CVS commit: src/sys/dist/pf/net

[Peter Postma <peter%netbsd.org@localhost>]

Module Name:    src
Committed By:   peter
Date:           Tue Dec 21 12:06:37 UTC 2004

Modified Files:
        src/sys/dist/pf/net: pf.c

Log Message:
Apply a patch from OPENBSD_3_6 branch (ok yamt).

MFC:
Fix by dhartmei@

IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6
header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing
the header chain. In the case where headers are skipped, the protocol
checksum verification used the wrong length (included the skipped headers),
leading to incorrectly mismatching checksums. Such IPv6 packets with
headers were silently dropped. Reported by Bernhard Schmidt.

ok deraadt@ dhartmei@ mcbride@


To generate a diff of this commit:
cvs rdiff -r1.10 -r1.11 src/sys/dist/pf/net/pf.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.