svn commit: r349568 - head/sys/contrib/ipfilter/netinet

[Cy Schubert]

Author: cy
Date: Sun Jun 30 22:32:33 2019
New Revision: 349568
URL: https://svnweb.freebsd.org/changeset/base/349568

Log:
  The RFC 3128 test should be made after the offset mask has been applied.
  
  Reported by:	christos at NetBSD.org
  X-MFC with:	r349399

Modified:
  head/sys/contrib/ipfilter/netinet/fil.c

Modified: head/sys/contrib/ipfilter/netinet/fil.c
==============================================================================
--- head/sys/contrib/ipfilter/netinet/fil.c	Sun Jun 30 22:27:58 2019	(r349567)
+++ head/sys/contrib/ipfilter/netinet/fil.c	Sun Jun 30 22:32:33 2019	(r349568)
@@ -1723,15 +1723,15 @@ ipf_pr_ipv4hdr(fin)
 	 * calculate the byte offset that it represents.
 	 */
 	off &= IP_MF|IP_OFFMASK;
-	if (off == 1 && p == IPPROTO_TCP) {
-		fin->fin_flx |= FI_SHORT;	/* RFC 3128 */
-		DT1(ipf_fi_tcp_frag_off_1, fr_info_t *, fin);
-	}
 	if (off != 0) {
 		int morefrag = off & IP_MF;
 
 		fi->fi_flx |= FI_FRAG;
 		off &= IP_OFFMASK;
+		if (off == 1 && p == IPPROTO_TCP) {
+			fin->fin_flx |= FI_SHORT;	/* RFC 3128 */
+			DT1(ipf_fi_tcp_frag_off_1, fr_info_t *, fin);
+		}
 		if (off != 0) {
 			fin->fin_flx |= FI_FRAGBODY;
 			off <<= 3;