From nobody Tue Oct 20 07:24:34 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j83nz291Bz6wYJJ for ; Tue, 20 Oct 2026 07:24:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j83nz18n7z3NrS for ; Tue, 20 Oct 2026 07:24:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792481079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dFvsxTRlNH2jC2vQ3exq+He6VWLp8jsCoYnJD7hdclI=; b=BRBxYoLQQzARkF6PZy3ky3DXjt3L501x5RkWdVKEiHyYBYRDPltGA4oXZo3WYbgESR5h56 chuCB3vyf4XU+5NIAux3RHwXc+usls6Xnhf++kBi3IKZuxN5dVgDfu8pgXMaZRwzVTL81W BnxUWFZrmdxDUk5lxKin2dVZW90KoedNO7rLlE2F4MLBH71ziSfqsFKKlxvVoZylhVVYfb 3td5OK6A+tXESr0sHAbKZyJ9lLYCGJsear4bWysMFMDv9EgzJKKoMQhBYnKj/REhjBituV sqPuaW6gR1K+Ye4BOR+lu/Nr6M5T+AgmE6sW25QaLRUiIR2QSZOC1lDkTovmIA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792481079; b=dLLUVQhOogpqF2AHYN2IcwFhuSjkFQrQKvcUdliRPgGxRLkyQSXG37ZrzgSELWSlstpiqr q7mrAop4JpMldNhQ1ZN44foQfBPPg//rX7hcCTKT/uFcHo6pjKz5vkjTXwTjkIDKjyQR5f TDmB2s+3j60bB/QG/rhsmILGnoGyUoClgcIbenfW0u2OlQnHuf6SoWrOApi2T7aqg8+SoM qnB9PzuPi1lznu5DXmCrc8IzFriFGhGvEpYQGoUuYYrxf9f9sEqB6/gxFnqsEPn3L9g3NY JABpis5+YxO2k15uCYt4KH9afiqS4pHCPcOQBioGSjRrhiVq7imzzMgySAQlJg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792481079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dFvsxTRlNH2jC2vQ3exq+He6VWLp8jsCoYnJD7hdclI=; b=OA9oCV5U64sdjmBxbO5YPdoS4yO8sc2M1YZgBf6cMViN9I4t4ilb3E8cTyjHpvQxjppQr0 TcVtuHMJJRTNhDMCdQ77mpezowto/KFHlpqiEvbiyJXAIVXknohJ2YdHrkl1OhvkEJ7rX0 8cinGRsjNtLuNqrIQU5yQsk5apNYJIWzE2FCUy4CQ8hdio29mPKUefyB7+8csE83ffb1ct XfwtbfX5fCqxFjjeW1yKjaViUqb0tisrmK6st2/1+xCmWGGUjB5gHSX4FDjae6hS9ieD9p ibQQtBLuByhoy3FibLzJj/5ldmYfCrrrfFUqfpWkgFma67ykiUkiAUng6S5/Uw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j83nz0k83zy4q for ; Tue, 20 Oct 2026 07:24:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3cd9e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 20 Oct 2026 07:24:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: 3cbfe09ea3a0 - stable/15 - pf: check AH header length. List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3cbfe09ea3a0ac063dbe00bb2756ea6386a68852 Auto-Submitted: auto-generated Date: Tue, 20 Oct 2026 07:24:34 +0000 Message-Id: <6ad71732.3cd9e.23f519a8@gitrepo.freebsd.org> The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=3cbfe09ea3a0ac063dbe00bb2756ea6386a68852 commit 3cbfe09ea3a0ac063dbe00bb2756ea6386a68852 Author: Kristof Provost AuthorDate: 2026-10-12 12:28:22 +0000 Commit: Kristof Provost CommitDate: 2026-10-20 07:22:50 +0000 pf: check AH header length. pf_walk_header() advances the packet offset for each AH extension header. It was not checked that this does not exceed the packet length if no next header was processed. Fix it like in IPv6. OK henning@ sashan@ MFC after: 1 week Obtained from: OpenBSD, bluhm , fcd4e5522e Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit b4d2c9835c0edfddd1d6742afa86d4873ccfad16) --- sys/netpfil/pf/pf.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 1e65bb4dfd96..4a4dd209b7c2 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -10086,7 +10086,7 @@ static int pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short *reason) { struct ah ext; - u_int32_t hlen, end; + u_int32_t hlen, end, extlen; int hdr_cnt; hlen = h->ip_hl << 2; @@ -10134,7 +10134,16 @@ pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short *reason) DPFPRINTF(PF_DEBUG_MISC, "IP short exthdr"); return (PF_DROP); } - pd->off += (ext.ah_len + 2) * 4; + extlen = (ext.ah_len + 2) * 4; + if (end < pd->off + extlen) { + if ((h->ip_off & htons(IP_MF | IP_OFFMASK)) + != 0) + return (PF_PASS); + DPFPRINTF(PF_DEBUG_MISC, "IP long exthdr"); + REASON_SET(reason, PFRES_SHORT); + return (PF_DROP); + } + pd->off += extlen; pd->proto = ext.ah_nxt; break; default: