diff options
| author | cy <cy@FreeBSD.org> | 2017-04-26 02:37:25 +0000 |
|---|---|---|
| committer | cy <cy@FreeBSD.org> | 2017-04-26 02:37:25 +0000 |
| commit | 3ed8a5dd69e932961ff7900dbee62b78df437f51 (patch) | |
| tree | 466a76478e547daa42782f9285aea80b2504522c /sys/contrib/ipfilter/netinet/ip_state.c | |
| parent | 484b5e0d4660cc1cdf0f1ec08cec9f7e18ad821a (diff) | |
| download | FreeBSD-src-3ed8a5dd69e932961ff7900dbee62b78df437f51.zip FreeBSD-src-3ed8a5dd69e932961ff7900dbee62b78df437f51.tar.gz | |
MFC r316810, r316814, r316816, r316991:
Keep state incorrectly assumes keep frags. This is counter to the
ipfilter man pages. This also currently restricts keep frags to only when
keep state is used, which is redundant because keep state currently
assumes keep frags. This commit fixes this.
To the user this change means that to maintain the current behaviour
one must add keep frags to any ipfilter keep state rule (as documented
in the man pages).
This patch also allows the flexability to specify and use keep frags
separate from keep state, as documented in an example in ipf.conf.5,
instead of the currently broken behaviour.
MFC suggested by: rgrimes
Relnotes: yes
Diffstat (limited to 'sys/contrib/ipfilter/netinet/ip_state.c')
| -rw-r--r-- | sys/contrib/ipfilter/netinet/ip_state.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/contrib/ipfilter/netinet/ip_state.c b/sys/contrib/ipfilter/netinet/ip_state.c index 2ceec32..0d90505 100644 --- a/sys/contrib/ipfilter/netinet/ip_state.c +++ b/sys/contrib/ipfilter/netinet/ip_state.c @@ -3408,7 +3408,8 @@ ipf_state_check(fin, passp) * If this packet is a fragment and the rule says to track fragments, * then create a new fragment cache entry. */ - if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(is->is_pass)) + if (fin->fin_flx & FI_FRAG && FR_ISPASS(is->is_pass) && + is->is_pass & FR_KEEPFRAG) (void) ipf_frag_new(softc, fin, is->is_pass); /* |
