| 821774df | 03-Nov-2025 |
Cy Schubert <cy@FreeBSD.org> |
ipfilter: Verify ipnat on entry into kernel
The ipnat struct is built by ipnat(8), specifically ipnat_y.y when
parsing the ipnat configuration file (typically ipnat.conf). ipnat
contains a variable
ipfilter: Verify ipnat on entry into kernel
The ipnat struct is built by ipnat(8), specifically ipnat_y.y when
parsing the ipnat configuration file (typically ipnat.conf). ipnat
contains a variable length string field at the end of the struct. This
data field, called in_names, may contain various text strings such as
NIC names. There is no upper bound limit to the length of strings as
long as the in_namelen length field specifies the length of in_names
within the ipnat structure and in_size specifies the size of the ipnat
structure itself.
Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Reviewed by: markj
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53843
show more ...
|
| df381bec | 23-Oct-2025 |
Cy Schubert <cy@FreeBSD.org> |
ipfilter: Don't trust userland supplied iph_size
ipf_htable_create() trusts a user-supplied iph_size from iphtable_t
and computes the allocation size as iph->iph_size * sizeof(*iph->iph_table)
witho
ipfilter: Don't trust userland supplied iph_size
ipf_htable_create() trusts a user-supplied iph_size from iphtable_t
and computes the allocation size as iph->iph_size * sizeof(*iph->iph_table)
without checking for integer overflow. A sufficiently large iph_size
causes the multiplication to wrap, resulting in an under-sized allocation
for the table pointer array. Subsequent code (e.g., in ipf_htent_insert())
can then write past the end of the allocated buffer, corrupting kernel
memory and causing DoS or potential privilege escalation.
This is not typically a problem when using the ipfilter provided
userland tools as calculate the correct lengths. This mitigates a
rogue actor calling ipfilter ioctls directly.
Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Reviewed by: markj
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D53286
show more ...
|
| eee36ffa | 01-Mar-2023 |
Cy Schubert <cy@FreeBSD.org> |
ipfilter/ippool: Dump a copy of ippool dstlist data in "new" format
As with 7531c434a593, which dumped ippool table data in the "new"
format, print dstlist data in the "new" format.
MFC after:
ipfilter/ippool: Dump a copy of ippool dstlist data in "new" format
As with 7531c434a593, which dumped ippool table data in the "new"
format, print dstlist data in the "new" format.
MFC after: 1 week
show more ...
|
| 9da30a23 | 08-Nov-2024 |
Cy Schubert <cy@FreeBSD.org> |
ipfilter: Include the IP address in error message
Include the IP address in the message when a hashnode add error occurs.
This helps to identify the ippool.conf statement that the error occurred.
M
ipfilter: Include the IP address in error message
Include the IP address in the message when a hashnode add error occurs.
This helps to identify the ippool.conf statement that the error occurred.
MFC after: 1 week
show more ...
|
| 3a2cb65b | 08-Nov-2024 |
Cy Schubert <cy@FreeBSD.org> |
ipfilter: Support printing of IPv6 addresses in error message
Replace inet_ntoa(3) with inet_ntop(3). This supporting the printing of
IPv6 IP addresses in addition to IPv4 IP addresses in error mess
ipfilter: Support printing of IPv6 addresses in error message
Replace inet_ntoa(3) with inet_ntop(3). This supporting the printing of
IPv6 IP addresses in addition to IPv4 IP addresses in error message.
MFC after: 1 week
show more ...
|