diff options
author | adrian <adrian@FreeBSD.org> | 2009-01-09 16:02:19 +0000 |
---|---|---|
committer | adrian <adrian@FreeBSD.org> | 2009-01-09 16:02:19 +0000 |
commit | e2eee65f2168a3fcb7a12e27d463de4003f878c8 (patch) | |
tree | 8c07cef62e1d76619aefbcb33f9d854e35d8a18b /sys/netinet/in_pcb.h | |
parent | 1a2c174bc92cc7dcd1bcd0abdc0aee5a57aeacb5 (diff) | |
download | FreeBSD-src-e2eee65f2168a3fcb7a12e27d463de4003f878c8.zip FreeBSD-src-e2eee65f2168a3fcb7a12e27d463de4003f878c8.tar.gz |
Implement a new IP option (not compiled/enabled by default) to allow
applications to specify a non-local IP address when bind()'ing a socket
to a local endpoint.
This allows applications to spoof the client IP address of connections
if (obviously!) they somehow are able to receive the traffic normally
destined to said clients.
This patch doesn't include any changes to ipfw or the bridging code to
redirect the client traffic through the PCB checks so TCP gets a shot
at it. The normal behaviour is that packets with a non-local destination
IP address are not handled locally. This can be dealth with some IPFW hackery;
modifications to IPFW to make this less hacky will occur in subsequent
commmits.
Thanks to Julian Elischer and others at Ironport. This work was approved
and donated before Cisco acquired them.
Obtained from: Julian Elischer and others
MFC after: 2 weeks
Diffstat (limited to 'sys/netinet/in_pcb.h')
-rw-r--r-- | sys/netinet/in_pcb.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h index 01636fe..acc6404 100644 --- a/sys/netinet/in_pcb.h +++ b/sys/netinet/in_pcb.h @@ -411,6 +411,8 @@ void inp_4tuple_get(struct inpcb *inp, uint32_t *laddr, uint16_t *lp, #define INP_FAITH 0x200 /* accept FAITH'ed connections */ #define INP_RECVTTL 0x400 /* receive incoming IP TTL */ #define INP_DONTFRAG 0x800 /* don't fragment packet */ +#define INP_NONLOCALOK 0x1000 /* Allow bind to spoof any address */ + /* - requires options IP_NONLOCALBIND */ #define IN6P_IPV6_V6ONLY 0x008000 /* restrict AF_INET6 socket for v6 */ |