From nobody Tue Nov 04 00:53:32 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4d0qhD37xYz6G7kP; Tue, 04 Nov 2025 00:53:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4d0qhD2jSFz3tmT; Tue, 04 Nov 2025 00:53:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1762217612; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=05gIk75sXEDqr9eMlxmTF5q9UKJC/XNHe28ipPUTdz4=; b=WK98gouSp4xR+OI4+cAD+JhZFKZH3TB4yZwmURB/iOR9HkkIWLhSt8AcwWjNXbiaeYcG6G elnJTHUI/JohcZoXzFEW32K7HY5jqG+GP/+FIIYl6gN6l0jb/vH3ibeMLkNyTIklLaKKuI u2SJuTCoZsfZfCEXNYcPCVs08nhYswFsdOSy4FfOuvrxic9vSztrLJ/2LbLmh7EnkwCeXN R683QREjLxQYKMvLts7bOrQOHBWIU5DVEEmwp/wQ9vJy4SVQdoso79hQL+VuBDHat2M8if q0vr1cJq1UeqhJVFk7+beMm1T0OmQLX4R+7bUxMSN9+Wf3vxubJJZLUAazk32A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1762217612; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=05gIk75sXEDqr9eMlxmTF5q9UKJC/XNHe28ipPUTdz4=; b=yduAp1aaYXPEzENv9hmKBdU1dfZS/uTaaXR4vhZuOcQeP1iD34zmLdkwOT4qPnpg8DCwiN hzdO91IkaYXFTSQYao2zelZH9asR92VeD04wdOecGGO8QDw/ZnvC9C+xB2lclV/tuKgW+L ADNdvVRJ4h7/mYe1jhyOgN1OiKY4i8jdJ+5UOkgpPSFmxa0gFcPITKy4ukLwosbOkq4GoK kzAl2x3FE0Va6LavKLbIo3Me242x7PRzufZtPtO85JcUEvWEasoQsajJK1hbE6TrsLAHD6 igoxI3oq+YcAiY92s+DjUtExyi5OAnoTGWPJhFpS2/MvYX3Hk8KvfAKYX0XMgA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1762217612; a=rsa-sha256; cv=none; b=YBCRIfoC17PwL7yXAZpYscuC5VB6oCC7k+bQCYQln+icu2mYqCYira4zzfkdZpmPqVXgoT WxBl0AN2MUqI/73bVsQrPKeYLfL/rf4eYJsvfKA508df1x7wAHvwwVa5GrmAyfz/nU3CLr KAS/WFPAhA6rc6mDyxUFgpKgdXyufWPQhErKzAWvOgrPe3bstIU3gZp0/UhbT9xCECr/KP 6MlZz/tTAD48eW9bF8h81lepfI6MsF7HhBvSRovyeMj/7eJg8F1a42lz+rOZYBGR1l9zMy 565UU1rZZkQYmi5ABBzg/djP4TBSlHJjYb9qEqIIp8uMD449FWmSEy1mwqfBfw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4d0qhD29XDzbVZ; Tue, 04 Nov 2025 00:53:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 5A40rWQW057476; Tue, 4 Nov 2025 00:53:32 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 5A40rW0o057473; Tue, 4 Nov 2025 00:53:32 GMT (envelope-from git) Date: Tue, 4 Nov 2025 00:53:32 GMT Message-Id: <202511040053.5A40rW0o057473@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: deb684f9d1d6 - stable/14 - ipfw: pmod: avoid further rule processing after tcp-mod failures List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: deb684f9d1d6a3681e451d3af31f768c567f7dbe Auto-Submitted: auto-generated The branch stable/14 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=deb684f9d1d6a3681e451d3af31f768c567f7dbe commit deb684f9d1d6a3681e451d3af31f768c567f7dbe Author: Kyle Evans AuthorDate: 2025-11-01 17:34:11 +0000 Commit: Kyle Evans CommitDate: 2025-11-04 00:52:54 +0000 ipfw: pmod: avoid further rule processing after tcp-mod failures m_pullup() here will have freed the mbuf chain, but we pass back an IP_FW_DENY without any signal that the outer loop should finish. Thus, rule processing continues without an mbuf and there's a chance that we conclude that the packet may pass (but there's no mbuf remaining) depending on the rules that follow it. PR: 284606 Reviewed by: ae (cherry picked from commit c0382512bfce872102d213b9bc2550de0bc30b67) --- sys/netpfil/ipfw/pmod/tcpmod.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/sys/netpfil/ipfw/pmod/tcpmod.c b/sys/netpfil/ipfw/pmod/tcpmod.c index d7400f4fd5ed..138fefe22a98 100644 --- a/sys/netpfil/ipfw/pmod/tcpmod.c +++ b/sys/netpfil/ipfw/pmod/tcpmod.c @@ -58,7 +58,8 @@ VNET_DEFINE_STATIC(uint16_t, tcpmod_setmss_eid) = 0; #define V_tcpmod_setmss_eid VNET(tcpmod_setmss_eid) static int -tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) +tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss, + int *done) { struct mbuf *m; u_char *cp; @@ -73,8 +74,10 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) * TCP header with options. */ *mp = m = m_pullup(m, m->m_pkthdr.len); - if (m == NULL) + if (m == NULL) { + *done = 1; return (ret); + } } /* Parse TCP options. */ for (tlen -= sizeof(struct tcphdr), cp = (u_char *)(tcp + 1); @@ -115,7 +118,7 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) #ifdef INET6 static int -tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct ip6_hdr *ip6; struct ip6_hbh *hbh; @@ -143,13 +146,13 @@ tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET6 */ #ifdef INET static int -tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct tcphdr *tcp; struct ip *ip; @@ -163,7 +166,7 @@ tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET */ @@ -207,19 +210,23 @@ ipfw_tcpmod(struct ip_fw_chain *chain, struct ip_fw_args *args, switch (args->f_id.addr_type) { #ifdef INET case 4: - ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1), + done); break; #endif #ifdef INET6 case 6: - ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1), + done); break; #endif } /* * We return zero in both @ret and @done on success, and ipfw_chk() * will update rule counters. Otherwise a packet will not be matched - * by rule. + * by rule. We passed @done around above in case we hit a fatal error + * somewhere, we'll return non-zero but signal that rule processing + * cannot succeed. */ return (ret); }