HomeFreeBSD

pf: Make tag hashing more robust

Description

pf: Make tag hashing more robust

tagname2tag() hashes the tag name before truncating it to 63 characters.
tag_unref() removes the tag from the name hash by computing the hash
over the truncated name. Ensure that both operations compute the same
hash for a given tag.

The larger issue is a lack of string validation in pf(4) ioctl handlers.
This is intended to be fixed with some future work, but an extra safety
belt in tagname2hashindex() is worthwhile regardless.

Reported by: syzbot+a0988828aafb00de7d68@syzkaller.appspotmail.com
Reviewed by: kp
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D27346

Details

Provenance
markjAuthored on
Reviewer
kp
Differential Revision
D27346: pf: Fix tag hashing
Parents
rS367986: Remove concept of mbox_sleep_ok.
Branches
Unknown
Tags
Unknown