diff options
Diffstat (limited to 'sys/netpfil/pf/pf.c')
| -rw-r--r-- | sys/netpfil/pf/pf.c | 33 |
1 files changed, 21 insertions, 12 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index d6fc24a23fe9..2f09d47dc6e1 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -1007,7 +1007,7 @@ pf_src_node_exists(struct pf_ksrc_node **sn, struct pf_srchash *sh) return (false); } -static void +void pf_free_src_node(struct pf_ksrc_node *sn) { @@ -3531,7 +3531,7 @@ pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, /* Change inner protocol port, fix inner protocol checksum. */ if (ip != NULL) { u_int16_t oip = *ip; - u_int32_t opc; + u_int16_t opc; if (pc != NULL) opc = *pc; @@ -3547,7 +3547,7 @@ pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, switch (af) { #ifdef INET case AF_INET: { - u_int32_t oh2c = *h2c; + u_int16_t oh2c = *h2c; *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c, oia.addr16[0], ia->addr16[0], 0), @@ -5965,6 +5965,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, ctx.nat_pool = &(ctx.nr->rdr); } + *ctx.rm = &V_pf_default_rule; if (ctx.nr && ctx.nr->natpass) { r = ctx.nr; ruleset = *ctx.rsm; @@ -7395,7 +7396,11 @@ pf_sctp_track(struct pf_kstate *state, struct pf_pdesc *pd, } if (src->scrub != NULL) { - if (src->scrub->pfss_v_tag == 0) + /* + * Allow tags to be updated, in case of retransmission of + * INIT/INIT_ACK chunks. + **/ + if (src->state <= SCTP_COOKIE_WAIT) src->scrub->pfss_v_tag = pd->hdr.sctp.v_tag; else if (src->scrub->pfss_v_tag != pd->hdr.sctp.v_tag) return (PF_DROP); @@ -11074,10 +11079,12 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0 break; action = pf_test_state(&s, &pd, &reason); if (action == PF_PASS || action == PF_AFRT) { - if (V_pfsync_update_state_ptr != NULL) - V_pfsync_update_state_ptr(s); - r = s->rule; - a = s->anchor; + if (s != NULL) { + if (V_pfsync_update_state_ptr != NULL) + V_pfsync_update_state_ptr(s); + r = s->rule; + a = s->anchor; + } } else if (s == NULL) { /* Validate remote SYN|ACK, re-create original SYN if * valid. */ @@ -11126,10 +11133,12 @@ pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0 default: action = pf_test_state(&s, &pd, &reason); if (action == PF_PASS || action == PF_AFRT) { - if (V_pfsync_update_state_ptr != NULL) - V_pfsync_update_state_ptr(s); - r = s->rule; - a = s->anchor; + if (s != NULL) { + if (V_pfsync_update_state_ptr != NULL) + V_pfsync_update_state_ptr(s); + r = s->rule; + a = s->anchor; + } } else if (s == NULL) { action = pf_test_rule(&r, &s, &pd, &a, &ruleset, &reason, inp, &match_rules); |