In some email I received from Olaf Schreck, sie wrote:
> Hi,
>
> ipfilter 3.4.31, OpenBSD 3.1-stable + recent errata. Couldn't compile a
> kernel with ipfilter and bridge code enabled.
>
> Followed $IPFDIR/OpenBSD-3/README.3_1, patched with 3.1-sys-diffs, ran
> BSD/kupgrade, compiled the kernel. Then I got this while compiling
> /usr/src/sys/net/if_bridge.c
[...]
That's a bug in the OpenBSD source, not my patch.
There should be a #if NPF > 0 around the calls to pf_test but it's also
missing ipfilter checks..
Ah, I see a problem - not outside the #if for PF....complete patch to
if_bridge.c below.
Darren
*** /sys/net/if_bridge.c.orig Fri Dec 6 03:46:25 2002
--- if_bridge.c Sun Dec 8 19:23:57 2002
***************
*** 1,4 ****
! /* $OpenBSD: if_bridge.c,v 1.102 2002/08/07 18:44:39 jason Exp $ */
/*
* Copyright (c) 1999, 2000 Jason L. Wright ([EMAIL PROTECTED])
--- 1,4 ----
! /* $OpenBSD: if_bridge.c,v 1.102.2.1 2002/11/04 14:33:50 jason Exp $ */
/*
* Copyright (c) 1999, 2000 Jason L. Wright ([EMAIL PROTECTED])
***************
*** 2224,2230 ****
* We don't need to do loop detection, the
* bridge will do that for us.
*/
! #if NFP > 0
switch (af) {
#ifdef INET
case AF_INET:
--- 2224,2230 ----
* We don't need to do loop detection, the
* bridge will do that for us.
*/
! #if NPF > 0
switch (af) {
#ifdef INET
case AF_INET:
***************
*** 2248,2253 ****
--- 2248,2258 ----
if (m == NULL)
return (1);
#endif /* NPF */
+ #if defined(IPFILTER) || defined(IPFILTER_LKM)
+ if (fr_checkp &&
+ ((*fr_checkp)(ip, hlen, ifp, dir, &m) || !m))
+ return 1;
+ #endif
#ifdef INET
if (af == AF_INET) {
ip = mtod(m, struct ip *);
***************
*** 2376,2393 ****
return (NULL);
#endif /* IPSEC */
#if NPF > 0
/* Finally, we get to filter the packet! */
m->m_pkthdr.rcvif = ifp;
if (pf_test(dir, ifp, &m) != PF_PASS)
goto dropit;
#if defined(IPFILTER) || defined(IPFILTER_LKM)
! if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, dir, &m))
! goto dropit;
#endif
if (m == NULL)
goto dropit;
- #endif /* NPF */
/* Rebuild the IP header */
if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
--- 2381,2408 ----
return (NULL);
#endif /* IPSEC */
+ #if defined(IPFILTER) || defined(IPFILTER_LKM)
+ if (dir == 1) {
+ if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, dir, &m))
+ goto dropit;
+ if (m == NULL)
+ goto dropit;
+ }
+ #endif
#if NPF > 0
/* Finally, we get to filter the packet! */
m->m_pkthdr.rcvif = ifp;
if (pf_test(dir, ifp, &m) != PF_PASS)
goto dropit;
+ #endif /* NPF */
#if defined(IPFILTER) || defined(IPFILTER_LKM)
! if (dir == 0) {
! if fr_checkp && (*fr_checkp)(ip, hlen, ifp, dir, &m))
! goto dropit;
! }
#endif
if (m == NULL)
goto dropit;
/* Rebuild the IP header */
if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
***************
*** 2431,2442 ****
--- 2446,2473 ----
return (NULL);
#endif /* IPSEC */
+ #if defined(IPFILTER) || defined(IPFILTER_LKM)
+ if (dir == 1) {
+ if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, dir, &m))
+ goto dropit;
+ if (m == NULL)
+ return (NULL);
+ }
+ #endif
#if NPF > 0
if (pf_test6(dir, ifp, &m) != PF_PASS)
goto dropit;
if (m == NULL)
return (NULL);
#endif /* NPF */
+ #if defined(IPFILTER) || defined(IPFILTER_LKM)
+ if (dir == 0) {
+ if fr_checkp && (*fr_checkp)(ip, hlen, ifp, dir, &m))
+ goto dropit;
+ if (m == NULL)
+ return (NULL);
+ }
+ #endif
break;
}
***************
*** 2478,2484 ****
struct mbuf *m;
{
struct llc llc;
! struct mbuf *m0 = m;
int s, len, error = 0;
int hassnap = 0;
#ifdef INET
--- 2509,2515 ----
struct mbuf *m;
{
struct llc llc;
! struct mbuf *m0;
int s, len, error = 0;
int hassnap = 0;
#ifdef INET
***************
*** 2515,2520 ****
--- 2546,2554 ----
if (hassnap)
m_adj(m, LLC_SNAPFRAMELEN);
+ if (m->m_len < sizeof(struct ip) &&
+ (m = m_pullup(m, sizeof(struct ip))) == NULL)
+ goto dropit;
ip = mtod(m, struct ip *);
NTOHS(ip->ip_len);
NTOHS(ip->ip_off);
***************
*** 2530,2536 ****
if (error == EMSGSIZE)
goto dropit;
! for (m = m0; m; m = m0) {
m0 = m->m_nextpkt;
m->m_nextpkt = 0;
if (error == 0) {
--- 2564,2570 ----
if (error == EMSGSIZE)
goto dropit;
! for (; m; m = m0) {
m0 = m->m_nextpkt;
m->m_nextpkt = 0;
if (error == 0) {
