diff options
author | sam <sam@FreeBSD.org> | 2003-11-24 03:57:03 +0000 |
---|---|---|
committer | sam <sam@FreeBSD.org> | 2003-11-24 03:57:03 +0000 |
commit | fa98e6052ae92dd7ca5a7b8e8cf46fc79623a29f (patch) | |
tree | bb218bcd0f96cc500b2f1f62c154a12f8d426f19 /sys/netinet/ip_fw2.c | |
parent | 939be2da2f8bc8c28d0f98fff3a2ba8ab4b9f46a (diff) | |
download | FreeBSD-src-fa98e6052ae92dd7ca5a7b8e8cf46fc79623a29f.zip FreeBSD-src-fa98e6052ae92dd7ca5a7b8e8cf46fc79623a29f.tar.gz |
Correct a problem where ipfw-generated packets were being returned
for ipfw processing w/o an indication the packets were generated
by ipfw--and so should not be processed (this manifested itself
as a LOR.) The flag bit in the mbuf that was used to mark the
packets was not listed in M_COPYFLAGS so if a packet had a header
prepended (as done by IPsec) the flag was lost. Correct this by
defining a new M_PROTO6 flag and use it to mark packets that need
this processing.
Reviewed by: bms
Approved by: re (rwatson)
MFC after: 2 weeks
Diffstat (limited to 'sys/netinet/ip_fw2.c')
-rw-r--r-- | sys/netinet/ip_fw2.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/sys/netinet/ip_fw2.c b/sys/netinet/ip_fw2.c index 19799bc..a532a6d 100644 --- a/sys/netinet/ip_fw2.c +++ b/sys/netinet/ip_fw2.c @@ -82,12 +82,16 @@ #include <machine/in_cksum.h> /* XXX for in_cksum */ /* - * XXX This one should go in sys/mbuf.h. It is used to avoid that - * a firewall-generated packet loops forever through the firewall. + * This is used to avoid that a firewall-generated packet + * loops forever through the firewall. Note that it must + * be a flag that is unused by other protocols that might + * be called from ip_output (e.g. IPsec) and it must be + * listed in M_COPYFLAGS in mbuf.h so that if the mbuf chain + * is altered on the way through ip_output it is not lost. + * It might be better to add an m_tag since the this happens + * infrequently. */ -#ifndef M_SKIP_FIREWALL -#define M_SKIP_FIREWALL 0x4000 -#endif +#define M_SKIP_FIREWALL M_PROTO6 /* * set_disable contains one bit per set value (0..31). |