upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 08:43:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pfil hooks can modify packet contents so check if the destination

Browse source 
address has been changed when PFIL_HOOKS is enabled and, if it has,
arrange for the proper action by ip*_forward.

Submitted by:	Pyun YongHyeon
Supported by:	FreeBSD Foundation
This commit is contained in:
Sam Leffler 2003-10-16 18:57:45 +00:00
parent 034d260750
commit 3c92002f24
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
sys/netinet6/ip6_input.c
View file

@ -247,6 +247,10 @@ ip6_input(m)
int nxt, ours = 0;
struct ifnet *deliverifp = NULL;
#ifdef PFIL_HOOKS
struct in6_addr odst;
#endif
int srcrt = 0;
#ifdef IPSEC
/*
* should the inner packet be considered authentic?
@ -346,7 +350,12 @@ ip6_input(m)
return;
if (m == NULL) /* consumed by filter */
return;
*
* NB: Beware of the destination address changing
* (e.g. by NAT rewriting). When this happens,
* tell ip6_forward to do the right thing.
ip6 = mtod(m, struct ip6_hdr *);
odst = ip6->ip6_dst;
#endif /* PFIL_HOOKS */
ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
@ -356,6 +365,7 @@ ip6_input(m)
*/
if (ip6_fw_enable && ip6_fw_chk_ptr) {
u_short port = 0;
srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
/* If ipfw says divert, we have to just drop packet */
/* use port as a dummy argument */
if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) {
@ -710,7 +720,7 @@ ip6_input(m)
return;
}
} else if (!ours) {
ip6_forward(m, 0);
ip6_forward(m, srcrt);
return;
}