Page MenuHomeFreeBSD

pf: Fix usage of pf tags with syncookies
ClosedPublic

Authored by vegeta_tuxpowered.net on Jun 17 2023, 7:20 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Oct 11, 6:56 PM
Unknown Object (File)
Fri, Oct 10, 7:23 PM
Unknown Object (File)
Fri, Oct 10, 3:56 PM
Unknown Object (File)
Wed, Sep 24, 1:27 AM
Unknown Object (File)
Sep 9 2025, 1:34 PM
Unknown Object (File)
Sep 9 2025, 5:19 AM
Unknown Object (File)
Sep 9 2025, 1:29 AM
Unknown Object (File)
Aug 27 2025, 12:23 AM

Details

Summary

The value stored in pf_mtag->tag comes from "tag" and "match tag" keywords in pf.conf and must not be abused for storing other information. A ruleset with enough tags could set or remove the bits responsible for PF_TAG_SYNCOOKIE_RECREATED. Move this syncookie status to pf_mtag->flags. Rename this and other related constants in a way that will prevent such mistakes in the future. Move PF_REASSEMBLED constant to mbuf.h and rename accordingly because it's not a flag stored in pf_mtag, but an identifier of a different m_tag. Change the value of the constant to avoid conflicts with other m_tags using MTAG_ABI_COMPAT. Rename the variables in pf_build_tcp() and pf_send_tcp() in to reduce confusion.

Sponsored by: InnoGames GmbH

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision was not accepted when it landed; it landed in state Needs Review.Jun 19 2023, 10:05 AM
This revision was automatically updated to reflect the committed changes.