[Bug 207598] pf adds icmp unreach on gre/ipsec somehow

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207598

--- Comment #26 from Max <maximos at als.nnov.ru> ---
Does it look reasonable? We should use consistent return values in
pf_reassemble(), I think.

--- pf_norm.c.orig      2016-05-28 23:40:52.171196000 +0300
+++ pf_norm.c   2016-05-28 23:50:39.912093000 +0300
@@ -623,7 +623,7 @@ pf_reassemble(struct mbuf **m0, struct i
        m = *m0 = NULL;

        if (!pf_isfull_fragment(frag))
-               return (PF_PASS);  /* drop because *m0 is NULL, no error */
+               return (PF_DROP);

        /* We have all the data */
        frent = TAILQ_FIRST(&frag->fr_queue);
@@ -1284,8 +1284,6 @@ pf_normalize_ip(struct mbuf **m0, int di
                        return (PF_DROP);

                m = *m0;
-               if (m == NULL)
-                       return (PF_DROP);

                /* use mtag from concatenated mbuf chain */
                pd->pf_mtag = pf_find_mtag(m);

IPv6 versions should be fixed too.

-- 
You are receiving this mail because:
You are the assignee for the bug.