FreeBSD-SA-05:13.ipfw "ipfw packet matching errors with address tables"

t ! security

The FreeBSD Project よりセキュリティ勧告が出ました。要点を以下にまとめます。

  • 未稿

セキュリティ勧告は ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc にあります。
以下は上記のセキュリティ勧告の一部とその訳文です。ただし品質は保証致しません。

I. 背景 - Background

ipfw(8) is a system facility which allows IP packet filtering, redirecting, and traffic accounting. ipfw lookup tables are a way to specify many IP addresses which can be used for packet matching in an efficient manner.

II. 問題の詳細 - Problem Description

The ipfw tables lookup code caches the result of the last query. The kernel may process multiple packets concurrently, performing several concurrent table lookups. Due to an insufficient locking, a cached result can become corrupted that could cause some addresses to be incorrectly matched against a lookup table.

III. 影響範囲 - Impact

When lookup tables are used with ipfw, packets may on very rare occasions incorrectly match a lookup table. This could result in a packet being treated contrary to the defined packet filtering ruleset. For example, a packet may be allowed to pass through when it should have been discarded.
The problem can only occur on Symmetric Multi-Processor (SMP) systems, or on Uni Processor (UP) systems with the PREEMPTION kernel option enabled (not the default).

IV. 回避方法 - Workaround

a) Do not use lookup tables.
OR
b) Disable concurrent processing of packets in the network stack by setting the "debug.mpsafenet=0" tunable:

# echo "debug.mpsafenet=0" >> /boot/loader.conf

>