upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-11 01:30:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update the pf fragment handling code to closer match recent OpenBSD.

Browse source 
That partially fixes IPv6 fragment handling. Thanks to Kristof for
working on that.

Submitted by:		Kristof Provost
Tested by:		peter
Differential Revision:	D1765
This commit is contained in:
Gleb Smirnoff 2015-02-16 03:38:27 +00:00
parent add9975cd1
commit f5ceb22b78
2 changed files with 576 additions and 310 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
sys/netpfil/pf/pf.c
View file

@ -362,6 +362,45 @@ VNET_DEFINE(void *, pf_swi_cookie);
VNET_DEFINE(uint32_t, pf_hashseed);
#define V_pf_hashseed VNET(pf_hashseed)
int
pf_addr_cmp(struct pf_addr *a, struct pf_addr *b, sa_family_t af)
{
switch (af) {
#ifdef INET
case AF_INET:
if (a->addr32[0] > b->addr32[0])
return (1);
if (a->addr32[0] < b->addr32[0])
return (-1);
break;
#endif /* INET */
#ifdef INET6
case AF_INET6:
if (a->addr32[3] > b->addr32[3])
return (1);
if (a->addr32[3] < b->addr32[3])
return (-1);
if (a->addr32[2] > b->addr32[2])
return (1);
if (a->addr32[2] < b->addr32[2])
return (-1);
if (a->addr32[1] > b->addr32[1])
return (1);
if (a->addr32[1] < b->addr32[1])
return (-1);
if (a->addr32[0] > b->addr32[0])
return (1);
if (a->addr32[0] < b->addr32[0])
return (-1);
break;
#endif /* INET6 */
default:
panic("%s: unknown address family %u", __func__, af);
}
return (0);
}
static __inline uint32_t
pf_hashkey(struct pf_state_key *sk)
{

847
sys/netpfil/pf/pf_norm.c
View file

File diff suppressed because it is too large Load diff