diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index d7310c7bccb4..ed987350bf58 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -158,6 +158,7 @@ static int pf_reassemble(struct mbuf **, struct ip *, int, u_short *); static int pf_reassemble6(struct mbuf **, struct ip6_hdr *, struct ip6_frag *, uint16_t, uint16_t, u_short *); static void pf_scrub_ip6(struct mbuf **, uint8_t); +static void pf_scrub_ip6_frag(struct mbuf **m0, u_int32_t flags, u_int8_t tos); #endif /* INET6 */ #define DPFPRINTF(x) do { \ @@ -1278,10 +1279,13 @@ pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kkif *kif, goto shortpkt; pf_scrub_ip6(&m, r->min_ttl); + pf_scrub_ip6_frag(&m, r->rule_flag, r->set_tos); return (PF_PASS); fragment: + pf_scrub_ip6_frag(&m, r->rule_flag, r->set_tos); + if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len) goto shortpkt; @@ -2034,4 +2038,15 @@ pf_scrub_ip6(struct mbuf **m0, u_int8_t min_ttl) if (min_ttl && h->ip6_hlim < min_ttl) h->ip6_hlim = min_ttl; } + +static void +pf_scrub_ip6_frag(struct mbuf **m0, u_int32_t flags, u_int8_t tos) { + struct mbuf *m = *m0; + struct ip6_hdr *h = mtod(m, struct ip6_hdr *); + + if (flags & PFRULE_SET_TOS) { + h->ip6_flow &= ~htonl(0xff << 20); + h->ip6_flow |= htonl(tos << 20); + } +} #endif