From nobody Mon Mar 31 14:57:58 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZRDlB4lnNz5s8HV; Mon, 31 Mar 2025 14:57:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ZRDlB2YCDz44JF; Mon, 31 Mar 2025 14:57:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1743433078; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pJcc9ku0H4a9W6qsftOEtaEQoQWf99SFklqMkGk7ZqI=; b=GbMwu4naz+j+d/zxtzU3PY/bgLt23srt3zRY97aGa1KQU9/5dmeGeGzO9hTPWu+rYv1uL8 lIBPCrP97Qr1Hy10ld+84t0ZmUgYZXqotzlQjxGKMm4rpEC0j2b9GSRUJn1tcwiCfgc+8N yR0WJRhlqu4KUgkZ1tzu53HeOAbAqC3eXe4VfwfDYTCXs4Uiy7WckWw1lFvEgs8flekUQz BnMyAUPU3JKOhsT12NfaL2r4Qzh1RcjDu+Jrwr9rvzyd4LGODT5AtBBbvbFdK4BtbMUaUX TAlOyAlgKwxOjtbvbLljflrXfLA1OUUOM81yzlkbKXVmnpY/ys0K6GPuA2M1vw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1743433078; a=rsa-sha256; cv=none; b=oTYdaC6o3eSB9kKOrUTvHZCQU9HLBT/CsKu+PcllamyeuSAvenIky2vvJTlI0v8J8etsmV N/F/77HJYbHH2TdGc2K0WIulLn7rHoTuw3lprVGmmOb+wU/vmAsba5NGfMYBBBl2h94urS YTi6HbQ2ComvtMfI2ZcI0Awy2ebk05L7YckoDUtX/ZzHkk4CGnL+Kq2V7UwBYmrWtjgz3s xeXpP0KLry2mLi2RcGp+VbaO1Y3JaZG1hzHRRThcD0/htGReSmqlXheoMC0L1XHzIGhJDP B7IWPIYBBup2PLFgsjkv6D7QbSXvEdJi8UCvYxP47wdeQvRZ67KPbWFMmm7dFQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1743433078; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pJcc9ku0H4a9W6qsftOEtaEQoQWf99SFklqMkGk7ZqI=; b=R2ds7bwm1AZiDyxzvbxF0Yn7rv46K5fdxP9qszHd0OlQzCzlCQ++CcyfudkMD0Re7u5rZS KntpHPg7ExR445cKz/867tn48N/ZcQHJvmTW6jo7Ii9o0urEmsFjnuiUsNU+SknJ5MuGky +FkTKbgI3/JzHzKjuqiW/ma1XOF7QX828PVvFCvXTd2K4Ab1coXRw7bgIPEJ/4FidiSBla SC3VzuDSxT0pUyc7aqbRiuM0YDyjEZSjB9caFJIZuJpAqiToErDbyFZAtaxLxg6lHi587k qcV58tf5EfFzCYF2urPPkyghzd+69lhkNR2orNYPG/IBj/uRe89R+nLVD+Kjrw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4ZRDlB26gVzqh6; Mon, 31 Mar 2025 14:57:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 52VEvwak037991; Mon, 31 Mar 2025 14:57:58 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 52VEvwOk037988; Mon, 31 Mar 2025 14:57:58 GMT (envelope-from git) Date: Mon, 31 Mar 2025 14:57:58 GMT Message-Id: <202503311457.52VEvwOk037988@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: bdea9cbcf2de - main - pf: don't use state keys after pf_state_insert() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bdea9cbcf2decafeb4da5a0280313efccc09e1b3 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=bdea9cbcf2decafeb4da5a0280313efccc09e1b3 commit bdea9cbcf2decafeb4da5a0280313efccc09e1b3 Author: Kristof Provost AuthorDate: 2025-03-27 14:35:40 +0000 Commit: Kristof Provost CommitDate: 2025-03-31 12:56:16 +0000 pf: don't use state keys after pf_state_insert() pf_state_insert() may free the state keys, it's not safe to access these pointers after the call. Introduce osrc/odst (similar to osport/odport) to store the original source and destination addresses. This allows us to undo NAT transformations without having to access the state keys. Reviewed by: glebius, markj MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D49551 --- sys/net/pfvar.h | 2 ++ sys/netpfil/pf/pf.c | 30 +++++++++++++++--------------- 2 files changed, 17 insertions(+), 15 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 39ca13c89379..156ffd22c07b 