Module Name:	pkgsrc
Committed By:	peter
Date:		Tue Jan 18 17:35:27 UTC 2005

Modified Files:
	pkgsrc/security/pflkm: Makefile distinfo

Log Message:
Update to 20050118.

Changes:
* Updated the ALTQ patch, now works correctly on NetBSD 2.0 release.
  Thanks to Miles Nordin for helping and testing.

* Write struct "pcap_sf_pkthdr" instead of "pcap_pkthdr". Fixes
  an LP64 specific problem with reading the pflog with tcpdump(8).

* Applied patch to pf.c from OPENBSD_3_6 branch:
  ICMP state entries use the ICMP ID as port for the unique state key. When
  checking for a usable key, construct the key in the same way. Otherwise,
  a colliding key might be missed or a state insertion might be refused even
  though it could be inserted. The second case triggers the endless loop
  fixed by 1.474, possibly allowing a NATed LAN client to lock up the kernel.
  Report and test data by Srebrenko Sehic.

* Applied patch to pf_lkm.c from NetBSD HEAD:
  pfil4_wrapper: clear M_CANFASTFWD which is not compatible with pf.

* Applied patch to pf_ioctl.c from OPENBSD_3_6 branch:
  replace finer-grained spl locking in pfioctl() with a single broad lock
  around the entire body. this resolves the (misleading) panics in
  pf_tag_packet() during heavy ioctl operations (like when using authpf)
  that occur because softclock can interrupt ioctl on i386 since SMP.

* Applied patch to pf.c from OPENBSD_3_6 branch:
  IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6
  header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing
  the header chain. In the case where headers are skipped, the protocol
  checksum verification used the wrong length (included the skipped headers),
  leading to incorrectly mismatching checksums. Such IPv6 packets with
  headers were silently dropped. Reported by Bernhard Schmidt.

* Applied patch to pfctl_optimize.c from OPENBSD_3_6 branch:
  &&/|| inversion would try to merge IP addresses with non-addresses into a
  single table causing a ruleset load error and eventually a double-free.

* Applied patch to pf.c from OPENBSD_3_6 branch:
  Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN,
  prevents a possible endless loop in pf_get_sport() with 'static-port'

* Fix to if_events.diff from Miles Nordin <carton at Ivy dot NET>:
  Call free after removing the element from the list, not before.
  Fixes panic with "unaligned access" on Alpha.


To generate a diff of this commit:
cvs rdiff -r1.4 -r1.5 pkgsrc/security/pflkm/Makefile
cvs rdiff -r1.2 -r1.3 pkgsrc/security/pflkm/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.