Kristof Provost 6f4909de5f pf: IPv6 fragments with malformed extension headers could be erroneously passed by pf or cause a panic ...

We mistakenly used the extoff value from the last packet to patch the
next_header field. If a malicious host sends a chain of fragmented packets
where the first packet and the final packet have different lengths or number of
extension headers we'd patch the next_header at the wrong offset.
This can potentially lead to panics or rule bypasses.

Security:       CVE-2019-5597
Obtained from:  OpenBSD
Reported by:    Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv

2019-03-01 07:37:45 +00:00

..

if_pflog.c

Use the new VNET_DEFINE_STATIC macro when we are defining static VNET

2018-07-24 16:35:52 +00:00

if_pfsync.c

pf: fix pfsync breaking carp

2019-01-18 08:19:54 +00:00

in4_cksum.c

SPDX: license IDs for some ISC-related files.

2017-12-08 15:57:29 +00:00

pf_altq.h

Extended pf(4) ioctl interface and pfctl(8) to allow bandwidths of

2018-08-22 19:38:48 +00:00

pf_if.c

Mechanical cleanup of epoch(9) usage in network stack.

2019-01-09 01:11:19 +00:00

pf_ioctl.c

Place pf_altq_get_nth_active() under the ALTQ ifdef

2019-02-11 05:39:38 +00:00

pf_lb.c

pf: Fix endless loop on NAT exhaustion with sticky-address

2018-12-12 20:15:06 +00:00

pf_mtag.h

sys: general adoption of SPDX licensing ID tags.

2017-11-27 15:23:17 +00:00

pf_norm.c

pf: IPv6 fragments with malformed extension headers could be erroneously passed by pf or cause a panic

2019-03-01 07:37:45 +00:00

pf_osfp.c

Use the new VNET_DEFINE_STATIC macro when we are defining static VNET

2018-07-24 16:35:52 +00:00

pf_ruleset.c

sys: general adoption of SPDX licensing ID tags.

2017-11-27 15:23:17 +00:00

pf_table.c

pf: silence a runtime warning

2019-01-15 08:59:51 +00:00

pf.c

pf: Small performance tweak

2019-02-24 17:23:55 +00:00

pf.h

netpfil: Introduce PFIL_FWD flag

2018-03-23 16:56:44 +00:00