d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

When checking the sequence number of a TCP header embedded in an

Browse Source 
ICMP error message, do not access th_flags. The field is beyond
the first eight bytes of the header that are required to be present
and were pulled up in the mbuf.

A random value of th_flags can have TH_SYN set, which made the
sequence number comparison not apply the window scaling factor,
which led to legitimate ICMP(v6) packets getting blocked with
"BAD ICMP" debug log messages (if enabled with pfctl -xm), thus
breaking PMTU discovery.

Triggering the bug requires TCP window scaling to be enabled
(sysctl net.inet.tcp.rfc1323, enabled by default) on both end-
points of the TCP connection. Large scaling factors increase
the probability of triggering the bug.

PR:		kern/115413: [ipv6] ipv6 pmtu not working
Tested by:	Jacek Zapala
Reviewed by:	mlaier
Approved by:	re (kensmith)
This commit is contained in:
Daniel Hartmeier 2007-08-23 09:30:58 +00:00
parent 527f4a62ae
commit 7f368082ad
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/contrib/pf/net/pf.c
View File

@ -5445,8 +5445,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
dst = &(*state)->dst;
}
if (src->wscale && dst->wscale &&
!(th.th_flags & TH_SYN))
if (src->wscale && dst->wscale)
dws = dst->wscale & PF_WSCALE_MASK;
else
dws = 0;