git: 06a6ec55fbd0 - main - pf: ignore/preserve ECN bits on ToS matching and scrubbing

[Kristof Provost]

The branch main has been updated by kp:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=06a6ec55fbd01a372778870cb5039341bdea9e38

commit 06a6ec55fbd01a372778870cb5039341bdea9e38
Author:     Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-01-22 10:56:09 +0000
Commit:     Kristof Provost <k...@freebsd.org>
CommitDate: 2025-01-24 10:20:31 +0000

    pf: ignore/preserve ECN bits on ToS matching and scrubbing
    
    The lower 2 bits of the tos-header are used for ECN.
     (http://tools.ietf.org/html/rfc2474#section-3)
    OK henning@, haesbaert@
    
    Obtained from:  OpenBSD, mpf <m...@openbsd.org>, 60dfe711ee
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index a0bc65e78430..0ebc813756f1 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -9986,7 +9986,7 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc 
*pd, struct mbuf **m0,
                pd->dst = (struct pf_addr *)&h->ip_dst;
                pd->ip_sum = &h->ip_sum;
                pd->virtual_proto = pd->proto = h->ip_p;
-               pd->tos = h->ip_tos;
+               pd->tos = h->ip_tos & ~IPTOS_ECN_MASK;
                pd->ttl = h->ip_ttl;
                pd->tot_len = ntohs(h->ip_len);
                pd->act.rtableid = -1;