git: e97ce7c66ee0 - main - pf: improve DIOCNATLOOK validation

[Kristof Provost]

The branch main has been updated by kp:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=e97ce7c66ee0ab0afe58695b6922ff310262d7c5

commit e97ce7c66ee0ab0afe58695b6922ff310262d7c5
Author:     Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-07-03 15:23:46 +0000
Commit:     Kristof Provost <k...@freebsd.org>
CommitDate: 2025-07-09 08:57:49 +0000

    pf: improve DIOCNATLOOK validation
    
    Check address family of pf ioctl(2) DIOCNATLOOK parameter at kernel
    entry instead of calling panic() due to unhandled af.
    Reported-by: syzbot+92be143c2dd1746cf...@syzkaller.appspotmail.com
    from Benjamin Baier
    
    Also validate the direction.
    
    Obtained from:  OpenBSD, bluhm <bl...@openbsd.org>, 4804479228
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf_ioctl.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 8a3f311d7d30..737f9ca060c5 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -2817,6 +2817,28 @@ pf_ioctl_natlook(struct pfioc_natlook *pnl)
            (!pnl->dport || !pnl->sport)))
                return (EINVAL);
 
+       switch (pnl->direction) {
+       case PF_IN:
+       case PF_OUT:
+       case PF_INOUT:
+               break;
+       default:
+               return (EINVAL);
+       }
+
+       switch (pnl->af) {
+#ifdef INET
+       case AF_INET:
+               break;
+#endif /* INET */
+#ifdef INET6
+       case AF_INET6:
+               break;
+#endif /* INET6 */
+       default:
+               return (EAFNOSUPPORT);
+       }
+
        bzero(&key, sizeof(key));
        key.af = pnl->af;
        key.proto = pnl->proto;