From nobody Mon Oct 12 16:06:00 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j3MlF1xJVz6w2L5 for ; Mon, 12 Oct 2026 16:06:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j3MlD5m6kz4H69 for ; Mon, 12 Oct 2026 16:06:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791821160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LILsx07MLZXvNWXxbbZ6sNCMEBDpIatwQdxo81pA/CI=; b=IllDzMJr8Wpua86Pws3h7gbBHf0P8j92HPJMJTM8pzR8u3pPOU/M+ZJe2bIKbLb+zetLZG YgTHU7oyIXQmJdd+l4VOZYqwkk7ctf/CPA3lI+mb+/zCf5aI1gcqsP/xRvZt3SSFlOLZXW TJphUE0+PogA4gJ4MrV9dSxDlafVJe3QiivzOR30kIk03IJYqCb2Yn++nA+M1ryBkyp4OS aPc3I9xwoOJSuET0dYvpNhY2obfkb2EzJXV8JKSh7VSt8Ysdc7m+SbtfYsWkZneQwqMzSW znmjyoeOEbGV/cCAVZTiSTRPeSCMfF7sWMvAXR0EfQbho66BURO6DyUYZpnTzQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791821160; b=X6ZMPbu1YUp+WcAmYE+3o1lmtAFcwainn094kZAEJ+QYux7sHaYRh5YSoEKVc2iEIUF5I9 tJiRovVSVeWV5VSHjRfk1UMQEAEWTZF1kaKzbj3r2mw+1ir9thkeuROTH9GW3oGrHnKo+j 3SGyWV4efJ3hSb9DV7820+EbTMfjCLw696WZBvS+wbbe7vRlrbfO03Cz2bXwP9GVussrsB bCZNUCDGXUrc1wY1Nca/T9xP6rCJq5lV2/NofAWJqPOQd9luqbNs1KNZC7EwxVWHRt/QhM 2cPnTBqHpN58PlJzDBOhPB0W5gBRGn6EThKmWd1fXeGM4m3nndGi+7GvyUXzlQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791821160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LILsx07MLZXvNWXxbbZ6sNCMEBDpIatwQdxo81pA/CI=; b=TCIIQ4w7ZDoAAXEVmW3bT7MxfunBrlbo7upBtOk5b6HIqnMm81koZ5POXV8Ha9hIHRUDCE TC6skYgIbQ/rzd2krws2B2Rurhiev7GDZ27xh+AE2b3V4jzlJUWZtWfwxtnVNhAj9qh7Tw bsWrPkVlCRDT/ZMbO2wus9/W17KY6byqjSl6srqystqfmKayvQEHgZtN+b9u3WYidmJ8kz 6U/AIDMt080GuM9EMu/vrlmOeYfap4GS+/NJOk2msKD7Oh/2cQ49XR4FIZaeToWfiIlPOW SFoL+t0EoNucPAFAX5MppOb0du6+2SeQYT5EPEo+LhG37HsmvxEM0drQSGZ8EA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j3MlD4phWzcHF for ; Mon, 12 Oct 2026 16:06:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f3bc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 12 Oct 2026 16:06:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: b4d2c9835c0e - main - pf: check AH header length. List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b4d2c9835c0edfddd1d6742afa86d4873ccfad16 Auto-Submitted: auto-generated Date: Mon, 12 Oct 2026 16:06:00 +0000 Message-Id: <6acd0568.1f3bc.9f9ecdd@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=b4d2c9835c0edfddd1d6742afa86d4873ccfad16 commit b4d2c9835c0edfddd1d6742afa86d4873ccfad16 Author: Kristof Provost AuthorDate: 2026-10-12 12:28:22 +0000 Commit: Kristof Provost CommitDate: 2026-10-12 13:08:59 +0000 pf: check AH header length. pf_walk_header() advances the packet offset for each AH extension header. It was not checked that this does not exceed the packet length if no next header was processed. Fix it like in IPv6. OK henning@ sashan@ MFC after: 1 week Obtained from: OpenBSD, bluhm , fcd4e5522e Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 46f9f044accb..dffaabf77434 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -10825,7 +10825,7 @@ static int pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short *reason) { struct ah ext; - u_int32_t hlen, end; + u_int32_t hlen, end, extlen; int hdr_cnt; hlen = h->ip_hl << 2; @@ -10873,7 +10873,16 @@ pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short *reason) DPFPRINTF(PF_DEBUG_MISC, "IP short exthdr"); return (PF_DROP); } - pd->off += (ext.ah_len + 2) * 4; + extlen = (ext.ah_len + 2) * 4; + if (end < pd->off + extlen) { + if ((h->ip_off & htons(IP_MF | IP_OFFMASK)) + != 0) + return (PF_PASS); + DPFPRINTF(PF_DEBUG_MISC, "IP long exthdr"); + REASON_SET(reason, PFRES_SHORT); + return (PF_DROP); + } + pd->off += extlen; pd->proto = ext.ah_nxt; break; default: