kern/168190: [pf] panic when using pf and route-to (maybe: bad fragment handling?)

[Daniel Hartmeier]

The following reply was made to PR kern/168190; it has been noted by GNATS.

From: Daniel Hartmeier <daniel at benzedrine.cx>
To: Joerg Pulz <Joerg.Pulz at frm2.tum.de>
Cc: bug-followup at freebsd.org, freebsd-pf at freebsd.org
Subject: Re: kern/168190: [pf] panic when using pf and route-to (maybe: bad fragment handling?)
Date: Mon, 4 Jun 2012 12:25:44 +0200

 Here's a patch that directly tests this theory.
 
 If correct, it will replace the panics with simple log messages that
 show when ipfilter left an m_len==0 mbuf.
 
 Daniel
 
 Index: sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
 ===================================================================
 RCS file: /home/ncvs/src/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c,v
 retrieving revision 1.20.4.1
 diff -u -r1.20.4.1 ip_fil_freebsd.c
 --- sys/contrib/ipfilter/netinet/ip_fil_freebsd.c       23 Sep 2011 00:51:37 -0000      1.20.4.1
 +++ sys/contrib/ipfilter/netinet/ip_fil_freebsd.c       4 Jun 2012 10:19:04 -0000
 @@ -182,8 +182,18 @@
  static int
  fr_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
  {
 +       int r;
 +
         struct ip *ip = mtod(*mp, struct ip *);
 -       return fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
 +       ASSERT_HOST_BYTE_ORDER(*mp);
 +       r = fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
 +       if (*mp != NULL && (*mp)->m_pkthdr.len >= sizeof(struct ip) &&
 +           (*mp)->m_len < sizeof(struct ip)) {
 +               printf("fr_check_wrapper: m_len %d fixed\n",
 +                   (int)(*mp)->m_len);
 +               *mp = m_pullup(*mp, sizeof(struct ip));
 +       }
 +       return r;
  }
 
  # ifdef USE_INET6