diff options
| author |   bluhm <bluhm@openbsd.org> | 2011-07-09 17:42:19 +0000 |
|---|---|---|
| committer | bluhm <bluhm@openbsd.org> | 2011-07-09 17:42:19 +0000 |
| commit | 7ce93f3346255cfe40d986ecaeafa936bc9246aa (patch) | |
| tree | 212525d844e08dae1b7a195799e044e2db119ce5 | |
| parent | Add a missing prototype, fix build with WARNINGS=yes. (diff) | |
| download | wireguard-openbsd-7ce93f3346255cfe40d986ecaeafa936bc9246aa.tar.xz wireguard-openbsd-7ce93f3346255cfe40d986ecaeafa936bc9246aa.zip | |
If ipv4+icmp6 or ipv6+icmp packets were embedded into an icmp
payload, we missed to drop them. While there, also add a reason
to the corresponding check in pf_test().
ok mcbride@ claudio@
| -rw-r--r-- | sys/net/pf.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/sys/net/pf.c b/sys/net/pf.c index 506ef24873b..d0ccad46a5a 100644 --- a/sys/net/pf.c +++ b/sys/net/pf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pf.c,v 1.763 2011/07/08 18:50:51 henning Exp $ */ +/* $OpenBSD: pf.c,v 1.764 2011/07/09 17:42:19 bluhm Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -4561,6 +4561,11 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif, case IPPROTO_ICMP: { struct icmp iih; + if (pd2.af != AF_INET) { + REASON_SET(reason, PFRES_NORM); + return (PF_DROP); + } + if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN, NULL, reason, pd2.af)) { DPFPRINTF(LOG_NOTICE, @@ -4622,6 +4627,11 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif, case IPPROTO_ICMPV6: { struct icmp6_hdr iih; + if (pd2.af != AF_INET6) { + REASON_SET(reason, PFRES_NORM); + return (PF_DROP); + } + if (!pf_pull_hdr(m, off2, &iih, sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) { DPFPRINTF(LOG_NOTICE, @@ -5988,8 +5998,9 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0, } case IPPROTO_ICMP: { - if (af == AF_INET6) { + if (af != AF_INET) { action = PF_DROP; + REASON_SET(&reason, PFRES_NORM); DPFPRINTF(LOG_NOTICE, "dropping IPv6 packet with ICMPv4 payload"); goto done; @@ -6010,8 +6021,9 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0, } case IPPROTO_ICMPV6: { - if (af == AF_INET) { + if (af != AF_INET6) { action = PF_DROP; + REASON_SET(&reason, PFRES_NORM); DPFPRINTF(LOG_NOTICE, "dropping IPv4 packet with ICMPv6 payload"); goto done; |