Page MenuHomeFreeBSD
Files F176840037

D61034.1793468487.diff
No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

D61034.1793468487.diff
View Options

diff --git a/sys/netinet6/ip6_fastfwd.c b/sys/netinet6/ip6_fastfwd.c
--- a/sys/netinet6/ip6_fastfwd.c
+++ b/sys/netinet6/ip6_fastfwd.c
@@ -145,19 +145,6 @@
m->m_pkthdr.len);
}
- /*
- * Hop limit.
- */
-#ifdef IPSTEALTH
- if (!V_ip6stealth)
-#endif
- if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
- icmp6_error(m, ICMP6_TIME_EXCEEDED,
- ICMP6_TIME_EXCEED_TRANSIT, 0);
- m = NULL;
- goto dropin;
- }
-
bzero(&dst, sizeof(dst));
dst.sin6_family = AF_INET6;
dst.sin6_len = sizeof(dst);
@@ -197,6 +184,19 @@
dst.sin6_addr = ip6->ip6_dst;
}
passin:
+ /*
+ * Hop limit, checked after the inbound hooks as on the other
+ * forwarding paths: a packet they drop gets no time exceeded error.
+ */
+#ifdef IPSTEALTH
+ if (!V_ip6stealth)
+#endif
+ if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
+ icmp6_error(m, ICMP6_TIME_EXCEEDED,
+ ICMP6_TIME_EXCEED_TRANSIT, 0);
+ m = NULL;
+ goto dropin;
+ }
/*
* Find route to destination.
*/
diff --git a/tests/sys/netpfil/pf/forward.sh b/tests/sys/netpfil/pf/forward.sh
--- a/tests/sys/netpfil/pf/forward.sh
+++ b/tests/sys/netpfil/pf/forward.sh
@@ -163,8 +163,57 @@
pft_cleanup
}
+atf_test_case "v6_hlim" "cleanup"
+v6_hlim_head()
+{
+ atf_set descr 'Test that packets pf blocks get no time exceeded error'
+ atf_set require.user root
+}
+
+v6_hlim_body()
+{
+ pft_init
+
+ epair_send=$(vnet_mkepair)
+ epair_recv=$(vnet_mkepair)
+
+ ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled
+ ifconfig ${epair_recv}a up
+
+ vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b
+
+ jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad
+ jexec alcatraz ifconfig ${epair_recv}b inet6 2001:db8:43::2/64 up no_dad
+ jexec alcatraz sysctl net.inet6.ip6.forwarding=1
+ jexec alcatraz ndp -s 2001:db8:43::3 00:01:02:03:04:05
+ route add -6 2001:db8:43::/64 2001:db8:42::2
+
+ jexec alcatraz pfctl -e
+ pft_set_rules alcatraz \
+ "block in inet6 proto icmp6 icmp6-type echoreq"
+
+ for redirect in 0 1; do
+ jexec alcatraz sysctl net.inet6.ip6.redirect=${redirect}
+ atf_check -s exit:2 -o ignore \
+ ping -6 -c 1 -m 1 -W 1 2001:db8:43::3
+ atf_check -o match:"[[:space:]]0 time exceed transit" \
+ jexec alcatraz netstat -s -p icmp6
+ done
+
+ pft_set_rules alcatraz "pass"
+ atf_check -s exit:2 -o ignore ping -6 -c 1 -m 1 -W 1 2001:db8:43::3
+ atf_check -o match:"[[:space:]]1 time exceed transit" \
+ jexec alcatraz netstat -s -p icmp6
+}
+
+v6_hlim_cleanup()
+{
+ pft_cleanup
+}
+
atf_init_test_cases()
{
atf_add_test_case "v4"
atf_add_test_case "v6"
+ atf_add_test_case "v6_hlim"
}

File Metadata

Mime Type
text/plain
Expires
Sat, Oct 31, 5:41 PM (3 h, 37 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41264687
Default Alt Text
D61034.1793468487.diff (2 KB)

Event Timeline