CVSROOT: /cvs
Module name: src
Changes by: bl...@cvs.openbsd.org 2019/03/21 07:33:07
Modified files:
sys/net : Tag: OPENBSD_6_4 pf.c
Log message:
States in pf(4) let ICMP and ICMP6 packets pass if they have a
packet in their payload that matches an exiting connection. It was
not checked whether the outer ICMP packet has the same destination
IP as the source IP of the inner protocol packet. Enforce that
these addresses match, to prevent ICMP packets that do not make
sense.
Issue found by Nicolas Collignon, Corentin Bayet, Eloi Vanderbeken,
Luca Moro at Synacktiv.com
OK sashan@
OpenBSD 6.4 errata 015
