From nobody Tue Jul 15 10:07:54 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bhFHb0MxTz62DbN; Tue, 15 Jul 2025 10:07:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bhFHZ2djLz3fCh; Tue, 15 Jul 2025 10:07:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752574074; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cebF6vyi7SL/WB3wegS8WrnGfm/ikyt8g32z+cljvMY=; b=geMqy2B3GAwlkDKzfUjjDzDwFshT1BfMFQV6T8KXGEMwffsEbos/ZXzGdP8uoPIIQEnakV zYBK9ibNAsSLGUiAd395ofUXpMiAEE4qoE3LniuV+YVKLI1COMEG4EgPSiMLo2P25RMiCH +unhd1UJkPUAPV3dC7xXG/vF3+J0OrQF9Bc4voR3IwK/Z6xNCUwGfLy0+M8PDj5AkGkgZg vSg3owkCRs7u96L+u4/eQ/DLwFCWEJI+xWv+GZ3+eq0/T7iLTGxrj2ZZQSRqQE9oevtzia 8yOug9enVznpKeupm95TC5pz9I6653FHsqyl1HjjxxNKDFHRDCT+0QYULwETEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752574074; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cebF6vyi7SL/WB3wegS8WrnGfm/ikyt8g32z+cljvMY=; b=KNhCz/Lz9e1WZJcvPzdpwLz51gO+OkDrtkfbacsxNAs516qgRLsXC9TWSpo+umzz8H5NAy Oz2Upv8LoJ+j4QjfZbvdbUUEVKmIyX6cLiPIHjCSfafXpreOo8Pu3I06Rq9ddrflA6CZ1n b06I1cPi+UipRiESuu7L7hM4R2ZURink+cZyUQ8k25rQYiB15Jvj7k7RanV7wLq0Lvxkiq jKaIVS/6HGNs5MVUPxCbBudvDR8qNizwhQWykijTNnrnsF3vSj/8wp4Zq+n1hh5XpJKoe3 leAQyumZOLgz+RyXmDWZtDfVkNPD9rwYJrRqKwXPeoBAO4vwtFPmyj/tYfqxhw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1752574074; a=rsa-sha256; cv=none; b=kk2QeTr1EM+Xtf5hdx+2Y2fL2366mi0hQNrYGTvrxz+Qn+qlaaDSjf0AZHhStvpNR2LF+M jGc4liR/wGhn76XHPt8LD9XpKNgqKoUltq6/6WxqArl0dk1FxBM8B9ecBCDstu+Z+9OYkU Ukmq94eAm9iqNXI3JLi7vXQV3cuEX0BI1WIgOwoA6mS+yq6AzMKKSyX9GoLSYkZae09rKY atAXVRKzcr7d0b16UyJk/0KwLDtgWK2nZVsURP2+ml0Mebr+MrdJjqxJygQM9xA5I+8lbL g5AfffMv7HxwhT3MvIB7cpeQXilMrrdSE5qlfdNIBeF0ZSqhmXCSwyBMpBZaNw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bhFHZ22t2zbbq; Tue, 15 Jul 2025 10:07:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 56FA7sPS027917; Tue, 15 Jul 2025 10:07:54 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 56FA7swW027914; Tue, 15 Jul 2025 10:07:54 GMT (envelope-from git) Date: Tue, 15 Jul 2025 10:07:54 GMT Message-Id: <202507151007.56FA7swW027914@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 3524dfd74144 - main - pfctl: Fail to parse rules with invalid ranges List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3524dfd74144b7e9ad43f4317d494bf41645bb45 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=3524dfd74144b7e9ad43f4317d494bf41645bb45 commit 3524dfd74144b7e9ad43f4317d494bf41645bb45 Author: Kristof Provost AuthorDate: 2025-07-08 09:39:25 +0000 Commit: Kristof Provost CommitDate: 2025-07-15 07:55:29 +0000 pfctl: Fail to parse rules with invalid ranges This makes pfctl(8) detect bogus ranges (with and without `-n') before loading the ruleset and completes the previous commit. OK sashan sthen Obtained from: OpenBSD, kn , 123a1e155c Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/parse.y | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 4286b6149ac6..a8a165d336fa 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -367,6 +367,7 @@ static struct node_fairq_opts fairq_opts; static struct node_state_opt *keep_state_defaults = NULL; static struct pfctl_watermarks syncookie_opts; +int validate_range(uint8_t, uint16_t, uint16_t); int disallow_table(struct node_host *, const char *); int disallow_urpf_failed(struct node_host *, const char *); int disallow_alias(struct node_host *, const char *); @@ -3825,9 +3826,14 @@ port_item : portrange { err(1, "port_item: calloc"); $$->port[0] = $1.a; $$->port[1] = $1.b; - if ($1.t) + if ($1.t) { $$->op = PF_OP_RRG; - else + if (validate_range($$->op, $$->port[0], + $$->port[1])) { + yyerror("invalid port range"); + YYERROR; + } + } else $$->op = PF_OP_EQ; $$->next = NULL; $$->tail = $$; @@ -3844,6 +3850,10 @@ port_item : portrange { $$->port[0] = $2.a; $$->port[1] = $2.b; $$->op = $1; + if (validate_range($$->op, $$->port[0], $$->port[1])) { + yyerror("invalid port range"); + YYERROR; + } $$->next = NULL; $$->tail = $$; } @@ -3859,6 +3869,10 @@ port_item : portrange { $$->port[0] = $1.a; $$->port[1] = $3.a; $$->op = $2; + if (validate_range($$->op, $$->port[0], $$->port[1])) { + yyerror("invalid port range"); + YYERROR; + } $$->next = NULL; $$->tail = $$; } @@ -5196,6 +5210,19 @@ yyerror(const char *fmt, ...) return (0); } +int +validate_range(uint8_t op, uint16_t p1, uint16_t p2) +{ + uint16_t a = ntohs(p1); + uint16_t b = ntohs(p2); + + if ((op == PF_OP_RRG && a > b) || /* 34:12, i.e. none */ + (op == PF_OP_IRG && a >= b) || /* 34><12, i.e. none */ + (op == PF_OP_XRG && a > b)) /* 34<>22, i.e. all */ + return 1; + return 0; +} + int disallow_table(struct node_host *h, const char *fmt) { @@ -6018,8 +6045,14 @@ apply_rdr_ports(struct pfctl_rule *r, struct pfctl_pool *rpool, struct redirspec if (!rs->rport.b && rs->rport.t) { rpool->proxy_port[1] = ntohs(rs->rport.a) + (ntohs(r->dst.port[1]) - ntohs(r->dst.port[0])); - } else + } else { + if (validate_range(rs->rport.t, rs->rport.a, + rs->rport.b)) { + yyerror("invalid rdr-to port range"); + return (1); + } r->rdr.proxy_port[1] = ntohs(rs->rport.b); + } if (rs->pool_opts.staticport) { yyerror("the 'static-port' option is only valid with nat rules");