Page MenuHomeFreeBSD

pf: align IPv4 and IPv6 AH header handling
ClosedPublic

Authored by kp on Jun 3 2025, 12:48 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Oct 8, 8:55 PM
Unknown Object (File)
Fri, Oct 3, 3:34 PM
Unknown Object (File)
Wed, Oct 1, 7:41 PM
Unknown Object (File)
Tue, Sep 30, 8:30 PM
Unknown Object (File)
Thu, Sep 18, 2:30 AM
Unknown Object (File)
Sep 3 2025, 12:48 PM
Unknown Object (File)
Aug 18 2025, 8:52 PM
Unknown Object (File)
Aug 15 2025, 12:11 AM

Details

Summary

Pf was handling IPv4 and IPv6 differently regarding AH extension
headers. pf_walk_header6() steps over it and detects the real
protocol. So to implement a minimal header walking function
pf_walk_header() for IPv4. It does the header checks and jumps
over AH. Then pf does not understand AH as a protocol, it is just
an extension that authenticates the packet. Move some header and
option checks to pf_walk_header() for consistency with IPv6. This
also improves the header check for IPv4 packets in ICMP payload.
OK henning@

Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 22ef11432c
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable