Page MenuHomeFreeBSD

pf tests: test IPv6 fragmentation with link-local addresses
ClosedPublic

Authored by kp on Mar 13 2023, 5:19 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Oct 10, 7:28 AM
Unknown Object (File)
Fri, Oct 10, 7:28 AM
Unknown Object (File)
Fri, Oct 10, 7:28 AM
Unknown Object (File)
Fri, Oct 10, 7:28 AM
Unknown Object (File)
Fri, Oct 10, 1:34 AM
Unknown Object (File)
Wed, Sep 24, 5:04 PM
Unknown Object (File)
Sun, Sep 21, 3:12 PM
Unknown Object (File)
Sun, Sep 21, 1:26 AM

Details

Summary

We've observed a panic after pf_refragment6() with link-local addresses,
because pf_refragment6() calls ip6_forward() even for a simple output
case.
That results in us entering ip6_forward() with an mbuf with a NULL
m->m_pkthdr.rcvif, which can cause a NULL deref (but seemingly not for
GUAs.

Test sending fragmented link-local packets to pf.

MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kp requested review of this revision.Mar 13 2023, 5:19 PM
jlduran added inline comments.
tests/sys/netpfil/pf/fragmentation.sh
128

While ping6 is still a thing, I would humbly advise to use ping -6 instead.

This revision was not accepted when it landed; it landed in state Needs Review.Mar 16 2023, 10:01 AM
This revision was automatically updated to reflect the committed changes.