aboutsummaryrefslogtreecommitdiff
path: root/sys/netpfil/ipfilter
Commit message (Collapse)AuthorAgeFilesLines
* ipfilter: Fix ip_pptp_pxy (PPTP proxy) length underflowCy Schubert2026-06-081-2/+6
| | | | | | | | | | | | | A PPTP client sending a specially crafted PPTP message with a length smaller than the already processed fixed header can panic the system. This resultes in a negative remaining length (a large unsigned 16-bit number). Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D57383
* ipfilter: Fix NULL dereferences in ipf_checkicmp6matchingstate()Teddy Engel2026-05-201-1/+9
| | | | | | | | | | | | | | | | | | | Add NULL checks for ic6 (the ICMPv6 header pointer from fin->fin_dp) and oic (the inner ICMPv6 header from ofin.fin_dp after ipf_makefrip). These pointers can be NULL when processing malformed ICMPv6 error packets with extension headers. Also fix the length validation: the original check (fin->fin_plen < sizeof(ip6_t)) could never trigger because an earlier check already ensures fin->fin_plen >= ICMP6ERR_MINPKTLEN (48). Replace with a proper check that fin->fin_dlen contains at least ICMPERR_ICMPHLEN + sizeof(ip6_t) bytes to ensure sufficient data exists for both the ICMPv6 error header and the embedded IPv6 header. PR: 288333 MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2214 Signed-off-by: Teddy Engel <engel.teddy@gmail.com>
* ipfilter: Add NULL check for fin_m in ipf_pr_icmp6()Teddy Engel2026-05-201-0/+3
| | | | | | | | | | | | | Add NULL check for fin->fin_m before calling M_LEN() in the ICMPv6 error handling code path. When ipf_checkicmp6matchingstate() calls ipf_makefrip() with a synthesized fr_info_t that has fin_m set to NULL, the subsequent call to ipf_pr_ipv6hdr() can reach ipf_pr_icmp6() which would crash when trying to access the mbuf via M_LEN(). PR: 288333 MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2214 Signed-off-by: Teddy Engel <engel.teddy@gmail.com>
* ipfilter: Add NULL check for fin_dp in ICMP packet handlersTeddy Engel2026-05-201-0/+4
| | | | | | | | | | | | | Add NULL checks for fin->fin_dp in ipf_pr_icmp6() and ipf_pr_icmp() before dereferencing. When processing packets with IPv6 extension headers, ipf_pr_pullup() can succeed but fin->fin_dp may still be NULL due to extension header processing leaving insufficient data for the protocol header. PR: 288333 MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2214 Signed-off-by: Teddy Engel <engel.teddy@gmail.com>
* ipfilter: Validate length before checksumCy Schubert2026-05-201-4/+13
| | | | | | | | | | Validate the length of the packet listed in the mbuf is the same as the calculated packet length. If not reject the packet and bump the bad packet stat. PR: 295198 MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57095
* ipfilter: Avoid negative array indiciesCy Schubert2026-02-173-4/+4
| | | | | | | | | | Array indices must always be posive. We avoid this by making each index unsigned. This mitigates out-of-bounds reads and writes. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: glebius MFC after: 3 days Differential revision: https://reviews.freebsd.org/D55260
* ipfilter: Interface name must not extend beyond end of bufferCy Schubert2026-02-101-2/+21
| | | | | | | | | | | | | | | | | | sifpidx (an interface name) cannot extend beyond the end of the fr_names buffer. We do the validation for fr_sifpidx here because it is a union that contains an offset only when fr_sifpidx points to an interface name, an offset into fr_names. The union is an offset into fr_names in this case only. interr_tbl now becomes a static variable outside a function to facilitate its use by two functions within fil.c Note that sifpidx is only used in ipf_sync() which implments ipf -y. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> MFC after: 1 week
* ipfilter: Fix possible overrunCy Schubert2026-02-041-1/+1
| | | | | | | | | | | The destination buffer is FR_GROUPLEN (16 bytes) in length. When gname is created, the userspace utilities correctly use FR_GROUPLEN as the buffer length. The kernel should also limit its copy operation to FR_GROUPLEN bytes to avoid any user written code from exploiting this vulnerability. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> MFC after: 1 week
* net: add ifnet_rename_event EVENTHANDLER(9) for interface renamingGleb Smirnoff2025-12-221-0/+8
| | | | | | | | | | | | | | | | | and don't trigger ifnet_arrival_event and ifnet_departure_event for a rename, as the interface isn't being detached from any protocol. The consumers of the arrival/departure events are divided into a few categories: - which indeed need to do the same actions as if interface was fully detached and attached: routing socket and netlink notifications to userland and the Linux sysfs. All addressed by this commit. - which build their logic based on an interface name, but should actually update their database on rename: packet filters. This commit leaves them with the old behavior - emulate full detach & attach, but this should be improved. - which shouldn't do anything on rename, not touched by the commit. - ng_ether and if_tuntap, that are special and will be addressed by separate commits.
