git: f1c0030bb05c - main - pf: only check MTU for IPv6 packets when forwarding

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=f1c0030bb05cfa01bdd500e50befbb425fecc4c4

commit f1c0030bb05cfa01bdd500e50befbb425fecc4c4
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-01-24 16:34:01 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-01-24 18:08:29 +0000

    pf: only check MTU for IPv6 packets when forwarding
    
    When the packets are generated locally (i.e. PFIL_FWD is not set) we
    might generate overly large packets and rely on the NIC to fragment it
    for us. In that case we'd reject a valid packet.
    
    Reported by:    Herbert J. Skuhra <herbert@gojira.at>
    Tested by:      Herbert J. Skuhra <herbert@gojira.at>
    Fixes:          54c62e3e5d8cd90c5571a1d4c8c5f062d580480e
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 38a5a45d7991..2dc6d02d330a 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
 	 * confused and fail to send the icmp6 packet too big error. Just send
 	 * it here, before we do any NAT.
 	 */
-	if (dir == PF_OUT && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) {
+	if (dir == PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) {
 		PF_RULES_RUNLOCK();
 		*m0 = NULL;
 		icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp));