From 5b551954ab0c94bd17a4405183a5a3dfd4370751 Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Tue, 11 Dec 2018 21:44:39 +0000 Subject: [PATCH] pf: Prevent integer overflow in PF when calculating the adaptive timeout. Mainly states of established TCP connections would be affected resulting in immediate state removal once the number of states is bigger than adaptive.start. Disabling adaptive timeouts is a workaround to avoid this bug. Issue found and initial diff by Mathieu Blanc (mathieu.blanc at cea dot fr) Reported by: Andreas Longwitz Obtained from: OpenBSD MFC after: 2 weeks --- sys/netpfil/pf/pf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 4c8afca756e9..9fa2c06f4528 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -1567,9 +1567,11 @@ pf_state_expires(const struct pf_state *state) states = V_pf_status.states; } if (end && states > start && start < end) { - if (states < end) - return (state->expire + timeout * (end - states) / - (end - start)); + if (states < end) { + timeout = (u_int64_t)timeout * (end - states) / + (end - start); + return (state->expire + timeout); + } else return (time_uptime); }