Page MenuHomeFreeBSD
Files F163357185

D40256.id122405.diff
No OneTemporary
Actions

D40256.id122405.diff
View Options

diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -136,7 +136,9 @@
CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip_sav), true,
"Drop incoming packets with source address that is a local address");
-VNET_DEFINE(pfil_head_t, inet_pfil_head); /* Packet filter hooks */
+/* Packet filter hooks */
+VNET_DEFINE(pfil_head_t, inet_pfil_head);
+VNET_DEFINE(pfil_head_t, inet_local_pfil_head);
static struct netisr_handler ip_nh = {
.nh_name = "ip",
@@ -326,6 +328,8 @@
args.pa_type = PFIL_TYPE_IP4;
args.pa_headname = PFIL_INET_NAME;
V_inet_pfil_head = pfil_head_register(&args);
+ args.pa_headname = PFIL_INET_LOCAL_NAME;
+ V_inet_local_pfil_head = pfil_head_register(&args);
if (hhook_head_register(HHOOK_TYPE_IPSEC_IN, AF_INET,
&V_ipsec_hhh_in[HHOOK_IPSEC_INET],
@@ -816,6 +820,20 @@
return;
#endif /* IPSTEALTH */
+ /*
+ * We are going to ship the packet to the local protocol stack. Call the
+ * filter again for this 'output' action, allowing redirect-like rules
+ * to adjust the source address.
+ */
+ if (PFIL_HOOKED_OUT(V_inet_local_pfil_head)) {
+ if (pfil_mbuf_out(V_inet_local_pfil_head, &m, V_loif, NULL) !=
+ PFIL_PASS)
+ return;
+ if (m == NULL) /* consumed by filter */
+ return;
+ ip = mtod(m, struct ip *);
+ }
+
/*
* Attempt reassembly; if it succeeds, proceed.
* ip_reass() will return a different mbuf.
diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h
--- a/sys/netinet/ip_var.h
+++ b/sys/netinet/ip_var.h
@@ -255,6 +255,10 @@
#define V_inet_pfil_head VNET(inet_pfil_head)
#define PFIL_INET_NAME "inet"
+VNET_DECLARE(struct pfil_head *, inet_local_pfil_head);
+#define V_inet_local_pfil_head VNET(inet_local_pfil_head)
+#define PFIL_INET_LOCAL_NAME "inet-local"
+
void in_delayed_cksum(struct mbuf *m);
/* Hooks for ipfw, dummynet, divert etc. Most are declared in raw_ip.c */
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -208,6 +208,7 @@
#endif
VNET_DEFINE(pfil_head_t, inet6_pfil_head);
+VNET_DEFINE(pfil_head_t, inet6_local_pfil_head);
VNET_PCPUSTAT_DEFINE(struct ip6stat, ip6stat);
VNET_PCPUSTAT_SYSINIT(ip6stat);
@@ -244,6 +245,8 @@
args.pa_type = PFIL_TYPE_IP6;
args.pa_headname = PFIL_INET6_NAME;
V_inet6_pfil_head = pfil_head_register(&args);
+ args.pa_headname = PFIL_INET6_LOCAL_NAME;
+ V_inet6_local_pfil_head = pfil_head_register(&args);
if (hhook_head_register(HHOOK_TYPE_IPSEC_IN, AF_INET6,
&V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
@@ -884,6 +887,20 @@
return;
}
+ /*
+ * We are going to ship the packet to the local protocol stack. Call the
+ * filter again for this 'output' action, allowing redirect-like rules
+ * to adjust the source address.
+ */
+ if (PFIL_HOOKED_OUT(V_inet6_local_pfil_head)) {
+ if (pfil_mbuf_out(V_inet6_local_pfil_head, &m, V_loif, NULL) !=
+ PFIL_PASS)
+ return;
+ if (m == NULL) /* consumed by filter */
+ return;
+ ip6 = mtod(m, struct ip6_hdr *);
+ }
+
/*
* Tell launch routine the next header
*/
diff --git a/sys/netinet6/ip6_var.h b/sys/netinet6/ip6_var.h
--- a/sys/netinet6/ip6_var.h
+++ b/sys/netinet6/ip6_var.h
@@ -325,6 +325,10 @@
#define V_inet6_pfil_head VNET(inet6_pfil_head)
#define PFIL_INET6_NAME "inet6"
+VNET_DECLARE(struct pfil_head *, inet6_local_pfil_head);
+#define V_inet6_local_pfil_head VNET(inet6_local_pfil_head)
+#define PFIL_INET6_LOCAL_NAME "inet6-local"
+
#ifdef IPSTEALTH
VNET_DECLARE(int, ip6stealth);
#define V_ip6stealth VNET(ip6stealth)
diff --git a/tests/sys/netpfil/pf/rdr.sh b/tests/sys/netpfil/pf/rdr.sh
--- a/tests/sys/netpfil/pf/rdr.sh
+++ b/tests/sys/netpfil/pf/rdr.sh
@@ -67,7 +67,60 @@
pft_cleanup
}
+atf_test_case "local_redirect" "cleanup"
+local_redirect_head()
+{
+ atf_set descr 'Redirect local traffic test'
+ atf_set require.user root
+}
+
+local_redirect_body()
+{
+ pft_init
+
+ bridge=$(vnet_mkbridge)
+ ifconfig ${bridge} 192.0.2.1/24 up
+
+ epair1=$(vnet_mkepair)
+ epair2=$(vnet_mkepair)
+
+ vnet_mkjail first ${epair1}b
+ ifconfig ${epair1}a up
+ ifconfig ${bridge} addm ${epair1}a
+ jexec first ifconfig ${epair1}b 192.0.2.2/24 up
+ jexec first ifconfig lo0 127.0.0.1/8 up
+
+ vnet_mkjail second ${epair2}b
+ ifconfig ${epair2}a up
+ ifconfig ${bridge} addm ${epair2}a
+ jexec second ifconfig ${epair2}b 192.0.2.3/24 up
+ jexec second ifconfig lo0 127.0.0.1/8 up
+ jexec second sysctl net.inet.ip.forwarding=1
+ jexec second sysctl net.inet.ip.filter_local_output=1
+
+ # Enable pf!
+ jexec second pfctl -e
+ jexec second pfilctl link -o pf:default-out inet-local
+ pft_set_rules second \
+ "rdr pass proto tcp from any to 192.0.2.3/24 port 1234 -> 192.0.2.2 port 4321"
+
+ echo "foo" | jexec first nc -N -l 4321 &
+ sleep 1
+
+ # Verify that second can use its rule to redirect local connections to first
+ result=$(jexec second nc -N -w 3 192.0.2.3 1234)
+ if [ "$result" != "foo" ]; then
+ atf_fail "Redirect failed"
+ fi
+}
+
+local_redirect_cleanup()
+{
+ pft_cleanup
+}
+
atf_init_test_cases()
{
atf_add_test_case "basic"
+ atf_add_test_case "local_redirect"
}

File Metadata

Mime Type
text/plain
Expires
Thu, Jul 23, 11:33 AM (6 h, 32 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35400602
Default Alt Text
D40256.id122405.diff (5 KB)

Event Timeline