From owner-freebsd-ipfw@FreeBSD.ORG Mon May 3 11:08:13 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
by hub.freebsd.org (Postfix) with ESMTP id F177A1065672
for <freebsd-ipfw@FreeBSD.org>; Mon, 3 May 2010 11:08:13 +0000 (UTC)
(envelope-from owner-bugmaster@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40])
by mx1.freebsd.org (Postfix) with ESMTP id C6A9D8FC25
for <freebsd-ipfw@FreeBSD.org>; Mon, 3 May 2010 11:08:13 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o43B8DpX033634
for <freebsd-ipfw@FreeBSD.org>; Mon, 3 May 2010 11:08:13 GMT
(envelope-from owner-bugmaster@FreeBSD.org)
Received: (from gnats@localhost)
by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o43B8DF5033632
for freebsd-ipfw@FreeBSD.org; Mon, 3 May 2010 11:08:13 GMT
(envelope-from owner-bugmaster@FreeBSD.org)
Date: Mon, 3 May 2010 11:08:13 GMT
Message-Id: <201005031108.o43B8DF5033632@freefall.freebsd.org>
X-Authentication-Warning: freefall.freebsd.org: gnats set sender to
owner-bugmaster@FreeBSD.org using -f
From: FreeBSD bugmaster <bugmaster@FreeBSD.org>
To: freebsd-ipfw@FreeBSD.org
Cc:
Subject: Current problem reports assigned to freebsd-ipfw@FreeBSD.org
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 03 May 2010 11:08:14 -0000
Note: to view an individual PR, use:
http://www.freebsd.org/cgi/query-pr.cgi?pr=(number).
The following is a listing of current problems submitted by FreeBSD users.
These represent problem reports covering all versions including
experimental development code and obsolete releases.
S Tracker Resp. Description
--------------------------------------------------------------------------------
o kern/145733 ipfw [ipfw] [patch] ipfw flaws with ipv6 fragments
o kern/145305 ipfw [ipfw] ipfw problems, panics, data corruption, ipv6 so
o kern/145167 ipfw [ipfw] ipfw nat does not follow its documentation
o kern/144869 ipfw [ipfw] [panic] Instant kernel panic when adding NAT ru
o kern/144269 ipfw [ipfw] problem with ipfw tables
o kern/144187 ipfw [ipfw] deadlock using multiple ipfw nat and multiple l
o kern/143973 ipfw [ipfw] [panic] ipfw forward option causes kernel reboo
o kern/143653 ipfw [ipfw] [patch] ipfw nat redirect_port "buf is too smal
o kern/143621 ipfw [ipfw] [dummynet] [patch] dummynet and vnet use result
o kern/143474 ipfw [ipfw] ipfw table contains the same address
o kern/139581 ipfw [ipfw] "ipfw pipe" not limiting bandwidth
o kern/139226 ipfw [ipfw] install_state: entry already present, done
o kern/137346 ipfw [ipfw] ipfw nat redirect_proto is broken
o kern/137232 ipfw [ipfw] parser troubles
o kern/136695 ipfw [ipfw] [patch] fwd reached after skipto in dynamic rul
o kern/135476 ipfw [ipfw] IPFW table breaks after adding a large number o
o bin/134975 ipfw [patch] ipfw(8) can't work with set in rule file.
