Attachment 196187 Details for Bug 221137 – Plausible icmp redirect fix for ipv4 and ipv6

[patch] Plausible icmp redirect fix for ipv4 and ipv6

ipredirectfix (text/plain), 1.72 KB, created by Stephen McKay on 2018-08-14 04:56:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stephen McKay

Created: 2018-08-14 04:56:23 UTC

Size: 1.72 KB

patch

obsolete

>Index: netinet/ip_input.c
>===================================================================
>--- netinet/ip_input.c	(revision 337398)
>+++ netinet/ip_input.c	(working copy)
>@@ -557,6 +557,8 @@
> 
> 	/*
> 	 * Try to forward the packet, but if we fail continue.
>+	 * ip_tryforward() does not generate redirects, so fall
>+	 * through to normal processing if redirects are required.
> 	 * ip_tryforward() does inbound and outbound packet firewall
> 	 * processing. If firewall has decided that destination becomes
> 	 * our local address, it sets M_FASTFWD_OURS flag. In this
>@@ -563,7 +565,7 @@
> 	 * case skip another inbound firewall processing and update
> 	 * ip pointer.
> 	 */
>-	if (V_ipforwarding != 0
>+	if (V_ipforwarding && !V_ipsendredirects
> #if defined(IPSEC) || defined(IPSEC_SUPPORT)
> 	    && (!IPSEC_ENABLED(ipv4) ||
> 	    IPSEC_CAPS(ipv4, m, IPSEC_CAP_OPERABLE) == 0)
>Index: netinet6/ip6_input.c
>===================================================================
>--- netinet6/ip6_input.c	(revision 337398)
>+++ netinet6/ip6_input.c	(working copy)
>@@ -720,6 +720,8 @@
> #endif
> 	/*
> 	 * Try to forward the packet, but if we fail continue.
>+	 * ip6_tryforward() does not generate redirects, so fall
>+	 * through to normal processing if redirects are required.
> 	 * ip6_tryforward() does inbound and outbound packet firewall
> 	 * processing. If firewall has decided that destination becomes
> 	 * our local address, it sets M_FASTFWD_OURS flag. In this
>@@ -726,7 +728,7 @@
> 	 * case skip another inbound firewall processing and update
> 	 * ip6 pointer.
> 	 */
>-	if (V_ip6_forwarding != 0
>+	if (V_ip6_forwarding && !V_ip6_sendredirects
> #if defined(IPSEC) || defined(IPSEC_SUPPORT)
> 	    && (!IPSEC_ENABLED(ipv6) ||
> 	    IPSEC_CAPS(ipv6, m, IPSEC_CAP_OPERABLE) == 0)

Actions: View | Diff

Attachments on bug 221137: 184886 | 185012 | 196187