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -1633,6 +1633,8 @@ struct pf_pdesc { struct pf_addr *src; /* src address */ struct pf_addr *dst; /* dst address */ + struct pf_addr osrc; + struct pf_addr odst; u_int16_t *pcksum; /* proto cksum */ u_int16_t *sport; u_int16_t *dport; diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index ae1ad679d951..12b4d8c1398b 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -4280,8 +4280,7 @@ pf_send_tcp(const struct pf_krule *r, sa_family_t af, static void pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd, - struct pf_state_key *sk, struct tcphdr *th, - u_int16_t bproto_sum, u_int16_t bip_sum, + struct tcphdr *th, u_int16_t bproto_sum, u_int16_t bip_sum, u_short *reason, int rtableid) { struct pf_addr * const saddr = pd->src; @@ -4289,12 +4288,12 @@ pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd, /* undo NAT changes, if they have taken place */ if (nr != NULL) { - PF_ACPY(saddr, &sk->addr[pd->sidx], pd->af); - PF_ACPY(daddr, &sk->addr[pd->didx], pd->af); + PF_ACPY(saddr, &pd->osrc, pd->af); + PF_ACPY(daddr, &pd->odst, pd->af); if (pd->sport) - *pd->sport = sk->port[pd->sidx]; + *pd->sport = pd->osport; if (pd->dport) - *pd->dport = sk->port[pd->didx]; + *pd->dport = pd->odport; if (pd->ip_sum) *pd->ip_sum = bip_sum; m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any); @@ -5926,7 +5925,7 @@ nextrule: ((r->rule_flag & PFRULE_RETURNRST) || (r->rule_flag & PFRULE_RETURNICMP) || (r->rule_flag & PFRULE_RETURN))) { - pf_return(r, nr, pd, sk, th, bproto_sum, + pf_return(r, nr, pd, th, bproto_sum, bip_sum, &reason, r->rtableid); } @@ -5975,7 +5974,7 @@ nextrule: pd->act.log |= PF_LOG_FORCE; if (action == PF_DROP && (r->rule_flag & PFRULE_RETURN)) - pf_return(r, nr, pd, sk, th, + pf_return(r, nr, pd, th, bproto_sum, bip_sum, &reason, pd->act.rtableid); return (action); @@ -6255,15 +6254,12 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC); /* undo NAT changes, if they have taken place */ if (nr != NULL) { - struct pf_state_key *skt = s->key[PF_SK_WIRE]; - if (pd->dir == PF_OUT) - skt = s->key[PF_SK_STACK]; - PF_ACPY(pd->src, &skt->addr[pd->sidx], pd->af); - PF_ACPY(pd->dst, &skt->addr[pd->didx], pd->af); + PF_ACPY(pd->src, &pd->osrc, pd->af); + PF_ACPY(pd->dst, &pd->odst, pd->af); if (pd->sport) - *pd->sport = skt->port[pd->sidx]; + *pd->sport = pd->osport; if (pd->dport) - *pd->dport = skt->port[pd->didx]; + *pd->dport = pd->odport; if (pd->ip_sum) *pd->ip_sum = bip_sum; m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any); @@ -9883,6 +9879,8 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0, } pd->src = (struct pf_addr *)&h->ip_src; pd->dst = (struct pf_addr *)&h->ip_dst; + PF_ACPY(&pd->osrc, pd->src, af); + PF_ACPY(&pd->odst, pd->dst, af); pd->ip_sum = &h->ip_sum; pd->virtual_proto = pd->proto = h->ip_p; pd->tos = h->ip_tos & ~IPTOS_ECN_MASK; @@ -9924,6 +9922,8 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0, h = mtod(pd->m, struct ip6_hdr *); pd->src = (struct pf_addr *)&h->ip6_src; pd->dst = (struct pf_addr *)&h->ip6_dst; + PF_ACPY(&pd->osrc, pd->src, af); + PF_ACPY(&pd->odst, pd->dst, af); pd->ip_sum = NULL; pd->tos = IPV6_DSCP(h); pd->ttl = h->ip6_hlim;