HomeFreeBSD

Avoid IPv6 source address selection on accepting TCP connections

Description

Avoid IPv6 source address selection on accepting TCP connections

When an application listens IPv6 TCP socket, due to ipfw
forwarding tag it may handle connections for addresses that do not
belongs to the jail or even current host (transparent proxy).
Syncache code can successfully handle TCP handshake for such connections.
When syncache finally accepts connection it uses in6_pcbconnect() to
properly initlize new connection info.

For IPv4 this scenario just works, but for IPv6 it fails when
local address doesn't belongs to the jail. This check occurs when
in6_pcbladdr() applies IPv6 SAS algorithm.
We need IPv6 SAS when we are connection initiator, but in the above
case connection is already established and both source and destination
addresses are known.

Use unused argument to notify in6_pcbconnect() when we don't need
source address selection. This will fix ipfw fwd to jailed IPv6
address.

When we are connection initiator, we stil use IPv6 SAS algorithm and
apply all related restrictions.

MFC after: 1 month
Sponsored by: Yandex LLC
Differential Revision: https://reviews.freebsd.org/D41685

(cherry picked from commit 0bf5377b6b9642acc85355062b921a07604b7c04)

Details

Provenance
aeAuthored on Sep 14 2023, 8:39 AM
Differential Revision
D41685: Avoid IPv6 source address selection on accepting TCP connections
Parents
rG699526792d2f: isa: Postpone removal of the non-PNP driver until 15
Branches
Unknown
Tags
Unknown