diff options
| author | ae <ae@FreeBSD.org> | 2011-06-01 19:44:52 +0000 |
|---|---|---|
| committer | ae <ae@FreeBSD.org> | 2011-06-01 19:44:52 +0000 |
| commit | e19bc4159fdd38491efea1559b1c00b44370e565 (patch) | |
| tree | 83ca5f843fbfa6ccbf75da672e25bf40a95e0a13 | |
| parent | 9b5209bba0c74f739138641bc5061bd67b995fef (diff) | |
| download | FreeBSD-src-e19bc4159fdd38491efea1559b1c00b44370e565.zip FreeBSD-src-e19bc4159fdd38491efea1559b1c00b44370e565.tar.gz | |
O_FORWARD_IP is only action which depends from the result of lookup of
dynamic rules. We are doing forwarding in the following cases:
o For the simple ipfw fwd rule, e.g.
fwd 10.0.0.1 ip from any to any out xmit em0
fwd 127.0.0.1,3128 tcp from any to any 80 in recv em1
o For the dynamic fwd rule, e.g.
fwd 192.168.0.1 tcp from any to 10.0.0.3 3333 setup keep-state
When this rule triggers it creates a dynamic rule, but this
dynamic rule should forward packets only in forward direction.
o And the last case that does not work before - simple fwd rule which
triggers when some dynamic rule is already executed.
PR: kern/147720, kern/150798
MFC after: 1 month
| -rw-r--r-- | sys/netinet/ipfw/ip_fw2.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/netinet/ipfw/ip_fw2.c b/sys/netinet/ipfw/ip_fw2.c index 6672084..b4d3abb 100644 --- a/sys/netinet/ipfw/ip_fw2.c +++ b/sys/netinet/ipfw/ip_fw2.c @@ -2118,7 +2118,8 @@ do { \ case O_FORWARD_IP: if (args->eh) /* not valid on layer2 pkts */ break; - if (!q || dyn_dir == MATCH_FORWARD) { + if (q == NULL || q->rule != f || + dyn_dir == MATCH_FORWARD) { struct sockaddr_in *sa; sa = &(((ipfw_insn_sa *)cmd)->sa); if (sa->sin_addr.s_addr == INADDR_ANY) { |
