From nobody Tue Apr 22 15:59:41 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Zhn4F4JbXz5sq4H; Tue, 22 Apr 2025 15:59:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Zhn4F2x6wz3hcM; Tue, 22 Apr 2025 15:59:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1745337581; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4IGe8cyD4eQGnXWuRmQBYSR2ZGapgZFtnQljRtPFNNw=; b=AMnWouy2s4eFc2xK2Rq5Nh16zUNftG9K7TSXxNO2ycD4RXOpkFhFVfEu5HkpPCPiikdJQA 7VIGjncJxhsb3kjvFeGQXdQkn0qeHf+VrEPFEJXDj6i0i/hwFsz+4icm7uKgMlrJRoyNsu XkXQQywakNIy07c0MBP0ItTl2wL/zKjxPSVNkhE5M5viyUaK3etSisK1J1j2XhtqmPvtBE 7BP9lR72gMpWcyp42ARoNgWwsIMAqm8i6g/KOri9O5FKFbyLllWmWmWi4MCikUCSP7m9yo fPax0zYPeboa5jL1thhCmtCTc/RELcKL0v/GJJF71x4Fr3yXDOn0FQ6P+qYgGg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1745337581; a=rsa-sha256; cv=none; b=KFN1RcDUgppNwlCMK9TC24GgmH5HIbK9t1yE8bvFqMYrKI96iyE9WYm5L/peK7k/BCiSgB AUiZlcdv9X35Rv2Vr543aANxJr33Jjb0cS8yxVQP5Po0aTH/LAsPR56FgIj2On1gqUhfS0 3jti8sQBIi+HIoRfLrqLXkPyBFSolw9SHsNiCZpNnCpjQUsWGsLSCppY0ydlzdY3rRJhkD n8NU0P9SfpddjHtiTmeQEfdSHE1d1FPp/0btkJzUuxIRYX0iXzA1xGYPtYC6VviM4FJHzl b7XPrl8guzKhfPuA+zr+V8FHh4TqSEyubg5UkTeSdVW/DQKxaxRI0Q9lulXVBg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1745337581; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4IGe8cyD4eQGnXWuRmQBYSR2ZGapgZFtnQljRtPFNNw=; b=uGVevSf0WQ9kgGSt1dpR+VmeFvSusfTofScKZpcoGj1/g0kjhCFwpR7cmXRRMvQ1XehQSS SJFZdj2vm030UpQYkgy7OE9rG5T/fO+yyV7JsRS0TV0Jfd/eRj85zkQmHjuh0TjcgnxPgB jQu/KlZcHYVdg/3zRIBE4TPnmcD+EeISdRGx72tpDaQtkguZcjSyhkeWSsp0P3fu4eADFe Btmf+xTfg0c8ByNSxgizmfW7IbK9n221i3YsVE58KxO1+aq9aMwioxdHt1wKDld9X78Ius y/eSQHsP/mEfdnodiZND6Fz0UA8lIiMFUy12ftD3+apdH215uGVKXH6A7Bqm1Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Zhn4F2X2wz9YG; Tue, 22 Apr 2025 15:59:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 53MFxf5n031740; Tue, 22 Apr 2025 15:59:41 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 53MFxfvb031737; Tue, 22 Apr 2025 15:59:41 GMT (envelope-from git) Date: Tue, 22 Apr 2025 15:59:41 GMT Message-Id: <202504221559.53MFxfvb031737@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: b7a61e09e4ad - main - netinet6: Do not forward or send ICMPv6 messages to the unspec address List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b7a61e09e4ad5fda44b7f4b6fee14f1b53996b41 Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b7a61e09e4ad5fda44b7f4b6fee14f1b53996b41 commit b7a61e09e4ad5fda44b7f4b6fee14f1b53996b41 Author: Mark Johnston AuthorDate: 2025-04-22 14:54:37 +0000 Commit: Mark Johnston CommitDate: 2025-04-22 14:54:37 +0000 netinet6: Do not forward or send ICMPv6 messages to the unspec address As in f7174eb2b4c4 ("netinet: Do not forward or ICMP response to INADDR_ANY"), the IPv6 stack should avoid sending packets to the unspecified address. In particular: - Make sure that we do not forward received packets to the unspecified address; the check in ip6_input() catches this in the common case, but after commit 40faf87894ff it's possible for a pfil hook to bypass this check and pass the packet to ip6_forward() using the PACKET_TAG_IPFORWARD tag. - Make sure that we do not reflect packets back to the unspecified address; RFC 4443 section 2.4 states that we must not generate error messages in response to packets from the unspecified address. Reviewed by: zlei, glebius Reported by: Franco Fichtner MFC after: 1 month Sponsored by: Klara, Inc. Sponsored by: OPNsense Differential Revision: https://reviews.freebsd.org/D49339 --- sys/netinet6/icmp6.c | 6 ++++++ sys/netinet6/ip6_forward.c | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c index 3740a3eaec0d..764e57ef9b76 100644 --- a/sys/netinet6/icmp6.c +++ b/sys/netinet6/icmp6.c @@ -2087,6 +2087,12 @@ icmp6_reflect(struct mbuf *m, size_t off) hlim = 0; srcp = NULL; + if (__predict_false(IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src))) { + nd6log((LOG_DEBUG, + "icmp6_reflect: source address is unspecified\n")); + goto bad; + } + /* * If the incoming packet was addressed directly to us (i.e. unicast), * use dst as the src for the reply. diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index 44a349d1750f..ad8c95c9363c 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -109,7 +109,8 @@ ip6_forward(struct mbuf *m, int srcrt) */ if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 || IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || + IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { IP6STAT_INC(ip6s_cantforward); /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */ if (V_ip6_log_cannot_forward && ip6_log_ratelimit()) {