Page MenuHomeFreeBSD
Files F167683729

D59068.diff
No OneTemporary
Actions

D59068.diff
View Options

diff --git a/sys/netpfil/pf/pf.h b/sys/netpfil/pf/pf.h
--- a/sys/netpfil/pf/pf.h
+++ b/sys/netpfil/pf/pf.h
@@ -752,5 +752,14 @@
RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
int pf_get_ruleset_number(u_int8_t);
+#ifdef _KERNEL
+bool pf_isforlocal(struct mbuf *m, int af);
+#ifdef INET
+void pf_send_ip_mbuf(struct mbuf *m);
+#endif
+#ifdef INET6
+void pf_send_ip6_mbuf(struct mbuf *m);
+#endif
+#endif /* _KERNEL */
#endif /* _NET_PF_H_ */
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -2491,7 +2491,7 @@
swi_sched(V_pf_swi_cookie, 0);
}
-static bool
+bool
pf_isforlocal(struct mbuf *m, int af)
{
switch (af) {
@@ -2693,6 +2693,43 @@
return (0); /* These types match to their own state */
}
+#ifdef INET
+void
+pf_send_ip_mbuf(struct mbuf *m)
+{
+ if (pf_isforlocal(m, AF_INET)) {
+ KASSERT(m->m_pkthdr.rcvif == V_loif,
+ ("%s: rcvif != loif", __func__));
+
+ m->m_flags |= M_SKIP_FIREWALL;
+ m->m_pkthdr.csum_flags |= CSUM_IP_VALID | CSUM_IP_CHECKED |
+ CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
+ m->m_pkthdr.csum_data = 0xffff;
+ ip_input(m);
+ } else {
+ ip_output(m, NULL, NULL, 0, NULL, NULL);
+ }
+}
+#endif
+
+#ifdef INET6
+void
+pf_send_ip6_mbuf(struct mbuf *m)
+{
+ if (pf_isforlocal(m, AF_INET6)) {
+ KASSERT(m->m_pkthdr.rcvif == V_loif,
+ ("%s: rcvif != loif", __func__));
+
+ m->m_flags |= M_SKIP_FIREWALL | M_LOOP;
+ m->m_pkthdr.csum_flags |= CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
+ m->m_pkthdr.csum_data = 0xffff;
+ ip6_input(m);
+ } else {
+ ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
+ }
+}
+#endif
+
void
pf_intr(void *v)
{
@@ -2713,20 +2750,7 @@
switch (pfse->pfse_type) {
#ifdef INET
case PFSE_IP: {
- if (pf_isforlocal(pfse->pfse_m, AF_INET)) {
- KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif,
- ("%s: rcvif != loif", __func__));
-
- pfse->pfse_m->m_flags |= M_SKIP_FIREWALL;
- pfse->pfse_m->m_pkthdr.csum_flags |=
- CSUM_IP_VALID | CSUM_IP_CHECKED |
- CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
- pfse->pfse_m->m_pkthdr.csum_data = 0xffff;
- ip_input(pfse->pfse_m);
- } else {
- ip_output(pfse->pfse_m, NULL, NULL, 0, NULL,
- NULL);
- }
+ pf_send_ip_mbuf(pfse->pfse_m);
break;
}
case PFSE_ICMP:
@@ -2736,20 +2760,7 @@
#endif /* INET */
#ifdef INET6
case PFSE_IP6:
- if (pf_isforlocal(pfse->pfse_m, AF_INET6)) {
- KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif,
- ("%s: rcvif != loif", __func__));
-
- pfse->pfse_m->m_flags |= M_SKIP_FIREWALL |
- M_LOOP;
- pfse->pfse_m->m_pkthdr.csum_flags |=
- CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
- pfse->pfse_m->m_pkthdr.csum_data = 0xffff;
- ip6_input(pfse->pfse_m);
- } else {
- ip6_output(pfse->pfse_m, NULL, NULL, 0, NULL,
- NULL, NULL);
- }
+ pf_send_ip6_mbuf(pfse->pfse_m);
break;
case PFSE_ICMP6:
icmp6_error(pfse->pfse_m, pfse->icmpopts.type,
diff --git a/sys/netpfil/pf/pf_syncookies.c b/sys/netpfil/pf/pf_syncookies.c
--- a/sys/netpfil/pf/pf_syncookies.c
+++ b/sys/netpfil/pf/pf_syncookies.c
@@ -60,6 +60,9 @@
//#include "pflog.h"
+#include "opt_inet.h"
+#include "opt_inet6.h"
+
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/mbuf.h>
@@ -80,11 +83,16 @@
#include <net/route.h>
#include <netinet/in.h>
+#include <netinet/in_var.h>
#include <netinet/in_pcb.h>
#include <netinet/ip.h>
+#include <netinet/ip_var.h>
#include <netinet/tcp.h>
#include <netinet/tcp_var.h>
+#include <netinet/ip6.h>
+#include <netinet6/ip6_var.h>
+
#include <net/pfvar.h>
#include <netpfil/pf/pf_nv.h>
@@ -291,13 +299,31 @@
{
uint16_t mss;
uint32_t iss;
+ struct mbuf *m;
mss = max(V_tcp_mssdflt, pf_get_mss(pd));
iss = pf_syncookie_generate(pd, mss);
- pf_send_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport,
- iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN|TH_ACK, 0, mss,
- 0, M_SKIP_FIREWALL | (pd->m->m_flags & M_LOOP), 0, 0,
+
+ m = pf_build_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport,
+ iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN | TH_ACK, 0, mss, 0,
+ M_SKIP_FIREWALL | (pd->m->m_flags & M_LOOP), 0, 0, 0,
pd->act.rtableid, reason);
+ if (m == NULL)
+ return;
+ switch (pd->af) {
+#ifdef INET
+ case AF_INET:
+ pf_send_ip_mbuf(m);
+ break;
+#endif /* INET */
+#ifdef INET6
+ case AF_INET6:
+ pf_send_ip6_mbuf(m);
+ break;
+#endif /* INET6 */
+ default:
+ unhandled_af(pd->af);
+ }
counter_u64_add(V_pf_status.lcounters[KLCNT_SYNCOOKIES_SENT], 1);
/* XXX Maybe only in adaptive mode? */
atomic_add_64(&V_pf_status.syncookies_inflight[V_pf_syncookie_status.oddeven],

File Metadata

Mime Type
text/plain
Expires
Mon, Aug 24, 6:25 PM (2 h, 11 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
37172984
Default Alt Text
D59068.diff (4 KB)

Event Timeline