d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

PF_ANEQ() macro will in most situations returns TRUE comparing two identical

Browse Source 
IPv4 packets (when it should return FALSE). It happens because PF_ANEQ() doesn't
stop if first 32 bits of IPv4 packets are equal and starts to check next 3*32
bits (like for IPv6 packet). Those bits containt some garbage and in result
PF_ANEQ() wrongly returns TRUE.

Fix: Check if packet is of AF_INET type and if it is then compare only first 32
bits of data.

PR:		204005
Submitted by:	Miłosz Kaniewski
This commit is contained in:
Kristof Provost 2015-10-25 13:14:53 +00:00
parent f6d1992dc3
commit 7d7624233a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=289932
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/net/pfvar.h
View File

@ -198,10 +198,11 @@ extern struct rwlock pf_rules_lock;
(a)->addr32[0] == (b)->addr32[0])) \
#define PF_ANEQ(a, b, c) \
((a)->addr32[0] != (b)->addr32[0] || \
((c == AF_INET && (a)->addr32[0] != (b)->addr32[0]) || \
(c == AF_INET6 && (a)->addr32[3] != (b)->addr32[3] && \
(a)->addr32[1] != (b)->addr32[1] || \
(a)->addr32[2] != (b)->addr32[2] || \
(a)->addr32[3] != (b)->addr32[3]) \
(a)->addr32[3] != (b)->addr32[3])) \
#define PF_AZERO(a, c) \
((c == AF_INET && !(a)->addr32[0]) || \