mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Correctly handle aliases for the target on inetd rules. Otherwise bad parameters are passed to netcat(nc) and we DoS the host.

Browse Source
This commit is contained in:
Ermal 2011-03-25 18:45:25 +00:00
parent d93ee937f2
commit 650b573bd8
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
etc/inc/filter.inc
View File

@ -1070,7 +1070,12 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
$socktype = "stream";
$dash_u = "";
}
$reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$target} {$tda}\n";
$target = explode(" ", $target);
foreach ($target as $targip) {
if (empty($targip))
continue;
$reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$targip} {$tda}\n";
}
}
$inetdport++;
}