Page MenuHomeFreeBSD
Files F109589309

D8764.id23086.diff
No OneTemporary
Actions

D8764.id23086.diff
View Options

Index: head/sys/netinet/ip_input.c
===================================================================
--- head/sys/netinet/ip_input.c
+++ head/sys/netinet/ip_input.c
@@ -550,24 +550,35 @@
m_adj(m, ip_len - m->m_pkthdr.len);
}
- /* Try to forward the packet, but if we fail continue */
+ /*
+ * Try to forward the packet, but if we fail continue.
+ * ip_tryforward() does inbound and outbound packet firewall
+ * processing. If firewall has decided that destination becomes
+ * our local address, it sets M_FASTFWD_OURS flag. In this
+ * case skip another inbound firewall processing and update
+ * ip pointer.
+ */
+ if (V_ipforwarding != 0
#ifdef IPSEC
- /* For now we do not handle IPSEC in tryforward. */
- if (!key_havesp(IPSEC_DIR_INBOUND) && !key_havesp(IPSEC_DIR_OUTBOUND) &&
- (V_ipforwarding == 1))
- if (ip_tryforward(m) == NULL)
+ && !key_havesp(IPSEC_DIR_INBOUND)
+ && !key_havesp(IPSEC_DIR_OUTBOUND)
+#endif
+ ) {
+ if ((m = ip_tryforward(m)) == NULL)
return;
+ if (m->m_flags & M_FASTFWD_OURS) {
+ m->m_flags &= ~M_FASTFWD_OURS;
+ ip = mtod(m, struct ip *);
+ goto ours;
+ }
+ }
+#ifdef IPSEC
/*
* Bypass packet filtering for packets previously handled by IPsec.
*/
if (ip_ipsec_filtertunnel(m))
goto passin;
-#else
- if (V_ipforwarding == 1)
- if (ip_tryforward(m) == NULL)
- return;
-#endif /* IPSEC */
-
+#endif
/*
* Run through list of hooks for input packets.
*
Index: head/sys/netinet6/ip6_input.c
===================================================================
--- head/sys/netinet6/ip6_input.c
+++ head/sys/netinet6/ip6_input.c
@@ -726,23 +726,36 @@
goto bad;
}
#endif
- /* Try to forward the packet, but if we fail continue */
+ /*
+ * Try to forward the packet, but if we fail continue.
+ * ip6_tryforward() does inbound and outbound packet firewall
+ * processing. If firewall has decided that destination becomes
+ * our local address, it sets M_FASTFWD_OURS flag. In this
+ * case skip another inbound firewall processing and update
+ * ip6 pointer.
+ */
+ if (V_ip6_forwarding != 0
#ifdef IPSEC
- if (V_ip6_forwarding != 0 && !key_havesp(IPSEC_DIR_INBOUND) &&
- !key_havesp(IPSEC_DIR_OUTBOUND))
- if (ip6_tryforward(m) == NULL)
+ && !key_havesp(IPSEC_DIR_INBOUND)
+ && !key_havesp(IPSEC_DIR_OUTBOUND)
+#endif
+ ) {
+ if ((m = ip6_tryforward(m)) == NULL)
return;
+ if (m->m_flags & M_FASTFWD_OURS) {
+ m->m_flags &= ~M_FASTFWD_OURS;
+ ours = 1;
+ ip6 = mtod(m, struct ip6_hdr *);
+ goto hbhcheck;
+ }
+ }
+#ifdef IPSEC
/*
* Bypass packet filtering for packets previously handled by IPsec.
*/
if (ip6_ipsec_filtertunnel(m))
goto passin;
-#else
- if (V_ip6_forwarding != 0)
- if (ip6_tryforward(m) == NULL)
- return;
-#endif /* IPSEC */
-
+#endif
/*
* Run through list of hooks for input packets.
*
@@ -750,12 +763,12 @@
* (e.g. by NAT rewriting). When this happens,
* tell ip6_forward to do the right thing.
*/
- odst = ip6->ip6_dst;
/* Jump over all PFIL processing if hooks are not active. */
if (!PFIL_HOOKED(&V_inet6_pfil_hook))
goto passin;
+ odst = ip6->ip6_dst;
if (pfil_run_hooks(&V_inet6_pfil_hook, &m,
m->m_pkthdr.rcvif, PFIL_IN, NULL))
return;

File Metadata

Mime Type
text/plain
Expires
Sat, Feb 8, 3:15 AM (20 h, 27 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
16518208
Default Alt Text
D8764.id23086.diff (3 KB)

Event Timeline