On Wed, Aug 31, 2011 at 05:02:01PM +0200, Henning Brauer wrote:
> @@ -5679,6 +5665,13 @@ pf_setup_pdesc(sa_family_t af, int dir,
> m, *off, pd, a, ruleset, *hdrlen);
> if (*action != PF_PASS)
> REASON_SET(reason, PFRES_FRAG);
> +
> + PF_ACPY(&pd->nsaddr, pd->src, pd->af);
> + PF_ACPY(&pd->ndaddr, pd->dst, pd->af);
You should set this a few lines above before calling pf_test_rule().
> + if (pd->sport)
> + pd->nsport = *pd->sport;
> + if (pd->dport)
> + pd->ndport = *pd->dport;
They are always NULL here.
> return (-1);
> }
> break;
You have forgotten IPv6. What do you think about deduplicating
this code?
bluhm
Index: net/pf.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/pf.c,v
retrieving revision 1.771
diff -u -p -r1.771 pf.c
--- net/pf.c 30 Aug 2011 00:40:47 -0000 1.771
+++ net/pf.c 31 Aug 2011 18:55:13 -0000
@@ -5666,21 +5697,9 @@ pf_setup_pdesc(sa_family_t af, int dir,
if (h->ip_hl > 5) /* has options */
pd->badopts++;
- if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
- /*
- * handle fragments that aren't reassembled by
- * normalization
- */
+ if (h->ip_off & htons(IP_MF | IP_OFFMASK))
pd->virtual_proto = PF_VPROTO_FRAGMENT;
- if (kif == NULL || r == NULL) /* pflog */
- *action = PF_DROP;
- else
- *action = pf_test_rule(r, s, dir, kif,
- m, *off, pd, a, ruleset, *hdrlen);
- if (*action != PF_PASS)
- REASON_SET(reason, PFRES_FRAG);
- return (-1);
- }
+
break;
}
#endif
@@ -5763,21 +5782,9 @@ pf_setup_pdesc(sa_family_t af, int dir,
pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
pd->virtual_proto = pd->proto = nxt;
- if (fragoff != 0) {
- /*
- * handle fragments that aren't reassembled by
- * normalization
- */
+ if (fragoff != 0)
pd->virtual_proto = PF_VPROTO_FRAGMENT;
- if (kif == NULL || r == NULL) /* pflog */
- *action = PF_DROP;
- else
- *action = pf_test_rule(r, s, dir, kif,
- m, *off, pd, a, ruleset, *hdrlen);
- if (*action != PF_PASS)
- REASON_SET(reason, PFRES_FRAG);
- return (-1);
- }
+
break;
}
#endif
@@ -5786,7 +5793,20 @@ pf_setup_pdesc(sa_family_t af, int dir,
}
- switch (pd->proto) {
+ switch (pd->virtual_proto) {
+ case PF_VPROTO_FRAGMENT:
+ /*
+ * handle fragments that aren't reassembled by
+ * normalization
+ */
+ if (kif == NULL || r == NULL) /* pflog */
+ *action = PF_DROP;
+ else
+ *action = pf_test_rule(r, s, dir, kif,
+ m, *off, pd, a, ruleset, *hdrlen);
+ if (*action != PF_PASS)
+ REASON_SET(reason, PFRES_FRAG);
+ return (-1);
case IPPROTO_TCP: {
struct tcphdr *th = pd->hdr.tcp;
