svn commit: r317434 - in stable: 10 10/sys/contrib/ipfilter/netinet 11 11/sys/contrib/ipfilter/netinet

[Cy Schubert]

Author: cy
Date: Wed Apr 26 02:37:25 2017
New Revision: 317434
URL: https://svnweb.freebsd.org/changeset/base/317434

Log:
  MFC r316810, r316814, r316816, r316991:
  
  Keep state incorrectly assumes keep frags. This is counter to the
  ipfilter man pages. This also currently restricts keep frags to only when
  keep state is used, which is redundant because keep state currently
  assumes keep frags. This commit fixes this.
  
  To the user this change means that to maintain the current behaviour
  one must add keep frags to any ipfilter keep state rule (as documented
  in the man pages).
  
  This patch also allows the flexability to specify and use keep frags
  separate from keep state, as documented in an example in ipf.conf.5,
  instead of the currently broken behaviour.
  
  MFC suggested by:	rgrimes
  Relnotes:		yes

Modified:
  stable/11/UPDATING
  stable/11/sys/contrib/ipfilter/netinet/fil.c
  stable/11/sys/contrib/ipfilter/netinet/ip_state.c
Directory Properties:
  stable/11/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/10/UPDATING
  stable/10/sys/contrib/ipfilter/netinet/fil.c
  stable/10/sys/contrib/ipfilter/netinet/ip_state.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/11/UPDATING
==============================================================================
--- stable/11/UPDATING	Wed Apr 26 01:08:25 2017	(r317433)
+++ stable/11/UPDATING	Wed Apr 26 02:37:25 2017	(r317434)
@@ -21,6 +21,15 @@ from older version of current across the
 	use any explicitly assigned loopback address available in the jail
 	instead of using the first assigned address of the jail.
 
+20170413:
+	As of r316810 for ipfilter, keep frags is no longer assumed when
+	keep state is specified in a rule. r316810 aligns ipfilter with
+	documentation in man pages separating keep frags from keep state.
+	This allows keep state to specified without forcing keep frags
+	and allows keep frags to be specified independently of keep state.
+	To maintain previous behaviour, also specify keep frags with
+	keep state (as documented in ipf.conf.5).
+
 20170402:
 	Clang, llvm, lldb, compiler-rt and libc++ have been upgraded to 4.0.0.
 	Please see the 20141231 entry below for information about prerequisites

Modified: stable/11/sys/contrib/ipfilter/netinet/fil.c
==============================================================================
--- stable/11/sys/contrib/ipfilter/netinet/fil.c	Wed Apr 26 01:08:25 2017	(r317433)
+++ stable/11/sys/contrib/ipfilter/netinet/fil.c	Wed Apr 26 02:37:25 2017	(r317434)
@@ -2786,7 +2786,7 @@ ipf_firewall(fin, passp)
 	 * If the rule has "keep frag" and the packet is actually a fragment,
 	 * then create a fragment state entry.
 	 */
-	if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
+	if (pass & FR_KEEPFRAG) {
 		if (fin->fin_flx & FI_FRAG) {
 			if (ipf_frag_new(softc, fin, pass) == -1) {
 				LBUMP(ipf_stats[out].fr_bnfr);

Modified: stable/11/sys/contrib/ipfilter/netinet/ip_state.c
==============================================================================
--- stable/11/sys/contrib/ipfilter/netinet/ip_state.c	Wed Apr 26 01:08:25 2017	(r317433)
+++ stable/11/sys/contrib/ipfilter/netinet/ip_state.c	Wed Apr 26 02:37:25 2017	(r317434)
@@ -3414,7 +3414,8 @@ ipf_state_check(fin, passp)
 	 * If this packet is a fragment and the rule says to track fragments,
 	 * then create a new fragment cache entry.
 	 */
-	if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(is->is_pass))
+	if (fin->fin_flx & FI_FRAG && FR_ISPASS(is->is_pass) &&
+	   is->is_pass & FR_KEEPFRAG)
 		(void) ipf_frag_new(softc, fin, is->is_pass);
 
 	/*