* ipf: copy{in,out}ptr -> ipf_copy{in,out}_indirectBrooks Davis2025-12-195-12/+14
| | | | | | | | | | | | | | | | | These functions take the source or destintation address indirectly from a potentially missaligned buffer. Rename them to refect this and to free up the copy{in,out}ptr names. Some of the code in question is dead code and doesn't or won't compile, but I've changed it all for consistency. NB: If the pointers are actually stored under aligned then this code is broken with CHERI. Reviewed by: cy Effort: CHERI upstreaming Sponsored by: Innovate UK Differential Revision: https://reviews.freebsd.org/D54232
* ipfilter: Add missing kenv fetchCy Schubert2025-12-161-0/+2
| | | | | | | | | | | When a module the environment must be explicitly fetched. Fixes: d9788eabffa4 PR: 291548 Noted by: markj Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D54242 MFC after: 3 days
* ipfilter: Prevent stack buffer overflowDag-Erling Smørgrav2025-12-161-14/+37
| | | | | | | | | | | | | | | | When copying ipfs data from user space, don't just check that the payload length is nonzero, but also that it does not exceed the size of the stack buffer we're copying it into. While we're at it, use a union to create a buffer of the exact size we need instead of guessing that 2048 will be enough (and not too much). Finally, check the size of the payload once it gets to where it's used. MFC after: 3 days Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: cy Differential Revision: https://reviews.freebsd.org/D54194
* ipfilter: Disable ipfs(8) by defaultCy Schubert2025-12-082-1/+8
| | | | | | | | | | | | | At the moment ipfs(8) is a tool that can be easily abused. Though the concept is sound the implementation needs some work. ipfs(8) should be considered experimental at the moment. This commit also makes ipfs support in the kernel optional. Reviewed by: emaste, glebius MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53787
* ipfilter: Restrict ipfilter within a jailCy Schubert2025-12-084-0/+18
| | | | | | | | | | | | | | | | | | | | Add a sysctl/tunable (net.inet.ipf.jail_allowed) to control whether a jail can manage its own ipfilter rules, pools, and settings. A jail's control over its own ipfilter rules and settings may not be desireable. The default is jail access to ipfilter is denied. The host system can stil manage a jail's rules by attaching the rules, using the on keyword, limiting the rule to the jail's interface. Or the sysctl/tunable can be enabled to allow a jail control over its own ipfilter rules and settings. Implementation note: Rather than store the jail_allowed variable, referenced by sysctl(9), in a global area, storing the variable in the ipfilter softc is consistent with ipfilter's use of its softc. Discussed with: emaste, jrm MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53623
* ipfilter: fix broken buildWarner Losh2025-11-272-6/+1
| | | | | | | | Every commit earns me a dozen emails that LINT is broken. This should stop that. Fixes: eda1756d0454f ipfilter: Verify frentry on entry into kernel Sponsored by: Netflix
* ipfilter: Restore used variableCy Schubert2025-11-261-1/+1
| | | | | | One of the "unused" i variables is actually used. Fixes: 20c48f090b27
* ipfilter: Remove unused variableCy Schubert2025-11-262-2/+2
| | | | | | | Reported by: jlduran Fixes: eda1756d0454, 821774dfbdaa MFC after: 1 week X-MFC with: eda1756d0454, 821774dfbdaa
* ipfilter: Verify ipnat on entry into kernelCy Schubert2025-11-261-1/+41
| | | | | | | | | | | | | | | | The ipnat struct is built by ipnat(8), specifically ipnat_y.y when parsing the ipnat configuration file (typically ipnat.conf). ipnat contains a variable length string field at the end of the struct. This data field, called in_names, may contain various text strings such as NIC names. There is no upper bound limit to the length of strings as long as the in_namelen length field specifies the length of in_names within the ipnat structure and in_size specifies the size of the ipnat structure itself. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53843
* ipfilter: Verify frentry on entry into kernelCy Schubert2025-11-263-2/+61
| | | | | | | | | | | | | | | | | | | | The frentry struct is built by ipf(8), specifically ipf_y.y when parsing the ipfilter configuration file (typically ipf.conf). frentry contains a variable length string field at the end of the struct. This data field, called fr_names, may contain various text strings such as NIC names, destination list (dstlist) names, and filter rule comments. The length field specifies the length of fr_names within the frentry structure and fr_size specifies the size of the frentry structure itself. The upper bound limit to the length of strings field is controlled by the fr_max_namelen sysctl/kenv or the max_namelen ipfilter tuneable. The initial concepts were discussed with emaste and jrm. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53843
