d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: Improve forwarding detection

Browse Source 
When we guess the nature of the outbound packet (output vs. forwarding) we need
to take bridges into account. When bridging the input interface does not match
the output interface, but we're not forwarding. Similarly, it's possible for the
interface to actually be the bridge interface itself (and not a member interface).

PR:		202351
MFC after:	2 weeks
This commit is contained in:
Kristof Provost 2016-03-16 06:42:15 +00:00
parent 1890c9065c
commit 0d8c93313e
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=296932
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/netpfil/pf/pf.c
View File

@ -6192,11 +6192,13 @@ pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
* We do need to be careful about bridges. If the
* net.link.bridge.pfil_bridge sysctl is set we can be filtering on a
* bridge, so if the input interface is a bridge member and the output
* interface is its bridge we're not actually forwarding but bridging.
* interface is its bridge or a member of the same bridge we're not
* actually forwarding but bridging.
*/
if (dir == PF_OUT && m->m_pkthdr.rcvif && ifp != m->m_pkthdr.rcvif
&& (m->m_pkthdr.rcvif->if_bridge == NULL
|| m->m_pkthdr.rcvif->if_bridge != ifp->if_softc))
if (dir == PF_OUT && m->m_pkthdr.rcvif && ifp != m->m_pkthdr.rcvif &&
(m->m_pkthdr.rcvif->if_bridge == NULL ||
(m->m_pkthdr.rcvif->if_bridge != ifp->if_softc &&
m->m_pkthdr.rcvif->if_bridge != ifp->if_bridge)))
fwdir = PF_FWD;
if (!V_pf_status.running)