d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Restore ability to send ICMP and ICMPv6 redirects.

Browse Source 
It was lost when tryforward appeared. Now ip[6]_tryforward will be enabled
only when sending redirects for corresponding IP version is disabled via
sysctl. Otherwise will be used default forwarding function.

PR:		221137
Submitted by:	mckay@
MFC after:	2 weeks
This commit is contained in:
Andrey V. Elsukov 2018-08-14 07:54:14 +00:00
parent 81eb4dcf9e
commit 62484790e0
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet/ip_input.c
View File

@ -557,13 +557,15 @@ ip_input(struct mbuf *m)
/*
* Try to forward the packet, but if we fail continue.
* ip_tryforward() does not generate redirects, so fall
* through to normal processing if redirects are required.
* ip_tryforward() does inbound and outbound packet firewall
* processing. If firewall has decided that destination becomes
* our local address, it sets M_FASTFWD_OURS flag. In this
* case skip another inbound firewall processing and update
* ip pointer.
*/
if (V_ipforwarding != 0
if (V_ipforwarding != 0 && V_ipsendredirects == 0
#if defined(IPSEC) || defined(IPSEC_SUPPORT)
&& (!IPSEC_ENABLED(ipv4) ||
IPSEC_CAPS(ipv4, m, IPSEC_CAP_OPERABLE) == 0)

4
sys/netinet6/ip6_input.c
View File

@ -720,13 +720,15 @@ ip6_input(struct mbuf *m)
#endif
/*
* Try to forward the packet, but if we fail continue.
* ip6_tryforward() does not generate redirects, so fall
* through to normal processing if redirects are required.
* ip6_tryforward() does inbound and outbound packet firewall
* processing. If firewall has decided that destination becomes
* our local address, it sets M_FASTFWD_OURS flag. In this
* case skip another inbound firewall processing and update
* ip6 pointer.
*/
if (V_ip6_forwarding != 0
if (V_ip6_forwarding != 0 && V_ip6_sendredirects == 0
#if defined(IPSEC) || defined(IPSEC_SUPPORT)
&& (!IPSEC_ENABLED(ipv6) ||
IPSEC_CAPS(ipv6, m, IPSEC_CAP_OPERABLE) == 0)