From nobody Sun Aug 25 06:45:19 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Ws47M6VcBz5VRQG; Sun, 25 Aug 2024 06:45:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Ws47M5v6lz4kp9; Sun, 25 Aug 2024 06:45:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1724568319; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Gz5ISccCYwrwvlhk+aeXnxwECW+ag/ekkg15tx65GWk=; b=bgR1XKpvLxQulqej1IjT7e1rt0penC74b9EF4LUpspWQDTA814a4qW3W4pvzkzyNn/EOem YgSy4pEMa0xVIs/qd1Rxza4Es2SQN+mnUFTcbPY0A9utv2tMElYToPvG7NNTmyG3/85Tw7 gFKk91ZWLLr/BKotQqLZ+F1oiPBh0MWfOdXMszJzujcdB3bAA+aJO556H1qHsLWTr459fA h6JRQs5659qOVW98+YGnbZums9GadVcl18oTqupg/kM6iesZk+5GhO+Vn8sC5O5+7s5ahg FtnwRJanU3gSc773VC41d7dSjYoapFb+OOu/YFBqJUSO0KU6LPs59ITcC34GmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1724568319; a=rsa-sha256; cv=none; b=MDvUiQGHpxxXXdjQETHQDWQckRONg8ILOHuXCOZWl3rIccaU+EdysdccUoFOJQVDGFPPdS KUnLstQw3vAacf0gb+9WSWqFfPE4M8eyDxjETWphx9QmI10HSgweb0gPKt2XWDv445Rwv9 s8KyGsxHIzCq6P7755duddR2Mq5CroXIjTKql14kqGYuKRRbIJoNWa1+etd3lXLTHAlKUG O2UeljsR0IAQO1MGDBcTg7m2rQcezAzEcEmtCZuMvtnnyodUHsSrn1WqbffpXaxAD994LI Z38fA1DGxeZAOS6xD+y/xLyfa7KUnjVwlQVWrIEJ3yDbDt6IKrImCqLx2mMQuw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1724568319; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Gz5ISccCYwrwvlhk+aeXnxwECW+ag/ekkg15tx65GWk=; b=lRJgVDI3L7t3qeZkfgEAn1MIRcdEtBeeABVAAfAvQRhBIRypyWUDs4lwxmEPr2Ao5GRxkn g20nbCQ6nmmz7D9EcMjSQXIYzIrTQqNRHyoVGUO83iEzL7u4rXUQgy/NGvsiKnMTqMuXbi 8K2VTwx9UzmxigGz2k2QcRXFI+jAmJnqo/GhK+qAiVKZkq2NePSS9/zRvUsfRUJkR1pNQE Mz24R40+T99IxUFIe55h3S/u6fsrtobAw7wdIe8lyUQ4qn/8JwrB2mBlJc4bhvV8V296i2 AQYntdjt41rYrD9nlX07G3niTBJIj29LDgvGxosBpq0Hg9RZ8hITU9PpsC9Rxw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Ws47M5Mn5z1Rfw; Sun, 25 Aug 2024 06:45:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 47P6jJia042946; Sun, 25 Aug 2024 06:45:19 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 47P6jJ8F042943; Sun, 25 Aug 2024 06:45:19 GMT (envelope-from git) Date: Sun, 25 Aug 2024 06:45:19 GMT Message-Id: <202408250645.47P6jJ8F042943@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Eugene Grosbein Subject: git: f20a1805f7da - stable/13 - libalias: fix subtle racy problem in outside-inside forwarding List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: f20a1805f7dace1e4fcfe25e26e552a9ec7ede74 Auto-Submitted: auto-generated The branch stable/13 has been updated by eugen: URL: https://cgit.FreeBSD.org/src/commit/?id=f20a1805f7dace1e4fcfe25e26e552a9ec7ede74 commit f20a1805f7dace1e4fcfe25e26e552a9ec7ede74 Author: Eugene Grosbein AuthorDate: 2024-08-19 03:34:37 +0000 Commit: Eugene Grosbein CommitDate: 2024-08-25 06:42:12 +0000 libalias: fix subtle racy problem in outside-inside forwarding sys/netinet/libalias/alias_db.c has internal static function UseLink() that passes a link to CleanupLink() to verify if the link has expired. If so, UseLink() may return NULL. _FindLinkIn()'s usage of UseLink() is not quite correct. Assume there is "redirect_port udp" configured to forward incoming traffic for specific port to some internal address. Such a rule creates partially specified permanent link. After first such incoming packet libalias creates new fully specified temporary LINK_UDP with default timeout of 60 seconds. Also, in case of low traffic libalias may assign "timestamp" for this new temporary link way in the past because LibAliasTime is updated seldom and can keep old value for tens of seconds, and it will be used for the temporary link. It may happen that next incoming packet for redirected port passed to _FindLinkIn() results in a call to UseLink() that returns NULL due to detected expiration. Immediate return of NULL results in broken translation: either a packet is dropped (deny_incoming mode) or delivered to original destination address instead of internal one. Fix it with additional check for NULL to proceed with a search for original partially specified link. In case of UDP, it also recreates temporary fully specified link with a call to ReLink(). Practical examples are "redirect_port udp" rules for unidirectional SYSLOG protocol (port 514) or some low volume VPN encapsulated in UDP. Thanks to Peter Much for initial analysis and first version of a patch. Reported by: Peter Much PR: 269770 (cherry picked from commit 8132e959099f0c533f698d8fbc17386f9144432f) (cherry picked from commit e5b85380836378c9e321a4e6d300591e6faf622a) --- sys/netinet/libalias/alias_db.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sys/netinet/libalias/alias_db.c b/sys/netinet/libalias/alias_db.c index ba0117ff090d..1209348bed5c 100644 --- a/sys/netinet/libalias/alias_db.c +++ b/sys/netinet/libalias/alias_db.c @@ -868,8 +868,18 @@ _FindLinkIn(struct libalias *la, struct in_addr dst_addr, case 0: LIST_FOREACH(lnk, &grp->full, all.in) { if (lnk->dst_addr.s_addr == dst_addr.s_addr && - lnk->dst_port == dst_port) - return (UseLink(la, lnk)); + lnk->dst_port == dst_port) { + struct alias_link *found; + + found = UseLink(la, lnk); + if (found != NULL) + return (found); + /* link expired */ + grp = StartPointIn(la, alias_addr, alias_port, link_type, 0); + if (grp == NULL) + return (NULL); + break; + } } break; case LINK_UNKNOWN_DEST_PORT: