From owner-svn-src-all@freebsd.org Mon Mar 12 16:58:57 2018 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 469C9F2B873; Mon, 12 Mar 2018 16:58:57 +0000 (UTC) (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net) Received: from pdx.rh.CN85.dnsmgr.net (br1.CN84in.dnsmgr.net [69.59.192.140]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 964A485C81; Mon, 12 Mar 2018 16:58:56 +0000 (UTC) (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net) Received: from pdx.rh.CN85.dnsmgr.net (localhost [127.0.0.1]) by pdx.rh.CN85.dnsmgr.net (8.13.3/8.13.3) with ESMTP id w2CGws7m079444; Mon, 12 Mar 2018 09:58:54 -0700 (PDT) (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net) Received: (from freebsd@localhost) by pdx.rh.CN85.dnsmgr.net (8.13.3/8.13.3/Submit) id w2CGwsmx079443; Mon, 12 Mar 2018 09:58:54 -0700 (PDT) (envelope-from freebsd) From: "Rodney W. Grimes" Message-Id: <201803121658.w2CGwsmx079443@pdx.rh.CN85.dnsmgr.net> Subject: Re: svn commit: r330792 - in head: sbin/ipfw sys/netpfil/ipfw In-Reply-To: <201803120940.w2C9ekns070289@repo.freebsd.org> To: "Andrey V. Elsukov" Date: Mon, 12 Mar 2018 09:58:54 -0700 (PDT) CC: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Reply-To: rgrimes@freebsd.org X-Mailer: ELM [version 2.4ME+ PL121h (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Mar 2018 16:58:57 -0000 > Author: ae > Date: Mon Mar 12 09:40:46 2018 > New Revision: 330792 > URL: https://svnweb.freebsd.org/changeset/base/330792 > > Log: > Do not try to reassemble IPv6 fragments in "reass" rule. > > ip_reass() expects IPv4 packet and will just corrupt any IPv6 packets > that it gets. Until proper IPv6 fragments handling function will be > implemented, pass IPv6 packets to next rule. Thank you! This should simplify some discussion occuring about /etc/rc.firewall in workstation mode and the fact it does not handly fragmentation correctly, part of fixing that invovled be sure to only pass ipv4 to a reass rule, with this fix that shall no longer be necessary. https://reviews.freebsd.org/D9920 > PR: 170604 > MFC after: 1 week > > Modified: > head/sbin/ipfw/ipfw.8 > head/sys/netpfil/ipfw/ip_fw2.c > > Modified: head/sbin/ipfw/ipfw.8 > ============================================================================== > --- head/sbin/ipfw/ipfw.8 Mon Mar 12 05:41:27 2018 (r330791) > +++ head/sbin/ipfw/ipfw.8 Mon Mar 12 09:40:46 2018 (r330792) > @@ -1,7 +1,7 @@ > .\" > .\" $FreeBSD$ > .\" > -.Dd November 26, 2017 > +.Dd March 12, 2018 > .Dt IPFW 8 > .Os > .Sh NAME > @@ -1135,7 +1135,7 @@ Regardless of matched a packet or not by the > .Cm tcp-setmss > rule, the search continues with the next rule. > .It Cm reass > -Queue and reassemble IP fragments. > +Queue and reassemble IPv4 fragments. > If the packet is not fragmented, counters are updated and > processing continues with the next rule. > If the packet is the last logical fragment, the packet is reassembled and, if > > Modified: head/sys/netpfil/ipfw/ip_fw2.c > ============================================================================== > --- head/sys/netpfil/ipfw/ip_fw2.c Mon Mar 12 05:41:27 2018 (r330791) > +++ head/sys/netpfil/ipfw/ip_fw2.c Mon Mar 12 09:40:46 2018 (r330792) > @@ -3018,8 +3018,10 @@ do { \ > case O_REASS: { > int ip_off; > > - IPFW_INC_RULE_COUNTER(f, pktlen); > l = 0; /* in any case exit inner loop */ > + if (is_ipv6) /* IPv6 is not supported yet */ > + break; > + IPFW_INC_RULE_COUNTER(f, pktlen); > ip_off = ntohs(ip->ip_off); > > /* if not fragmented, go to next rule */ > > -- Rod Grimes rgrimes@freebsd.org