The branch releng/13.3 has been updated by markj:
URL:
https://cgit.FreeBSD.org/src/commit/?id=aca9955aec8f339c003d977e113594d99be153f8
commit aca9955aec8f339c003d977e113594d99be153f8
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2024-08-26 14:44:20 +0000
Commit: Mark Johnston <ma...@freebsd.org>
CommitDate: 2024-09-19 13:01:36 +0000
pf: be less strict about icmp state checking for sloppy state tracking
Sloppy state tracking renders ICMP direction check useless
and harmful as we might see only half of the connection in
the asymmetric setups but ignore the state match. The bug
was reported and fix was verified by Insan Praja <insan ()
ims-solusi ! com>. Thanks! OK mcbride, henning
Approved by: so
Security: FreeBSD-EN-24:16.pf
MFC after: 1 week
Obtained from: OpenBSD, mikeb <mi...@openbsd.org>, 538596657140
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 3da3eb6081a2e2f6ea2fed1728d5dd7f9e8786e5)
(cherry picked from commit b4b8b2fc9bd25d10eab0afdbd06a7ef8735b7b6b)
---
sys/netpfil/pf/pf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index ecad3c274d74..100302ab2ca5 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -6075,6 +6075,9 @@ pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct
pf_pdesc *pd,
STATE_LOOKUP(kif, key, direction, *state, pd);
+ if ((*state)->state_flags & PFSTATE_SLOPPY)
+ return (-1);
+
/* Is this ICMP message flowing in right direction? */
if ((*state)->rule.ptr->type &&
(((!inner && (*state)->direction == direction) ||
