The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=f1c0030bb05cfa01bdd500e50befbb425fecc4c4
commit f1c0030bb05cfa01bdd500e50befbb425fecc4c4 Author: Kristof Provost <[email protected]> AuthorDate: 2024-01-24 16:34:01 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2024-01-24 18:08:29 +0000 pf: only check MTU for IPv6 packets when forwarding When the packets are generated locally (i.e. PFIL_FWD is not set) we might generate overly large packets and rely on the NIC to fragment it for us. In that case we'd reject a valid packet. Reported by: Herbert J. Skuhra <[email protected]> Tested by: Herbert J. Skuhra <[email protected]> Fixes: 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 38a5a45d7991..2dc6d02d330a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * confused and fail to send the icmp6 packet too big error. Just send * it here, before we do any NAT. */ - if (dir == PF_OUT && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { + if (dir == PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { PF_RULES_RUNLOCK(); *m0 = NULL; icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp));
