We've observed a panic after pf_refragment6() with link-local addresses, because pf_refragment6() calls ip6_forward() even for a simple output case. That results in us entering ip6_forward() with an mbuf with a NULL m->m_pkthdr.rcvif, which can cause a NULL deref (but seemingly not for GUAs. Test sending fragmented link-local packets to pf. MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D39063 |
||
---|---|---|
.. | ||
common | ||
ipfw | ||
pf | ||
Makefile | ||
Makefile.depend |