To me the patch looks good enough. I can't approve the approach taken, that adds a future version tool to a stable/xx tree. This is up to releng as the main upgrade path gatekeeper and @jhb who requested the compatibility shim.

Looks great, thanks!

Approved!

I have very little idea about that. I'm just working on making interfaces detach more safe and I want in6_ifextra to be a single piece of memory which would have delayed reclamation.

In D54636#1250207, @pouria wrote:

@glebius should these minor changes to the manual be approved by the manpages group?

Have you tried to submit this the tcpdump project itself? https://github.com/the-tcpdump-group/tcpdump

I would suggest to go deeper and call memset() directly. These empty proxy functions do not improve readability.

The description mentions ip_output(), but in reality the patch is against rip_send(), which is send(2) method for a PF_INET/SOCK_RAW. Looks like with a specially crafted send(2) we can achieve such a bogus mbuf. Instead of putting the bandaid let's find out how this mbuf was produced and fix the bug. Note that mbufs are formed outside of protocol implementation, so potentially the problem discovered may apply to other protocols beyond PF_INET/SOCK_RAW.

• Fix lock leak in ipfw_commit_rules().

But where is the ICMP_REDIRECT_DEFAULT_TIMEOUT defined? The patch as is can't be compilable.

Thanks!

Well I think you're right. if_getifaddr() ( wrapper around ifp->if_addr ) is the right accessor to get link level address. Using that directly is much simpler than a iterator.

Have you tried chaining mbufs instead of having an array? Does that have negative cache effect?

I'd also suggest to change it to SYSCTL_BOOL.