o kern/132553 ipfw [ipfw] ipfw doesn't understand ftp-data port
o kern/131817 ipfw [ipfw] blocks layer2 packets that should not be blocke
o kern/131601 ipfw [ipfw] [panic] 7-STABLE panic in nat_finalise (tcp=0)
o kern/131558 ipfw [ipfw] Inconsistent "via" ipfw behavior
o bin/130132 ipfw [patch] ipfw(8): no way to get mask from ipfw pipe sho
o kern/129103 ipfw [ipfw] IPFW check state does not work =(
o kern/129093 ipfw [ipfw] ipfw nat must not drop packets
o kern/129036 ipfw [ipfw] 'ipfw fwd' does not change outgoing interface n
o kern/128260 ipfw [ipfw] [patch] ipfw_divert damages IPv6 packets
o kern/127230 ipfw [ipfw] [patch] Feature request to add UID and/or GID l
o kern/127209 ipfw [ipfw] IPFW table become corrupted after many changes
o bin/125370 ipfw [ipfw] [patch] increase a line buffer limit
o conf/123119 ipfw [patch] rc script for ipfw does not handle IPv6
o kern/122963 ipfw [ipfw] tcpdump does not show packets redirected by 'ip
s kern/121807 ipfw [request] TCP and UDP port_table in ipfw
o kern/121382 ipfw [dummynet]: 6.3-RELEASE-p1 page fault in dummynet (cor
o kern/121122 ipfw [ipfw] [patch] add support to ToS IP PRECEDENCE fields
o kern/118993 ipfw [ipfw] page fault - probably it's a locking problem
o bin/117214 ipfw ipfw(8) fwd with IPv6 treats input as IPv4
o kern/116009 ipfw [ipfw] [patch] Ignore errors when loading ruleset from
o docs/113803 ipfw [patch] ipfw(8) - don't get bitten by the fwd rule
p kern/113388 ipfw [ipfw] [patch] Addition actions with rules within spec
o kern/112561 ipfw [ipfw] ipfw fwd does not work with some TCP packets
o kern/105330 ipfw [ipfw] [patch] ipfw (dummynet) does not allow to set q
o bin/104921 ipfw [patch] ipfw(8) sometimes treats ipv6 input as ipv4 (a
o kern/104682 ipfw [ipfw] [patch] Some minor language consistency fixes a
o kern/103454 ipfw [ipfw] [patch] [request] add a facility to modify DF b
o kern/103328 ipfw [ipfw] [request] sugestions about ipfw table
o kern/102471 ipfw [ipfw] [patch] add tos and dscp support
o kern/98831 ipfw [ipfw] ipfw has UDP hickups
o kern/97951 ipfw [ipfw] [patch] ipfw does not tie interface details to
o kern/97504 ipfw [ipfw] IPFW Rules bug
o kern/95084 ipfw [ipfw] [regression] [patch] IPFW2 ignores "recv/xmit/v
o kern/93300 ipfw [ipfw] ipfw pipe lost packets
o kern/91847 ipfw [ipfw] ipfw with vlanX as the device
o kern/88659 ipfw [modules] ipfw and ip6fw do not work properly as modul
o kern/87032 ipfw [ipfw] [patch] ipfw ioctl interface implementation
o kern/86957 ipfw [ipfw] [patch] ipfw mac logging
o bin/83046 ipfw [ipfw] ipfw2 error: "setup" is allowed for icmp, but s
o kern/82724 ipfw [ipfw] [patch] [request] Add setnexthop and defaultrou
s kern/80642 ipfw [ipfw] [patch] ipfw small patch - new RULE OPTION
o bin/78785 ipfw [patch] ipfw(8) verbosity locks machine if /etc/rc.fir
o kern/74104 ipfw [ipfw] ipfw2/1 conflict not detected or reported, manp
o kern/73910 ipfw [ipfw] serious bug on forwarding of packets after NAT
o kern/72987 ipfw [ipfw] ipfw/dummynet pipe/queue 'queue [BYTES]KBytes (
o kern/71366 ipfw [ipfw] "ipfw fwd" sometimes rewrites destination mac a
o kern/69963 ipfw [ipfw] install_state warning about already existing en
o kern/60719 ipfw [ipfw] Headerless fragments generate cryptic error mes
o kern/55984 ipfw [ipfw] [patch] time based firewalling support for ipfw
o kern/51274 ipfw [ipfw] [patch] ipfw2 create dynamic rules with parent
o kern/48172 ipfw [ipfw] [patch] ipfw does not log size and flags
o kern/46159 ipfw [ipfw] [patch] [request] ipfw dynamic rules lifetime f
a kern/26534 ipfw [ipfw] Add an option to ipfw to log gid/uid of who cau
70 problems total.
