jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-12-03 14:48:57 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

MFC r287376

Browse Source 
pf: Fix misdetection of forwarding when net.link.bridge.pfil_bridge is set

If net.link.bridge.pfil_bridge is set we can end up thinking we're forwarding
in pf_test6() because the rcvif and the ifp (output interface) are different.
In that case we're bridging though, and the rcvif the the bridge member on
which the packet was received and ifp is the bridge itself.
If we'd set dir to PF_FWD we'd end up calling ip6_forward() which is
incorrect.

Instead check if the rcvif is a member of the ifp bridge. (In other words, the
if_bridge is the ifp's softc). If that's the case we're not forwarding but
bridging.

PR:   202351
This commit is contained in:
Kristof Provost 2015-09-11 17:19:24 +00:00
parent 49240aaa7c
commit aa4a30d06e
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/stable/10/; revision=287680
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/netpfil/pf/pf.c
View File

@ -6082,7 +6082,17 @@ pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
M_ASSERTPKTHDR(m);
if (dir == PF_OUT && m->m_pkthdr.rcvif && ifp != m->m_pkthdr.rcvif)
/* Detect packet forwarding.
* If the input interface is different from the output interface we're
* forwarding.
* We do need to be careful about bridges. If the
* net.link.bridge.pfil_bridge sysctl is set we can be filtering on a
* bridge, so if the input interface is a bridge member and the output
* interface is its bridge we're not actually forwarding but bridging.
*/
if (dir == PF_OUT && m->m_pkthdr.rcvif && ifp != m->m_pkthdr.rcvif
&& (m->m_pkthdr.rcvif->if_bridge == NULL
|| m->m_pkthdr.rcvif->if_bridge != ifp->if_softc))
fwdir = PF_FWD;
if (!V_pf_status.running)