From owner-svn-src-all@FreeBSD.ORG  Tue Jun 29 16:57:30 2010
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id F1468106566C;
	Tue, 29 Jun 2010 16:57:30 +0000 (UTC)
	(envelope-from glebius@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id DF12D8FC1B;
	Tue, 29 Jun 2010 16:57:30 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o5TGvUIT081559;
	Tue, 29 Jun 2010 16:57:30 GMT (envelope-from glebius@svn.freebsd.org)
Received: (from glebius@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id o5TGvU55081558;
	Tue, 29 Jun 2010 16:57:30 GMT (envelope-from glebius@svn.freebsd.org)
Message-Id: <201006291657.o5TGvU55081558@svn.freebsd.org>
From: Gleb Smirnoff <glebius@FreeBSD.org>
Date: Tue, 29 Jun 2010 16:57:30 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r209589 - head/sys/netinet/ipfw
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jun 2010 16:57:31 -0000

Author: glebius
Date: Tue Jun 29 16:57:30 2010
New Revision: 209589
URL: http://svn.freebsd.org/changeset/base/209589

Log:
  After processing the O_SKIPTO opcode our cmd points to the next rule, and
  "match" processing at the end of inner loop would look ahead into the next
  rule, which is incorrect. Particularly, in the case when the next rule
  started with F_NOT opcode it was skipped blindly.
  
  To fix this, exit the inner loop with the continue operator forcibly and
  explicitly.
  
  PR:		kern/147798

Modified:
  head/sys/netinet/ipfw/ip_fw2.c

Modified: head/sys/netinet/ipfw/ip_fw2.c
==============================================================================
--- head/sys/netinet/ipfw/ip_fw2.c	Tue Jun 29 14:32:01 2010	(r209588)
+++ head/sys/netinet/ipfw/ip_fw2.c	Tue Jun 29 16:57:30 2010	(r209589)
@@ -2012,14 +2012,15 @@ do {								\
 				     (1 << chain->map[f_pos]->set));
 				    f_pos++)
 				;
-			    /* prepare to enter the inner loop */
+			    /* Re-enter the inner loop at the skipto rule. */
 			    f = chain->map[f_pos];
 			    l = f->cmd_len;
 			    cmd = f->cmd;
 			    match = 1;
 			    cmdlen = 0;
 			    skip_or = 0;
-			    break;
+			    continue;
+			    break;	/* not reached */
 
 			case O_REJECT:
 				/*