After finding the socket's inp by using the pf's statekey, reset

the pointer to the statekey in the mbuf.
When an UDP socket is spliced, pf would use this key during ip_output()
although the packet went through two sockets in the meantime.  Reset
the mbuf's statekey in tcp_input() and udp_input() to eliminate the
pointer to pf lingering in the socket buffers.
OK claudio@

1 files changed, 10 insertions, 1 deletions

diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 82f0eef86c9..1a869c94310 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.151 2012/09/28 16:06:20 markus Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.152 2013/01/17 11:43:06 bluhm Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -620,6 +620,15 @@ udp_input(struct mbuf *m, ...)
 		}
 	}
 
+#if NPF > 0
+	/*
+	 * The statekey has finished finding the inp, it is no longer needed.
+	 * If UDP socket splicing is used, the statekey will confuse pf when
+	 * the same packet goes through ip_output().  So reset the statekey.
+	 */
+	m->m_pkthdr.pf.statekey = NULL;
+#endif
+
 #ifdef IPSEC
 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
 	s = splnet();