# DF-0611 — Verification verdict **Verdict:** **CONFIRMED-LATENT (source-level)** — the missing-validation logic in `sys/netgraph7/ng_nat.c:690–763` is a real, code-confirmed bug, **but the module is unreachable on the running guest** (it cannot be compiled or loaded). Deterministic userspace harness reproduces the missing-validation logic and proves the proposed fix closes it. **Reproduction status:** not reproduced on the running kernel (impossible — the module does not build); reproduced deterministically at the code-logic level via the harness in this folder. **Impact:** unreachable on this guest; would be `oob-read`/`oob-write`/`panic` on a build of the module. Severity Medium holds as a latent code-level finding; real-world exposure today is NONE. **Confidence:** certain (on the source-level claim and the unreachability); speculative on libalias acceptance (libalias sources absent from the tree). --- ## Why the kernel sink cannot be reached The vulnerable node is `netgraph7_nat`, conditionally compiled by `sys/conf/files:1718`: ``` netgraph7/ng_nat.c optional netgraph7_nat ``` with five further `optional netgraph7_nat` translation units in `sys/conf/files:1735–1739`: ``` netinet/libalias/alias.c optional netgraph7_nat netinet/libalias/alias_db.c optional netgraph7_nat netinet/libalias/alias_mod.c optional netgraph7_nat netinet/libalias/alias_proxy.c optional netgraph7_nat netinet/libalias/alias_util.c optional netgraph7_nat ``` Two of these dependencies are absent from the current DragonFlyBSD master tree and from the audit guest's `/usr/src`: 1. **The entire `sys/netinet/libalias/` directory is missing.** Confirmed on the host (`find sys -name libalias` returns only `dfbsd-upstream/lib/libalias`, a userspace library — not the kernel sources the module expects) and on the guest (`ls /usr/src/sys/netinet/libalias` ⇒ No such file or directory). 2. **`m_megapullup()` is undefined.** `grep -rn 'm_megapullup' sys/` finds exactly one occurrence — the *call site* at `ng_nat.c:692`. There is no definition anywhere in `sys/`. Empirical confirmation on the running guest (saved in `env.txt`): ``` $ kldload ng_nat kldload: can't load ng_nat: No such file or directory $ ls /boot/kernel/ng_nat* /boot/kernel/*libalias* ls: No such file or directory $ cd /tmp/ngnat_mod && make # KMOD=ng_nat, bsd.kmod.mk ng_nat.c:45:10: fatal error: netinet/libalias/alias.h: No such file or directory *** Error code 1 ``` `ng_nat.ko` is not shipped, not enabled in `X86_64_GENERIC`, cannot be `kldload`ed, and cannot be built from `/usr/src` because its `#include ` (ng_nat.c:45) is unsatisfiable. **Net reachability:** the sink is **dead on this kernel** — neither an unprivileged user nor root can drive a packet through `ng_nat_rcvdata()`, because the node type cannot exist. The bug is therefore recorded as **latent**: real code, no runtime exposure today. --- ## Source-level line-by-line trace (the bug IS real) `sys/netgraph7/ng_nat.c:690–763`. After `m_megapullup` collapses the mbuf into a single contiguous buffer: ```c 690: m = NGI_M(item); 692: if ((m = m_megapullup(m, m->m_pkthdr.len)) == NULL) { ... } 698: NGI_M(item) = m; 700: c = mtod(m, char *); 701: ip = mtod(m, struct ip *); 703: KASSERT(m->m_pkthdr.len == ntohs(ip->ip_len), 704: ("ng_nat: ip_len != m_pkthdr.len")); ``` The only validation here is the debug-only `KASSERT` at 703-704 (`sys/sys/param.h` → `KASSERT` expands to a no-op when `INVARIANTS` is off). There is **no check** that `m->m_pkthdr.len >= sizeof(struct ip)`, so a frame shorter than 20 bytes already samples uninitialized trailing data when `ip->ip_len` is read. ```c 722: m->m_pkthdr.len = m->m_len = ntohs(ip->ip_len); ``` `m_len` is reassigned directly from the attacker-controlled `ip->ip_len` with **no upper-bound check against the pullup'd buffer**. A lying `ip_len` (e.g. 200 when the frame is 24 bytes) inflates `m_len`, which is then consumed by `in_delayed_cksum()` (`sys/netinet/ip_output.c:928–952`, called at ng_nat.c:760) to walk `in_cksum_skip(m, ntohs(ip->ip_len), offset)` — i.e. heap it does not own. ```c 724: if ((ip->ip_off & htons(IP_OFFMASK)) == 0 && 725: ip->ip_p == IPPROTO_TCP) { 726: struct tcphdr *th = (struct tcphdr *)((caddr_t)ip + 727: (ip->ip_hl << 2)); ... 