Date: Sat, 26 Jun 2021 08:58:47 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 47535a9065ac - stable/12 - pf: store L4 headers in pf_pdesc Message-ID: <202106260858.15Q8wlUj028764@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=47535a9065aceab49c8d0cdf50673b90c8da1df1 commit 47535a9065aceab49c8d0cdf50673b90c8da1df1 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2021-06-04 08:52:07 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2021-06-26 08:55:21 +0000 pf: store L4 headers in pf_pdesc Rather than pointers to the headers store full copies. This brings us slightly closer to what OpenBSD does, and also makes more sense than storing pointers to stack variable copies of the headers. Reviewed by: donner, scottl MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30719 (cherry picked from commit d38630f6192a40934912fbffc52c9650776c2b53) --- sys/net/pfvar.h | 19 +++-- sys/netpfil/pf/pf.c | 182 +++++++++++++++++++++-------------------------- sys/netpfil/pf/pf_lb.c | 2 +- sys/netpfil/pf/pf_norm.c | 2 +- 4 files changed, 95 insertions(+), 110 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index eb63af9d47d3..7e16e40ccc45 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -50,6 +50,13 @@ #include <net/radix.h> #include <netinet/in.h> +#ifdef _KERNEL +#include <netinet/ip.h> +#include <netinet/tcp.h> +#include <netinet/udp.h> +#include <netinet/ip_icmp.h> +#include <netinet/icmp6.h> +#endif #include <netpfil/pf/pf.h> #include <netpfil/pf/pf_altq.h> @@ -904,14 +911,14 @@ struct pf_pdesc { gid_t gid; } lookup; u_int64_t tot_len; /* Make Mickey money */ - union { - struct tcphdr *tcp; - struct udphdr *udp; - struct icmp *icmp; + union pf_headers { + struct tcphdr tcp; + struct udphdr udp; + struct icmp icmp; #ifdef INET6 - struct icmp6_hdr *icmp6; + struct icmp6_hdr icmp6; #endif /* INET6 */ - void *any; + char any[0]; } hdr; struct pf_krule *nat_rule; /* nat/rdr rule applied to packet */ diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 9eb8c2f54c42..57bbd355e2fb 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -3115,17 +3115,13 @@ pf_socket_lookup(int direction, struct pf_pdesc *pd, struct mbuf *m) switch (pd->proto) { case IPPROTO_TCP: - if (pd->hdr.tcp == NULL) - return (-1); - sport = pd->hdr.tcp->th_sport; - dport = pd->hdr.tcp->th_dport; + sport = pd->hdr.tcp.th_sport; + dport = pd->hdr.tcp.th_dport; pi = &V_tcbinfo; break; case IPPROTO_UDP: - if (pd->hdr.udp == NULL) - return (-1); - sport = pd->hdr.udp->uh_sport; - dport = pd->hdr.udp->uh_dport; + sport = pd->hdr.udp.uh_sport; + dport = pd->hdr.udp.uh_dport; pi = &V_udbinfo; break; default: @@ -3314,8 +3310,8 @@ pf_tcp_iss(struct pf_pdesc *pd) ctx = V_pf_tcp_secret_ctx; - MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short)); - MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short)); + MD5Update(&ctx, (char *)&pd->hdr.tcp.th_sport, sizeof(u_short)); + MD5Update(&ctx, (char *)&pd->hdr.tcp.th_dport, sizeof(u_short)); if (pd->af == AF_INET6) { MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr)); MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr)); @@ -3343,7 +3339,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction, struct pf_krule *r, *a = NULL; struct pf_kruleset *ruleset = NULL; struct pf_ksrc_node *nsn = NULL; - struct tcphdr *th = pd->hdr.tcp; + struct tcphdr *th = &pd->hdr.tcp; struct pf_state_key *sk = NULL, *nk = NULL; u_short