git: 47535a9065ac - stable/12 - pf: store L4 headers in pf_pdesc
Kristof Provost
kp at FreeBSD.org
Sat Jun 26 08:58:49 UTC 2021
The branch stable/12 has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=47535a9065aceab49c8d0cdf50673b90c8da1df1
commit 47535a9065aceab49c8d0cdf50673b90c8da1df1
Author: Kristof Provost <kp at FreeBSD.org>
AuthorDate: 2021-06-04 08:52:07 +0000
Commit: Kristof Provost <kp at FreeBSD.org>
CommitDate: 2021-06-26 08:55:21 +0000
pf: store L4 headers in pf_pdesc
Rather than pointers to the headers store full copies. This brings us
slightly closer to what OpenBSD does, and also makes more sense than
storing pointers to stack variable copies of the headers.
Reviewed by: donner, scottl
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D30719
(cherry picked from commit d38630f6192a40934912fbffc52c9650776c2b53)
---
sys/net/pfvar.h | 19 +++--
sys/netpfil/pf/pf.c | 182 +++++++++++++++++++++--------------------------
sys/netpfil/pf/pf_lb.c | 2 +-
sys/netpfil/pf/pf_norm.c | 2 +-
4 files changed, 95 insertions(+), 110 deletions(-)
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index eb63af9d47d3..7e16e40ccc45 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -50,6 +50,13 @@
#include <net/radix.h>
#include <netinet/in.h>
+#ifdef _KERNEL
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+#include <netinet/ip_icmp.h>
+#include <netinet/icmp6.h>
+#endif
#include <netpfil/pf/pf.h>
#include <netpfil/pf/pf_altq.h>
@@ -904,14 +911,14 @@ struct pf_pdesc {
gid_t gid;
} lookup;
u_int64_t tot_len; /* Make Mickey money */
- union {
- struct tcphdr *tcp;
- struct udphdr *udp;
- struct icmp *icmp;
+ union pf_headers {
+ struct tcphdr tcp;
+ struct udphdr udp;
+ struct icmp icmp;
#ifdef INET6
- struct icmp6_hdr *icmp6;
+ struct icmp6_hdr icmp6;
#endif /* INET6 */
- void *any;
+ char any[0];
} hdr;
struct pf_krule *nat_rule; /* nat/rdr rule applied to packet */
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 9eb8c2f54c42..57bbd355e2fb 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -3115,17 +3115,13 @@ pf_socket_lookup(int direction, struct pf_pdesc *pd, struct mbuf *m)
switch (pd->proto) {
case IPPROTO_TCP:
- if (pd->hdr.tcp == NULL)
- return (-1);
- sport = pd->hdr.tcp->th_sport;
- dport = pd->hdr.tcp->th_dport;
+ sport = pd->hdr.tcp.th_sport;
+ dport = pd->hdr.tcp.th_dport;
pi = &V_tcbinfo;
break;
case IPPROTO_UDP:
- if (pd->hdr.udp == NULL)
- return (-1);
- sport = pd->hdr.udp->uh_sport;
- dport = pd->hdr.udp->uh_dport;
+ sport = pd->hdr.udp.uh_sport;
+ dport = pd->hdr.udp.uh_dport;
pi = &V_udbinfo;
break;
default:
@@ -3314,8 +3310,8 @@ pf_tcp_iss(struct pf_pdesc *pd)
ctx = V_pf_tcp_secret_ctx;
- MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short));
- MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short));
+ MD5Update(&ctx, (char *)&pd->hdr.tcp.th_sport, sizeof(u_short));
+ MD5Update(&ctx, (char *)&pd->hdr.tcp.th_dport, sizeof(u_short));
if (pd->af == AF_INET6) {
MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr));
MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr));
@@ -3343,7 +3339,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction,
struct pf_krule *r, *a = NULL;
struct pf_kruleset *ruleset = NULL;
struct pf_ksrc_node *nsn = NULL;
- struct tcphdr *th = pd->hdr.tcp;
+ struct tcphdr *th = &pd->hdr.tcp;
struct pf_state_key *sk = NULL, *nk = NULL;
