Module Name: src
Committed By: jdc
Date: Tue Apr 14 11:43:58 UTC 2009
Modified Files:
src/sys/dist/pf/net [netbsd-5]: pf.c
Log Message:
Pull up revision 1.54 (requested by christos in ticket #702).
Fix http://www.securityfocus.com/archive/1/502634, from OpenBSD.
To generate a diff of this commit:
cvs rdiff -u -r1.53 -r1.53.4.1 src/sys/dist/pf/net/pf.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dist/pf/net/pf.c
diff -u src/sys/dist/pf/net/pf.c:1.53 src/sys/dist/pf/net/pf.c:1.53.4.1
--- src/sys/dist/pf/net/pf.c:1.53 Sat Oct 11 13:40:57 2008
+++ src/sys/dist/pf/net/pf.c Tue Apr 14 11:43:57 2009
@@ -1,4 +1,4 @@
-/* $NetBSD: pf.c,v 1.53 2008/10/11 13:40:57 pooka Exp $ */
+/* $NetBSD: pf.c,v 1.53.4.1 2009/04/14 11:43:57 jdc Exp $ */
/* $OpenBSD: pf.c,v 1.552.2.1 2007/11/27 16:37:57 henning Exp $ */
/*
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pf.c,v 1.53 2008/10/11 13:40:57 pooka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pf.c,v 1.53.4.1 2009/04/14 11:43:57 jdc Exp $");
#include "bpfilter.h"
#include "pflog.h"
@@ -3118,6 +3118,7 @@
state_icmp++;
break;
#endif /* INET */
+
#ifdef INET6
case IPPROTO_ICMPV6:
if (pd->af != AF_INET6)
@@ -5883,6 +5884,15 @@
break;
}
+#ifdef INET6
+ case IPPROTO_ICMPV6: {
+ action = PF_DROP;
+ DPFPRINTF(PF_DEBUG_MISC,
+ ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
+ goto done;
+ }
+#endif
+
default:
action = pf_test_state_other(&s, dir, kif, &pd);
if (action == PF_PASS) {
@@ -6269,6 +6279,15 @@
break;
}
+#ifdef INET
+ case IPPROTO_ICMP: {
+ action = PF_DROP;
+ DPFPRINTF(PF_DEBUG_MISC,
+ ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
+ goto done;
+ }
+#endif
+
case IPPROTO_ICMPV6: {
struct icmp6_hdr ih;
