From 7dce9b515b54dfb62c8ad4a9d0c8ab3139b15233 Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Wed, 1 Apr 2015 12:16:56 +0000 Subject: [PATCH] pf: Deal with runt packets On Ethernet packets have a minimal length, so very short packets get padding appended to them. This padding is not stripped off in ip6_input() (due to support for IPv6 Jumbograms, RFC2675). That means PF needs to be careful when reassembling fragmented packets to not include the padding in the reassembled packet. While here also remove the 'Magic from ip_input.' bits. Splitting up and re-joining an mbuf chain here doesn't make any sense. Differential Revision: https://reviews.freebsd.org/D2189 Approved by: gnn (mentor) --- sys/netpfil/pf/pf_norm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index 8aaca93380e..01c0958f214 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -573,11 +573,8 @@ pf_join_fragment(struct pf_fragment *frag) frent = TAILQ_FIRST(&frag->fr_queue); next = TAILQ_NEXT(frent, fr_next); - /* Magic from ip_input. */ m = frent->fe_m; - m2 = m->m_next; - m->m_next = NULL; - m_cat(m, m2); + m_adj(m, (frent->fe_hdrlen + frent->fe_len) - m->m_pkthdr.len); uma_zfree(V_pf_frent_z, frent); for (frent = next; frent != NULL; frent = next) { next = TAILQ_NEXT(frent, fr_next); @@ -585,6 +582,9 @@ pf_join_fragment(struct pf_fragment *frag) m2 = frent->fe_m; /* Strip off ip header. */ m_adj(m2, frent->fe_hdrlen); + /* Strip off any trailing bytes. */ + m_adj(m2, frent->fe_len - m2->m_pkthdr.len); + uma_zfree(V_pf_frent_z, frent); m_cat(m, m2); }