Page MenuHomeFreeBSD
Files F168968956

D46647.diff
No OneTemporary
Actions

D46647.diff
View Options

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -8590,78 +8590,6 @@
if (h->ip_off & htons(IP_MF | IP_OFFMASK))
return (0);
- switch (h->ip_p) {
- case IPPROTO_TCP: {
- struct tcphdr *th = &pd->hdr.tcp;
-
- if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
- reason, AF_INET)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = sizeof(*th);
- pd->p_len = pd->tot_len - *off - (th->th_off << 2);
- pd->sport = &th->th_sport;
- pd->dport = &th->th_dport;
- break;
- }
- case IPPROTO_UDP: {
- struct udphdr *uh = &pd->hdr.udp;
-
- if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
- reason, AF_INET)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = sizeof(*uh);
- if (uh->uh_dport == 0 ||
- ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
- ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- pd->sport = &uh->uh_sport;
- pd->dport = &uh->uh_dport;
- break;
- }
- case IPPROTO_SCTP: {
- if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
- action, reason, AF_INET)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = sizeof(pd->hdr.sctp);
- pd->p_len = pd->tot_len - *off;
-
- pd->sport = &pd->hdr.sctp.src_port;
- pd->dport = &pd->hdr.sctp.dest_port;
- if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- break;
- }
- case IPPROTO_ICMP: {
- if (!pf_pull_hdr(m, *off, &pd->hdr.icmp, ICMP_MINLEN,
- action, reason, AF_INET)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = ICMP_MINLEN;
- break;
- }
- }
break;
}
#endif
@@ -8750,103 +8678,114 @@
}
} while (!terminal);
- switch (pd->proto) {
- case IPPROTO_TCP: {
- struct tcphdr *th = &pd->hdr.tcp;
+ break;
+ }
+#endif
+ default:
+ panic("pf_setup_pdesc called with illegal af %u", af);
+ }
- if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
- reason, AF_INET6)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = sizeof(*th);
- pd->p_len = pd->tot_len - *off - (th->th_off << 2);
- pd->sport = &th->th_sport;
- pd->dport = &th->th_dport;
- break;
+ switch (pd->proto) {
+ case IPPROTO_TCP: {
+ struct tcphdr *th = &pd->hdr.tcp;
+
+ if (!pf_pull_hdr(m, *off, th, sizeof(*th), action,
+ reason, af)) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
}
- case IPPROTO_UDP: {
- struct udphdr *uh = &pd->hdr.udp;
+ *hdrlen = sizeof(*th);
+ pd->p_len = pd->tot_len - *off - (th->th_off << 2);
+ pd->sport = &th->th_sport;
+ pd->dport = &th->th_dport;
+ break;
+ }
+ case IPPROTO_UDP: {
+ struct udphdr *uh = &pd->hdr.udp;
- if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
- reason, AF_INET6)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = sizeof(*uh);
- if (uh->uh_dport == 0 ||
- ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
- ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- pd->sport = &uh->uh_sport;
- pd->dport = &uh->uh_dport;
- break;
+ if (!pf_pull_hdr(m, *off, uh, sizeof(*uh), action,
+ reason, af)) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
}
- case IPPROTO_SCTP: {
- if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
- action, reason, AF_INET6)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = sizeof(pd->hdr.sctp);
- pd->p_len = pd->tot_len - *off;
-
- pd->sport = &pd->hdr.sctp.src_port;
- pd->dport = &pd->hdr.sctp.dest_port;
- if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- break;
+ *hdrlen = sizeof(*uh);
+ if (uh->uh_dport == 0 ||
+ ntohs(uh->uh_ulen) > m->m_pkthdr.len - *off ||
+ ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
}
- case IPPROTO_ICMPV6: {
- size_t icmp_hlen = sizeof(struct icmp6_hdr);
+ pd->sport = &uh->uh_sport;
+ pd->dport = &uh->uh_dport;
+ break;
+ }
+ case IPPROTO_SCTP: {
+ if (!pf_pull_hdr(m, *off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
+ action, reason, af)) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
+ }
+ *hdrlen = sizeof(pd->hdr.sctp);
+ pd->p_len = pd->tot_len - *off;
- if (!pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
- action, reason, AF_INET6)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- /* ICMP headers we look further into to match state */
- switch (pd->hdr.icmp6.icmp6_type) {
- case MLD_LISTENER_QUERY:
- case MLD_LISTENER_REPORT:
- icmp_hlen = sizeof(struct mld_hdr);
- break;
- case ND_NEIGHBOR_SOLICIT:
- case ND_NEIGHBOR_ADVERT:
- icmp_hlen = sizeof(struct nd_neighbor_solicit);
- break;
- }
- if (icmp_hlen > sizeof(struct icmp6_hdr) &&
- !pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
- action, reason, AF_INET6)) {
- *action = PF_DROP;
- REASON_SET(reason, PFRES_SHORT);
- return (-1);
- }
- *hdrlen = icmp_hlen;
+ pd->sport = &pd->hdr.sctp.src_port;
+ pd->dport = &pd->hdr.sctp.dest_port;
+ if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
+ }
+ if (pf_scan_sctp(m, *off, pd, kif) != PF_PASS) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
+ }
+ break;
+ }
+ case IPPROTO_ICMP: {
+ if (!pf_pull_hdr(m, *off, &pd->hdr.icmp, ICMP_MINLEN,
+ action, reason, af)) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
+ }
+ *hdrlen = ICMP_MINLEN;
+ break;
+ }
+ case IPPROTO_ICMPV6: {
+ size_t icmp_hlen = sizeof(struct icmp6_hdr);
+
+ if (!pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+ action, reason, af)) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
+ }
+ /* ICMP headers we look further into to match state */
+ switch (pd->hdr.icmp6.icmp6_type) {
+ case MLD_LISTENER_QUERY:
+ case MLD_LISTENER_REPORT:
+ icmp_hlen = sizeof(struct mld_hdr);
+ break;
+ case ND_NEIGHBOR_SOLICIT:
+ case ND_NEIGHBOR_ADVERT:
+ icmp_hlen = sizeof(struct nd_neighbor_solicit);
break;
}
+ if (icmp_hlen > sizeof(struct icmp6_hdr) &&
+ !pf_pull_hdr(m, *off, &pd->hdr.icmp6, icmp_hlen,
+ action, reason, af)) {
+ *action = PF_DROP;
+ REASON_SET(reason, PFRES_SHORT);
+ return (-1);
}
+ *hdrlen = icmp_hlen;
break;
}
-#endif
- default:
- panic("pf_setup_pdesc called with illegal af %u", af);
}
return (0);
}

File Metadata

Mime Type
text/plain
Expires
Tue, Sep 1, 12:24 AM (3 h, 44 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
37734461
Default Alt Text
D46647.diff (7 KB)

Event Timeline