[src/trunk]: src/sys/dist/pf/net Apply a patch from OPENBSD_3_6 branch (ok ya...

[peter <peter%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0d81076360d0
branches:  trunk
changeset: 572141:0d81076360d0
user:      peter <peter%NetBSD.org@localhost>
date:      Tue Dec 21 12:06:37 2004 +0000

description:
Apply a patch from OPENBSD_3_6 branch (ok yamt).

MFC:
Fix by dhartmei@

IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6
header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing
the header chain. In the case where headers are skipped, the protocol
checksum verification used the wrong length (included the skipped headers),
leading to incorrectly mismatching checksums. Such IPv6 packets with
headers were silently dropped. Reported by Bernhard Schmidt.

ok deraadt@ dhartmei@ mcbride@

diffstat:

 sys/dist/pf/net/pf.c |  13 ++++++++-----
 1 files changed, 8 insertions(+), 5 deletions(-)

diffs (41 lines):

diff -r 456ae37ee3bf -r 0d81076360d0 sys/dist/pf/net/pf.c
--- a/sys/dist/pf/net/pf.c      Tue Dec 21 12:05:34 2004 +0000
+++ b/sys/dist/pf/net/pf.c      Tue Dec 21 12:06:37 2004 +0000
@@ -1,5 +1,5 @@
-/*     $NetBSD: pf.c,v 1.10 2004/12/21 12:05:34 peter Exp $    */
-/*     $OpenBSD: pf.c,v 1.457.2.5 2004/12/16 02:04:55 brad Exp $ */
+/*     $NetBSD: pf.c,v 1.11 2004/12/21 12:06:37 peter Exp $    */
+/*     $OpenBSD: pf.c,v 1.457.2.6 2004/12/19 18:48:57 brad Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -5928,7 +5928,8 @@
                        goto done;
                }
                if (dir == PF_IN && pf_check_proto_cksum(m, off,
-                   ntohs(h->ip6_plen), IPPROTO_TCP, AF_INET6)) {
+                   ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)),
+                   IPPROTO_TCP, AF_INET6)) {
                        action = PF_DROP;
                        goto done;
                }
@@ -5961,7 +5962,8 @@
                        goto done;
                }
                if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m,
-                   off, ntohs(h->ip6_plen), IPPROTO_UDP, AF_INET6)) {
+                   off, ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)),
+                   IPPROTO_UDP, AF_INET6)) {
                        action = PF_DROP;
                        goto done;
                }
@@ -5995,7 +5997,8 @@
                        goto done;
                }
                if (dir == PF_IN && pf_check_proto_cksum(m, off,
-                   ntohs(h->ip6_plen), IPPROTO_ICMPV6, AF_INET6)) {
+                   ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)),
+                   IPPROTO_ICMPV6, AF_INET6)) {
                        action = PF_DROP;
                        goto done;
                }