751: if (th->th_x2) { /* READ past real data */ 752: th->th_x2 = 0; /* WRITE */ 753: th->th_sum = in_pseudo(...); /* WRITE */ ... 760: in_delayed_cksum(m); /* walks m_len bytes */ 761: } 762: } 763: } ``` `ip->ip_hl` is a 4-bit attacker-controlled field (0..15). The `th` pointer at 726-727 is derived purely from it, with **no check the offset fits inside the packet**. With `ip_hl=15`, `th` lands at `ip+60`; subsequent reads/writes of `th_x2` (+12) and `th_sum` (+16..17) touch offsets 72..77 of the mbuf data area regardless of actual packet length. The downstream sink in `in_delayed_cksum()` (`sys/netinet/ip_output.c:928-952`) has its own latent NULL-deref: ```c 949: m = m_pullup(m, offset + sizeof(u_short)); 950: } 952: *(u_short *)(m->m_data + offset) = csum; /* unconditional — NULL-deref * if m_pullup returned NULL */ ``` So the documented impact chain is real: - OOB read of mbuf trailing data (`th_x2` and `in_cksum_skip` walk); - OOB write to mbuf trailing data (`th_x2=0`, `th_sum=in_pseudo(...)`); - kernel panic (NULL-deref at `ip_output.c:952` after `m_pullup` failure, or a page fault while walking a lying `ip_len`). The speculative element the finding flags — whether libalias would itself reject every malformed frame first — cannot be resolved in-tree because the libalias sources are gone. Even if libalias today happens to reject every malformed frame, ng_nat provides no defense of its own and any future change to libalias, or any mode the user can select via `NGM_NAT_SET_MODE` (lines 355-372 — `PKT_ALIAS_PROXY_ONLY` / `PKT_ALIAS_REVERSE`), could re-expose it. The missing-validation pattern is a real defect that should be fixed alongside any reintroduction of libalias / `m_megapullup`. --- ## Exploit chain / escalation **Not applicable** — the sink is unreachable on the running guest (module cannot be built or loaded), so there is no primitive to convert. Per AGENT.md's bright-line rule this is a **valid hard blocker**: "The vulnerable code path is dead/unreachable at runtime on this guest AND no harness can exercise it" — provably the case here, since `netinet/libalias/` and `m_megapullup()` are absent from the source tree itself. The harness below proves the primitive at the object/logic level, which is the AGENT.md-endorsed fallback for latent findings. If `netgraph7_nat` were ever built (libalias + `m_megapullup` reintroduced), the same harness ported into a kernel module, plus a `ng_socket`-driven graph with `nat:in` connected to an `ng_iface` and a crafted raw frame injected, would convert the OOB-write of `th_sum` into a slab-primitive in the kmalloc bucket holding the mbuf data. On the audit guest (no SMAP/SMEP/KASLR) a forged `struct ucred` placed in userspace at a fixed address and a corrupted `m_data` pointer aimed at it would be the escalation vector. That work is **not done here** because the bug is genuinely unreachable; the harness documents the primitive precisely so this chain can be picked up the moment the module is buildable. --- ## Deterministic userspace harness (`df0611_harness.c`) Because the kernel module cannot be built, the missing-validation logic of `ng_nat_rcvdata()` lines 690–763 is reproduced byte-for-byte in a userspace harness operating on heap buffers (fake mbufs). The harness: 1. **BUGGY path** — ports the C logic of `ng_nat_rcvdata()` lines 700-763 (omitting `LibAliasIn`/`LibAliasOut`, which are not validation checkpoints and whose sources are gone — this is conservative). 2. **FIXED path** — ports the same function with the three guards from `fix.diff` added: minimum-IP-header check, `ip_hl`/`ip_len` sanity, and TCP-header-fits check. 