git: f20a1805f7da - stable/13 - libalias: fix subtle racy problem in outside-inside forwarding

From: Eugene Grosbein <eugen_at_FreeBSD.org>
Date: Sun, 25 Aug 2024 06:45:19 UTC
The branch stable/13 has been updated by eugen:

URL: https://cgit.FreeBSD.org/src/commit/?id=f20a1805f7dace1e4fcfe25e26e552a9ec7ede74

commit f20a1805f7dace1e4fcfe25e26e552a9ec7ede74
Author:     Eugene Grosbein <eugen@FreeBSD.org>
AuthorDate: 2024-08-19 03:34:37 +0000
Commit:     Eugene Grosbein <eugen@FreeBSD.org>
CommitDate: 2024-08-25 06:42:12 +0000

    libalias: fix subtle racy problem in outside-inside forwarding
    
    sys/netinet/libalias/alias_db.c has internal static function UseLink()
    that passes a link to CleanupLink() to verify if the link has expired.
    If so, UseLink() may return NULL.
    
    _FindLinkIn()'s usage of UseLink() is not quite correct.
    
    Assume there is "redirect_port udp" configured to forward incoming
    traffic for specific port to some internal address.
    Such a rule creates partially specified permanent link.
    
    After first such incoming packet libalias creates new fully specified
    temporary LINK_UDP with default timeout of 60 seconds.
    Also, in case of low traffic libalias may assign "timestamp"
    for this new temporary link way in the past because
    LibAliasTime is updated seldom and can keep old value
    for tens of seconds, and it will be used for the temporary link.
    
    It may happen that next incoming packet for redirected port
    passed to _FindLinkIn() results in a call to UseLink()
    that returns NULL due to detected expiration.
    Immediate return of NULL results in broken translation:
    either a packet is dropped (deny_incoming mode) or delivered to
    original destination address instead of internal one.
    
    Fix it with additional check for NULL to proceed with a search
    for original partially specified link. In case of UDP,
    it also recreates temporary fully specified link
    with a call to ReLink().
    
    Practical examples are "redirect_port udp" rules for unidirectional
    SYSLOG protocol (port 514) or some low volume VPN encapsulated in UDP.
    
    Thanks to Peter Much for initial analysis and first version of a patch.
    
    Reported by:    Peter Much <pmc@citylink.dinoex.sub.org>
    PR:             269770
    
    (cherry picked from commit 8132e959099f0c533f698d8fbc17386f9144432f)
    (cherry picked from commit e5b85380836378c9e321a4e6d300591e6faf622a)
---
 sys/netinet/libalias/alias_db.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/libalias/alias_db.c b/sys/netinet/libalias/alias_db.c
index ba0117ff090d..1209348bed5c 100644
--- a/sys/netinet/libalias/alias_db.c
+++ b/sys/netinet/libalias/alias_db.c
@@ -868,8 +868,18 @@ _FindLinkIn(struct libalias *la, struct in_addr dst_addr,
 	case 0:
 		LIST_FOREACH(lnk, &grp->full, all.in) {
 			if (lnk->dst_addr.s_addr == dst_addr.s_addr &&
-			    lnk->dst_port == dst_port)
-				return (UseLink(la, lnk));
+			    lnk->dst_port == dst_port) {
+				struct alias_link *found;
+
+				found = UseLink(la, lnk);
+				if (found != NULL)
+					return (found);
+				/* link expired */
+				grp = StartPointIn(la, alias_addr, alias_port, link_type, 0);
+				if (grp == NULL)
+					return (NULL);
+				break;
+			}
 		}
 		break;
 	case LINK_UNKNOWN_DEST_PORT: