On Sat, Feb 5, 2011 at 2:54 PM, Alexander Bluhm <[email protected]> wrote: > On Sat, Feb 05, 2011 at 02:03:25PM +0100, Mike Belopuhov wrote: >> we can check if "af == inet" in icmp case obviously, but how and why >> can we end up with af == inet6 and an icmp payload (or af == inet >> and icmp6 payload for that matter)? > > Somebody could send us such a packet. > > It is strange but not illegal. If we decide, pf should drop such > packets that is a complete different thing. > > Anyway we should make sure that pf_translate() can handle these > packets by itself. Protocol 1 for IPv6 packets means no special > treatment so it should end in the else case. > > I suggest that diff (untested): >
in this case i'm okay with your diff.
