⬢ DragonFlyBSD Kernel Audit
DF-0632 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
diff --git a/sys/net/ipfw3_basic/ip_fw3_state.c b/sys/net/ipfw3_basic/ip_fw3_state.c
--- a/sys/net/ipfw3_basic/ip_fw3_state.c
+++ b/sys/net/ipfw3_basic/ip_fw3_state.c
@@ -399,6 +399,13 @@
 			kfree(s, M_IPFW3_STATE);
 		}
 	}
+	/* DF-0632: reset counters when flushing all states. */
+	state_ctx->count_tcp_in = 0;
+	state_ctx->count_tcp_out = 0;
+	state_ctx->count_udp_in = 0;
+	state_ctx->count_udp_out = 0;
+	state_ctx->count_icmp_in = 0;
+	state_ctx->count_icmp_out = 0;
 	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
 }
 
@@ -546,36 +553,48 @@
 		if (time_uptime - s->timestamp > sysctl_var_icmp_timeout) {
 			RB_REMOVE(fw3_state_tree, &state_ctx->rb_icmp_in, s);
 			kfree(s, M_IPFW3_STATE);
+		if (state_ctx->count_icmp_in > 0)
+			state_ctx->count_icmp_in--;
 		}
 	}
 	RB_FOREACH_SAFE(s, fw3_state_tree, &state_ctx->rb_icmp_out, tmp) {
 		if (time_uptime - s->timestamp > sysctl_var_icmp_timeout) {
 			RB_REMOVE(fw3_state_tree, &state_ctx->rb_icmp_out, s);
 			kfree(s, M_IPFW3_STATE);
+		if (state_ctx->count_icmp_out > 0)
+			state_ctx->count_icmp_out--;
 		}
 	}
 	RB_FOREACH_SAFE(s, fw3_state_tree, &state_ctx->rb_tcp_in, tmp) {
 		if (time_uptime - s->timestamp > sysctl_var_tcp_timeout) {
 			RB_REMOVE(fw3_state_tree, &state_ctx->rb_tcp_in, s);
 			kfree(s, M_IPFW3_STATE);
+		if (state_ctx->count_tcp_in > 0)
+			state_ctx->count_tcp_in--;
 		}
 	}
 	RB_FOREACH_SAFE(s, fw3_state_tree, &state_ctx->rb_tcp_out, tmp) {
 		if (time_uptime - s->timestamp > sysctl_var_tcp_timeout) {
 			RB_REMOVE(fw3_state_tree, &state_ctx->rb_tcp_out, s);
 			kfree(s, M_IPFW3_STATE);
+		if (state_ctx->count_tcp_out > 0)
+			state_ctx->count_tcp_out--;
 		}
 	}
 	RB_FOREACH_SAFE(s, fw3_state_tree, &state_ctx->rb_udp_in, tmp) {
 		if (time_uptime - s->timestamp > sysctl_var_udp_timeout) {
 			RB_REMOVE(fw3_state_tree, &state_ctx->rb_udp_in, s);
 			kfree(s, M_IPFW3_STATE);
+		if (state_ctx->count_udp_in > 0)
+			state_ctx->count_udp_in--;
 		}
 	}
 	RB_FOREACH_SAFE(s, fw3_state_tree, &state_ctx->rb_udp_out, tmp) {
 		if (time_uptime - s->timestamp > sysctl_var_udp_timeout) {
 			RB_REMOVE(fw3_state_tree, &state_ctx->rb_udp_out, s);
 			kfree(s, M_IPFW3_STATE);
+		if (state_ctx->count_udp_out > 0)
+			state_ctx->count_udp_out--;
 		}
 	}
 	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);