Date: 13 Jan 2004 15:24:36 -0000 From: Max Laier <max@love2party.net> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/61318: Maintainer-Update: security/pf - Version 2.02 Message-ID: <20040113152436.55036.qmail@vampire.homelinux.org> Resent-Message-ID: <200401131530.i0DFUMOq075971@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 61318 >Category: ports >Synopsis: Maintainer-Update: security/pf - Version 2.02 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Tue Jan 13 07:30:22 PST 2004 >Closed-Date: >Last-Modified: >Originator: Max Laier >Release: FreeBSD 5.1-RELEASE-p10 i386 >Organization: >Environment: System: FreeBSD router.laiers.local 5.1-RELEASE-p10 FreeBSD 5.1-RELEASE-p10 #1: Sun Oct 5 17:38:55 CEST 2003 root@router.laiers.local:/usr/obj/usr/src/sys/ALTQ i386 >Description: >How-To-Repeat: >Fix: Update security/pf to version 2.02: - Fix severe byte order related problem with "route-to" rules (much help from Joris Vandalon with testing here) - Make tcpdump's -w flag work for if_pfsync - Fix byte order and drop lock for icmp_error() calls. (note that it is necessary to allow icmp_error messages - from "block-policy return" - as FreeBSD does not know about pf's special tags, yet). Update ALTQ-message to point to the new 5.2R-patchset from rofug.ro as well. N.B.: removes patch-ac and patch-ad --- pf.diff begins here --- diff -ruN pf.orig/Makefile pf/Makefile --- pf.orig/Makefile Tue Jan 13 00:06:17 2004 +++ pf/Makefile Tue Jan 13 00:15:04 2004 @@ -6,8 +6,7 @@ # PORTNAME= pf_freebsd -PORTVERSION= 2.00 -PORTREVISION= 1 +PORTVERSION= 2.02 CATEGORIES= security ipv6 MASTER_SITES= http://pf4freebsd.love2party.net/ .if defined(WITH_ALTQ) && (${WITH_ALTQ} == "yes") @@ -60,8 +59,9 @@ pre-fetch: @${ECHO_MSG} "=======================================================" @${ECHO_MSG} "* If you have ALTQ support from: *" - @${ECHO_MSG} "* http://www.nipsi.de/altq/index.html *" - @${ECHO_MSG} "* You can may define WITH_ALTQ=yes to make use of it *" + @${ECHO_MSG} "* http://www.nipsi.de/altq/index.html or *" + @${ECHO_MSG} "* http://www.rofug.ro/projects/freebsd-altq/ *" + @${ECHO_MSG} "* You can define WITH_ALTQ=yes to make use of it *" @${ECHO_MSG} "* Please define SYS_ALTQ to point to the patched src *" @${ECHO_MSG} "* *" @${ECHO_MSG} "* e.g.: make WITH_ALTQ=yes SYS_ALTQ=/usr/src/sys.altq *" diff -ruN pf.orig/distinfo pf/distinfo --- pf.orig/distinfo Tue Jan 13 00:06:17 2004 +++ pf/distinfo Tue Jan 13 00:15:40 2004 @@ -1 +1 @@ -MD5 (pf_freebsd_2.00.tar.gz) = e55504a934a232a0030dc746f0bf96d0 +MD5 (pf_freebsd_2.02.tar.gz) = 378eb8b827604cb313e7e1d16318106e diff -ruN pf.orig/files/patch-ac pf/files/patch-ac --- pf.orig/files/patch-ac Tue Jan 13 00:06:17 2004 +++ pf/files/patch-ac Thu Jan 1 01:00:00 1970 @@ -1,98 +0,0 @@ ---- pf/pf.c.orig Fri Nov 21 14:32:14 2003 -+++ pf/pf.c Fri Nov 21 14:32:33 2003 -@@ -1250,8 +1250,10 @@ - struct tcphdr *th; - #if defined(__FreeBSD__) - struct ip *ip; -+#if (__FreeBSD_version < 501114) - struct route ro; - #endif -+#endif - char *opt; - - /* maximum segment size tcp option */ -@@ -1366,7 +1368,6 @@ - h->ip_ttl = ttl ? ttl : ip_defttl; - h->ip_sum = 0; - #if defined(__FreeBSD__) -- bzero(&ro, sizeof(ro)); - ip = mtod(m, struct ip *); - /* - * XXX -@@ -1376,6 +1377,8 @@ - */ - NTOHS(ip->ip_len); - NTOHS(ip->ip_off); -+#if (__FreeBSD_version < 501114) -+ bzero(&ro, sizeof(ro)); - ip_rtaddr(ip->ip_dst, &ro); - PF_UNLOCK(); - ip_output(m, (void *)NULL, &ro, 0, (void *)NULL, -@@ -1384,7 +1387,13 @@ - if(ro.ro_rt) { - RTFREE(ro.ro_rt); - } --#else -+#else /* __FreeBSD_version >= 501114 */ -+ PF_UNLOCK(); -+ ip_output(m, (void *)NULL, (void *)NULL, 0, (void *)NULL, -+ (void *)NULL); -+ PF_LOCK(); -+#endif -+#else /* ! __FreeBSD__ */ - ip_output(m, (void *)NULL, (void *)NULL, 0, (void *)NULL, - (void *)NULL); - #endif -@@ -2354,8 +2363,12 @@ - dst->sin_len = sizeof(*dst); - dst->sin_addr = addr->v4; - #if defined(__FreeBSD__) -+#ifdef RTF_PRCLONING - rtalloc_ign(&ro, (RTF_CLONING | RTF_PRCLONING)); --#else -+#else /* !RTF_PRCLONING */ -+ rtalloc_ign(&ro, RTF_CLONING); -+#endif -+#else /* ! __FreeBSD__ */ - rtalloc_noclone(&ro, NO_CLONING); - #endif - rt = ro.ro_rt; -@@ -2370,9 +2383,13 @@ - dst6->sin6_len = sizeof(*dst6); - dst6->sin6_addr = addr->v6; - #if defined(__FreeBSD__) -+#ifdef RTF_PRCLONING - rtalloc_ign((struct route *)&ro6, - (RTF_CLONING | RTF_PRCLONING)); --#else -+#else /* !RTF_PRCLONING */ -+ rtalloc_ign((struct route *)&ro6, RTF_CLONING); -+#endif -+#else /* ! __FreeBSD__ */ - rtalloc_noclone((struct route *)&ro6, NO_CLONING); - #endif - rt = ro6.ro_rt; -@@ -4731,8 +4748,12 @@ - dst->sin_len = sizeof(*dst); - dst->sin_addr = addr->v4; - #if defined(__FreeBSD__) -+#ifdef RTF_PRCLONING - rtalloc_ign(&ro, (RTF_CLONING|RTF_PRCLONING)); --#else -+#else /* !RTF_PRCLONING */ -+ rtalloc_ign(&ro, RTF_CLONING); -+#endif -+#else /* ! __FreeBSD__ */ - rtalloc_noclone(&ro, NO_CLONING); - #endif - -@@ -5044,7 +5065,8 @@ - m0->m_pkthdr.csum_flags &= ifp->if_hwassist; - - if (ntohs(ip->ip_len) <= ifp->if_mtu || -- ifp->if_hwassist & CSUM_FRAGMENT) { -+ (ifp->if_hwassist & CSUM_FRAGMENT && -+ ((ip->ip_off & htons(IP_DF)) == 0))) { - /* - * ip->ip_len = htons(ip->ip_len); - * ip->ip_off = htons(ip->ip_off); diff -ruN pf.orig/files/patch-ad pf/files/patch-ad --- pf.orig/files/patch-ad Tue Jan 13 00:06:17 2004 +++ pf/files/patch-ad Thu Jan 1 01:00:00 1970 @@ -1,23 +0,0 @@ ---- freebsd_libpcap/savefile.c.orig Fri Nov 21 14:35:34 2003 -+++ freebsd_libpcap/savefile.c Fri Nov 21 14:35:46 2003 -@@ -178,6 +178,9 @@ - #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */ - #define LINKTYPE_IPFILTER 116 /* IP Filter capture files */ - #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */ -+#if defined(DLT_PFSYNC) -+#define LINKTYPE_PFSYNC DLT_PFSYNC -+#endif - - static struct linktype_map { - int dlt; -@@ -271,6 +274,10 @@ - * defining DLT_* values that collide with those - * LINKTYPE_* values, either). - */ -+ { DLT_PFLOG, LINKTYPE_PFLOG }, -+#if defined(DLT_PFSYNC) -+ { DLT_PFSYNC, LINKTYPE_PFSYNC }, -+#endif - { -1, -1 } - }; - --- pf.diff ends here --- >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040113152436.55036.qmail>