The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=ee97d89183896e45d3ff40d0f3a5b727b7a534cb
commit ee97d89183896e45d3ff40d0f3a5b727b7a534cb
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-05-27 14:44:56 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2025-06-06 11:16:00 +0000
pf: align option handling for IPv4 and IPv6
Block IPv6 packets in pf(4) that have hop-by-hop options header or
destination options header. Such packets can be passed by adding
"allow-opts" to the rule. So IPv6 options are handled like their
counterpart in IPv4 now.
tested by benno@; OK henning@
Obtained from: OpenBSD, bluhm <bl...@openbsd.org>, c50c83ac27
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D50662
---
share/man/man5/pf.conf.5 | 13 +++++++------
sys/netpfil/pf/pf.c | 11 +++++++----
2 files changed, 14 insertions(+), 10 deletions(-)
diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5
index 6cabdc6741a6..df1e0a99a47e 100644
--- a/share/man/man5/pf.conf.5
+++ b/share/man/man5/pf.conf.5
@@ -27,7 +27,7 @@
.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd May 26, 2025
+.Dd May 27, 2025
.Dt PF.CONF 5
.Os
.Sh NAME
@@ -2147,20 +2147,21 @@ pass all tos 0x10
pass all tos 16
.Ed
.It Ar allow-opts
-By default, IPv4 packets with IP options or IPv6 packets with routing
-extension headers are blocked.
+By default, packets with IPv4 options or IPv6 hop-by-hop or destination
+options header are blocked.
When
.Ar allow-opts
is specified for a
.Ar pass
rule, packets that pass the filter based on that rule (last matching)
-do so even if they contain IP options or routing extension headers.
+do so even if they contain options.
For packets that match state, the rule that initially created the
state is used.
The implicit
.Ar pass
-rule that is used when a packet does not match any rules does not
-allow IP options.
+rule, that is used when a packet does not match
+any rules, does not allow IP options or option headers.
+Note that IPv6 packets with type 0 routing headers are always dropped.
.It Ar label Aq Ar string
Adds a label (name) to the rule, which can be used to identify the rule.
For instance,
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index f1b04a96590b..fa4c4b73809c 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -9707,6 +9707,8 @@ pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short
*reason)
REASON_SET(reason, PFRES_SHORT);
return (PF_DROP);
}
+ if (hlen != sizeof(struct ip))
+ pd->badopts++;
end = pd->off + ntohs(h->ip_len);
pd->off += hlen;
pd->proto = h->ip_p;
@@ -9814,6 +9816,11 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h,
u_short *reason)
pd->fragoff = pd->extoff = pd->jumbolen = 0;
pd->proto = h->ip6_nxt;
for (hdr_cnt = 0; hdr_cnt < PF_HDR_LIMIT; hdr_cnt++) {
+ switch (pd->proto) {
+ case IPPROTO_HOPOPTS:
+ case IPPROTO_DSTOPTS:
+ pd->badopts++;
+ }
switch (pd->proto) {
case IPPROTO_FRAGMENT:
if (fraghdr_cnt++) {
@@ -10007,10 +10014,6 @@ pf_setup_pdesc(sa_family_t af, int dir, struct
pf_pdesc *pd, struct mbuf **m0,
pd->tot_len = ntohs(h->ip_len);
pd->act.rtableid = -1;
pd->df = h->ip_off & htons(IP_DF);
-
- if (h->ip_hl > 5) /* has options */
- pd->badopts++;
-
pd->virtual_proto = (h->ip_off & htons(IP_MF | IP_OFFMASK)) ?
PF_VPROTO_FRAGMENT : pd->proto;
