From dd544baa782e2ccb20703acaffc7ff61da4f9105 Mon Sep 17 00:00:00 2001 From: peter Date: Tue, 21 Dec 2004 12:06:37 +0000 Subject: [PATCH] Apply a patch from OPENBSD_3_6 branch (ok yamt). MFC: Fix by dhartmei@ IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6 header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing the header chain. In the case where headers are skipped, the protocol checksum verification used the wrong length (included the skipped headers), leading to incorrectly mismatching checksums. Such IPv6 packets with headers were silently dropped. Reported by Bernhard Schmidt. ok deraadt@ dhartmei@ mcbride@ --- sys/dist/pf/net/pf.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/sys/dist/pf/net/pf.c b/sys/dist/pf/net/pf.c index dd54ff1e0ce9..50e303ee5731 100644 --- a/sys/dist/pf/net/pf.c +++ b/sys/dist/pf/net/pf.c @@ -1,5 +1,5 @@ -/* $NetBSD: pf.c,v 1.10 2004/12/21 12:05:34 peter Exp $ */ -/* $OpenBSD: pf.c,v 1.457.2.5 2004/12/16 02:04:55 brad Exp $ */ +/* $NetBSD: pf.c,v 1.11 2004/12/21 12:06:37 peter Exp $ */ +/* $OpenBSD: pf.c,v 1.457.2.6 2004/12/19 18:48:57 brad Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -5928,7 +5928,8 @@ pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, goto done; } if (dir == PF_IN && pf_check_proto_cksum(m, off, - ntohs(h->ip6_plen), IPPROTO_TCP, AF_INET6)) { + ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), + IPPROTO_TCP, AF_INET6)) { action = PF_DROP; goto done; } @@ -5961,7 +5962,8 @@ pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, goto done; } if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, - off, ntohs(h->ip6_plen), IPPROTO_UDP, AF_INET6)) { + off, ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), + IPPROTO_UDP, AF_INET6)) { action = PF_DROP; goto done; } @@ -5995,7 +5997,8 @@ pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, goto done; } if (dir == PF_IN && pf_check_proto_cksum(m, off, - ntohs(h->ip6_plen), IPPROTO_ICMPV6, AF_INET6)) { + ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), + IPPROTO_ICMPV6, AF_INET6)) { action = PF_DROP; goto done; }