* ipfilter: Add ipf_check_names_string()Cy Schubert2025-11-262-0/+32
| | | | | | | | | | | | ipf_check_names_string will verify userland inputs in names strings (fr.fr_names, in.in_names) for correctness. Original concept of ipf_check_names_string() instead of macros by markj. Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53843
* ipfilter: Don't trust userland supplied iph_sizeCy Schubert2025-11-051-0/+9
| | | | | | | | | | | | | | | | | | | ipf_htable_create() trusts a user-supplied iph_size from iphtable_t and computes the allocation size as iph->iph_size * sizeof(*iph->iph_table) without checking for integer overflow. A sufficiently large iph_size causes the multiplication to wrap, resulting in an under-sized allocation for the table pointer array. Subsequent code (e.g., in ipf_htent_insert()) can then write past the end of the allocated buffer, corrupting kernel memory and causing DoS or potential privilege escalation. This is not typically a problem when using the ipfilter provided userland tools as calculate the correct lengths. This mitigates a rogue actor calling ipfilter ioctls directly. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53286
* ipfilter: Add an htable max size tuneable.Cy Schubert2025-11-052-0/+9
| | | | | | | | | | | Add an ipfilter runtime option (ipf -T) to adjust the default maximum hash table size. Default it to 1024 entries. It will be used by a subsequent commit to limit any damage due to excessively large hash table input by the user. Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53284
* ipfilter: Add htable (hash table) tunableCy Schubert2025-11-051-0/+27
| | | | | | | | This is in preparation for addition of a hash table max size. Reviewed by: markj MFC after: 1 week Differential revision: https://reviews.freebsd.org/D53283
* ipfilter: Plug ip_htable kernel information leakCy Schubert2025-10-231-0/+2
| | | | | | | | | | | | | | | | ipf_htable_stats_get() constructs an iphtstat_t on the stack and only initializes select fields before copying the entire structure to userland. The trailing padding array iphs_pad[16] is never initialized, so ~128 bytes of uninitialized kernel stack memory can be leaked to user space on each call. This is a classic information disclosure vulnerability that can reveal pointers and other sensitive data. We fix this by zeroing out the data structure prior to use. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: emaste MFC after: 3 days Differential revision: https://reviews.freebsd.org/D53275
* ipfilter: Plug ip_nat kernel information leakCy Schubert2025-10-231-0/+1
| | | | | | | | | | | | | | | | | ipf_nat_getent() allocates a variable-sized nat_save_t buffer with KMALLOCS() (which does not zero memory) and then copies only a subset of fields into it before returning the object to userland using ipf_outobjsz(). Because the structure is not fully initialized on all paths, uninitialized kernel heap bytes can be copied back to user space, resulting in an information leak. We fix this by zeroing out the data structure immediately after allocation. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: emaste MFC after: 3 days Differential revision: https://reviews.freebsd.org/D53274
* ipfilter: fix LINT-NOINET6 buildKristof Provost2025-07-121-2/+3
| | | | | Event: Berlin 2025 Hackathon Sponsored by: Rubicon Communications, LLC ("Netgate")
* netpfil/ipfilter: fix remaining trivial unused variable warningsSiva Mahadevan2025-07-0814-82/+23
| | | | | Pull Request: https://github.com/freebsd/freebsd-src/pull/1677 MFC after: 1 month
* ip_nat6.c: fix non-trivial unused variable warningsSiva Mahadevan2025-07-081-38/+14
| | | | | Pull Request: https://github.com/freebsd/freebsd-src/pull/1677 MFC after: 1 month
* ip_nat.c: fix non-trivial unused variable warningsSiva Mahadevan2025-07-081-30/+13
| | | | | Pull Request: https://github.com/freebsd/freebsd-src/pull/1677 MFC after: 1 month
* ip_htable: fix -Wtautological-pointer-compare warningsSiva Mahadevan2025-07-081-4/+1
| | | | | | | This also fixes a few other trivial -Wunused-but-set-variable warnings. Pull Request: https://github.com/freebsd/freebsd-src/pull/1677 MFC after: 1 month
* ipfilter: Save unit in hash table entryCy Schubert2025-07-071-0/+1
| | | | | | As with tree tables the unit must also be saved in hash tables. MFC after: 1 week
* Revert "ipfilter: Avoid allocating a new ipf token when not needed"Cy Schubert2025-07-071-4/+9
| | | | | | | | malloc() outside of a write lock will reduce potential contention. MFC after: 3 days This reverts commit 7f5e3b9fa3d159b7f061b4d01a767cbe5d0527f3.
