Change Details

A new destination for a forwarded packet might be installed by a pfil hook. It might either be a gateway or a result of change of the destination address in the IP header. In case of a gateway installed by pfil_mbuf_in keep it even if pfil_mbuf_out modifies the destination address. Sponsored by: InnoGames GmbH

In the fast forwarding path the next hop installed by pfil_mbuf_in is read but then lost. In the slow forwarding path only the presence of the next hop is checked, then the pfil_mbuf_out hook is called and only after that the next hop from the PACKET_TAG_IPFORWARD tag is applied. This causes firewalls applying the next hop in pfil_mbuf_in to not work correctly when rules are interface-bound because pfil_mbuf_out is called on the interface matching the destination IP address from the IP header instead of then one matching the next hop. Sponsored by: InnoGames GmbH

A new destination for a forwarded packet might be installed by a pfil hook.In the fast forwarding path the next hop installed by pfil_mbuf_in is read but then lost. In the slow forwarding path only the presence of the next hop is checked, It might either be a gateway or a result of change ofthen the pfil_mbuf_out hook is called and only after that the next hop from the destination address in the IP headerPACKET_TAG_IPFORWARD tag is applied. In case of a gateway installed by pfil_mbuf_in keep it even if pfil_mbuf_out modifies the destination addressThis causes firewalls applying the next hop in pfil_mbuf_in to not work correctly when rules are interface-bound because pfil_mbuf_out is called on the interface matching the destination IP address from the IP header instead of then one matching the next hop. Sponsored by: InnoGames GmbH