reason; int rewrite = 0, hdrlen = 0; @@ -3372,18 +3368,18 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction, hdrlen = sizeof(*th); break; case IPPROTO_UDP: - sport = pd->hdr.udp->uh_sport; - dport = pd->hdr.udp->uh_dport; - hdrlen = sizeof(*pd->hdr.udp); + sport = pd->hdr.udp.uh_sport; + dport = pd->hdr.udp.uh_dport; + hdrlen = sizeof(pd->hdr.udp); break; #ifdef INET case IPPROTO_ICMP: if (pd->af != AF_INET) break; - sport = dport = pd->hdr.icmp->icmp_id; - hdrlen = sizeof(*pd->hdr.icmp); - icmptype = pd->hdr.icmp->icmp_type; - icmpcode = pd->hdr.icmp->icmp_code; + sport = dport = pd->hdr.icmp.icmp_id; + hdrlen = sizeof(pd->hdr.icmp); + icmptype = pd->hdr.icmp.icmp_type; + icmpcode = pd->hdr.icmp.icmp_code; if (icmptype == ICMP_UNREACH || icmptype == ICMP_SOURCEQUENCH || @@ -3397,10 +3393,10 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction, case IPPROTO_ICMPV6: if (af != AF_INET6) break; - sport = dport = pd->hdr.icmp6->icmp6_id; - hdrlen = sizeof(*pd->hdr.icmp6); - icmptype = pd->hdr.icmp6->icmp6_type; - icmpcode = pd->hdr.icmp6->icmp6_code; + sport = dport = pd->hdr.icmp6.icmp6_id; + hdrlen = sizeof(pd->hdr.icmp6); + icmptype = pd->hdr.icmp6.icmp6_type; + icmpcode = pd->hdr.icmp6.icmp6_code; if (icmptype == ICMP6_DST_UNREACH || icmptype == ICMP6_PACKET_TOO_BIG || @@ -3450,27 +3446,27 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction, rewrite++; break; case IPPROTO_UDP: - bproto_sum = pd->hdr.udp->uh_sum; - pd->proto_sum = &pd->hdr.udp->uh_sum; + bproto_sum = pd->hdr.udp.uh_sum; + pd->proto_sum = &pd->hdr.udp.uh_sum; if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) || nk->port[pd->sidx] != sport) { - pf_change_ap(m, saddr, &pd->hdr.udp->uh_sport, - pd->ip_sum, &pd->hdr.udp->uh_sum, + pf_change_ap(m, saddr, &pd->hdr.udp.uh_sport, + pd->ip_sum, &pd->hdr.udp.uh_sum, &nk->addr[pd->sidx], nk->port[pd->sidx], 1, af); - sport = pd->hdr.udp->uh_sport; - pd->sport = &pd->hdr.udp->uh_sport; + sport = pd->hdr.udp.uh_sport; + pd->sport = &pd->hdr.udp.uh_sport; } if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) || nk->port[pd->didx] != dport) { - pf_change_ap(m, daddr, &pd->hdr.udp->uh_dport, - pd->ip_sum, &pd->hdr.udp->uh_sum, + pf_change_ap(m, daddr, &pd->hdr.udp.uh_dport, + pd->ip_sum, &pd->hdr.udp.uh_sum, &nk->addr[pd->didx], nk->port[pd->didx], 1, af); - dport = pd->hdr.udp->uh_dport; - pd->dport = &pd->hdr.udp->uh_dport; + dport = pd->hdr.udp.uh_dport; + pd->dport = &pd->hdr.udp.uh_dport; } rewrite++; break; @@ -3485,25 +3481,25 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction, pf_change_a(&daddr->v4.s_addr, pd->ip_sum, nk->addr[pd->didx].v4.s_addr, 0); - if (nk->port[1] != pd->hdr.icmp->icmp_id) { - pd->hdr.icmp->icmp_cksum = pf_cksum_fixup( - pd->hdr.icmp->icmp_cksum, sport, + if (nk->port[1] != pd->hdr.icmp.icmp_id) { + pd->hdr.icmp.icmp_cksum = pf_cksum_fixup( + pd->hdr.icmp.icmp_cksum, sport, nk->port[1], 0); - pd->hdr.icmp->icmp_id = nk->port[1]; - pd->sport = &pd->hdr.icmp->icmp_id; + pd->hdr.icmp.icmp_id = nk->port[1]; + pd->sport = &pd->hdr.icmp.icmp_id; } - m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp); + m_copyback(m, off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp); break; #endif /* INET */ #ifdef INET6 case IPPROTO_ICMPV6: nk->port[0] = nk->port[1]; if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET6)) - pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum, + pf_change_a6(saddr, &pd->hdr.icmp6.icmp6_cksum, &nk->addr[pd->sidx], 