[DragonFlyBSD - Bug #3437] (Resolved) PF: IPv6 fragment length check uses different units

[liweitianux]

Issue #3437 has been updated by liweitianux.

Status changed from New to Resolved

Patch merged. Thank you.

----------------------------------------
Bug #3437: PF: IPv6 fragment length check uses different units
http://bugs.dragonflybsd.org/issues/3437#change-14867

* Author: sigttou
* Status: Resolved
* Priority: Normal
* Category: PF
* Target version: 6.6
* Start date: 2026-10-04
----------------------------------------
`pf_normalize_ip6()` subtracts `off` from `ip6_plen`. `off` includes the
40-byte IPv6 header; `ip6_plen` does not. Unsigned arithmetic rejects some
valid short fragments and accepts some fragments exceeding the reassembled
payload limit. For example, offset 65528 plus 40 data bytes exceeds 65535,
but passes the old check.

The patch checks the declared packet and fragment-header bounds, computes the
fragment data length in matching units, checks non-final eight-byte alignment,
and includes pre-fragment extension headers in the reassembled payload limit.

Before/after tests cover short fragments, extension headers, alignment and
size limits. Real two-fragment ICMPv6 echo tests use a 64-byte first fragment
and tails of 1, 7, 8, 16, 31, 32, 40 and 64 bytes in both arrival orders.
The patch restores replies for the short tails.

This does not add IPv6 reassembly to PF. Port/type filtering of IPv6 fragments
is a separate issue.

---Files--------------------------------
0002-pf-fix-IPv6-fragment-length-checks.patch (1.68 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account