Page MenuHomeFreeBSD
Differential D46647

pf: dedupe layer 4 protocol code in pf_setup_pdesc()
Needs ReviewPublic
Actions

Authored by kp on Thu, Sep 12, 11:57 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Sep 21, 11:18 AM
Unknown Object (File)
Thu, Sep 19, 10:40 AM
Unknown Object (File)
Tue, Sep 17, 4:45 PM
Unknown Object (File)
Tue, Sep 17, 1:07 PM
Unknown Object (File)
Mon, Sep 16, 2:52 AM
Unknown Object (File)
Thu, Sep 12, 11:13 PM
Unknown Object (File)
Thu, Sep 12, 6:09 PM
Unknown Object (File)
Thu, Sep 12, 6:09 PM
View All 10 Files
Subscribers
farrokhi
glebius
imp
melifaro
vegeta_tuxpowered.net
zlei

Details

Reviewers
None
Group Reviewers
network
pfsense
Summary

In pf_setup_pdesc() the code for analysing TCP and UDP headers was
the same for v4 and v6. Deduplicate by moving the protocol switch
after the address family switch.
ok henning@ claudio@

Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 72cf18cc6e
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 59450
Build 56337: arc lint + arc unit

Event Timeline

kp created this revision.Thu, Sep 12, 11:57 AM
Herald added subscribers: vegeta_tuxpowered.net, glebius, melifaro and 2 others. · View Herald TranscriptThu, Sep 12, 11:57 AM
kp requested review of this revision.Thu, Sep 12, 11:57 AM
Harbormaster completed remote builds in B59450: Diff 143272.Thu, Sep 12, 11:57 AM
kp added a child revision: D46648: pf: remove pointless CURVNET_SET.Thu, Sep 12, 11:57 AM
zlei added a subscriber: zlei.Sat, Sep 14, 7:18 AM

I'm a little nervous about this change. It seems invalid combinations such as IPv4/ICMPv6 and IPv6/ICMP are now possible after the change. Do we have some pre-checks about those combinations ?

kp added a comment.Mon, Sep 16, 9:00 AM
In D46647#1063679, @zlei wrote:

I'm a little nervous about this change. It seems invalid combinations such as IPv4/ICMPv6 and IPv6/ICMP are now possible after the change. Do we have some pre-checks about those combinations ?

There's an explicit test in pf_test() where we drop such packets. It's introduced in D46649. That's after pf_setup_pdesc(), but I'd argue that that's fine. pf_setup_pdesc() is only meant to set up a context struct, it doesn't have to do the full packet validation.

Revision Contents
Changeset List

PathSize
sys/
netpfil/
pf/
255 lines

Diff 143272

View Options

sys/netpfil/pf/pf.c

Loading...