From owner-freebsd-ipfw@FreeBSD.ORG Thu May 6 11:58:08 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
by hub.freebsd.org (Postfix) with ESMTP id C5D6F1065673
for <freebsd-ipfw@freebsd.org>; Thu, 6 May 2010 11:58:08 +0000 (UTC)
(envelope-from emelie@ns11-wistee.fr)
Received: from ns11.wistee.fr (dns-ns11.wistee.fr [94.124.84.11])
by mx1.freebsd.org (Postfix) with ESMTP id 208C98FC24
for <freebsd-ipfw@freebsd.org>; Thu, 6 May 2010 11:58:08 +0000 (UTC)
Received: from emelie by ns11.wistee.fr with local (Exim 4.67)
(envelope-from <emelie@ns11-wistee.fr>) id 1O9ziM-0003Mh-2h
for freebsd-ipfw@freebsd.org; Thu, 06 May 2010 13:58:02 +0200
To: freebsd-ipfw@freebsd.org
X-PHP-Script: emelie.ns11-wistee.fr/blainne.php for 41.251.59.30
From: IRISH NATIONAL LOTTERY <irishnational.lot@englandmail.com>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
Message-Id: <E1O9ziM-0003Mh-2h@ns11.wistee.fr>
Sender: <emelie@ns11-wistee.fr>
Date: Thu, 06 May 2010 13:58:02 +0200
Subject: Contact Us:(IRISH NATIONAL LOTTERY)
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: irishnational.lot@englandmail.com
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 06 May 2010 11:58:08 -0000
Dear Reader
Greetings from Irish National Lottery here in london.We wish to inform you that Ł750,000.00 Pounds has been awarded to your E-mail in our IRISH NATIONAL LOTTERY ONLINE PROMO PROGRAMME To file your
claims contact our fiduciary agent for claims:
Mr. Edward Brown
Email: edwardbrown85@gmail.com
Provide him with the information below:
Full Names:.............
Tel:.............
Sex:............
Age:............
Congratulations once more.
From owner-freebsd-ipfw@FreeBSD.ORG Fri May 7 21:38:11 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
by hub.freebsd.org (Postfix) with ESMTP id 14DD2106564A;
Fri, 7 May 2010 21:38:11 +0000 (UTC)
(envelope-from linimon@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40])
by mx1.freebsd.org (Postfix) with ESMTP id E12868FC22;
Fri, 7 May 2010 21:38:10 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o47LcA4X010617;
Fri, 7 May 2010 21:38:10 GMT
(envelope-from linimon@freefall.freebsd.org)
Received: (from linimon@localhost)
by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o47LcAKa010613;
Fri, 7 May 2010 21:38:10 GMT (envelope-from linimon)
Date: Fri, 7 May 2010 21:38:10 GMT
Message-Id: <201005072138.o47LcAKa010613@freefall.freebsd.org>
To: linimon@FreeBSD.org, freebsd-bugs@FreeBSD.org, freebsd-ipfw@FreeBSD.org
From: linimon@FreeBSD.org
Cc:
Subject: Re: kern/146372: [ipfw] ipfw setfib does not work on local outgoing
connections
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 07 May 2010 21:38:11 -0000
Old Synopsis: ipfw setfib does not work on local outgoing connections
New Synopsis: [ipfw] ipfw setfib does not work on local outgoing connections
Responsible-Changed-From-To: freebsd-bugs->freebsd-ipfw
Responsible-Changed-By: linimon
Responsible-Changed-When: Fri May 7 21:37:54 UTC 2010
Responsible-Changed-Why:
Over to maintainer(s).
