diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index d7310c7bccb4..60532f3d2c49 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -157,7 +157,7 @@ static int pf_reassemble(struct mbuf **, struct ip *, int, u_short *); #ifdef INET6 static int pf_reassemble6(struct mbuf **, struct ip6_hdr *, struct ip6_frag *, uint16_t, uint16_t, u_short *); -static void pf_scrub_ip6(struct mbuf **, uint8_t); +static void pf_scrub_ip6(struct mbuf **, uint8_t, uint32_t, uint8_t); #endif /* INET6 */ #define DPFPRINTF(x) do { \ @@ -1277,11 +1277,13 @@ pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kkif *kif, if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len) goto shortpkt; - pf_scrub_ip6(&m, r->min_ttl); + pf_scrub_ip6(&m, r->min_ttl, r->rule_flag, r->set_tos); return (PF_PASS); fragment: + pf_scrub_ip6(&m, 0, r->rule_flag, r->set_tos); + if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len) goto shortpkt;