mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-29 21:26:51 +00:00
pf: ensure states passed to pf_free_state() are always unlinked
In pf_create_state() we can end up deleting the state immediately. This can happen if we fail to map the relevant addresses or fail normalization or fail to insert it into the state table. If that happens we delete the state again with pf_free_state(). However, this asserts that the state must be unlinked. It's correct to simply set the state to PFTM_UNLINKED because we've not yet linked it. Submitted by: Mateusz Guzik <mjg@FreeBSD.org> Reviewed by: scottl MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31752
This commit is contained in:
parent
71611b0c68
commit
a0c64a443e
|
@ -3980,6 +3980,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
|
|||
if (pf_map_addr(pd->af, r, pd->src, &s->rt_addr, NULL, &sn)) {
|
||||
REASON_SET(&reason, PFRES_MAPFAILED);
|
||||
pf_src_tree_remove_state(s);
|
||||
s->timeout = PFTM_UNLINKED;
|
||||
STATE_DEC_COUNTERS(s);
|
||||
pf_free_state(s);
|
||||
goto csfailed;
|
||||
|
@ -4002,6 +4003,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
|
|||
off, pd, th, &s->src, &s->dst)) {
|
||||
REASON_SET(&reason, PFRES_MEMORY);
|
||||
pf_src_tree_remove_state(s);
|
||||
s->timeout = PFTM_UNLINKED;
|
||||
STATE_DEC_COUNTERS(s);
|
||||
pf_free_state(s);
|
||||
return (PF_DROP);
|
||||
|
@ -4014,6 +4016,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
|
|||
("pf_normalize_tcp_stateful failed on first "
|
||||
"pkt\n"));
|
||||
pf_src_tree_remove_state(s);
|
||||
s->timeout = PFTM_UNLINKED;
|
||||
STATE_DEC_COUNTERS(s);
|
||||
pf_free_state(s);
|
||||
return (PF_DROP);
|
||||
|
@ -4041,6 +4044,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
|
|||
(pd->dir == PF_IN) ? nk : sk, s)) {
|
||||
REASON_SET(&reason, PFRES_STATEINS);
|
||||
pf_src_tree_remove_state(s);
|
||||
s->timeout = PFTM_UNLINKED;
|
||||
STATE_DEC_COUNTERS(s);
|
||||
pf_free_state(s);
|
||||
return (PF_DROP);
|
||||
|
|
Loading…
Reference in a new issue