Created attachment 162429 [details] patch PF_ANEQ() macro will in most situations returns TRUE comparing two identical IPv4 packets (when it should return FALSE). It happens because PF_ANEQ() doesn't stop if first 32 bits of IPv4 packets are equal and starts to check next 3*32 bits (like for IPv6 packet). Those bits containt some garbage and in result PF_ANEQ() wrongly returns TRUE. Fix: Check if packet is of AF_INET type and if it is then compare only first 32 bits of data. Proposed fix in attachment. This bug was already described and repaired in OpenBSD pf: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/net/pfvar.h?f=h#rev1.287
A commit references this bug: Author: kp Date: Sun Oct 25 13:14:54 UTC 2015 New revision: 289932 URL: https://svnweb.freebsd.org/changeset/base/289932 Log: PF_ANEQ() macro will in most situations returns TRUE comparing two identical IPv4 packets (when it should return FALSE). It happens because PF_ANEQ() doesn't stop if first 32 bits of IPv4 packets are equal and starts to check next 3*32 bits (like for IPv6 packet). Those bits containt some garbage and in result PF_ANEQ() wrongly returns TRUE. Fix: Check if packet is of AF_INET type and if it is then compare only first 32 bits of data. PR: 204005 Submitted by: Mi?osz Kaniewski Changes: head/sys/net/pfvar.h
Thanks! It looks like this was mostly relatively harmless (it's most often used to optimise things, i.e. don't do anything if the address doesn't change anyway), but it's good to fix this anyway. You're clearly right that this was wrong and needed to be fixed.
A commit references this bug: Author: kp Date: Wed Aug 17 15:14:21 UTC 2016 New revision: 304293 URL: https://svnweb.freebsd.org/changeset/base/304293 Log: MFC r289932, r289940: PF_ANEQ() macro will in most situations returns TRUE comparing two identical IPv4 packets (when it should return FALSE). It happens because PF_ANEQ() doesn't stop if first 32 bits of IPv4 packets are equal and starts to check next 3*32 bits (like for IPv6 packet). Those bits containt some garbage and in result PF_ANEQ() wrongly returns TRUE. Fix: Check if packet is of AF_INET type and if it is then compare only first 32 bits of data. PR: 204005 Submitted by: Mi?osz Kaniewski Changes: _U stable/10/ stable/10/sys/net/pfvar.h