D51324.id.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D51324.id.diff
View Options

	diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
	--- a/sys/netpfil/pf/pf.c
	+++ b/sys/netpfil/pf/pf.c
	@@ -10141,6 +10141,12 @@
	}

	h = mtod(pd->m, struct ip6_hdr *);
	+ if (pd->m->m_pkthdr.len <
	+ sizeof(struct ip6_hdr) + ntohs(h->ip6_plen)) {
	+ *action = PF_DROP;
	+ REASON_SET(reason, PFRES_SHORT);
	+ return (-1);
	+ }

	if (pf_walk_header6(pd, h, reason) != PF_PASS) {
	*action = PF_DROP;
	diff --git a/tests/sys/netpfil/pf/nat64.py b/tests/sys/netpfil/pf/nat64.py
	--- a/tests/sys/netpfil/pf/nat64.py
	+++ b/tests/sys/netpfil/pf/nat64.py
	@@ -272,3 +272,18 @@
	reply = self.common_test_source_addr(packet)
	icmp = reply.getlayer(sp.ICMPv6EchoRequest)
	assert icmp
	+
	+ @pytest.mark.require_user("root")
	+ @pytest.mark.require_progs(["scapy"])
	+ def test_bad_len(self):
	+ """
	+ PR 288224: we can panic if the IPv6 plen is longer than the packet length.
	+ """
	+ ToolsHelper.print_output("/sbin/route -6 add default 2001:db8::1")
	+ import scapy.all as sp
	+
	+ packet = sp.IPv6(dst="64:ff9b::198.51.100.2", hlim=2, plen=512) \
	+ / sp.ICMPv6EchoRequest() / sp.Raw("foo")
	+ reply = sp.sr1(packet, timeout=3)
	+ # We don't expect a reply to a corrupted packet
	+ assert not reply