diff options
author | kp <kp@FreeBSD.org> | 2017-04-20 09:05:53 +0000 |
---|---|---|
committer | Renato Botelho <renato@netgate.com> | 2017-04-20 09:30:28 -0300 |
commit | 539d8571ccbd8999cc55736a3adb1c412cd21a5b (patch) | |
tree | 68a2bb297283e04b22eca9fb15403dc97bf61b12 /contrib/openbsm/bin/auditdistd/pjdlog.h | |
parent | 26e03fe8d578308454f0b67ed90452003ceb1e31 (diff) | |
download | FreeBSD-src-RELENG_2_3_3.zip FreeBSD-src-RELENG_2_3_3.tar.gz |
pf: Fix possible incorrect IPv6 fragmentationRELENG_2_3_3
When forwarding pf tracks the size of the largest fragment in a fragmented
packet, and refragments based on this size.
It failed to ensure that this size was a multiple of 8 (as is required for all
but the last fragment), so it could end up generating incorrect fragments.
For example, if we received an 8 byte and 12 byte fragment pf would emit a first
fragment with 12 bytes of payload and the final fragment would claim to be at
offset 8 (not 12).
We now assert that the fragment size is a multiple of 8 in ip6_fragment(), so
other users won't make the same mistake.
Reported by: Antonios Atlasis <aatlasis at secfu net>
MFC after: 3 days
(cherry picked from commit 4f3397263b95a45dd58e2be3a566029f8841cace)
Diffstat (limited to 'contrib/openbsm/bin/auditdistd/pjdlog.h')
0 files changed, 0 insertions, 0 deletions