u_short reason;
int rewrite = 0, hdrlen = 0;
@@ -3372,18 +3368,18 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction,
hdrlen = sizeof(*th);
break;
case IPPROTO_UDP:
- sport = pd->hdr.udp->uh_sport;
- dport = pd->hdr.udp->uh_dport;
- hdrlen = sizeof(*pd->hdr.udp);
+ sport = pd->hdr.udp.uh_sport;
+ dport = pd->hdr.udp.uh_dport;
+ hdrlen = sizeof(pd->hdr.udp);
break;
#ifdef INET
case IPPROTO_ICMP:
if (pd->af != AF_INET)
break;
- sport = dport = pd->hdr.icmp->icmp_id;
- hdrlen = sizeof(*pd->hdr.icmp);
- icmptype = pd->hdr.icmp->icmp_type;
- icmpcode = pd->hdr.icmp->icmp_code;
+ sport = dport = pd->hdr.icmp.icmp_id;
+ hdrlen = sizeof(pd->hdr.icmp);
+ icmptype = pd->hdr.icmp.icmp_type;
+ icmpcode = pd->hdr.icmp.icmp_code;
if (icmptype == ICMP_UNREACH ||
icmptype == ICMP_SOURCEQUENCH ||
@@ -3397,10 +3393,10 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction,
case IPPROTO_ICMPV6:
if (af != AF_INET6)
break;
- sport = dport = pd->hdr.icmp6->icmp6_id;
- hdrlen = sizeof(*pd->hdr.icmp6);
- icmptype = pd->hdr.icmp6->icmp6_type;
- icmpcode = pd->hdr.icmp6->icmp6_code;
+ sport = dport = pd->hdr.icmp6.icmp6_id;
+ hdrlen = sizeof(pd->hdr.icmp6);
+ icmptype = pd->hdr.icmp6.icmp6_type;
+ icmpcode = pd->hdr.icmp6.icmp6_code;
if (icmptype == ICMP6_DST_UNREACH ||
icmptype == ICMP6_PACKET_TOO_BIG ||
@@ -3450,27 +3446,27 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction,
rewrite++;
break;
case IPPROTO_UDP:
- bproto_sum = pd->hdr.udp->uh_sum;
- pd->proto_sum = &pd->hdr.udp->uh_sum;
+ bproto_sum = pd->hdr.udp.uh_sum;
+ pd->proto_sum = &pd->hdr.udp.uh_sum;
if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) ||
nk->port[pd->sidx] != sport) {
- pf_change_ap(m, saddr, &pd->hdr.udp->uh_sport,
- pd->ip_sum, &pd->hdr.udp->uh_sum,
+ pf_change_ap(m, saddr, &pd->hdr.udp.uh_sport,
+ pd->ip_sum, &pd->hdr.udp.uh_sum,
&nk->addr[pd->sidx],
nk->port[pd->sidx], 1, af);
- sport = pd->hdr.udp->uh_sport;
- pd->sport = &pd->hdr.udp->uh_sport;
+ sport = pd->hdr.udp.uh_sport;
+ pd->sport = &pd->hdr.udp.uh_sport;
}
if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) ||
nk->port[pd->didx] != dport) {
- pf_change_ap(m, daddr, &pd->hdr.udp->uh_dport,
- pd->ip_sum, &pd->hdr.udp->uh_sum,
+ pf_change_ap(m, daddr, &pd->hdr.udp.uh_dport,
+ pd->ip_sum, &pd->hdr.udp.uh_sum,
&nk->addr[pd->didx],
nk->port[pd->didx], 1, af);
- dport = pd->hdr.udp->uh_dport;
- pd->dport = &pd->hdr.udp->uh_dport;
+ dport = pd->hdr.udp.uh_dport;
+ pd->dport = &pd->hdr.udp.uh_dport;
}
rewrite++;
break;
@@ -3485,25 +3481,25 @@ pf_test_rule(struct pf_krule **rm, struct pf_state **sm, int direction,
pf_change_a(&daddr->v4.s_addr, pd->ip_sum,
nk->addr[pd->didx].v4.s_addr, 0);
- if (nk->port[1] != pd->hdr.icmp->icmp_id) {
- pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
- pd->hdr.icmp->icmp_cksum, sport,
+ if (nk->port[1] != pd->hdr.icmp.icmp_id) {
+ pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
+ pd->hdr.icmp.icmp_cksum, sport,
nk->port[1], 0);
- pd->hdr.icmp->icmp_id = nk->port[1];
- pd->sport = &pd->hdr.icmp->icmp_id;
+ pd->hdr.icmp.icmp_id = nk->port[1];
+ pd->sport = &pd->hdr.icmp.icmp_id;
}
- m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
+ m_copyback(m, off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
break;
#endif /* INET */
#ifdef INET6
case IPPROTO_ICMPV6:
nk->port[0] = nk->port[1];