0); if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET6)) - pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum, + pf_change_a6(daddr, &pd->hdr.icmp6.icmp6_cksum, &nk->addr[pd->didx], 0); rewrite++; break; @@ -3714,7 +3710,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, { struct pf_state *s = NULL; struct pf_ksrc_node *sn = NULL; - struct tcphdr *th = pd->hdr.tcp; + struct tcphdr *th = &pd->hdr.tcp; u_int16_t mss = V_tcp_mssdflt; u_short reason; @@ -4066,7 +4062,7 @@ pf_tcp_track_full(struct pf_state_peer *src, struct pf_state_peer *dst, struct pf_state **state, struct pfi_kkif *kif, struct mbuf *m, int off, struct pf_pdesc *pd, u_short *reason, int *copyback) { - struct tcphdr *th = pd->hdr.tcp; + struct tcphdr *th = &pd->hdr.tcp; u_int16_t win = ntohs(th->th_win); u_int32_t ack, end, seq, orig_seq; u_int8_t sws, dws; @@ -4395,7 +4391,7 @@ static int pf_tcp_track_sloppy(struct pf_state_peer *src, struct pf_state_peer *dst, struct pf_state **state, struct pf_pdesc *pd, u_short *reason) { - struct tcphdr *th = pd->hdr.tcp; + struct tcphdr *th = &pd->hdr.tcp; if (th->th_flags & TH_SYN) if (src->state < TCPS_SYN_SENT) @@ -4468,7 +4464,7 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kkif *kif, u_short *reason) { struct pf_state_key_cmp key; - struct tcphdr *th = pd->hdr.tcp; + struct tcphdr *th = &pd->hdr.tcp; int copyback = 0; struct pf_state_peer *src, *dst; struct pf_state_key *sk; @@ -4636,7 +4632,7 @@ pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kkif *kif, { struct pf_state_peer *src, *dst; struct pf_state_key_cmp key; - struct udphdr *uh = pd->hdr.udp; + struct udphdr *uh = &pd->hdr.udp; bzero(&key, sizeof(key)); key.af = pd->af; @@ -4711,10 +4707,10 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, switch (pd->proto) { #ifdef INET case IPPROTO_ICMP: - icmptype = pd->hdr.icmp->icmp_type; - icmpcode = pd->hdr.icmp->icmp_code; - icmpid = pd->hdr.icmp->icmp_id; - icmpsum = &pd->hdr.icmp->icmp_cksum; + icmptype = pd->hdr.icmp.icmp_type; + icmpcode = pd->hdr.icmp.icmp_code; + icmpid = pd->hdr.icmp.icmp_id; + icmpsum = &pd->hdr.icmp.icmp_cksum; if (icmptype == ICMP_UNREACH || icmptype == ICMP_SOURCEQUENCH || @@ -4726,10 +4722,10 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, #endif /* INET */ #ifdef INET6 case IPPROTO_ICMPV6: - icmptype = pd->hdr.icmp6->icmp6_type; - icmpcode = pd->hdr.icmp6->icmp6_code; - icmpid = pd->hdr.icmp6->icmp6_id; - icmpsum = &pd->hdr.icmp6->icmp6_cksum; + icmptype = pd->hdr.icmp6.icmp6_type; + icmpcode = pd->hdr.icmp6.icmp6_code; + icmpid = pd->hdr.icmp6.icmp6_id; + icmpsum = &pd->hdr.icmp6.icmp6_cksum; if (icmptype == ICMP6_DST_UNREACH || icmptype == ICMP6_PACKET_TOO_BIG || @@ -4782,17 +4778,17 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, nk->addr[pd->didx].v4.s_addr, 0); if (nk->port[0] != - pd->hdr.icmp->icmp_id) { - pd->hdr.icmp->icmp_cksum = + pd->hdr.icmp.icmp_id) { + pd->hdr.icmp.icmp_cksum = pf_cksum_fixup( - pd->hdr.icmp->icmp_cksum, icmpid, + pd->hdr.icmp.icmp_cksum, icmpid, nk->port[pd->sidx], 0); - pd->hdr.icmp->icmp_id = + pd->hdr.icmp.icmp_id = nk->port[pd->sidx]; } m_copyback(m, off, ICMP_MINLEN, - (caddr_t )pd->hdr.icmp); + (caddr_t )&pd->hdr.icmp); break; #endif /* INET */ #ifdef INET6 @@ -4800,17 +4796,17 