diff options
author | ae <ae@FreeBSD.org> | 2012-10-25 09:39:14 +0000 |
---|---|---|
committer | ae <ae@FreeBSD.org> | 2012-10-25 09:39:14 +0000 |
commit | 71112b5a8eb3a8cd3f5d49eff9664a32fec42b56 (patch) | |
tree | 74b574e44bf5e980b33dbec1477301fa3513db78 /sys/netinet6 | |
parent | ae88b227912c0ec48a0dde46fe47f423ca864059 (diff) | |
download | FreeBSD-src-71112b5a8eb3a8cd3f5d49eff9664a32fec42b56.zip FreeBSD-src-71112b5a8eb3a8cd3f5d49eff9664a32fec42b56.tar.gz |
Remove the IPFIREWALL_FORWARD kernel option and make possible to turn
on the related functionality in the runtime via the sysctl variable
net.pfil.forward. It is turned off by default.
Sponsored by: Yandex LLC
Discussed with: net@
MFC after: 2 weeks
Diffstat (limited to 'sys/netinet6')
-rw-r--r-- | sys/netinet6/ip6_forward.c | 8 | ||||
-rw-r--r-- | sys/netinet6/ip6_input.c | 4 | ||||
-rw-r--r-- | sys/netinet6/ip6_output.c | 6 | ||||
-rw-r--r-- | sys/netinet6/udp6_usrreq.c | 10 |
4 files changed, 10 insertions, 18 deletions
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index 3321a95..c1ea400 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -108,9 +108,7 @@ ip6_forward(struct mbuf *m, int srcrt) #ifdef SCTP int sw_csum; #endif -#ifdef IPFIREWALL_FORWARD struct m_tag *fwd_tag; -#endif char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; #ifdef IPSEC @@ -359,9 +357,7 @@ again: dst->sin6_len = sizeof(struct sockaddr_in6); dst->sin6_family = AF_INET6; dst->sin6_addr = ip6->ip6_dst; -#ifdef IPFIREWALL_FORWARD again2: -#endif rin6.ro_rt = in6_rtalloc1((struct sockaddr *)dst, 0, 0, M_GETFIB(m)); if (rin6.ro_rt != NULL) RT_UNLOCK(rin6.ro_rt); @@ -596,7 +592,8 @@ skip_routing: goto again; /* Redo the routing table lookup. */ } -#ifdef IPFIREWALL_FORWARD + if (V_pfilforward == 0) + goto pass; /* See if local, if yes, send it to netisr. */ if (m->m_flags & M_FASTFWD_OURS) { if (m->m_pkthdr.rcvif == NULL) @@ -622,7 +619,6 @@ skip_routing: m_tag_delete(m, fwd_tag); goto again2; } -#endif /* IPFIREWALL_FORWARD */ pass: error = nd6_output(rt->rt_ifp, origifp, m, dst, rt); diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c index f5ec27a..bbb6fdd 100644 --- a/sys/netinet6/ip6_input.c +++ b/sys/netinet6/ip6_input.c @@ -628,7 +628,8 @@ ip6_input(struct mbuf *m) ip6 = mtod(m, struct ip6_hdr *); srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst); -#ifdef IPFIREWALL_FORWARD + if (V_pfilforward == 0) + goto passin; if (m->m_flags & M_FASTFWD_OURS) { m->m_flags &= ~M_FASTFWD_OURS; ours = 1; @@ -644,7 +645,6 @@ ip6_input(struct mbuf *m) ip6_forward(m, 1); goto out; } -#endif /* IPFIREWALL_FORWARD */ passin: /* diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index bb1a673..e7254a6 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -257,9 +257,7 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt, int segleft_org = 0; struct secpolicy *sp = NULL; #endif /* IPSEC */ -#ifdef IPFIREWALL_FORWARD struct m_tag *fwd_tag; -#endif ip6 = mtod(m, struct ip6_hdr *); if (ip6 == NULL) { @@ -915,7 +913,8 @@ again: goto again; /* Redo the routing table lookup. */ } -#ifdef IPFIREWALL_FORWARD + if (V_pfilforward == 0) + goto passout; /* See if local, if yes, send it to netisr. */ if (m->m_flags & M_FASTFWD_OURS) { if (m->m_pkthdr.rcvif == NULL) @@ -941,7 +940,6 @@ again: m_tag_delete(m, fwd_tag); goto again; } -#endif /* IPFIREWALL_FORWARD */ passout: /* diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c index 1afe67b..d7040c4 100644 --- a/sys/netinet6/udp6_usrreq.c +++ b/sys/netinet6/udp6_usrreq.c @@ -92,6 +92,7 @@ __FBSDID("$FreeBSD$"); #include <net/if.h> #include <net/if_types.h> +#include <net/pfil.h> #include <net/route.h> #include <netinet/in.h> @@ -182,9 +183,7 @@ udp6_input(struct mbuf **mp, int *offp, int proto) int off = *offp; int plen, ulen; struct sockaddr_in6 fromsa; -#ifdef IPFIREWALL_FORWARD struct m_tag *fwd_tag; -#endif uint16_t uh_sum; ifp = m->m_pkthdr.rcvif; @@ -393,12 +392,12 @@ udp6_input(struct mbuf **mp, int *offp, int proto) /* * Locate pcb for datagram. */ -#ifdef IPFIREWALL_FORWARD + /* * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. */ - fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); - if (fwd_tag != NULL) { + if (V_pfilforward != 0 && + (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) { struct sockaddr_in6 *next_hop6; next_hop6 = (struct sockaddr_in6 *)(fwd_tag + 1); @@ -425,7 +424,6 @@ udp6_input(struct mbuf **mp, int *offp, int proto) /* Remove the tag from the packet. We don't need it anymore. */ m_tag_delete(m, fwd_tag); } else -#endif /* IPFIREWALL_FORWARD */ inp = in6_pcblookup_mbuf(&V_udbinfo, &ip6->ip6_src, uh->uh_sport, &ip6->ip6_dst, uh->uh_dport, INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, |