if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET6))
- pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum,
+ pf_change_a6(saddr, &pd->hdr.icmp6.icmp6_cksum,
&nk->addr[pd->sidx], 0);
if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET6))
- pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum,
+ pf_change_a6(daddr, &pd->hdr.icmp6.icmp6_cksum,
&nk->addr[pd->didx], 0);
rewrite++;
break;
@@ -3714,7 +3710,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
{
struct pf_state *s = NULL;
struct pf_ksrc_node *sn = NULL;
- struct tcphdr *th = pd->hdr.tcp;
+ struct tcphdr *th = &pd->hdr.tcp;
u_int16_t mss = V_tcp_mssdflt;
u_short reason;
@@ -4066,7 +4062,7 @@ pf_tcp_track_full(struct pf_state_peer *src, struct pf_state_peer *dst,
struct pf_state **state, struct pfi_kkif *kif, struct mbuf *m, int off,
struct pf_pdesc *pd, u_short *reason, int *copyback)
{
- struct tcphdr *th = pd->hdr.tcp;
+ struct tcphdr *th = &pd->hdr.tcp;
u_int16_t win = ntohs(th->th_win);
u_int32_t ack, end, seq, orig_seq;
u_int8_t sws, dws;
@@ -4395,7 +4391,7 @@ static int
pf_tcp_track_sloppy(struct pf_state_peer *src, struct pf_state_peer *dst,
struct pf_state **state, struct pf_pdesc *pd, u_short *reason)
{
- struct tcphdr *th = pd->hdr.tcp;
+ struct tcphdr *th = &pd->hdr.tcp;
if (th->th_flags & TH_SYN)
if (src->state < TCPS_SYN_SENT)
@@ -4468,7 +4464,7 @@ pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kkif *kif,
u_short *reason)
{
struct pf_state_key_cmp key;
- struct tcphdr *th = pd->hdr.tcp;
+ struct tcphdr *th = &pd->hdr.tcp;
int copyback = 0;
struct pf_state_peer *src, *dst;
struct pf_state_key *sk;
@@ -4636,7 +4632,7 @@ pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kkif *kif,
{
struct pf_state_peer *src, *dst;
struct pf_state_key_cmp key;
- struct udphdr *uh = pd->hdr.udp;
+ struct udphdr *uh = &pd->hdr.udp;
bzero(&key, sizeof(key));
key.af = pd->af;
@@ -4711,10 +4707,10 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
switch (pd->proto) {
#ifdef INET
case IPPROTO_ICMP:
- icmptype = pd->hdr.icmp->icmp_type;
- icmpcode = pd->hdr.icmp->icmp_code;
- icmpid = pd->hdr.icmp->icmp_id;
- icmpsum = &pd->hdr.icmp->icmp_cksum;
+ icmptype = pd->hdr.icmp.icmp_type;
+ icmpcode = pd->hdr.icmp.icmp_code;
+ icmpid = pd->hdr.icmp.icmp_id;
+ icmpsum = &pd->hdr.icmp.icmp_cksum;
if (icmptype == ICMP_UNREACH ||
icmptype == ICMP_SOURCEQUENCH ||
@@ -4726,10 +4722,10 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
#endif /* INET */
#ifdef INET6
case IPPROTO_ICMPV6:
- icmptype = pd->hdr.icmp6->icmp6_type;
- icmpcode = pd->hdr.icmp6->icmp6_code;
- icmpid = pd->hdr.icmp6->icmp6_id;
- icmpsum = &pd->hdr.icmp6->icmp6_cksum;
+ icmptype = pd->hdr.icmp6.icmp6_type;
+ icmpcode = pd->hdr.icmp6.icmp6_code;
+ icmpid = pd->hdr.icmp6.icmp6_id;
+ icmpsum = &pd->hdr.icmp6.icmp6_cksum;
if (icmptype == ICMP6_DST_UNREACH ||
icmptype == ICMP6_PACKET_TOO_BIG ||
@@ -4782,17 +4778,17 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
nk->addr[pd->didx].v4.s_addr, 0);
if (nk->port[0] !=
- pd->hdr.icmp->icmp_id) {
- pd->hdr.icmp->icmp_cksum =
+ pd->hdr.icmp.icmp_id) {
+ pd->hdr.icmp.icmp_cksum =
pf_cksum_fixup(
- pd->hdr.icmp->icmp_cksum, icmpid,
+ pd->hdr.icmp.icmp_cksum, icmpid,
nk->port[pd->sidx], 0);
- pd->hdr.icmp->icmp_id =
+ pd->hdr.icmp.icmp_id =
nk->port[pd->sidx];
}
m_copyback(m, off, ICMP_MINLEN,
- (caddr_t )pd->hdr.icmp);
+ (caddr_t )&pd->hdr.icmp);
