From owner-freebsd-pf@FreeBSD.ORG  Mon Jun  4 10:30:19 2012
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 18A2F1065673
	for <freebsd-pf@hub.freebsd.org>; Mon,  4 Jun 2012 10:30:19 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 02C958FC17
	for <freebsd-pf@hub.freebsd.org>; Mon,  4 Jun 2012 10:30:19 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q54AUIRo024480
	for <freebsd-pf@freefall.freebsd.org>; Mon, 4 Jun 2012 10:30:18 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q54AUIvC024477;
	Mon, 4 Jun 2012 10:30:18 GMT (envelope-from gnats)
Date: Mon, 4 Jun 2012 10:30:18 GMT
Message-Id: <201206041030.q54AUIvC024477@freefall.freebsd.org>
To: freebsd-pf@FreeBSD.org
From: Daniel Hartmeier <daniel@benzedrine.cx>
Cc: 
Subject: Re: kern/168190: [pf] panic when using pf and route-to (maybe: bad
	fragment handling?)
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Daniel Hartmeier <daniel@benzedrine.cx>
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Jun 2012 10:30:19 -0000

The following reply was made to PR kern/168190; it has been noted by GNATS.

From: Daniel Hartmeier <daniel@benzedrine.cx>
To: Joerg Pulz <Joerg.Pulz@frm2.tum.de>
Cc: bug-followup@freebsd.org, freebsd-pf@freebsd.org
Subject: Re: kern/168190: [pf] panic when using pf and route-to (maybe: bad fragment handling?)
Date: Mon, 4 Jun 2012 12:25:44 +0200

 Here's a patch that directly tests this theory.
 
 If correct, it will replace the panics with simple log messages that
 show when ipfilter left an m_len==0 mbuf.
 
 Daniel
 
 Index: sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
 ===================================================================
 RCS file: /home/ncvs/src/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c,v
 retrieving revision 1.20.4.1
 diff -u -r1.20.4.1 ip_fil_freebsd.c
 --- sys/contrib/ipfilter/netinet/ip_fil_freebsd.c       23 Sep 2011 00:51:37 -0000      1.20.4.1
 +++ sys/contrib/ipfilter/netinet/ip_fil_freebsd.c       4 Jun 2012 10:19:04 -0000
 @@ -182,8 +182,18 @@
  static int
  fr_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
  {
 +       int r;
 +
         struct ip *ip = mtod(*mp, struct ip *);
 -       return fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
 +       ASSERT_HOST_BYTE_ORDER(*mp);
 +       r = fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
 +       if (*mp != NULL && (*mp)->m_pkthdr.len >= sizeof(struct ip) &&
 +           (*mp)->m_len < sizeof(struct ip)) {
 +               printf("fr_check_wrapper: m_len %d fixed\n",
 +                   (int)(*mp)->m_len);
 +               *mp = m_pullup(*mp, sizeof(struct ip));
 +       }
 +       return r;
  }
 
  # ifdef USE_INET6