http://www.freebsd.org/cgi/query-pr.cgi?pr=146372
From owner-freebsd-ipfw@FreeBSD.ORG Fri May 7 22:04:37 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
by hub.freebsd.org (Postfix) with ESMTP id E601F1065675;
Fri, 7 May 2010 22:04:37 +0000 (UTC)
(envelope-from julian@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40])
by mx1.freebsd.org (Postfix) with ESMTP id D70078FC0A;
Fri, 7 May 2010 22:04:37 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o47M4bM4035841;
Fri, 7 May 2010 22:04:37 GMT
(envelope-from julian@freefall.freebsd.org)
Received: (from julian@localhost)
by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o47M4b8w035837;
Fri, 7 May 2010 15:04:37 -0700 (PDT) (envelope-from julian)
Date: Fri, 7 May 2010 15:04:37 -0700 (PDT)
Message-Id: <201005072204.o47M4b8w035837@freefall.freebsd.org>
To: melifaro@ipfw.ru, julian@FreeBSD.org, freebsd-ipfw@FreeBSD.org
From: julian@FreeBSD.org
Cc:
Subject: Re: kern/146372: [ipfw] ipfw setfib does not work on local outgoing
connections
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 07 May 2010 22:04:38 -0000
Synopsis: [ipfw] ipfw setfib does not work on local outgoing connections
State-Changed-From-To: open->closed
State-Changed-By: julian
State-Changed-When: Fri May 7 15:00:00 PDT 2010
State-Changed-Why:
Unfortunatly this is mostly unavoidable. The routing decision has already been made by the time that
ipfw is called. There is a small possibility that a change of fib could make the stack do teh same thing
as ipfw fwd and force he packet to go back to the start and get rerouted, but it's not quite as easy as that.
You should look at possibly setting the fib for the application in question or maybe jsut its socket
if you have source. contact me directly to get some ideas we may be able to work with you on.
http://www.freebsd.org/cgi/query-pr.cgi?pr=146372
From owner-freebsd-ipfw@FreeBSD.ORG Sat May 8 04:50:04 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
by hub.freebsd.org (Postfix) with ESMTP id 48FF7106566B
for <freebsd-ipfw@hub.freebsd.org>;
Sat, 8 May 2010 04:50:04 +0000 (UTC)
(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40])
by mx1.freebsd.org (Postfix) with ESMTP id 1FD648FC17
for <freebsd-ipfw@hub.freebsd.org>;
Sat, 8 May 2010 04:50:04 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o484o3w6077563
for <freebsd-ipfw@freefall.freebsd.org>; Sat, 8 May 2010 04:50:03 GMT
(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o484o3wN077562;
Sat, 8 May 2010 04:50:03 GMT (envelope-from gnats)
Date: Sat, 8 May 2010 04:50:03 GMT
Message-Id: <201005080450.o484o3wN077562@freefall.freebsd.org>
To: freebsd-ipfw@FreeBSD.org
From: Matthew Luckie <mjl@luckie.org.nz>
Cc:
Subject: Re: kern/145733: [patch] ipfw flaws with ipv6 fragments
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Matthew Luckie <mjl@luckie.org.nz>
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 08 May 2010 04:50:04 -0000
The following reply was made to PR kern/145733; it has been noted by GNATS.
From: Matthew Luckie <mjl@luckie.org.nz>
To: freebsd-bugs@FreeBSD.org
Cc:
Subject: Re: kern/145733: [patch] ipfw flaws with ipv6 fragments
Date: Sat, 8 May 2010 09:24:23 +1200
--xHFwDpU9dbj6ez1V
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Attached is a revised patch fixing a third flaw. ipfw will reject
very small IPv6 fragments when it tries to pullup the transport
header. This relaxes the code to be consistent with the IPv4 path
where it only tries to pull up the transport header on fragments with
offset zero.