* netinet: allow per protocol random IP id control, single out IPSECacazuc2025-03-042-3/+3
| | | | | | | | | | | | | | | | A globally enabled random IP id generation maybe useful in most IP contexts, but it may be unnecessary in the case of IPsec encapsulated packets because IPsec can be configured to use anti-replay windows. This commit adds a new net.inet.ipsec.random_id sysctl to control whether or not IPsec packets should use random IP id generation. Rest of the protocols/modules are still controlled by the global net.inet.ip.random_id, but can be easily augmented with a knob. Reviewed by: glebius Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D49164
* tcp: add TH_AE capabilities to ppp and pfRichard Scheffenegger2024-11-291-4/+4
| | | | | | | | | | Add support for the AE Flag in the TCP header to pf and ppp. Commonalize to the use of "E"(ECE), "W"(CWR) and "e"(AE) for the TCP header flags, in line with tcpdump. Reviewers: kp, cc, tuexen, cy, #transport! Sponsored by: NetApp, Inc. Differential Revision: https://reviews.freebsd.org/D47106
* tcp: extend the use of the th_flags accessor functionRichard Scheffenegger2024-11-298-27/+27
| | | | | | | | | | | Formally, there are 12 bits for TCP header flags. Use the accessor functions in more (kernel) places. No functional change. Reviewed By: cc, #transport, cy, glebius, #iflib, kbowling Sponsored by: NetApp, Inc. Differential Revision: https://reviews.freebsd.org/D47063
* ipfilter: Remove dead code from "Virtualize ipfilter"Cy Schubert2024-11-121-21/+0
| | | | | | | | | | 6d8a5eacae82 virtualized ipfilter for VNET. A few remnants of old defunct code remained. Remove them. At the time it was not known if 6d8a5eacae82 would cause any issues. As it's been a number of years since the conversion was done, it's certainly safe to remove the dead code. MFC after: 1 week
* ipfilter: ipfilter: Remove more dead codeCy Schubert2024-11-121-9/+0
| | | | | | | | This also is an artifact of the timeout(9) to callout(9) conversion done in ea3022cbbd3f5. Fixes: ea3022cbbd3f5 MFC after: 1 week
* ipfilter: Avoid holding a lock while stoppingJose Luis Duran2024-11-121-4/+1
| | | | | | | | | | | | | Avoid calling _callout_stop_safe with a non-sleepable lock held when detaching by initializing callout_init_rw() with CALLOUT_SHAREDLOCK, and avoiding re-initialization inside the timer function. PR: 282478 Reviewed by: cy, emaste, jhb, markj Tested by: cy Approved by: emaste (mentor) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D47530
* Revert "ipfilter: Avoid stopping with a lock held"Jose Luis Duran2024-11-121-2/+2
| | | | | | | | | | | The timeout function still tries to acquire the rwlock, and now it deadlocks, since the callout framework will have already acquired it. This reverts commit 1fa6daaafd74c1a457dcfe26e0a5943b5441dc9d. PR: 282478 Reported by: markj Approved by: emaste (mentor)
* ipfilter: Remove dead codeCy Schubert2024-11-121-3/+0
| | | | | | | | ea3022cbbd3f5 converted timeout(9) to callout(9). This code remained as an artifact of the conversion. Fixes: ea3022cbbd3f5 MFC after: 1 week