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET6)) pf_change_a6(saddr, - &pd->hdr.icmp6->icmp6_cksum, + &pd->hdr.icmp6.icmp6_cksum, &nk->addr[pd->sidx], 0); if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET6)) pf_change_a6(daddr, - &pd->hdr.icmp6->icmp6_cksum, + &pd->hdr.icmp6.icmp6_cksum, &nk->addr[pd->didx], 0); m_copyback(m, off, sizeof(struct icmp6_hdr), - (caddr_t )pd->hdr.icmp6); + (caddr_t )&pd->hdr.icmp6); break; #endif /* INET6 */ } @@ -5053,7 +5049,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, #ifdef INET case AF_INET: m_copyback(m, off, ICMP_MINLEN, - (caddr_t )pd->hdr.icmp); + (caddr_t )&pd->hdr.icmp); m_copyback(m, ipoff2, sizeof(h2), (caddr_t )&h2); break; @@ -5062,7 +5058,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, case AF_INET6: m_copyback(m, off, sizeof(struct icmp6_hdr), - (caddr_t )pd->hdr.icmp6); + (caddr_t )&pd->hdr.icmp6); m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t )&h2_6); break; @@ -5122,7 +5118,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, #ifdef INET case AF_INET: m_copyback(m, off, ICMP_MINLEN, - (caddr_t )pd->hdr.icmp); + (caddr_t )&pd->hdr.icmp); m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2); break; #endif /* INET */ @@ -5130,7 +5126,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, case AF_INET6: m_copyback(m, off, sizeof(struct icmp6_hdr), - (caddr_t )pd->hdr.icmp6); + (caddr_t )&pd->hdr.icmp6); m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t )&h2_6); break; @@ -5185,7 +5181,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, pd2.ip_sum, icmpsum, pd->ip_sum, 0, AF_INET); - m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp); + m_copyback(m, off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp); m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2); m_copyback(m, off2, ICMP_MINLEN, (caddr_t)&iih); } @@ -5238,7 +5234,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, pd->ip_sum, 0, AF_INET6); m_copyback(m, off, sizeof(struct icmp6_hdr), - (caddr_t)pd->hdr.icmp6); + (caddr_t)&pd->hdr.icmp6); m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6); m_copyback(m, off2, sizeof(struct icmp6_hdr), (caddr_t)&iih); @@ -5280,7 +5276,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, #ifdef INET case AF_INET: m_copyback(m, off, ICMP_MINLEN, - (caddr_t)pd->hdr.icmp); + (caddr_t)&pd->hdr.icmp); m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2); break; #endif /* INET */ @@ -5288,7 +5284,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif, case AF_INET6: m_copyback(m, off, sizeof(struct icmp6_hdr), - (caddr_t )pd->hdr.icmp6); + (caddr_t )&pd->hdr.icmp6); m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t )&h2_6); break; @@ -6117,16 +6113,13 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * switch (h->ip_p) { case IPPROTO_TCP: { - struct tcphdr th; - - pd.hdr.tcp = &th; - if (!pf_pull_hdr(m, off, &th, sizeof(th), + if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp), &action, &reason, AF_INET)) { log = action != PF_PASS; goto done; } - pd.p_len = pd.tot_len - off - (th.th_off << 2); - if ((th.th_flags & TH_ACK) && pd.p_len == 0) + pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2); + if ((pd.hdr.tcp.th_flags & TH_ACK) && pd.p_len == 0) pqid = 1; action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); if (action == PF_DROP) @@ -6146,17 +6139,14 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * } case IPPROTO_UDP: { - struct udphdr uh; - - pd.hdr.udp = &uh; - if (!pf_pull_hdr(m, off, &uh, sizeof(uh), + if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp), &action, &reason, AF_INET)) { log = action != PF_PASS; goto done; } - if (uh.uh_dport == 0 || - ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || - ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { + if (pd.hdr.udp.uh_dport == 0 || + ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off || + ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) { action = PF_DROP; REASON_SET(&reason, PFRES_SHORT); goto done; @@ -6175,10 +6165,7 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * } case IPPROTO_ICMP: { - struct icmp ih; - - pd.hdr.icmp = &ih; - if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN, + if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN, &action, &reason, AF_INET)) { log = action != PF_PASS; goto done; @@ -6568,15 +6555,12 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb switch (pd.proto) { case IPPROTO_TCP: { - struct tcphdr th; - - pd.hdr.tcp = &th; - if (!pf_pull_hdr(m, off, &th, sizeof(th), + if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp), &action, &reason, AF_INET6)) { log = action != PF_PASS; goto done; } - pd.p_len = pd.tot_len - off - (th.th_off << 2); + pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2); action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); if (action == PF_DROP) goto done; @@ -6595,17 +6579,14 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb } case IPPROTO_UDP: { - struct udphdr uh; - - pd.hdr.udp = &uh; - if (!pf_pull_hdr(m, off, &uh, sizeof(uh), + if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp), &action, &reason, AF_INET6)) { log = action != PF_PASS; goto done; } - if (uh.uh_dport == 0 || - ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || - ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { + if (pd.hdr.udp.uh_dport == 0 || + ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off || + ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) { action = PF_DROP; REASON_SET(&reason, PFRES_SHORT); goto done; @@ -6631,10 +6612,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb } case IPPROTO_ICMPV6: { - struct icmp6_hdr ih; - - pd.hdr.icmp6 = &ih; - if (!pf_pull_hdr(m, off, &ih, sizeof(ih), + if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6), &action, &reason, AF_INET6)) { log = action != PF_PASS; goto done; diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c index d8f8ae00fb8a..8160166edc95 100644 --- a/sys/netpfil/pf/pf_lb.c +++ b/sys/netpfil/pf/pf_lb.c @@ -182,7 +182,7 @@ pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off, r = TAILQ_NEXT(r, entries); else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto != IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m, - off, pd->hdr.tcp), r->os_fingerprint))) + off, &pd->hdr.tcp), r->os_fingerprint))) r = TAILQ_NEXT(r, entries); else { if (r->tag) diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index 8f970b68373b..b6e7fd5f1e1c 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -1346,7 +1346,7 @@ pf_normalize_tcp(int dir, struct pfi_kkif *kif, struct mbuf *m, int ipoff, int off, void *h, struct pf_pdesc *pd) { struct pf_krule *r, *rm = NULL; - struct tcphdr *th = pd->hdr.tcp; + struct tcphdr *th = &pd->hdr.tcp; int rewrite = 0; u_short reason; u_int8_t flags;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202106260858.15Q8wlUj028764>