From owner-svn-src-head@FreeBSD.ORG Mon Apr 1 11:28:53 2013 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 1A64E91F; Mon, 1 Apr 2013 11:28:53 +0000 (UTC) (envelope-from melifaro@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 0B986817; Mon, 1 Apr 2013 11:28:53 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r31BSqGM041862; Mon, 1 Apr 2013 11:28:52 GMT (envelope-from melifaro@svn.freebsd.org) Received: (from melifaro@localhost) by svn.freebsd.org (8.14.6/8.14.5/Submit) id r31BSqes041861; Mon, 1 Apr 2013 11:28:52 GMT (envelope-from melifaro@svn.freebsd.org) Message-Id: <201304011128.r31BSqes041861@svn.freebsd.org> From: "Alexander V. Chernikov" Date: Mon, 1 Apr 2013 11:28:52 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r248971 - head/sys/netpfil/ipfw X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2013 11:28:53 -0000 Author: melifaro Date: Mon Apr 1 11:28:52 2013 New Revision: 248971 URL: http://svnweb.freebsd.org/changeset/base/248971 Log: Fix ipfw rule validation partially broken by r248552. Pointed by: avg MFC with: r248552 Modified: head/sys/netpfil/ipfw/ip_fw_sockopt.c Modified: head/sys/netpfil/ipfw/ip_fw_sockopt.c ============================================================================== --- head/sys/netpfil/ipfw/ip_fw_sockopt.c Mon Apr 1 10:45:35 2013 (r248970) +++ head/sys/netpfil/ipfw/ip_fw_sockopt.c Mon Apr 1 11:28:52 2013 (r248971) @@ -672,10 +672,6 @@ check_ipfw_struct(struct ip_fw *rule, in case O_IPID: case O_IPTTL: case O_IPLEN: - case O_DSCP: - if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1) - goto bad_size; - break; case O_TCPDATALEN: case O_TCPWIN: case O_TAGGED: @@ -683,6 +679,11 @@ check_ipfw_struct(struct ip_fw *rule, in goto bad_size; break; + case O_DSCP: + if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1) + goto bad_size; + break; + case O_MAC_TYPE: case O_IP_SRCPORT: case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */