pf: clear PF_TAG_DUMMYNET for dummynet fast path
ip_dn_io_ptr() (i.e. dummynet_io()) can return the mbuf immediately (as opposed to owning it and later passing it through dummynet_send(), which returns it to pf_test()). In that case we must clear the PF_TAG_DUMMYNET flag to ensure we don't skip any subsequent firewall passes. This can happen if we process a packet in PFIL_IN, set PF_TAG_DUMMYNET on it, pass it to ip_dn_io_ptr() but have it returned immediately. The packet continues its normal path, eventually hitting pf_test(dir=PFIL_OUT), where we'd skip when we're not supposed to. Sponsored by: Rubicon Communications, LLC ("Netgate")
This commit is contained in:
parent
a85fea31c5
commit
27407a6adc
@ -7300,6 +7300,8 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *
|
||||
ip_dn_io_ptr(m0, &dnflow);
|
||||
if (*m0 == NULL)
|
||||
action = PF_DROP;
|
||||
else
|
||||
pd.pf_mtag->flags &= ~PF_TAG_DUMMYNET;
|
||||
}
|
||||
}
|
||||
break;
|
||||
@ -7758,6 +7760,8 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
|
||||
ip_dn_io_ptr(m0, &dnflow);
|
||||
if (*m0 == NULL)
|
||||
action = PF_DROP;
|
||||
else
|
||||
pd.pf_mtag->flags &= ~PF_TAG_DUMMYNET;
|
||||
}
|
||||
}
|
||||
break;
|
||||
|
Loading…
Reference in New Issue
Block a user