3. Runs five test frames (4 malformed, 1 well-formed) through both and reports the OOB offsets and accept/reject outcome. Decisive output (deterministic across 3 runs, see `run.log`): ``` test cap read@off write@off BUG_OOB? FIX_rej? ------------------------------------------------------------------------------ trigger-frame cap=80 ip_hl=15 ip_len=80 80 ACCEPT -> BUG read@72 write@76 m_len=80 (cap=80) (in-bounds) lying-ip_len cap=24 ip_hl=5 ip_len=200 24 n/a REJECT -> BUG read@32 write@-1 m_len=200 (cap=24) *** OOB *** sub-min-ip cap=12 ip_hl=5 ip_len=20 12 n/a n/a REJECT huge-ip_hl cap=40 ip_hl=15 ip_len=80 40 n/a REJECT -> BUG read@72 write@-1 m_len=80 (cap=40) *** OOB *** well-formed cap=40 ip_hl=5 ip_len=40 40 n/a ACCEPT ------------------------------------------------------------------------------ BUG: 2/5 frames drove OOB access. FIX: 3/5 frames rejected. RESULT: BUG CONFIRMED — 2 frames drive OOB under the buggy logic; FIX rejects all 3 malformed frames and accepts both valid ones. ``` The harness demonstrates: - `lying-ip_len` (cap=24, ip_len=200) drives an OOB read of `th_x2` at offset 32 (cap is 24) and inflates `m_len` to 200, which `in_delayed_cksum` would then walk. - `huge-ip_hl` (cap=40, ip_hl=15, ip_len=80) drives an OOB read of `th_x2` at offset 72 (cap is 40), exactly as the finding describes. - The FIXED path rejects all three malformed frames and accepts both valid ones (the trigger-frame case is in-bounds for `th_x2`/`th_sum` because cap happens to equal ip_len; the well-formed 40-byte TCP/IP packet is the legitimate case both paths accept). --- ## PoC changes - Added `df0611_harness.c` — deterministic userspace harness that ports the vulnerable and fixed code paths and proves the missing-validation bug + the proposed fix. (The original `README.md` is the finding's craft-and-send recipe, retained as the in-kernel reproduction recipe for when the module is buildable.) - Added `fix.diff` — standalone `git apply`-able unified diff against `sys/netgraph7/ng_nat.c`, adds three guards: minimum-IP-header check before `m_megapullup`; `ip_hl`/`ip_len` validation before any field is trusted; TCP-header-fits check before the fixup block. - Added `build.sh`, `run.sh` — exact repro commands. - Added `VERDICT.md`, `manifest.json`, `env.txt`, `build.log`, `run.log`. --- ## Recommended fix The fix adds three guards to `sys/netgraph7/ng_nat.c` (full diff in `fix.diff`, applies cleanly with `git apply -p1`): 1. **Before `m_megapullup`** (currently at line 690): reject any frame with `m->m_pkthdr.len < sizeof(struct ip)` (returns `EINVAL`). 2. **After `ip = mtod(m, struct ip *)`** (line 701): reject unless `ip->ip_hl >= 5 && ntohs(ip->ip_len) >= (ip->ip_hl << 2) && ntohs(ip->ip_len) <= m->m_pkthdr.len`. 3. **Before the TCP-fixup block** (line 724): additionally require `ntohs(ip->ip_len) >= (u_int)(ip->ip_hl << 2) + sizeof(struct tcphdr)` so `th` is fully inside the packet. These match (and slightly refine) the finding markdown's own `## Recommended fix` proposal. The harness proves they close every malformed case while accepting both valid ones. The KASSERT at line 703 becomes redundant once guard #2 is in place but is left in place for debug kernels. --- ## Phase 8 — fix validation status **not_testable.** The bug does not reproduce on the running kernel (module cannot be built or loaded), so the standard Phase 8 before/after comparison against a built-and-booted single-fix kernel is not meaningful: the patched kernel still cannot build the module either, since `libalias/` and `m_megapullup()` are absent from the source tree itself — they are not addressed by `fix.diff` (which is correctly scoped to the validation logic only, not the missing dependencies). What WAS validated: - `git apply --check -p1 fix.diff` succeeds against a pristine `sys/netgraph7/ng_nat.c` (the read-only audit tree). - The harness ports both the buggy and the fixed logic side-by-side and shows the FIXED path rejects every malformed frame the BUGGY path mishandles, while accepting both valid frames. This is the code-level proof that the fix closes the bug. A future fix-validation that builds a single-fix kernel can be done once the `netgraph7_nat` module is buildable again (i.e. once libalias and `m_megapullup` are reintroduced). At that point the same `fix.diff` becomes live-testable, and the harness's `ng_nat_rcvdata_FIXED` ports 1:1 to the guards in the diff.