Page MenuHomeFreeBSD

pfsync: Avoid transmitting uninitialized bytes in pfsync_sendout()
ClosedPublic

Authored by markj on Nov 3 2023, 10:05 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, May 24, 1:25 AM
Unknown Object (File)
Fri, May 24, 1:21 AM
Unknown Object (File)
Fri, May 24, 1:21 AM
Unknown Object (File)
Fri, May 24, 12:52 AM
Unknown Object (File)
Mar 15 2024, 12:50 AM
Unknown Object (File)
Mar 12 2024, 11:28 PM
Unknown Object (File)
Jan 24 2024, 8:55 PM
Unknown Object (File)
Jan 18 2024, 6:44 PM

Details

Summary

When IPv6 support was added to pfsync, PFSYNC_MINPKT increased such that
we always allocate enough space for either IPv4 or IPv6 headers. IPv6
headers are 20 bytes larger than IPv4 headers. When pfsync_sendout()
does its thing, it ends up allocating enough space for either; thus when
transmitting an IPv4 packet, the last 20 bytes of the buffer are left
uninitialized.

Fix the problem by stashing the length in a local variable and adjusting
it depending on the address family in use.

While here, just zero the entire buffer in one go rather than being
careful to initialize each subheader. This seems simpler and less error
prone.

Fixes: 6fc7fc2dbb2b ("pfsync: transport over IPv6")
Reported by: KMSAN

Test Plan

pfsync regression tests

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable