From b9bff254af00b29b6a01d3212c87aa9ed40b960b Mon Sep 17 00:00:00 2001 From: Gleb Smirnoff Date: Tue, 27 Jul 2010 14:26:34 +0000 Subject: [PATCH] Fix operation of "netgraph" action in conjunction with the net.inet.ip.fw.one_pass sysctl. The "ngtee" action is still broken. PR: kern/148885 Submitted by: Nickolay Dudorov --- sys/netgraph/ng_ipfw.c | 3 ++- sys/netinet/ipfw/ip_fw2.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/sys/netgraph/ng_ipfw.c b/sys/netgraph/ng_ipfw.c index 84938830f8fa..68bd89c09e8b 100644 --- a/sys/netgraph/ng_ipfw.c +++ b/sys/netgraph/ng_ipfw.c @@ -287,7 +287,8 @@ ng_ipfw_input(struct mbuf **m0, int dir, struct ip_fw_args *fwa, int tee) } r = (struct ipfw_rule_ref *)(tag + 1); *r = fwa->rule; - r->info = dir ? IPFW_INFO_IN : IPFW_INFO_OUT; + r->info &= IPFW_ONEPASS; /* keep this info */ + r->info |= dir ? IPFW_INFO_IN : IPFW_INFO_OUT; m_tag_prepend(m, tag); } else diff --git a/sys/netinet/ipfw/ip_fw2.c b/sys/netinet/ipfw/ip_fw2.c index abbe7520d43b..c291089c6f85 100644 --- a/sys/netinet/ipfw/ip_fw2.c +++ b/sys/netinet/ipfw/ip_fw2.c @@ -2084,6 +2084,8 @@ do { \ set_match(args, f_pos, chain); args->rule.info = (cmd->arg1 == IP_FW_TABLEARG) ? tablearg : cmd->arg1; + if (V_fw_one_pass) + args->rule.info |= IPFW_ONEPASS; retval = (cmd->opcode == O_NETGRAPH) ? IP_FW_NETGRAPH : IP_FW_NGTEE; l = 0; /* exit inner loop */