break;
#endif /* INET */
#ifdef INET6
@@ -4800,17 +4796,17 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
if (PF_ANEQ(pd->src,
&nk->addr[pd->sidx], AF_INET6))
pf_change_a6(saddr,
- &pd->hdr.icmp6->icmp6_cksum,
+ &pd->hdr.icmp6.icmp6_cksum,
&nk->addr[pd->sidx], 0);
if (PF_ANEQ(pd->dst,
&nk->addr[pd->didx], AF_INET6))
pf_change_a6(daddr,
- &pd->hdr.icmp6->icmp6_cksum,
+ &pd->hdr.icmp6.icmp6_cksum,
&nk->addr[pd->didx], 0);
m_copyback(m, off, sizeof(struct icmp6_hdr),
- (caddr_t )pd->hdr.icmp6);
+ (caddr_t )&pd->hdr.icmp6);
break;
#endif /* INET6 */
}
@@ -5053,7 +5049,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
#ifdef INET
case AF_INET:
m_copyback(m, off, ICMP_MINLEN,
- (caddr_t )pd->hdr.icmp);
+ (caddr_t )&pd->hdr.icmp);
m_copyback(m, ipoff2, sizeof(h2),
(caddr_t )&h2);
break;
@@ -5062,7 +5058,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
case AF_INET6:
m_copyback(m, off,
sizeof(struct icmp6_hdr),
- (caddr_t )pd->hdr.icmp6);
+ (caddr_t )&pd->hdr.icmp6);
m_copyback(m, ipoff2, sizeof(h2_6),
(caddr_t )&h2_6);
break;
@@ -5122,7 +5118,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
#ifdef INET
case AF_INET:
m_copyback(m, off, ICMP_MINLEN,
- (caddr_t )pd->hdr.icmp);
+ (caddr_t )&pd->hdr.icmp);
m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
break;
#endif /* INET */
@@ -5130,7 +5126,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
case AF_INET6:
m_copyback(m, off,
sizeof(struct icmp6_hdr),
- (caddr_t )pd->hdr.icmp6);
+ (caddr_t )&pd->hdr.icmp6);
m_copyback(m, ipoff2, sizeof(h2_6),
(caddr_t )&h2_6);
break;
@@ -5185,7 +5181,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
pd2.ip_sum, icmpsum,
pd->ip_sum, 0, AF_INET);
- m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
+ m_copyback(m, off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
m_copyback(m, off2, ICMP_MINLEN, (caddr_t)&iih);
}
@@ -5238,7 +5234,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
pd->ip_sum, 0, AF_INET6);
m_copyback(m, off, sizeof(struct icmp6_hdr),
- (caddr_t)pd->hdr.icmp6);
+ (caddr_t)&pd->hdr.icmp6);
m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6);
m_copyback(m, off2, sizeof(struct icmp6_hdr),
(caddr_t)&iih);
@@ -5280,7 +5276,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
#ifdef INET
case AF_INET:
m_copyback(m, off, ICMP_MINLEN,
- (caddr_t)pd->hdr.icmp);
+ (caddr_t)&pd->hdr.icmp);
m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
break;
#endif /* INET */
@@ -5288,7 +5284,7 @@ pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kkif *kif,
case AF_INET6:
m_copyback(m, off,
sizeof(struct icmp6_hdr),
- (caddr_t )pd->hdr.icmp6);
+ (caddr_t )&pd->hdr.icmp6);
m_copyback(m, ipoff2, sizeof(h2_6),
(caddr_t )&h2_6);
break;
@@ -6117,16 +6113,13 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *
switch (h->ip_p) {
case IPPROTO_TCP: {
- struct tcphdr th;
-
- pd.hdr.tcp = &th;
- if (!pf_pull_hdr(m, off, &th, sizeof(th),
+ if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
&action, &reason, AF_INET)) {
log = action != PF_PASS;
goto done;
}
- pd.p_len = pd.tot_len - off - (th.th_off << 2);
- if ((th.th_flags & TH_ACK) && pd.p_len == 0)
+ pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
+ if ((pd.hdr.tcp.th_flags & TH_ACK) && pd.p_len == 0)
pqid = 1;
action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
if (action == PF_DROP)