--xHFwDpU9dbj6ez1V
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=patch-ipfw-fraghdr
--- ip_fw2.c.orig 2010-05-08 08:38:40.000000000 +1200
+++ ip_fw2.c 2010-05-08 09:10:28.000000000 +1200
@@ -804,6 +804,7 @@
char *action;
int limit_reached = 0;
char action2[40], proto[128], fragment[32];
+ u_short mf = 0;
fragment[0] = '\0';
proto[0] = '\0';
@@ -952,6 +953,8 @@
snprintf(dst, sizeof(dst), "[%s]",
ip6_sprintf(ip6buf, &args->f_id.dst_ip6));
+ mf = offset & IP6F_MORE_FRAG;
+ offset &= IP6F_OFF_MASK;
ip6 = (struct ip6_hdr *)ip;
tcp = (struct tcphdr *)(((char *)ip) + hlen);
udp = (struct udphdr *)(((char *)ip) + hlen);
@@ -1021,13 +1024,13 @@
#ifdef INET6
if (IS_IP6_FLOW_ID(&(args->f_id))) {
- if (offset & (IP6F_OFF_MASK | IP6F_MORE_FRAG))
+ if (offset || mf)
snprintf(SNPARGS(fragment, 0),
" (frag %08x:%d@%d%s)",
args->f_id.frag_id6,
ntohs(ip6->ip6_plen) - hlen,
- ntohs(offset & IP6F_OFF_MASK) << 3,
- (offset & IP6F_MORE_FRAG) ? "+" : "");
+ ntohs(offset) << 3,
+ mf ? "+" : "");
} else
#endif
{
@@ -2184,16 +2187,13 @@
/*
* offset The offset of a fragment. offset != 0 means that
- * we have a fragment at this offset of an IPv4 packet.
- * offset == 0 means that (if this is an IPv4 packet)
- * this is the first or only fragment.
- * For IPv6 offset == 0 means there is no Fragment Header.
- * If offset != 0 for IPv6 always use correct mask to
- * get the correct offset because we add IP6F_MORE_FRAG
- * to be able to dectect the first fragment which would
- * otherwise have offset = 0.
+ * we have a fragment at this offset.
+ * offset == 0 means that this is the first or only fragment.
+ *
+ * mf The MF bit masked out of IPv6 packets.
*/
u_short offset = 0;
+ u_short mf = 0;
/*
* Local copies of addresses. They are only valid if we have
@@ -2281,7 +2281,7 @@
proto = ip6->ip6_nxt;
/* Search extension headers to find upper layer protocols */
- while (ulp == NULL) {
+ while (ulp == NULL && offset == 0) {
switch (proto) {
case IPPROTO_ICMPV6:
PULLUP_TO(hlen, ulp, struct icmp6_hdr);
@@ -2345,17 +2345,8 @@
proto = ((struct ip6_frag *)ulp)->ip6f_nxt;
offset = ((struct ip6_frag *)ulp)->ip6f_offlg &
IP6F_OFF_MASK;
- /* Add IP6F_MORE_FRAG for offset of first
- * fragment to be != 0. */
- offset |= ((struct ip6_frag *)ulp)->ip6f_offlg &
+ mf = ((struct ip6_frag *)ulp)->ip6f_offlg &
IP6F_MORE_FRAG;
- if (offset == 0) {
- printf("IPFW2: IPV6 - Invalid Fragment "
- "Header\n");
- if (V_fw_deny_unknown_exthdrs)
- return (IP_FW_DENY);
- break;
- }
args->f_id.frag_id6 =
ntohl(((struct ip6_frag *)ulp)->ip6f_ident);
ulp = NULL;
@@ -2941,7 +2932,7 @@
case O_LOG:
if (V_fw_verbose)
ipfw_log(f, hlen, args, m,
- oif, offset, tablearg, ip);
+ oif, offset|mf, tablearg, ip);
match = 1;
break;
--xHFwDpU9dbj6ez1V--