* ipfilter: Avoid stopping with a lock heldJose Luis Duran2024-11-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid calling _callout_stop_safe with a non-sleepable lock held when detaching by initializing callout_init_rw() with CALLOUT_SHAREDLOCK. It avoids the following WITNESS warning when stopping the service: # service ipfilter stop calling _callout_stop_safe with the following non-sleepable locks held: shared rw ipf filter load/unload mutex (ipf filter load/unload mutex) r = 0 (0xffff0000417c7530) locked @ /usr/src/sys/netpfil/ipfilter/netinet/fil.c:7926 stack backtrace: #0 0xffff00000052d394 at witness_debugger+0x60 #1 0xffff00000052e620 at witness_warn+0x404 #2 0xffff0000004d4ffc at _callout_stop_safe+0x8c #3 0xffff0000f7236674 at ipfdetach+0x3c #4 0xffff0000f723fa4c at ipf_ipf_ioctl+0x788 #5 0xffff0000f72367e0 at ipfioctl+0x144 #6 0xffff00000034abd8 at devfs_ioctl+0x100 #7 0xffff0000005c66a0 at vn_ioctl+0xbc #8 0xffff00000034b2cc at devfs_ioctl_f+0x24 #9 0xffff0000005331ec at kern_ioctl+0x2e0 #10 0xffff000000532eb4 at sys_ioctl+0x140 #11 0xffff000000880480 at do_el0_sync+0x604 #12 0xffff0000008579ac at handle_el0_sync+0x4c PR: 282478 Suggested by: markj Reviewed by: cy Approved by: emaste (mentor) MFC after: 1 week
* ipfilter(4): Fix typos in source code commentsGordon Bergling2024-07-211-2/+2
| | | | | | - s/inconsistancy/inconsistency/ MFC after: 3 days
* netpfil: Fix typos in source code commentsGordon Bergling2024-04-182-3/+3
| | | | | | - s/addres/address/ MFC after: 3 days
* pfil: PFIL_PASS never frees the mbufKristof Provost2024-01-291-0/+4
| | | | | | | | | | | | | | | | | | | | pfil hooks (i.e. firewalls) may pass, modify or free the mbuf passed to them. (E.g. when rejecting a packet, or when gathering up packets for reassembly). If the hook returns PFIL_PASS the mbuf must still be present. Assert this in pfil_mem_common() and ensure that ipfilter follows this convention. pf and ipfw already did. Similarly, if the hook returns PFIL_DROPPED or PFIL_CONSUMED the mbuf must have been freed (or now be owned by the firewall for further processing, like packet scheduling or reassembly). This allows us to remove a few extraneous NULL checks. Suggested by: tuexen Reviewed by: tuexen, zlei Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D43617
* netpfil: Fix a typo in a source code commentGordon Bergling2024-01-221-1/+1
| | | | | | - s/strucutre/structure/ MFC after: 3 days
* netpfil: Fix typo (triple S)Jose Luis Duran2023-12-282-3/+3
| | | | | | | While here, align the comment box. Reviewed by: imp Pull Request: https://github.com/freebsd/freebsd-src/pull/955
* netpfil: Use accessor functions and named constants for all tcphdr flagsRichard Scheffenegger2023-12-252-10/+3
| | | | | | | | | | | | | Update all remaining references to the struct tcphdr th_x2 field. This completes the compatibilty of various aspects with AccECN (TH_AE), after the internal ipfw "re-checksum required" was moved to use the TH_RES1 flag. No functional change. Reviewed By: tuexen, #transport, glebius Sponsored by: NetApp, Inc. Differential Revision: https://reviews.freebsd.org/D43172
* sys: Remove ancient SCCS tags.Warner Losh2023-11-2722-65/+0
| | | | | | | | Remove ancient SCCS tags from the tree, automated scripting, with two minor fixup to keep things compiling. All the common forms in the tree were removed with a perl script. Sponsored by: Netflix
* ipfilter: Add sysctl flag CTLFLAG_TUN to loader tunableZhenlei Huang2023-09-291-1/+1
| | | | | | | | | | | | | The sysctl variable `net.inet.ipf.large_nat` is actually a loader tunable. Add sysctl flag CTLFLAG_TUN to it so that `sysctl -T` will report it correctly. No functional change intended. Reviewed by: cy (for #network) Fixes: a805ffbcbce8 ipfilter: Make LARGE_NAT a tunable MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D42005
* Purge more stray embedded $FreeBSD$ stringsJohn Baldwin2023-09-254-4/+0
| | | | | | | These do not use __FBSDID but instead use bare char arrays. Reviewed by: imp, emaste Differential Revision: https://reviews.freebsd.org/D41957
generated by cgit v1.3 (git 2.53.0) at 2026-09-05 10:29:32 +0000