@@ -6146,17 +6139,14 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *
}
case IPPROTO_UDP: {
- struct udphdr uh;
-
- pd.hdr.udp = &uh;
- if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
+ if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
&action, &reason, AF_INET)) {
log = action != PF_PASS;
goto done;
}
- if (uh.uh_dport == 0 ||
- ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
- ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
+ if (pd.hdr.udp.uh_dport == 0 ||
+ ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
+ ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
action = PF_DROP;
REASON_SET(&reason, PFRES_SHORT);
goto done;
@@ -6175,10 +6165,7 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *
}
case IPPROTO_ICMP: {
- struct icmp ih;
-
- pd.hdr.icmp = &ih;
- if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN,
+ if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN,
&action, &reason, AF_INET)) {
log = action != PF_PASS;
goto done;
@@ -6568,15 +6555,12 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
switch (pd.proto) {
case IPPROTO_TCP: {
- struct tcphdr th;
-
- pd.hdr.tcp = &th;
- if (!pf_pull_hdr(m, off, &th, sizeof(th),
+ if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
&action, &reason, AF_INET6)) {
log = action != PF_PASS;
goto done;
}
- pd.p_len = pd.tot_len - off - (th.th_off << 2);
+ pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
if (action == PF_DROP)
goto done;
@@ -6595,17 +6579,14 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
}
case IPPROTO_UDP: {
- struct udphdr uh;
-
- pd.hdr.udp = &uh;
- if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
+ if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
&action, &reason, AF_INET6)) {
log = action != PF_PASS;
goto done;
}
- if (uh.uh_dport == 0 ||
- ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
- ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
+ if (pd.hdr.udp.uh_dport == 0 ||
+ ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
+ ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
action = PF_DROP;
REASON_SET(&reason, PFRES_SHORT);
goto done;
@@ -6631,10 +6612,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
}
case IPPROTO_ICMPV6: {
- struct icmp6_hdr ih;
-
- pd.hdr.icmp6 = &ih;
- if (!pf_pull_hdr(m, off, &ih, sizeof(ih),
+ if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6),
&action, &reason, AF_INET6)) {
log = action != PF_PASS;
goto done;
diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c
index d8f8ae00fb8a..8160166edc95 100644
--- a/sys/netpfil/pf/pf_lb.c
+++ b/sys/netpfil/pf/pf_lb.c
@@ -182,7 +182,7 @@ pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
r = TAILQ_NEXT(r, entries);
else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
- off, pd->hdr.tcp), r->os_fingerprint)))
+ off, &pd->hdr.tcp), r->os_fingerprint)))
r = TAILQ_NEXT(r, entries);
else {
if (r->tag)
diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
index 8f970b68373b..b6e7fd5f1e1c 100644
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -1346,7 +1346,7 @@ pf_normalize_tcp(int dir, struct pfi_kkif *kif, struct mbuf *m, int ipoff,
int off, void *h, struct pf_pdesc *pd)
{
struct pf_krule *r, *rm = NULL;
- struct tcphdr *th = pd->hdr.tcp;
+ struct tcphdr *th = &pd->hdr.tcp;
int rewrite = 0;
u_short reason;
u_int8_t flags;
More information about the dev-commits-src-all
mailing list