Author: ae
Date: Tue Aug 14 07:54:14 2018
New Revision: 337736
URL: https://svnweb.freebsd.org/changeset/base/337736
Log:
Restore ability to send ICMP and ICMPv6 redirects.
It was lost when tryforward appeared. Now ip[6]_tryforward will be enabled
only when sending redirects for corresponding IP version is disabled via
sysctl. Otherwise will be used default forwarding function.
PR: 221137
Submitted by: mckay@
MFC after: 2 weeks
Modified:
head/sys/netinet/ip_input.c
head/sys/netinet6/ip6_input.c
Modified: head/sys/netinet/ip_input.c
==============================================================================
--- head/sys/netinet/ip_input.c Tue Aug 14 05:18:43 2018 (r337735)
+++ head/sys/netinet/ip_input.c Tue Aug 14 07:54:14 2018 (r337736)
@@ -557,13 +557,15 @@ tooshort:
/*
* Try to forward the packet, but if we fail continue.
+ * ip_tryforward() does not generate redirects, so fall
+ * through to normal processing if redirects are required.
* ip_tryforward() does inbound and outbound packet firewall
* processing. If firewall has decided that destination becomes
* our local address, it sets M_FASTFWD_OURS flag. In this
* case skip another inbound firewall processing and update
* ip pointer.
*/
- if (V_ipforwarding != 0
+ if (V_ipforwarding != 0 && V_ipsendredirects == 0
#if defined(IPSEC) || defined(IPSEC_SUPPORT)
&& (!IPSEC_ENABLED(ipv4) ||
IPSEC_CAPS(ipv4, m, IPSEC_CAP_OPERABLE) == 0)
Modified: head/sys/netinet6/ip6_input.c
==============================================================================
--- head/sys/netinet6/ip6_input.c Tue Aug 14 05:18:43 2018
(r337735)
+++ head/sys/netinet6/ip6_input.c Tue Aug 14 07:54:14 2018
(r337736)
@@ -720,13 +720,15 @@ ip6_input(struct mbuf *m)
#endif
/*
* Try to forward the packet, but if we fail continue.
+ * ip6_tryforward() does not generate redirects, so fall
+ * through to normal processing if redirects are required.
* ip6_tryforward() does inbound and outbound packet firewall
* processing. If firewall has decided that destination becomes
* our local address, it sets M_FASTFWD_OURS flag. In this
* case skip another inbound firewall processing and update
* ip6 pointer.
*/
- if (V_ip6_forwarding != 0
+ if (V_ip6_forwarding != 0 && V_ip6_sendredirects == 0
#if defined(IPSEC) || defined(IPSEC_SUPPORT)
&& (!IPSEC_ENABLED(ipv6) ||
IPSEC_CAPS(ipv6, m, IPSEC_CAP_OPERABLE) == 0)
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
