bogus.
This is because the case IPPROTO_TCP does not do an m_pullup on the entire IP+TCP+TCP option header.
>How-To-Repeat:
>Fix:
The attached patch will call m_pullup on the TCP option space if it wasn't done already.
Patch attached with submission follows:
Index: netinet/ipfw/ip_fw2.c
===================================================================
--- netinet/ipfw/ip_fw2.c (revision 219967)
+++ netinet/ipfw/ip_fw2.c (working copy)
@@ -949,6 +949,11 @@
case IPPROTO_TCP:
PULLUP_TO(hlen, ulp, struct tcphdr);
+ /* kfl: check 'contiguousity' of the option space */
+ if (m->m_len < (hlen + (TCP(ulp)->th_off << 2))) {
+ if ((m = m_pullup(m, hlen+(TCP(ulp)->th_off << 2))) == NULL)
+ goto pullup_failed;
+ }
dst_port = TCP(ulp)->th_dport;
src_port = TCP(ulp)->th_sport;
/* save flags for dynamic rules */
@@ -1117,6 +1122,11 @@
switch (proto) {
case IPPROTO_TCP:
PULLUP_TO(hlen, ulp, struct tcphdr);
+ /* kfl: check 'contiguousity' of the option space */
+ if (m->m_len < (hlen + (TCP(ulp)->th_off << 2))) {
+ if ((m = m_pullup(m, hlen+(TCP(ulp)->th_off << 2))) == NULL)
+ goto pullup_failed;
+ }
dst_port = TCP(ulp)->th_dport;
src_port = TCP(ulp)->th_sport;
/* save flags for dynamic rules */
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201104041916.p34JGiXe053757>