d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ng_nat: avoid panic if attached directly to ng_ether and got short packet

Browse Source 
From the beginning, ng_nat safely assumed cleansed traffic
because of limited ways it could be attached to NETGRAPH:
ng_ipfw or ng_ppp only.

Now as it may be attached with ng_ether too, the assumption proven wrong.
Add needed check to the ng_nat. Thanks for markj for debugging this.

PR:		243096
Submitted by:	Lutz Donnerhacke <lutz@donnerhacke.de>
Reported by:	Robert James Hernandez <rob@sarcasticadmin.com>
Reviewed by:	markj and others
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D23091
This commit is contained in:
Eugene Grosbein 2020-02-12 00:31:00 +00:00
parent f976241773
commit 49f384cb47
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=357786
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/netgraph/ng_nat.c
View File

@ -806,11 +806,16 @@ ng_nat_rcvdata(hook_p hook, item_p item )
panic("Corrupted priv->dlt: %u", priv->dlt);
}
if (m->m_pkthdr.len < ipofs + sizeof(struct ip))
goto send; /* packet too short to hold IP */
c = (char *)mtodo(m, ipofs);
ip = (struct ip *)mtodo(m, ipofs);
KASSERT(m->m_pkthdr.len == ipofs + ntohs(ip->ip_len),
("ng_nat: ip_len != m_pkthdr.len"));
if (ip->ip_v != IPVERSION)
goto send; /* other IP version, let it pass */
if (m->m_pkthdr.len < ipofs + ntohs(ip->ip_len))
goto send; /* packet too short (i.e. fragmented or broken) */
/*
* We drop packet when: