Page MenuHomeFreeBSD

Draft: Forwarding: Use the next hop installed by pfil_mbuf_in
AbandonedPublic

Authored by vegeta_tuxpowered.net on Aug 16 2023, 7:04 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Oct 12, 8:20 AM
Unknown Object (File)
Mon, Sep 29, 5:59 PM
Unknown Object (File)
Mon, Sep 29, 3:18 PM
Unknown Object (File)
Mon, Sep 29, 1:19 PM
Unknown Object (File)
Sat, Sep 27, 1:32 AM
Unknown Object (File)
Fri, Sep 26, 9:24 PM
Unknown Object (File)
Thu, Sep 18, 8:48 PM
Unknown Object (File)
Thu, Sep 18, 11:54 AM

Details

Reviewers
None
Summary

In the fast forwarding path the next hop installed by pfil_mbuf_in is read but then lost.

In the slow forwarding path only the presence of the next hop is checked, then the pfil_mbuf_out hook is called and only after that the next hop from the PACKET_TAG_IPFORWARD tag is applied. This causes firewalls applying the next hop in pfil_mbuf_in to not work correctly when rules are interface-bound because pfil_mbuf_out is called on the interface matching the destination IP address from the IP header instead of then one matching the next hop.

Sponsored by: InnoGames GmbH

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

vegeta_tuxpowered.net retitled this revision from ip_fastfwd: Don't overwrite a next hop installed by pfil to Draft: fastfwd: Don't overwrite a next hop installed by pfil.

Updated to cover the IPv6 forwarding too

vegeta_tuxpowered.net retitled this revision from Draft: fastfwd: Don't overwrite a next hop installed by pfil to Draft: Forwarding: Use the next hop installed by pfil_mbuf_in.
vegeta_tuxpowered.net edited the summary of this revision. (Show Details)