HomeFreeBSD

pf: fix icmp-in-icmp state lookup

Description

pf: fix icmp-in-icmp state lookup

In 534ee17e6 pf state checking for ICMP(v6) was made stricter. This change
failed to correctly set the pf_pdesc for ICMP-in-ICMP lookups, resulting in ICMP
error packets potentially being dropped incorrectly.
Specially, it copied the ICMP header into a separate variable, not into the
pf_pdesc.

Populate the required pf_pdesc fields for the embedded ICMP packet's state lookup.

PR: 280701
Approved by: re (cperciva)
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 2da98eef1f352c496ffd458b4c68ddee972bb903)
(cherry picked from commit 0d8d4cc3ea47f1ee61d749b22b135eb73c7d33cd)

Details

Provenance
kpAuthored on Aug 12 2024, 2:07 PM
Parents
rGabf370e4000a: 13.4: Update to BETA3
Branches
Unknown
Tags
Unknown