svn commit: r231208 - stable/8/sys/netinet/ipfw

[Bjoern A. Zeeb]

Author: bz
Date: Wed Feb  8 16:03:05 2012
New Revision: 231208
URL: http://svn.freebsd.org/changeset/base/231208

Log:
  MFC r225032,225034:
  
   ipfw internally checks for offset == 0 to determine whether the
   packet is a/the first fragment or not.  For IPv6 we have added the
   "more fragments" flag as well to be able to determine on whether
   there will be more as we do not have the fragment header avaialble
   for logging, while for IPv4 this information can be derived directly
   from the IPv4 header.  This allowed fragmented packets to bypass
   normal rules as proper masking was not done when checking offset.
   Split variables to not need masking for IPv6 to avoid further errors.
  
   After r225032 fix logging in a similar way masking the the IPv6
   more fragments flag off so that offset == 0 checks work properly.
  
   Submitted by:	Matthew Luckie (mjl luckie.org.nz)
  PR:		kern/145733

Modified:
  stable/8/sys/netinet/ipfw/ip_fw2.c
  stable/8/sys/netinet/ipfw/ip_fw_log.c
Directory Properties:
  stable/8/sys/   (props changed)

Modified: stable/8/sys/netinet/ipfw/ip_fw2.c
==============================================================================
--- stable/8/sys/netinet/ipfw/ip_fw2.c	Wed Feb  8 15:38:36 2012	(r231207)
+++ stable/8/sys/netinet/ipfw/ip_fw2.c	Wed Feb  8 16:03:05 2012	(r231208)
@@ -844,17 +844,14 @@ ipfw_chk(struct ip_fw_args *args)
 	 *	we have a fragment at this offset of an IPv4 packet.
 	 *	offset == 0 means that (if this is an IPv4 packet)
 	 *	this is the first or only fragment.
-	 *	For IPv6 offset == 0 means there is no Fragment Header or there
-	 *	is a single packet fragement (fragement header added without
-	 *	needed).  We will treat a single packet fragment as if there
-	 *	was no fragment header (or log/block depending on the
+	 *	For IPv6 offset|ip6f_mf == 0 means there is no Fragment Header
+	 *	or there is a single packet fragement (fragement header added
+	 *	without needed).  We will treat a single packet fragment as if
+	 *	there was no fragment header (or log/block depending on the
 	 *	V_fw_permit_single_frag6 sysctl setting).
-	 *	If offset != 0 for IPv6 always use correct mask to
-	 *	get the correct offset because we add IP6F_MORE_FRAG to be able
-	 *	to dectect the first of multiple fragments which would
-	 *	otherwise have offset = 0.
 	 */
 	u_short offset = 0;
+	u_short ip6f_mf = 0;
 
 	/*
 	 * Local copies of addresses. They are only valid if we have
@@ -1013,12 +1010,10 @@ do {								\
 				proto = ((struct ip6_frag *)ulp)->ip6f_nxt;
 				offset = ((struct ip6_frag *)ulp)->ip6f_offlg &
 					IP6F_OFF_MASK;
-				/* Add IP6F_MORE_FRAG for offset of first
-				 * fragment to be != 0 if there shall be more. */
-				offset |= ((struct ip6_frag *)ulp)->ip6f_offlg &
+				ip6f_mf = ((struct ip6_frag *)ulp)->ip6f_offlg &
 					IP6F_MORE_FRAG;
 				if (V_fw_permit_single_frag6 == 0 &&
-				    offset == 0) {
+				    offset == 0 && ip6f_mf == 0) {
 					printf("IPFW2: IPV6 - Invalid Fragment "
 					    "Header\n");
 					if (V_fw_deny_unknown_exthdrs)
@@ -1666,7 +1661,7 @@ do {								\
 
 			case O_LOG:
 				ipfw_log(f, hlen, args, m,
-					    oif, offset, tablearg, ip);
+				    oif, offset | ip6f_mf, tablearg, ip);
 				match = 1;
 				break;
 

Modified: stable/8/sys/netinet/ipfw/ip_fw_log.c
==============================================================================
--- stable/8/sys/netinet/ipfw/ip_fw_log.c	Wed Feb  8 15:38:36 2012	(r231207)
+++ stable/8/sys/netinet/ipfw/ip_fw_log.c	Wed Feb  8 16:03:05 2012	(r231208)
@@ -328,10 +328,14 @@ ipfw_log(struct ip_fw *f, u_int hlen, st
 #ifdef INET6
 		struct ip6_hdr *ip6 = NULL;
 		struct icmp6_hdr *icmp6;
+		u_short ip6f_mf;
 #endif
 		src[0] = '\0';
 		dst[0] = '\0';
 #ifdef INET6
+		ip6f_mf = offset & IP6F_MORE_FRAG;
+		offset &= IP6F_OFF_MASK;
+
 		if (IS_IP6_FLOW_ID(&(args->f_id))) {
 			char ip6buf[INET6_ADDRSTRLEN];
 			snprintf(src, sizeof(src), "[%s]",
@@ -413,8 +417,7 @@ ipfw_log(struct ip_fw *f, u_int hlen, st
 				    " (frag %08x:%d@%d%s)",
 				    args->f_id.extra,
 				    ntohs(ip6->ip6_plen) - hlen,
-				    ntohs(offset & IP6F_OFF_MASK) << 3,
-				    (offset & IP6F_MORE_FRAG) ? "+" : "");
+				    ntohs(offset) << 3, ip6f_mf ? "+" : "");
 		} else
 #endif
 		{