diff options
author | andre <andre@FreeBSD.org> | 2004-07-21 19:55:14 +0000 |
---|---|---|
committer | andre <andre@FreeBSD.org> | 2004-07-21 19:55:14 +0000 |
commit | 695543e4da52de37acbefbb1254b7aae54bd0709 (patch) | |
tree | 16192d1db35e0904d9375d363cb7095980967e44 | |
parent | 697fd69b851e325aff839d56bd1bda29af5b50f5 (diff) | |
download | FreeBSD-src-695543e4da52de37acbefbb1254b7aae54bd0709.zip FreeBSD-src-695543e4da52de37acbefbb1254b7aae54bd0709.tar.gz |
Extend versrcreach by checking against the rt_flags for RTF_REJECT and
RTF_BLACKHOLE as well.
To quote the submitter:
The uRPF loose-check implementation by the industry vendors, at least on Cisco
and possibly Juniper, will fail the check if the route of the source address
is pointed to Null0 (on Juniper, discard or reject route). What this means is,
even if uRPF Loose-check finds the route, if the route is pointed to blackhole,
uRPF loose-check must fail. This allows people to utilize uRPF loose-check mode
as a pseudo-packet-firewall without using any manual filtering configuration --
one can simply inject a IGP or BGP prefix with next-hop set to a static route
that directs to null/discard facility. This results in uRPF Loose-check failing
on all packets with source addresses that are within the range of the nullroute.
Submitted by: James Jun <james@towardex.com>
-rw-r--r-- | sbin/ipfw/ipfw.8 | 4 | ||||
-rw-r--r-- | sys/netinet/ip_fw2.c | 6 |
2 files changed, 8 insertions, 2 deletions
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index 9197b6b..e985fa9 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -1267,8 +1267,8 @@ packets with source addresses not from this interface. .It Cm versrcreach For incoming packets, a routing table lookup is done on the packet's source address. -If a route to the source address exists, but not the default route, -the packet matches. +If a route to the source address exists, but not the default route +or a blackhole/reject route, the packet matches. Otherwise the packet does not match. All outgoing packets match. .Pp diff --git a/sys/netinet/ip_fw2.c b/sys/netinet/ip_fw2.c index 0b6f754..de6abf3 100644 --- a/sys/netinet/ip_fw2.c +++ b/sys/netinet/ip_fw2.c @@ -506,6 +506,12 @@ verify_path(struct in_addr src, struct ifnet *ifp) return 0; } + /* or if this is a blackhole/reject route */ + if (ifp == NULL && ro.ro_rt->rt_flags & (RTF_REJECT|RTF_BLACKHOLE)) { + RTFREE(ro.ro_rt); + return 0; + } + /* found valid route */ RTFREE(ro.ro_rt); return 1; |