Page MenuHomeFreeBSD

tcp: always set tcp_tun_port to a correct value
ClosedPublic

Authored by glebius on Dec 14 2023, 4:28 PM.
Tags
None
Referenced Files
Unknown Object (File)
May 9 2024, 6:43 AM
Unknown Object (File)
May 9 2024, 6:43 AM
Unknown Object (File)
May 8 2024, 5:36 PM
Unknown Object (File)
Feb 12 2024, 3:54 AM
Unknown Object (File)
Dec 25 2023, 2:25 AM
Unknown Object (File)
Dec 14 2023, 7:03 PM
Subscribers

Details

Summary

The tcp_tun_port field that is used to pass port value between UDP
and TCP in case of tunneling is a generic field that used to pass
data between network layers. It can be contaminated on entry, e.g.
by a VLAN tag set by a NIC driver. Explicily set it, so that it
is zeroed out in a normal not-tunneled TCP. If it contains garbage,
tcp_twcheck() later can enter wrong block of code and treat the packet
as incorrectly tunneled one. On main and stable/14 that will end up
with sending incorrect responses, but on stable/13 with ipfw(8) and
pcb-matching rules it may end up in a panic.

This is a minimal conservative patch to be merged to stable branches.
Later we may redesign this.

PR: 275169

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable