diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2024-08-26 14:42:05 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2024-09-04 08:53:06 +0000 |
| commit | fa4b64836183c33631d92dadb073a9e435c5bf6d (patch) | |
| tree | 6da47624cbc12316454c341e9c96ed4a91dd2b5a | |
| parent | 2c76404c79ac67d8d3df1d11881dce9c2fa44cca (diff) | |
pf: try to lookup the icmp state based on a correct packet descriptor
MFC after: 1 week
Obtained from: OpenBSD, mikeb <mikeb@openbsd.org>, e467ea25dcd3
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit b8cd169efa6ac0899b4998898129765ae5c685a6)
| -rw-r--r-- | sys/netpfil/pf/pf.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index f55ed99153b1..ef6a2bd7de40 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -6632,11 +6632,11 @@ pf_test_state_icmp(struct pf_kstate **state, int direction, struct pfi_kkif *kif pd->dir, kif, virtual_id, virtual_type, icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1); if (ret >= 0) { - if (ret == PF_DROP && pd->af == AF_INET6 && + if (ret == PF_DROP && pd2.af == AF_INET6 && icmp_dir == PF_OUT) { if (*state != NULL) PF_STATE_UNLOCK((*state)); - ret = pf_icmp_state_lookup(&key, pd, + ret = pf_icmp_state_lookup(&key, &pd2, state, m, off, pd->dir, kif, virtual_id, virtual_type, icmp_dir, &iidx, multi, 1); |