Kristof Provost 76afcbb524 pf: handle multiple IPv6 fragment headers ... With 'scrub fragment reassemble' if a packet contains multiple IPv6 fragment headers we would reassemble the packet and immediately continue processing it. That is, we'd remove the first fragment header and expect the next header to be a final header (i.e. TCP, UDP, ICMPv6, ...). However, if it's another fragment header we'd not treat the packet correctly. That is, we'd fail to recognise the payload and treat it as if it were an IPv6 fragment rather than as its actual payload. Fix this by restarting the normalisation on the reassembled packet. If there are multiple fragment headers drop the packet. Reported by: Enrico Bassetti bassetti@di.uniroma1.it (NetSecurityLab @ Sapienza University of Rome) MFC after: instant Sponsored by: Rubicon Communications, LLC ("Netgate")		2023-08-04 15:23:49 +02:00
..
ipfilter/netinet	netpfil: Fix a typo in a source code comment	2023-08-02 09:41:29 +02:00
ipfw
pf	pf: handle multiple IPv6 fragment headers	2023-08-04 15:23:49 +02:00