From nobody Tue Feb 18 17:43:14 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Yy6Lr0Kz4z5nwn3; Tue, 18 Feb 2025 17:43:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Yy6Lq2gWdz3WcS; Tue, 18 Feb 2025 17:43:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1739900595; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MvudcoPHqRNpoOczTkn2uSgjMEyDawzEKG4vt3n+q6E=; b=I2WNJ1sMTKfz4hZZQekuZE3Ifqtl/arseoBQUKJhbuUZT79VLnAfyZM9WATd5uIwSEy2xa TprthXBOprpadhWoJ1IDoxA7R05bn1mlYjqqM66s/kZdzaurTDAw4GV7RbYxlL7jTeJwLL Jt3ZRJMLSJYF9NBsMG01JkuBtUcXv+/qqEWjm1o1WZ4qZXzShelHGAEX4g2x/65CBB4QN3 j3ZdG8cradF1LFCF/yv8pW8+vPJCZhYc61cSxtR3FNJM4EtuU69lPrXN60M7b7YWgiIpBC aKKgHwudDGme9Fp0EpTP3siZ6+vNwq8CH+oVxv04QHT42fJXOah+jFx3ZrXayA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1739900595; a=rsa-sha256; cv=none; b=nmBWwd1vM1b5/UAnLSu3J3rDtWm9MrwUVo/N1hnziC8LgOxKfIE0s7UMtiKgliLH5gZpcX pyJYWeGV7ELqzMP++ddMNUpkOPWsbeusHimYwzEMUKWwwNtB4RspVHa51i2+xkZtRB6W2A 7eccwdGj4dAfyd76upzIdRwbhcRPD4YmykAn+uilhFvAzszGiUmeEffN+cC9f6vaysxyTk zTGjG/VMZ5xWCy266JQsRMvpCrc9rpsxGIc/eVH5kXCDMaP1ezwnHgfkmmWauSuvz+VbEF ZgaSB/lBFIlL+QQfeODqqMcygu2vp0mVpSI7rzxSq/elGF97VJOYElVSeGyaTw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1739900595; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MvudcoPHqRNpoOczTkn2uSgjMEyDawzEKG4vt3n+q6E=; b=ZZUF0D0bLTnteSkA26p84FHDCGbCJU3Pi2h86CuAet0i0rqoC2x6HMACWoVNLknUxNCKOR 1zXebs03DmgXYdC2y+Pr+wMkDBjMtjOrDEAAZLV7iIOM+/NtlOA7ER8/VC/5qL/oM1Vh5Z 3hWxu5jDlF8sVztFWdm2rGoWboUbjZ++fRLLe1Nfh54GmsPrsVc7N1Ghs+30ZH/lelLn5c X4o19DiFzQsObz7XAvXxSshkglRcA8MGL7nCb8QMBLgfFrHW2ORJuSbSPzev6Wje1+Gz7j WcMZFiMFrSRjkNDR83HmyBzpKuBY00OOtCVj/RREoahXdRcho5hI+3nIHLLrYg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Yy6Lp5WtVzTt8; Tue, 18 Feb 2025 17:43:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 51IHhESL021299; Tue, 18 Feb 2025 17:43:14 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 51IHhENC021289; Tue, 18 Feb 2025 17:43:14 GMT (envelope-from git) Date: Tue, 18 Feb 2025 17:43:14 GMT Message-Id: <202502181743.51IHhENC021289@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: d02fb54b5a90 - stable/14 - pf: do not keep state when dropping overlapping IPv6 fragments List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: d02fb54b5a901c47ee8faf8a63334af2e0971c90 Auto-Submitted: auto-generated The branch stable/14 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=d02fb54b5a901c47ee8faf8a63334af2e0971c90 commit d02fb54b5a901c47ee8faf8a63334af2e0971c90 Author: Kristof Provost AuthorDate: 2025-01-09 13:11:11 +0000 Commit: Kristof Provost CommitDate: 2025-02-18 17:40:26 +0000 pf: do not keep state when dropping overlapping IPv6 fragments ok sperreault@ Obtained from: OpenBSD, bluhm , cd45765685 Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 3b79f6d2d39405bcac395dc036ceb6f8fd09ce99) --- sys/netpfil/pf/pf_norm.c | 30 ++++++++---------------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index 69548e6a997f..e6e1549d3689 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -606,15 +606,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent, return (frag); } - if (TAILQ_EMPTY(&frag->fr_queue)) { - /* - * Overlapping IPv6 fragments have been detected. Do not - * reassemble packet but also drop future fragments. - * This will be done for this ident/src/dst combination - * until fragment queue timeout. - */ - goto drop_fragment; - } + KASSERT(!TAILQ_EMPTY(&frag->fr_queue), ("!TAILQ_EMPTY()->fr_queue")); /* Remember maximum fragment len for refragmentation. */ if (frent->fe_len > frag->fr_maxlen) @@ -651,7 +643,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent, uint16_t precut; if (frag->fr_af == AF_INET6) - goto flush_fragentries; + goto free_fragment; precut = prev->fe_off + prev->fe_len - frent->fe_off; if (precut >= frent->fe_len) { @@ -715,21 +707,15 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent, return (frag); -flush_fragentries: +free_fragment: /* - * RFC5722: When reassembling an IPv6 datagram, if one or - * more its constituent fragments is determined to be an - * overlapping fragment, the entire datagram (and any constituent - * fragments, including those not yet received) MUST be - * silently discarded. + * RFC 5722, Errata 3089: When reassembling an IPv6 datagram, if one + * or more its constituent fragments is determined to be an overlapping + * fragment, the entire datagram (and any constituent fragments) MUST + * be silently discarded. */ DPFPRINTF(("flush overlapping fragments\n")); - while ((prev = TAILQ_FIRST(&frag->fr_queue)) != NULL) { - TAILQ_REMOVE(&frag->fr_queue, prev, fr_next); - - m_freem(prev->fe_m); - uma_zfree(V_pf_frent_z, prev); - } + pf_free_fragment(frag); bad_fragment: REASON_SET(reason, PFRES_FRAG);