Author: ae
Date: Tue Aug 28 07:24:09 2018
New Revision: 338343
URL: https://svnweb.freebsd.org/changeset/base/338343

Log:
  MFC r337736:
    Restore ability to send ICMP and ICMPv6 redirects.
  
    It was lost when tryforward appeared. Now ip[6]_tryforward will be enabled
    only when sending redirects for corresponding IP version is disabled via
    sysctl. Otherwise will be used default forwarding function.
  
    PR:         221137

Modified:
  stable/11/sys/netinet/ip_input.c
  stable/11/sys/netinet6/ip6_input.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/ip_input.c
==============================================================================
--- stable/11/sys/netinet/ip_input.c    Mon Aug 27 19:34:50 2018        
(r338342)
+++ stable/11/sys/netinet/ip_input.c    Tue Aug 28 07:24:09 2018        
(r338343)
@@ -555,13 +555,15 @@ tooshort:
 
        /*
         * Try to forward the packet, but if we fail continue.
+        * ip_tryforward() does not generate redirects, so fall
+        * through to normal processing if redirects are required.
         * ip_tryforward() does inbound and outbound packet firewall
         * processing. If firewall has decided that destination becomes
         * our local address, it sets M_FASTFWD_OURS flag. In this
         * case skip another inbound firewall processing and update
         * ip pointer.
         */
-       if (V_ipforwarding != 0
+       if (V_ipforwarding != 0 && V_ipsendredirects == 0
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
            && (!IPSEC_ENABLED(ipv4) ||
            IPSEC_CAPS(ipv4, m, IPSEC_CAP_OPERABLE) == 0)

Modified: stable/11/sys/netinet6/ip6_input.c
==============================================================================
--- stable/11/sys/netinet6/ip6_input.c  Mon Aug 27 19:34:50 2018        
(r338342)
+++ stable/11/sys/netinet6/ip6_input.c  Tue Aug 28 07:24:09 2018        
(r338343)
@@ -718,13 +718,15 @@ ip6_input(struct mbuf *m)
 #endif
        /*
         * Try to forward the packet, but if we fail continue.
+        * ip6_tryforward() does not generate redirects, so fall
+        * through to normal processing if redirects are required.
         * ip6_tryforward() does inbound and outbound packet firewall
         * processing. If firewall has decided that destination becomes
         * our local address, it sets M_FASTFWD_OURS flag. In this
         * case skip another inbound firewall processing and update
         * ip6 pointer.
         */
-       if (V_ip6_forwarding != 0
+       if (V_ip6_forwarding != 0 && V_ip6_sendredirects == 0
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
            && (!IPSEC_ENABLED(ipv6) ||
            IPSEC_CAPS(ipv6, m, IPSEC_CAP_OPERABLE) == 0)
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to