HomeFreeBSD

netpfil: Introduce PFIL_FWD flag

Description

netpfil: Introduce PFIL_FWD flag

Forwarded packets passed through PFIL_OUT, which made it difficult for
firewalls to figure out if they were forwarding or producing packets. This in
turn is an issue for pf for IPv6 fragment handling: it needs to call
ip6_output() or ip6_forward() to handle the fragments. Figuring out which was
difficult (and until now, incorrect).
Having pfil distinguish the two removes an ugly piece of code from pf.

Introduce a new variant of the netpfil callbacks with a flags variable, which
has PFIL_FWD set for forwarded packets. This allows pf to reliably work out if
a packet is forwarded.

Reviewed by: ae, kevans
Differential Revision: https://reviews.freebsd.org/D13715

Details

Committed
kpMar 23 2018, 4:56 PM
Reviewer
ae
Differential Revision
D13715: netpfil: Introduce PFIL_FWD flag
Parents
rS331435: Flag when we have a pending TUR. Don't schedule another one when we
Branches
Unknown
Tags
Unknown