upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-19 08:25:22 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Correct pfil_run_hooks return handling: if the return value is non-zero

Browse source 
then the mbuf has been consumed by a hook; otherwise beware of a null
mbuf return (gack).  In particular the bridge was doing the wrong thing.
While in the ipv6 code make it's handling of pfil_run_hooks identical
to netbsd.

Pointed out by:	Pyun YongHyeon <yongari@kt-is.co.kr>
This commit is contained in:
Sam Leffler 2003-09-30 04:46:08 +00:00
parent 9afe34c150
commit b140bc1fc8
3 changed files with 11 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
sys/net/bridge.c
View file

@ -1020,13 +1020,11 @@ bdg_forward(struct mbuf *m0, struct ifnet *dst)
ip->ip_off = ntohs(ip->ip_off);
if (pfil_run_hooks(&inet_pfil_hook, &m0, src, PFIL_IN) != 0) {
EH_RESTORE(m0); /* restore Ethernet header */
return m0;
}
if (m0 == NULL) {
bdg_dropped++;
/* NB: hook should consume packet */
return NULL;
}
if (m0 == NULL) /* consumed by filter */
return m0;
/*
* If we get here, the firewall has passed the pkt, but the mbuf
* pointer might have changed. Restore ip and the fields ntohs()'d.

10
sys/netinet6/ip6_forward.c
View file

@ -522,10 +522,9 @@ ip6_forward(m, srcrt)
/*
* Run through list of hooks for output packets.
*/
if (pfil_run_hooks(&inet6_pfil_hook, &m, rt->rt_ifp, PFIL_OUT) != 0) {
error = EHOSTUNREACH;
goto freecopy;
}
error = pfil_run_hooks(&inet6_pfil_hook, &m, rt->rt_ifp, PFIL_OUT);
if (error != 0)
goto senderr;
if (m == NULL)
goto freecopy;
ip6 = mtod(m, struct ip6_hdr *);
@ -545,6 +544,9 @@ ip6_forward(m, srcrt)
goto freecopy;
}
}
#ifdef PFIL_HOOKS
senderr:
#endif
if (mcopy == NULL)
return;
switch (error) {

7
sys/netinet6/ip6_output.c
View file

@ -926,11 +926,8 @@ skip_ipsec2:;
/*
* Run through list of hooks for output packets.
*/
if (pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT) != 0) {
error = EHOSTUNREACH;
goto done;
}
if (m == NULL)
error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT);
if (error != 0 || m == NULL)
goto done;
ip6 = mtod(m, struct ip6_hdr *);
#endif /* PFIL_HOOKS */