Date: Wed, 24 Jan 2024 18:09:09 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: f1c0030bb05c - main - pf: only check MTU for IPv6 packets when forwarding Message-ID: <202401241809.40OI9908038211@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=f1c0030bb05cfa01bdd500e50befbb425fecc4c4 commit f1c0030bb05cfa01bdd500e50befbb425fecc4c4 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2024-01-24 16:34:01 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2024-01-24 18:08:29 +0000 pf: only check MTU for IPv6 packets when forwarding When the packets are generated locally (i.e. PFIL_FWD is not set) we might generate overly large packets and rely on the NIC to fragment it for us. In that case we'd reject a valid packet. Reported by: Herbert J. Skuhra <herbert@gojira.at> Tested by: Herbert J. Skuhra <herbert@gojira.at> Fixes: 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 38a5a45d7991..2dc6d02d330a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * confused and fail to send the icmp6 packet too big error. Just send * it here, before we do any NAT. */ - if (dir == PF_OUT && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { + if (dir == PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { PF_RULES_RUNLOCK(); *m0 = NULL; icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp));
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202401241809.40OI9908038211>