pf: limit how many headers we look at
ClosedPublic
Actions

Authored by kp on Jun 3 2025, 12:48 PM.

Tags

None

Referenced Files

	F165027975: D50659.id156465.diff
	Wed, Aug 5, 9:26 AM

	F164986366: D50659.id156612.diff
	Wed, Aug 5, 5:46 AM

	F164927954: D50659.diff
	Tue, Aug 4, 10:11 PM

	Unknown Object (File)
	Tue, Aug 4, 6:32 AM

	Unknown Object (File)
	Fri, Jul 31, 10:20 AM

	Unknown Object (File)
	Fri, Jul 31, 9:29 AM

	Unknown Object (File)
	Fri, Jul 31, 1:10 AM

	Unknown Object (File)
	Tue, Jul 28, 10:26 PM

Subscribers

vegeta_tuxpowered.net

Details

Reviewers

None

Group Reviewers

pfsense

Commits

rGdda88af8fa4e: pf: limit how many headers we look at

Summary

Limit the nested header chain for IPv6 extensions headers and for
authentication headers in the IPv4 case. This prevents spending
excessive cpu time on crafted packets.
OK henning@

Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 2e5bc81177
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

kp created this revision.Jun 3 2025, 12:48 PM

Herald added subscribers: vegeta_tuxpowered.net, glebius, melifaro and 2 others. · View Herald TranscriptJun 3 2025, 12:48 PM

kp requested review of this revision.Jun 3 2025, 12:48 PM

Harbormaster completed remote builds in B64608: Diff 156465.Jun 3 2025, 12:48 PM

kp added a parent revision: D50658: pf: use 'struct ah' for the AH extension header rather than 'struct ip6_ext'.Jun 3 2025, 12:48 PM

kp added a child revision: D50660: pf tests: verify header processing limit.

This revision was not accepted when it landed; it landed in state Needs Review.Jun 6 2025, 11:17 AM

Closed by commit rGdda88af8fa4e: pf: limit how many headers we look at (authored by kp). · Explain Why

This revision was automatically updated to reflect the committed changes.

kp added a commit: rGdda88af8fa4e: pf: limit how many headers we look at.

Revision Contents
Changeset List

Path

Size

sys/

netpfil/

pf/

pf.c

18 lines

Diff 156612

View Options

pf: limit how many headers we look atClosedPublicActions