The branch main has been updated by kp:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=541ea3d7828e0ede161ac2d8ef3e8419657ef5cb

commit 541ea3d7828e0ede161ac2d8ef3e8419657ef5cb
Author:     Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-01-06 09:06:01 +0000
Commit:     Kristof Provost <k...@freebsd.org>
CommitDate: 2025-01-17 08:40:29 +0000

    pf: verify that ABORT chunks are not mixed with DATA chunks
    
    RFC4960 3.3.7: DATA chunks MUST NOT be bundled with ABORT.
    
    MFC after:      2 weeks
    Sponsored by:   Orange Business Services
---
 sys/netpfil/pf/pf_norm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
index 9f1eaf7c4d76..c9a7f7d2df04 100644
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -2138,6 +2138,14 @@ pf_scan_sctp(struct pf_pdesc *pd)
        if ((pd->sctp_flags & PFDESC_SCTP_SHUTDOWN_COMPLETE) &&
            (pd->sctp_flags & ~PFDESC_SCTP_SHUTDOWN_COMPLETE))
                return (PF_DROP);
+       if ((pd->sctp_flags & PFDESC_SCTP_ABORT) &&
+           (pd->sctp_flags & PFDESC_SCTP_DATA)) {
+               /*
+                * RFC4960 3.3.7: DATA chunks MUST NOT be
+                * bundled with ABORT.
+                */
+               return (PF_DROP);
+       }
 
        return (PF_PASS);
 }

Reply via email to