Page MenuHomeFreeBSD
Files F176840053

D61042.1793468571.diff
No OneTemporary
Actions

Authored By
Unknown
Size
3 KB
Referenced Files
None
Subscribers
None

D61042.1793468571.diff
View Options

diff --git a/sys/netinet6/ip6_fastfwd.c b/sys/netinet6/ip6_fastfwd.c
--- a/sys/netinet6/ip6_fastfwd.c
+++ b/sys/netinet6/ip6_fastfwd.c
@@ -160,9 +160,15 @@
*/
if (!PFIL_HOOKED_IN(V_inet6_pfil_head))
goto passin;
- if (pfil_mbuf_in(V_inet6_pfil_head, &m, rcvif, NULL) !=
- PFIL_PASS)
+ switch (pfil_mbuf_in(V_inet6_pfil_head, &m, rcvif, NULL)) {
+ case PFIL_PASS:
+ break;
+ case PFIL_CONSUMED:
+ /* A hook sent the packet on itself (pf route-to). */
+ return (NULL);
+ default:
goto dropin;
+ }
/*
* If packet filter sets the M_FASTFWD_OURS flag, this means
* that new destination or next hop is our local address.
@@ -234,9 +240,18 @@
* Outgoing packet firewall processing.
*/
pfil_dst = ip6->ip6_dst;
- if (pfil_mbuf_fwd(V_inet6_pfil_head, &m, nh->nh_ifp,
- NULL) != PFIL_PASS)
+ switch (pfil_mbuf_fwd(V_inet6_pfil_head, &m, nh->nh_ifp, NULL)) {
+ case PFIL_PASS:
+ break;
+ case PFIL_CONSUMED:
+ /*
+ * A hook sent the packet on itself (pf route-to) or in
+ * fragments (pf refragmentation).
+ */
+ return (NULL);
+ default:
goto dropout;
+ }
/*
* We used slow path processing for packets with scoped addresses.
diff --git a/tests/sys/netpfil/pf/forward.sh b/tests/sys/netpfil/pf/forward.sh
--- a/tests/sys/netpfil/pf/forward.sh
+++ b/tests/sys/netpfil/pf/forward.sh
@@ -320,6 +320,58 @@
pft_cleanup
}
+atf_test_case "v6_route_to_discards" "cleanup"
+v6_route_to_discards_head()
+{
+ atf_set descr 'Test that packets pf sends on with route-to are not counted as discarded'
+ atf_set require.user root
+}
+
+v6_route_to_discards_body()
+{
+ pft_init
+
+ epair_send=$(vnet_mkepair)
+ epair_recv=$(vnet_mkepair)
+ epair_route=$(vnet_mkepair)
+
+ ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled
+ ifconfig ${epair_recv}a up
+ ifconfig ${epair_route}a up
+
+ vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b ${epair_route}b
+
+ jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad
+ jexec alcatraz ifconfig ${epair_recv}b inet6 2001:db8:43::2/64 up no_dad
+ jexec alcatraz ifconfig ${epair_route}b inet6 2001:db8:44::2/64 up no_dad
+ jexec alcatraz sysctl net.inet6.ip6.forwarding=1
+ jexec alcatraz ndp -s 2001:db8:43::3 00:01:02:03:04:05
+ jexec alcatraz ndp -s 2001:db8:44::3 00:01:02:03:04:06
+ jexec alcatraz route add -6 2001:db8:666::/64 2001:db8:43::3
+ route add -6 2001:db8:666::/64 2001:db8:42::2
+
+ jexec alcatraz pfctl -e
+
+ # route-to on the inbound pass: pf consumes the packet in the inbound
+ # hook. On the outbound pass: in the outbound hook, after the route
+ # lookup chose ${epair_recv}b. Neither is a discard.
+ for dir in in out; do
+ pft_set_rules alcatraz \
+ "pass" \
+ "pass ${dir} quick route-to (${epair_route}b 2001:db8:44::3) inet6 to 2001:db8:666::1"
+ atf_check -s exit:2 -o ignore ping -6 -c 1 -W 1 2001:db8:666::1
+ atf_check -o match:"[[:space:]]0 input datagrams discarded" \
+ jexec alcatraz netstat -s -p ip6 -I ${epair_send}b
+ atf_check -o match:"[[:space:]]0 total discarded output datagrams" \
+ jexec alcatraz netstat -s -p ip6 -I ${epair_recv}b
+ done
+}
+
+v6_route_to_discards_cleanup()
+{
+ pft_cleanup
+}
+
atf_init_test_cases()
{
atf_add_test_case "v4"
@@ -327,4 +379,5 @@
atf_add_test_case "v6_hlim"
atf_add_test_case "v6_hlim_decrement"
atf_add_test_case "v6_redirect_rewritten"
+ atf_add_test_case "v6_route_to_discards"
}

File Metadata

Mime Type
text/plain
Expires
Sat, Oct 31, 5:42 PM (18 h, 34 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41267889
Default Alt Text
D61042.1793468571.diff (3 KB)

Event Timeline