Kristof Provost 6f4909de5f pf: IPv6 fragments with malformed extension headers could be erroneously passed by pf or cause a panic ... We mistakenly used the extoff value from the last packet to patch the next_header field. If a malicious host sends a chain of fragmented packets where the first packet and the final packet have different lengths or number of extension headers we'd patch the next_header at the wrong offset. This can potentially lead to panics or rule bypasses. Security: CVE-2019-5597 Obtained from: OpenBSD Reported by: Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv		2019-03-01 07:37:45 +00:00
..
if_pflog.c	Use the new VNET_DEFINE_STATIC macro when we are defining static VNET	2018-07-24 16:35:52 +00:00
if_pfsync.c	pf: fix pfsync breaking carp	2019-01-18 08:19:54 +00:00
in4_cksum.c
pf_altq.h	Extended pf(4) ioctl interface and pfctl(8) to allow bandwidths of	2018-08-22 19:38:48 +00:00
pf_if.c	Mechanical cleanup of epoch(9) usage in network stack.	2019-01-09 01:11:19 +00:00
pf_ioctl.c	Place pf_altq_get_nth_active() under the ALTQ ifdef	2019-02-11 05:39:38 +00:00
pf_lb.c	pf: Fix endless loop on NAT exhaustion with sticky-address	2018-12-12 20:15:06 +00:00
pf_mtag.h
pf_norm.c	pf: IPv6 fragments with malformed extension headers could be erroneously passed by pf or cause a panic	2019-03-01 07:37:45 +00:00
pf_osfp.c	Use the new VNET_DEFINE_STATIC macro when we are defining static VNET	2018-07-24 16:35:52 +00:00
pf_ruleset.c
pf_table.c	pf: silence a runtime warning	2019-01-15 08:59:51 +00:00
pf.c	pf: Small performance tweak	2019-02-24 17:23:55 +00:00
pf.h