summaryrefslogtreecommitdiffstats
path: root/Makefile.inc1
diff options
context:
space:
mode:
authorkp <kp@FreeBSD.org>2016-09-24 07:09:43 +0000
committerRenato Botelho <renato@netgate.com>2016-09-26 11:25:32 -0300
commit7a802f5afcd9a21983a9bf56412e0890ce1cf905 (patch)
treeb92a7e1dcef599157732a9dfa410efbb92be170b /Makefile.inc1
parent2347f0a36657f63396a18192e845631b6df24672 (diff)
downloadFreeBSD-src-7a802f5afcd9a21983a9bf56412e0890ce1cf905.zip
FreeBSD-src-7a802f5afcd9a21983a9bf56412e0890ce1cf905.tar.gz
bridge: Fix fragment handling and memory leak
Fragmented UDP and ICMP packets were corrupted if a firewall with reassembling feature (like pf'scrub) is enabled on the bridge. This patch fixes corrupted packet problem and the panic (triggered easly with low RAM) as explain in PR 185633. bridge_pfil and bridge_fragment relationship: bridge_pfil() receive (IN direction) packets and sent it to the firewall The firewall can be configured for reassembling fragmented packet (like pf'scrubing) in one mbuf chain when bridge_pfil() need to send this reassembled packet to the outgoing interface, it needs to re-fragment it by using bridge_fragment() bridge_fragment() had to split this mbuf (using ip_fragment) first then had to M_PREPEND each packet in the mbuf chain for adding Ethernet header. But M_PREPEND can sometime create a new mbuf on the begining of the mbuf chain, then the "main" pointer of this mbuf chain should be updated and this case is tottaly forgotten. The original bridge_fragment code (Revision 158140, 2006 April 29) came from OpenBSD, and the call to bridge_enqueue was embedded. But on FreeBSD, bridge_enqueue() is done after bridge_fragment(), then the original OpenBSD code can't work as-it of FreeBSD. PR: 185633 Submitted by: Olivier Cochard-Labbé Differential Revision: https://reviews.freebsd.org/D7780 (cherry picked from commit a8a1202774e288fb88de8422397f7ff398f7e3fb)
Diffstat (limited to 'Makefile.inc1')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud