Hi,
The mbuf header cleanup I added in revision 1.173 of ip_icmp.c is
too strict. ICMP error packets generated by pf are not passed
immediately, but may be blocked. Preserve PF_TAG_GENERATED flag
in icmp_reflect() and icmp6_reflect().
ok?
bluhm
Index: netinet/ip_icmp.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_icmp.c,v
retrieving revision 1.186
diff -u -p -r1.186 ip_icmp.c
--- netinet/ip_icmp.c 30 Mar 2021 08:37:10 -0000 1.186
+++ netinet/ip_icmp.c 26 Jul 2021 14:10:37 -0000
@@ -691,6 +691,7 @@ icmp_reflect(struct mbuf *m, struct mbuf
struct rtentry *rt = NULL;
int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
u_int rtableid;
+ u_int8_t pfflags;
if (!in_canforward(ip->ip_src) &&
((ip->ip_src.s_addr & IN_CLASSA_NET) !=
@@ -704,8 +705,10 @@ icmp_reflect(struct mbuf *m, struct mbuf
return (ELOOP);
}
rtableid = m->m_pkthdr.ph_rtableid;
+ pfflags = m->m_pkthdr.pf.flags;
m_resethdr(m);
m->m_pkthdr.ph_rtableid = rtableid;
+ m->m_pkthdr.pf.flags = pfflags & PF_TAG_GENERATED;
/*
* If the incoming packet was addressed directly to us,
Index: netinet6/icmp6.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/icmp6.c,v
retrieving revision 1.235
diff -u -p -r1.235 icmp6.c
--- netinet6/icmp6.c 10 Mar 2021 10:21:49 -0000 1.235
+++ netinet6/icmp6.c 26 Jul 2021 15:42:33 -0000
@@ -1052,6 +1052,7 @@ icmp6_reflect(struct mbuf **mp, size_t o
struct in6_addr t, *src = NULL;
struct sockaddr_in6 sa6_src, sa6_dst;
u_int rtableid;
+ u_int8_t pfflags;
CTASSERT(sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) <= MHLEN);
@@ -1069,8 +1070,10 @@ icmp6_reflect(struct mbuf **mp, size_t o
return (ELOOP);
}
rtableid = m->m_pkthdr.ph_rtableid;
+ pfflags = m->m_pkthdr.pf.flags;
m_resethdr(m);
m->m_pkthdr.ph_rtableid = rtableid;
+ m->m_pkthdr.pf.flags = pfflags & PF_TAG_GENERATED;
/*
* If there are extra headers between IPv6 and ICMPv6, strip
