From owner-svn-src-all@FreeBSD.ORG Wed Apr 1 12:16:58 2015 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 48C27E2B; Wed, 1 Apr 2015 12:16:58 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 20724360; Wed, 1 Apr 2015 12:16:58 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t31CGvSc047695; Wed, 1 Apr 2015 12:16:57 GMT (envelope-from kp@FreeBSD.org) Received: (from kp@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t31CGv0C047694; Wed, 1 Apr 2015 12:16:57 GMT (envelope-from kp@FreeBSD.org) Message-Id: <201504011216.t31CGv0C047694@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: kp set sender to kp@FreeBSD.org using -f From: Kristof Provost Date: Wed, 1 Apr 2015 12:16:57 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r280956 - head/sys/netpfil/pf X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 12:16:58 -0000 Author: kp Date: Wed Apr 1 12:16:56 2015 New Revision: 280956 URL: https://svnweb.freebsd.org/changeset/base/280956 Log: pf: Deal with runt packets On Ethernet packets have a minimal length, so very short packets get padding appended to them. This padding is not stripped off in ip6_input() (due to support for IPv6 Jumbograms, RFC2675). That means PF needs to be careful when reassembling fragmented packets to not include the padding in the reassembled packet. While here also remove the 'Magic from ip_input.' bits. Splitting up and re-joining an mbuf chain here doesn't make any sense. Differential Revision: https://reviews.freebsd.org/D2189 Approved by: gnn (mentor) Modified: head/sys/netpfil/pf/pf_norm.c Modified: head/sys/netpfil/pf/pf_norm.c ============================================================================== --- head/sys/netpfil/pf/pf_norm.c Wed Apr 1 12:15:01 2015 (r280955) +++ head/sys/netpfil/pf/pf_norm.c Wed Apr 1 12:16:56 2015 (r280956) @@ -573,11 +573,8 @@ pf_join_fragment(struct pf_fragment *fra frent = TAILQ_FIRST(&frag->fr_queue); next = TAILQ_NEXT(frent, fr_next); - /* Magic from ip_input. */ m = frent->fe_m; - m2 = m->m_next; - m->m_next = NULL; - m_cat(m, m2); + m_adj(m, (frent->fe_hdrlen + frent->fe_len) - m->m_pkthdr.len); uma_zfree(V_pf_frent_z, frent); for (frent = next; frent != NULL; frent = next) { next = TAILQ_NEXT(frent, fr_next); @@ -585,6 +582,9 @@ pf_join_fragment(struct pf_fragment *fra m2 = frent->fe_m; /* Strip off ip header. */ m_adj(m2, frent->fe_hdrlen); + /* Strip off any trailing bytes. */ + m_adj(m2, frent->fe_len - m2->m_pkthdr.len); + uma_zfree(V_pf_frent_z, frent); m_cat(m, m2); }