>Number: 156180
>Category: kern
>Synopsis: ipfw checks TCP options on non-contiguous header
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Apr 04 19:20:09 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator: Karim Fodil-Lemelin
>Release: CURRENT
>Organization:
>Environment:
>Description:
When using tcpopt_match in ipfw there is no guarantee that the TCP option space
matched is not bogus.
This is because the case IPPROTO_TCP does not do an m_pullup on the entire
IP+TCP+TCP option header.
>How-To-Repeat:
>Fix:
The attached patch will call m_pullup on the TCP option space if it wasn't done
already.
Patch attached with submission follows:
Index: netinet/ipfw/ip_fw2.c
===================================================================
--- netinet/ipfw/ip_fw2.c (revision 219967)
+++ netinet/ipfw/ip_fw2.c (working copy)
@@ -949,6 +949,11 @@
case IPPROTO_TCP:
PULLUP_TO(hlen, ulp, struct tcphdr);
+ /* kfl: check 'contiguousity' of the option
space */
+ if (m->m_len < (hlen + (TCP(ulp)->th_off <<
2))) {
+ if ((m = m_pullup(m, hlen+(TCP(ulp)->th_off
<< 2))) == NULL)
+ goto pullup_failed;
+ }
dst_port = TCP(ulp)->th_dport;
src_port = TCP(ulp)->th_sport;
/* save flags for dynamic rules */
@@ -1117,6 +1122,11 @@
switch (proto) {
case IPPROTO_TCP:
PULLUP_TO(hlen, ulp, struct tcphdr);
+ /* kfl: check 'contiguousity' of the option
space */
+ if (m->m_len < (hlen + (TCP(ulp)->th_off <<
2))) {
+ if ((m = m_pullup(m, hlen+(TCP(ulp)->th_off
<< 2))) == NULL)
+ goto pullup_failed;
+ }
dst_port = TCP(ulp)->th_dport;
src_port = TCP(ulp)->th_sport;
/* save flags for dynamic rules */
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
