git: ee97d8918389 - main - pf: align option handling for IPv4 and IPv6

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=ee97d89183896e45d3ff40d0f3a5b727b7a534cb

commit ee97d89183896e45d3ff40d0f3a5b727b7a534cb
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-05-27 14:44:56 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-06-06 11:16:00 +0000

    pf: align option handling for IPv4 and IPv6
    
    Block IPv6 packets in pf(4) that have hop-by-hop options header or
    destination options header.  Such packets can be passed by adding
    "allow-opts" to the rule.  So IPv6 options are handled like their
    counterpart in IPv4 now.
    tested by benno@; OK henning@
    
    Obtained from:  OpenBSD, bluhm <bluhm@openbsd.org>, c50c83ac27
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D50662
---
 share/man/man5/pf.conf.5 | 13 +++++++------
 sys/netpfil/pf/pf.c      | 11 +++++++----
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5
index 6cabdc6741a6..df1e0a99a47e 100644
--- a/share/man/man5/pf.conf.5
+++ b/share/man/man5/pf.conf.5
@@ -27,7 +27,7 @@
 .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd May 26, 2025
+.Dd May 27, 2025
 .Dt PF.CONF 5
 .Os
 .Sh NAME
@@ -2147,20 +2147,21 @@ pass all tos 0x10
 pass all tos 16
 .Ed
 .It Ar allow-opts
-By default, IPv4 packets with IP options or IPv6 packets with routing
-extension headers are blocked.
+By default, packets with IPv4 options or IPv6 hop-by-hop or destination
+options header are blocked.
 When
 .Ar allow-opts
 is specified for a
 .Ar pass
 rule, packets that pass the filter based on that rule (last matching)
-do so even if they contain IP options or routing extension headers.
+do so even if they contain options.
 For packets that match state, the rule that initially created the
 state is used.
 The implicit
 .Ar pass
-rule that is used when a packet does not match any rules does not
-allow IP options.
+rule, that is used when a packet does not match
+any rules, does not allow IP options or option headers.
+Note that IPv6 packets with type 0 routing headers are always dropped.
 .It Ar label Aq Ar string
 Adds a label (name) to the rule, which can be used to identify the rule.
 For instance,
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index f1b04a96590b..fa4c4b73809c 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -9707,6 +9707,8 @@ pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short *reason)
 		REASON_SET(reason, PFRES_SHORT);
 		return (PF_DROP);
 	}
+	if (hlen != sizeof(struct ip))
+		pd->badopts++;
 	end = pd->off + ntohs(h->ip_len);
 	pd->off += hlen;
 	pd->proto = h->ip_p;
@@ -9814,6 +9816,11 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason)
 	pd->fragoff = pd->extoff = pd->jumbolen = 0;
 	pd->proto = h->ip6_nxt;
 	for (hdr_cnt = 0; hdr_cnt < PF_HDR_LIMIT; hdr_cnt++) {
+		switch (pd->proto) {
+		case IPPROTO_HOPOPTS:
+		case IPPROTO_DSTOPTS:
+			pd->badopts++;
+		}
 		switch (pd->proto) {
 		case IPPROTO_FRAGMENT:
 			if (fraghdr_cnt++) {
@@ -10007,10 +10014,6 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
 		pd->tot_len = ntohs(h->ip_len);
 		pd->act.rtableid = -1;
 		pd->df = h->ip_off & htons(IP_DF);
-
-		if (h->ip_hl > 5)	/* has options */
-			pd->badopts++;
-
 		pd->virtual_proto = (h->ip_off & htons(IP_MF | IP_OFFMASK)) ?
 		    PF_VPROTO_FRAGMENT : pd->proto;