OpenBSD/src TMAvYKosys/net pf.c

   States in pf(4) let ICMP and ICMP6 packets pass if they have a
   packet in their payload that matches an exiting connection.  It was
   not checked whether the outer ICMP packet has the same destination
   IP as the source IP of the inner protocol packet.  Enforce that
   these addresses match, to prevent ICMP packets that do not make
   sense.
   Issue found by Nicolas Collignon, Corentin Bayet, Eloi Vanderbeken,
   Luca Moro at Synacktiv.com
   OK sashan@
VersionDeltaFile
1.1081+24-4sys/net/pf.c
+24-41 files

UnifiedSplitRaw