CVS: cvs.openbsd.org: src

[Henning Brauer <henning_(_at_)_cvs_(_dot_)_openbsd_(_dot_)_org>]

CVSROOT:	/cvs
Module name:	src
Changes by:	henning_(_at_)_cvs_(_dot_)_openbsd_(_dot_)_org	2007/06/15 02:18:59

Modified files:
	sys/net        : pf.c 

Log message:
in pf_test_rule, before handling IPPROTO_ICMP / IPPROTO_ICMPV6, check that
the packet is of the expected address family (AF_INET / AF_INET6).
crafted IPv4 packets with IPPROTO_ICMPV6 can make us crash otherwise.
misbehaviour provoked by Adrian Close <adrian_(_at_)_close_(_dot_)_wattle_(_dot_)_id_(_dot_)_au> playing
with nmap; he also helped us big time debugging the problem. thanks!
ok ryan