d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't discard packets with 'Destination Unreachable' at the beginning

Browse Source 
of ip_forward(), if the IPSEC is compiled in.  It is possible that there
is an SPD that this packets will go through, even if there is no matching
route.  If not, ICMP will be sent anyway, after ip_output().

This is somewhat similar in purpose to r191621, except that one was
for the packets sent from the host, while this one is for packets
being forwarded by the host.

Reviewed by:	bz@
Sponsored by:	Wheel Sp. z o.o. (http://www.wheel.pl)
This commit is contained in:
Edward Tomasz Napierala 2009-05-27 12:44:36 +00:00
parent 84ccb25dc7
commit efbad25934
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/netinet/ip_input.c
View File

@ -1356,7 +1356,7 @@ ip_forward(struct mbuf *m, int srcrt)
{
INIT_VNET_INET(curvnet);
struct ip *ip = mtod(m, struct ip *);
struct in_ifaddr *ia = NULL;
struct in_ifaddr *ia;
struct mbuf *mcopy;
struct in_addr dest;
struct route ro;
@ -1380,10 +1380,17 @@ ip_forward(struct mbuf *m, int srcrt)
#endif
ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m));
#ifndef IPSEC
/*
* 'ia' may be NULL if there is no route for this destination.
* In case of IPsec, Don't discard it just yet, but pass it to
* ip_output in case of outgoing IPsec policy.
*/
if (!srcrt && ia == NULL) {
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
return;
}
#endif
/*
* Save the IP header and at most 8 bytes of the payload,
@ -1435,7 +1442,8 @@ ip_forward(struct mbuf *m, int srcrt)
* or a route modified by a redirect.
*/
dest.s_addr = 0;
if (!srcrt && V_ipsendredirects && ia->ia_ifp == m->m_pkthdr.rcvif) {
if (!srcrt && V_ipsendredirects &&
ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif) {
struct sockaddr_in *sin;
struct rtentry *rt;
@ -1502,7 +1510,7 @@ ip_forward(struct mbuf *m, int srcrt)
/* type, code set above */
break;
case ENETUNREACH: /* shouldn't happen, checked above */
case ENETUNREACH:
case EHOSTUNREACH:
case ENETDOWN:
case EHOSTDOWN: