HomeFreeBSD

pf: fix icmp-in-icmp state lookup

Description

pf: fix icmp-in-icmp state lookup

In 534ee17e6 pf state checking for ICMP(v6) was made stricter. This change
failed to correctly set the pf_pdesc for ICMP-in-ICMP lookups, resulting in ICMP
error packets potentially being dropped incorrectly.
Specially, it copied the ICMP header into a separate variable, not into the
pf_pdesc.

Populate the required pf_pdesc fields for the embedded ICMP packet's state lookup.

PR: 280701
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 2da98eef1f352c496ffd458b4c68ddee972bb903)

Details

Provenance
kpAuthored on Aug 12 2024, 2:07 PM
Parents
rG04716d51ba5b: ithread: Improve synchronization in ithread_destroy()
Branches
Unknown
Tags
Unknown