svn commit: r284580 - stable/10/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Thu Jun 18 21:23:41 2015
New Revision: 284580
URL: https://svnweb.freebsd.org/changeset/base/284580

Log:
  Merge r284222, r284260
  
  pf: address family must be set when creating a pf_fragment
  
  Fix a panic when handling fragmented ip4 packets with 'drop-ovl' set.
  In that scenario we take a different branch in pf_normalize_ip(), taking us to
  pf_fragcache() (rather than pf_reassemble()). In pf_fragcache() we create a
  pf_fragment, but do not set the address family. This leads to a panic when we
  try to insert that into pf_frag_tree because pf_addr_cmp(), which is used to
  compare the pf_fragments doesn't know what to do if the address family is not
  set.
  
  Simply ensure that the address family is set correctly (always AF_INET in this
  path).
  
  When we try to look up a pf_fragment with pf_find_fragment() we compare (see
  pf_frag_compare()) addresses (and family), but also protocol.  We failed to
  save the protocol to the pf_fragment in pf_fragcache(), resulting in failing
  reassembly.
  
  PR:		200330
  Differential Revision:	https://reviews.freebsd.org/D2824
  Reviewed by:	gnn

Modified:
  stable/10/sys/netpfil/pf/pf_norm.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netpfil/pf/pf_norm.c
==============================================================================
--- stable/10/sys/netpfil/pf/pf_norm.c	Thu Jun 18 21:21:52 2015	(r284579)
+++ stable/10/sys/netpfil/pf/pf_norm.c	Thu Jun 18 21:23:41 2015	(r284580)
@@ -825,6 +825,8 @@ pf_fragcache(struct mbuf **m0, struct ip
 		(*frag)->fr_max = 0;
 		(*frag)->fr_src.v4 = h->ip_src;
 		(*frag)->fr_dst.v4 = h->ip_dst;
+		(*frag)->fr_af = AF_INET;
+		(*frag)->fr_proto = h->ip_p;
 		(*frag)->fr_id = h->ip_id;
 		(*frag)->fr_timeout = time_uptime;