From nobody Sun Aug 16 16:40:21 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hNMCB136Yz6pJ9f for ; Sun, 16 Aug 2026 16:40:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hNMC966rHz3QrD for ; Sun, 16 Aug 2026 16:40:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786898421; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fsuCZ5cBCn5vxlJqhZOWVrK6llMQlPmSyL23CI6jR70=; b=nsrkc6MKE2WMrNxm4ONcPrMgp+F7L8RXMsSb9UcYn3mgFFrPyHeywKcqdVk589eiy0XI2d lY6o5hl6paSMxBwG83Kqo1wYVRByIq4pym9huWa9Gpcs1U0mEeRZgOFVxLkahMhm7/+jp/ U5JWfbJB0dFUea5pTbalOeumDaYss9Zh/m2m8aYfemosOWF1DVdo6mKrYdvKcPkzsHeGft csTsq/uGssbDylBB89ndySxOWuLM2YKrGPZFRZSNDA1cWTmvg7adbiOR3GHW/7702H0hlb GbKrbHQvsmDn+UjgDWmcolZiT9TCiQHO/BsdoQMOGtwNq5e5hl55xFmaGv9p9g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786898421; a=rsa-sha256; cv=none; b=cbqHBl9BZlIgfhTSP+qHIy7KYSL+Ozu+oSTy1KpCf3ebsEiBJ11IVf7VCn60zuuTj71Wd7 kpc7Lk6hgRIZ79MN5iYeR1ZCBcpj9fFE/D15f5vphQJzbXsiQf+wmGJ4YK97L4D6Pg/kP0 XIKGcXSdRmOcXd0hkAmL5lS4hWiOSg6bnH7P/wDRstkRxidSXsyAAtDoFPY//jyWXWzw9I kRYCnSK1EsqKQ7xd3QEDNBDjK/Z2esxPDK+yhZhf3b7YyCCvQIho+EpqPYPiNtGyr9FMIn Fqmfv1snUnHJHOfGVcmjl3QBPAC904fh7CEUCM1DUBghkPhHLNO1mC/kO0vfrg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786898421; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fsuCZ5cBCn5vxlJqhZOWVrK6llMQlPmSyL23CI6jR70=; b=aanYPj6Haa7IZZrEUBuP0SRqDIP/DbIiT6qTklzX6jQba+VCu3P551Zua/8NCClQWw0pVG 2ziobVzTGjwXpiyl+3ydJGRObJYBE0NdbNAECLCsIRnC9uGtBjGVDnoA9Pbx9ll73jcW5A yGGx0O4h745lPz7w6pnFZjLhrdoeJVzhUlGF7NQL+Mo+fHoywHLYEYvP2qlNlOXfLqEZok SkcWmdfc/HV3td/LVrsXeauMeZU5FsiLwY7PhZyuncvjDU6OBYZXGg13LBUDl9AxaOSf6w eFh7/iWcpW2cpbaKnQ0ogYZN24Lpv6wirEb7c7jk9e+oCvkbVncNDOhwtGwUSw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hNMC951T6zc49 for ; Sun, 16 Aug 2026 16:40:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 27945 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 16 Aug 2026 16:40:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 022f935a1fbc - stable/14 - PF_KEY socket: limit the length of copied socket address List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 022f935a1fbc75d39a055eee0a327cb2062a4596 Auto-Submitted: auto-generated Date: Sun, 16 Aug 2026 16:40:21 +0000 Message-Id: <6a81e7f5.27945.411d5496@gitrepo.freebsd.org> The branch stable/14 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=022f935a1fbc75d39a055eee0a327cb2062a4596 commit 022f935a1fbc75d39a055eee0a327cb2062a4596 Author: Konstantin Belousov AuthorDate: 2026-08-04 15:52:53 +0000 Commit: Konstantin Belousov CommitDate: 2026-08-16 16:37:15 +0000 PF_KEY socket: limit the length of copied socket address PR: 297264 (cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b) --- sys/netipsec/key.c | 128 +++++++++++++++++++++++++++++------------------------ 1 file changed, 69 insertions(+), 59 deletions(-) diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c index 74f4e2527401..2aa0e933ec44 100644 --- a/sys/netipsec/key.c +++ b/sys/netipsec/key.c @@ -546,32 +546,42 @@ static int key_checksockaddrs(const struct sockaddr *src, * set parameters into secpolicyindex buffer. * Must allocate secpolicyindex buffer passed to this function. */ -#define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \ -do { \ - bzero((idx), sizeof(struct secpolicyindex)); \ - (idx)->dir = (_dir); \ - (idx)->prefs = (ps); \ - (idx)->prefd = (pd); \ - (idx)->ul_proto = (ulp); \ - bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ - bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ -} while (0) +static void +key_setsecspidx(uint8_t dir, const void *s, const void *d, uint8_t prefs, + uint8_t prefd, uint8_t ul_proto, struct secpolicyindex *idx) +{ + MPASS(key_checksockaddrs((const struct sockaddr *)s, + (const struct sockaddr *)d) == 0); + + memset(idx, 0, sizeof(*idx)); + idx->dir = dir; + idx->prefs = prefs; + idx->prefd = prefd; + idx->ul_proto = ul_proto; + memcpy(&idx->src, s, ((const struct sockaddr *)s)->sa_len); + memcpy(&idx->dst, d, ((const struct sockaddr *)d)->sa_len); +} /* * set parameters into secasindex buffer. * Must allocate secasindex buffer before calling this function. */ -#define KEY_SETSECASIDX(p, m, r, s, d, idx) \ -do { \ - bzero((idx), sizeof(struct secasindex)); \ - (idx)->proto = (p); \ - (idx)->mode = (m); \ - (idx)->reqid = (r); \ - bcopy((s), &(idx)->src, ((const struct sockaddr *)(s))->sa_len); \ - bcopy((d), &(idx)->dst, ((const struct sockaddr *)(d))->sa_len); \ - key_porttosaddr(&(idx)->src.sa, 0); \ - key_porttosaddr(&(idx)->dst.sa, 0); \ -} while (0) +static void +key_setsecasidx(uint8_t proto, uint8_t mode, uint32_t reqid, + const void *s, const void *d, struct secasindex *idx) +{ + MPASS(key_checksockaddrs((const struct sockaddr *)s, + (const struct sockaddr *)d) == 0); + + memset(idx, 0, sizeof(*idx)); + idx->proto = proto; + idx->mode = mode; + idx->reqid = reqid; + memcpy(&idx->src, s, ((const struct sockaddr *)s)->sa_len); + memcpy(&idx->dst, d, ((const struct sockaddr *)d)->sa_len); + key_porttosaddr(&idx->src.sa, 0); + key_porttosaddr(&idx->dst.sa, 0); +} /* key statistics */ struct _keystat { @@ -1182,7 +1192,7 @@ key_allocsa_tunnel(union sockaddr_union *src, union sockaddr_union *dst, IPSEC_ASSERT(src != NULL, ("null src address")); IPSEC_ASSERT(dst != NULL, ("null dst address")); - KEY_SETSECASIDX(proto, IPSEC_MODE_TUNNEL, 0, &src->sa, + key_setsecasidx(proto, IPSEC_MODE_TUNNEL, 0, &src->sa, &dst->sa, &saidx); sav = NULL; @@ -2056,13 +2066,9 @@ key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) return key_senderror(so, m, error); } /* make secindex */ - KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, - src0 + 1, - dst0 + 1, - src0->sadb_address_prefixlen, - dst0->sadb_address_prefixlen, - src0->sadb_address_proto, - &spidx); + key_setsecspidx(xpl0->sadb_x_policy_dir, src0 + 1, dst0 + 1, + src0->sadb_address_prefixlen, dst0->sadb_address_prefixlen, + src0->sadb_address_proto, &spidx); /* Checking there is SP already or not. */ oldsp = key_getsp(&spidx); if (oldsp != NULL) { @@ -2274,13 +2280,9 @@ key_spddelete(struct socket *so, struct mbuf *m, return key_senderror(so, m, EINVAL); } /* make secindex */ - KEY_SETSECSPIDX(xpl0->sadb_x_policy_dir, - src0 + 1, - dst0 + 1, - src0->sadb_address_prefixlen, - dst0->sadb_address_prefixlen, - src0->sadb_address_proto, - &spidx); + key_setsecspidx(xpl0->sadb_x_policy_dir, src0 + 1, dst0 + 1, + src0->sadb_address_prefixlen, dst0->sadb_address_prefixlen, + src0->sadb_address_proto, &spidx); /* Is there SP in SPD ? */ if ((sp = key_getsp(&spidx)) == NULL) { @@ -4947,7 +4949,7 @@ key_getspi(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) error = EINVAL; goto fail; } - KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); + key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); /* SPI allocation */ SPI_ALLOC_LOCK(); @@ -5180,36 +5182,44 @@ key_updateaddresses(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp, struct secasvar *sav, struct secasindex *saidx) { - struct