diff options
| author | ae <ae@FreeBSD.org> | 2011-06-07 06:42:29 +0000 |
|---|---|---|
| committer | ae <ae@FreeBSD.org> | 2011-06-07 06:42:29 +0000 |
| commit | fa6e151ccb8412e23311b21d126564de84e84e49 (patch) | |
| tree | 5fbc710af5d95419a369b93465c54a077f84d6d9 /sys/netinet/ipfw | |
| parent | effca0c0196c2c3b53ca3c7fb6b4cf9999de0f55 (diff) | |
| download | FreeBSD-src-fa6e151ccb8412e23311b21d126564de84e84e49.zip FreeBSD-src-fa6e151ccb8412e23311b21d126564de84e84e49.tar.gz | |
Make a behaviour of the libalias based in-kernel NAT a bit closer to
how natd(8) does work. natd(8) drops packets only when libalias returns
PKT_ALIAS_IGNORED and "deny_incoming" option is set, but ipfw_nat
always did drop packets that were not aliased, even if they should
not be aliased and just are going through.
PR: kern/122109, kern/129093, kern/157379
Submitted by: Alexander V. Chernikov (previous version)
MFC after: 1 month
Diffstat (limited to 'sys/netinet/ipfw')
| -rw-r--r-- | sys/netinet/ipfw/ip_fw_nat.c | 22 |
1 files changed, 16 insertions, 6 deletions
diff --git a/sys/netinet/ipfw/ip_fw_nat.c b/sys/netinet/ipfw/ip_fw_nat.c index f8c3e63..fd6f09a 100644 --- a/sys/netinet/ipfw/ip_fw_nat.c +++ b/sys/netinet/ipfw/ip_fw_nat.c @@ -262,17 +262,27 @@ ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m) else retval = LibAliasOut(t->lib, c, mcl->m_len + M_TRAILINGSPACE(mcl)); - if (retval == PKT_ALIAS_RESPOND) { - m->m_flags |= M_SKIP_FIREWALL; - retval = PKT_ALIAS_OK; - } - if (retval != PKT_ALIAS_OK && - retval != PKT_ALIAS_FOUND_HEADER_FRAGMENT) { + + /* + * We drop packet when: + * 1. libalias returns PKT_ALIAS_ERROR; + * 2. For incoming packets: + * a) for unresolved fragments; + * b) libalias returns PKT_ALIAS_IGNORED and + * PKT_ALIAS_DENY_INCOMING flag is set. + */ + if (retval == PKT_ALIAS_ERROR || + (args->oif == NULL && (retval == PKT_ALIAS_UNRESOLVED_FRAGMENT || + (retval == PKT_ALIAS_IGNORED && + (t->lib->packetAliasMode & PKT_ALIAS_DENY_INCOMING) != 0)))) { /* XXX - should i add some logging? */ m_free(mcl); args->m = NULL; return (IP_FW_DENY); } + + if (retval == PKT_ALIAS_RESPOND) + m->m_flags |= M_SKIP_FIREWALL; mcl->m_pkthdr.len = mcl->m_len = ntohs(ip->ip_len); /* |
