summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorglebius <glebius@FreeBSD.org>2013-02-15 09:03:56 +0000
committerglebius <glebius@FreeBSD.org>2013-02-15 09:03:56 +0000
commitf8098d720c2ce28997d30a5e615da3393337aa12 (patch)
tree6ba1aba554fdcb05b2b43f0f7ff8be2c02815cd5
parentb9bd38a43112efa17a63a6df3fb174f3d9e24256 (diff)
downloadFreeBSD-src-f8098d720c2ce28997d30a5e615da3393337aa12.zip
FreeBSD-src-f8098d720c2ce28997d30a5e615da3393337aa12.tar.gz
Finish the r244185. This fixes ever growing counter of pfsync bad
length packets, which was actually harmless. Note that peers with different version of head/ may grow this counter, but it is harmless - all pfsync data is processed. Reported & tested by: Anton Yuzhaninov <citrin citrin.ru> Sponsored by: Nginx, Inc
-rw-r--r--sys/net/if_pfsync.h12
-rw-r--r--sys/netpfil/pf/if_pfsync.c3
2 files changed, 1 insertions, 14 deletions
diff --git a/sys/net/if_pfsync.h b/sys/net/if_pfsync.h
index a84a0b8..29d4b23 100644
--- a/sys/net/if_pfsync.h
+++ b/sys/net/if_pfsync.h
@@ -67,8 +67,6 @@
#define PFSYNC_ACT_EOF 12 /* end of frame */
#define PFSYNC_ACT_MAX 13
-#define PFSYNC_HMAC_LEN 20
-
/*
* A pfsync frame is built from a header followed by several sections which
* are all prefixed with their own subheaders. Frames must be terminated with
@@ -205,18 +203,8 @@ struct pfsync_tdb {
u_int8_t _pad[2];
} __packed;
-/*
- * EOF
- */
-
-struct pfsync_eof {
- u_int8_t hmac[PFSYNC_HMAC_LEN];
-} __packed;
-
#define PFSYNC_HDRLEN sizeof(struct pfsync_header)
-
-
/*
* Names for PFSYNC sysctl objects
*/
diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index 141ee6d..93f0729 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -99,8 +99,7 @@ __FBSDID("$FreeBSD$");
#define PFSYNC_MINPKT ( \
sizeof(struct ip) + \
sizeof(struct pfsync_header) + \
- sizeof(struct pfsync_subheader) + \
- sizeof(struct pfsync_eof))
+ sizeof(struct pfsync_subheader) )
struct pfsync_pkt {
struct ip *ip;
OpenPOWER on IntegriCloud