From nobody Thu Oct 10 12:37:15 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XPTmC5QxRz5Yyqj; Thu, 10 Oct 2024 12:37:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XPTmC3DVwz4H9g; Thu, 10 Oct 2024 12:37:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1728563835; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iriO64jsPctTOsqCbTr9QboEVgtmzOVwa+6t/B3GBxo=; b=vaZBxrY2oTIyldd2MMM4o5gNJOFHqglxw/D8+MAj9PzlXOu+IAanRfdpndCHc7dMdEz4wO NjtPB7RAqcAtTPw4QeQ4obhwrK+6I8Z1302lF1us7qMsmTGhJV3xJgVGfSQyMlCuAd3H9v u0f4hzPu1kcj1PSxdypi/AOZgIs82PfFX2kvLsK2uTbYO9mBlKuKZzmzBJ0irPc+k1Z9gT 7V1TjTnNDUXgKGZoYmpSjEcFVA/7XZPvLahRQJ3x6/erpS4p7NnU3iwx+akZ7xSO35DLzk 7neqYD3cBr1ijnhCkS8guaV+QAW3qzxgtpVyRv9gsGn+pZm1udTqCtrI+ga4YQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1728563835; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iriO64jsPctTOsqCbTr9QboEVgtmzOVwa+6t/B3GBxo=; b=v+UhxoLud4ik/rRC94Rlom3eQoDPI0O6InxBJQwhP4/fjADsaPZCTh36i7tq7VoleZ6M5i 7B7DRyr1ZRGfHX0QS5r2bYh7ZooKLnMS8CWJgIpVnPha8cGDNw3u3Ae4QtQmv0UM6hiRrH 2Mjv+4lUSoRwsPD0dWMRG0A1QsMcUxsQsswF3gKGhzVK+/XYTDQMRUeHpCSO/ODz8b6rO1 v+dzb4nUST8nYSYeqokCQ1cnS4SZzP/rZzcq6Da7+3p8NSB8GedFN8ReO+7j9TJXeVCQOl 55bikiJkIGjWfC0m7ftWZWnbVDd0z8ujVktBxURwSJWZbaqMLiIXICmcHZd66A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1728563835; a=rsa-sha256; cv=none; b=x1xM16PSYkDxP39AxDVeMypk59BLA4V4N2eSAOtFUXaEtMVLOqNS1QgSr8aw6ThVP1Gi/D iDex1ylQCgSU/bcNL+dsQFfpg983KTGse4iX3iji85isstekOs8gmvCNcjcxNW+V+ZAMJo fyuTZOqHhmXAGbwIk2RuCzTAYVsBQaP5CqnGh2EBC2aPYdmaZRg7vEvv9X0Q7eI7xiG1Pj LBVTxhh4SLet6JX6vu2cKxtPd5KJLEpwqbOjGSPksdypkyRUJ8bSd1/X2DsbY80b5aMPlp yFryJnibmjvGDeV5kOnFCgaDgkfZbKQJxR0ZfYx8XwDHAevFkZX9eDOjV93OCg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XPTmC27WHzxTP; Thu, 10 Oct 2024 12:37:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 49ACbFM8006104; Thu, 10 Oct 2024 12:37:15 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 49ACbFWA006101; Thu, 10 Oct 2024 12:37:15 GMT (envelope-from git) Date: Thu, 10 Oct 2024 12:37:15 GMT Message-Id: <202410101237.49ACbFWA006101@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 7d0f8cd93bce - main - pf: ensure that we won't enter an endless loop List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7d0f8cd93bce786728a1fff8b2e2184c8e48f3b2 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=7d0f8cd93bce786728a1fff8b2e2184c8e48f3b2 commit 7d0f8cd93bce786728a1fff8b2e2184c8e48f3b2 Author: Kristof Provost AuthorDate: 2024-09-26 15:53:53 +0000 Commit: Kristof Provost CommitDate: 2024-10-10 12:10:39 +0000 pf: ensure that we won't enter an endless loop ensure that we won't enter an endless loop while iterating over an address pool. problem found and solution tested by claudio. ok claudio, henning, "reads fine" to zinke Obtained from: OpenBSD, mikeb , e4fc4bddb9 Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D46927 --- sys/netpfil/pf/pf_table.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c index 690cb6d9ab90..77bd466ec2b3 100644 --- a/sys/netpfil/pf/pf_table.c +++ b/sys/netpfil/pf/pf_table.c @@ -2245,7 +2245,7 @@ pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter, struct pf_addr addr, cur, mask, umask_addr; union sockaddr_union uaddr, umask; struct pfr_kentry *ke, *ke2 = NULL; - int idx = -1, use_counter = 0; + int startidx, idx = -1, loop = 0, use_counter = 0; MPASS(pidx != NULL); MPASS(counter != NULL); @@ -2272,18 +2272,29 @@ pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter, use_counter = 1; if (idx < 0) idx = 0; + startidx = idx; _next_block: - ke = pfr_kentry_byidx(kt, idx, af); - if (ke == NULL) { + if (loop && startidx == idx) { pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1); return (1); } + + ke = pfr_kentry_byidx(kt, idx, af); + if (ke == NULL) { + /* we don't have this idx, try looping */ + if (loop || (ke = pfr_kentry_byidx(kt, 0, af)) == NULL) { + pfr_kstate_counter_add(&kt->pfrkt_nomatch, 1); + return (1); + } + idx = 0; + loop++; + } pfr_prepare_network(&umask, af, ke->pfrke_net); pfr_sockaddr_to_pf_addr(&ke->pfrke_sa, &cur); pfr_sockaddr_to_pf_addr(&umask, &mask); - if (use_counter) { + if (use_counter && !PF_AZERO(counter, af)) { /* is supplied address within block? */ if (!PF_MATCHA(0, &cur, &mask, counter, af)) { /* no, go to next block in table */