sockaddr *newaddr; + struct sockaddr *dnewaddr, *snewaddr; struct secashead *sah; struct secasvar *newsav, *tmp; struct mbuf *n; int error, isnew; + bool newsaidx; + newsaidx = false; /* Check that we need to change SAH */ if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) { - newaddr = (struct sockaddr *)( - ((struct sadb_address *) + snewaddr = (struct sockaddr *)(((struct sadb_address *) mhp->ext[SADB_X_EXT_NEW_ADDRESS_SRC]) + 1); - bcopy(newaddr, &saidx->src, newaddr->sa_len); - key_porttosaddr(&saidx->src.sa, 0); + newsaidx = true; + } else { + snewaddr = &saidx->src.sa; } if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { - newaddr = (struct sockaddr *)( - ((struct sadb_address *) + dnewaddr = (struct sockaddr *)(((struct sadb_address *) mhp->ext[SADB_X_EXT_NEW_ADDRESS_DST]) + 1); - bcopy(newaddr, &saidx->dst, newaddr->sa_len); + newsaidx = true; + } else { + dnewaddr = &saidx->dst.sa; + } + error = key_checksockaddrs(snewaddr, dnewaddr); + if (error != 0) { + ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n", + __func__)); + return (error); + } + if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC)) { + memcpy(&saidx->src, snewaddr, snewaddr->sa_len); + key_porttosaddr(&saidx->src.sa, 0); + } + if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { + memcpy(&saidx->dst, dnewaddr, dnewaddr->sa_len); key_porttosaddr(&saidx->dst.sa, 0); } - if (!SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_SRC) || - !SADB_CHECKHDR(mhp, SADB_X_EXT_NEW_ADDRESS_DST)) { - error = key_checksockaddrs(&saidx->src.sa, &saidx->dst.sa); - if (error != 0) { - ipseclog((LOG_DEBUG, "%s: invalid new sockaddr.\n", - __func__)); - return (error); - } - + if (newsaidx) { sah = key_getsah(saidx); if (sah == NULL) { /* create a new SA index */ @@ -5437,7 +5447,7 @@ key_update(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); return key_senderror(so, m, error); } - KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); + key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); sav = key_getsavbyspi(sa0->sadb_sa_spi); if (sav == NULL) { ipseclog((LOG_DEBUG, "%s: no SA found for SPI %u\n", @@ -5669,7 +5679,7 @@ key_add(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); return key_senderror(so, m, error); } - KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); + key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); spi = sa0->sadb_sa_spi; /* * For TCP-MD5 SAs we don't use SPI. Check the uniqueness using @@ -6057,7 +6067,7 @@ key_delete(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); return (key_senderror(so, m, EINVAL)); } - KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); + key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); if (SADB_CHECKHDR(mhp, SADB_EXT_SA)) { /* * Caller wants us to delete all non-LARVAL SAs @@ -6286,7 +6296,7 @@ key_get(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); return key_senderror(so, m, EINVAL); } - KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); + key_setsecasidx(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx); SPI_ALLOC_LOCK(); if (proto == IPPROTO_TCP) @@ -7103,7 +7113,7 @@ key_acquire2(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp) ipseclog((LOG_DEBUG, "%s: invalid sockaddr.\n", __func__)); return key_senderror(so, m, EINVAL); } - KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); + key_setsecasidx(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx); /* get a SA index */ SAHTREE_RLOCK();