Page MenuHomeFreeBSD

pf: Fix usage of pf tags with syncookies
ClosedPublic

Authored by vegeta_tuxpowered.net on Jun 17 2023, 7:20 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Jan 10, 9:02 PM
Unknown Object (File)
Thu, Dec 19, 10:12 AM
Unknown Object (File)
Dec 13 2024, 5:42 PM
Unknown Object (File)
Dec 8 2024, 4:44 PM
Unknown Object (File)
Dec 3 2024, 6:54 AM
Unknown Object (File)
Nov 21 2024, 6:44 AM
Unknown Object (File)
Nov 10 2024, 5:28 PM
Unknown Object (File)
Nov 9 2024, 11:53 PM

Details

Summary

The value stored in pf_mtag->tag comes from "tag" and "match tag" keywords in pf.conf and must not be abused for storing other information. A ruleset with enough tags could set or remove the bits responsible for PF_TAG_SYNCOOKIE_RECREATED. Move this syncookie status to pf_mtag->flags. Rename this and other related constants in a way that will prevent such mistakes in the future. Move PF_REASSEMBLED constant to mbuf.h and rename accordingly because it's not a flag stored in pf_mtag, but an identifier of a different m_tag. Change the value of the constant to avoid conflicts with other m_tags using MTAG_ABI_COMPAT. Rename the variables in pf_build_tcp() and pf_send_tcp() in to reduce confusion.

Sponsored by: InnoGames GmbH

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision was not accepted when it landed; it landed in state Needs Review.Jun 19 2023, 10:05 AM
This revision was automatically updated to reflect the committed changes.