From 4fb1f1e2022c76cd6d80c4c885312f56e2d0a596 Mon Sep 17 00:00:00 2001 From: julian Date: Thu, 17 Aug 2006 00:37:03 +0000 Subject: Remove the IPFIREWALL_FORWARD_EXTENDED option and make it on by default as it always was in older versions of FreeBSD. This option is pointless as it is needed in just about every interesting usage of forward that I have ever seen. It doesn't make the system any safer and just wastes huge amounts of develper time when the system doesn't behave as expected when code is moved from 4.x to 6.x It doesn't make the system any safer and just wastes huge amounts of develper time when the system doesn't behave as expected when code is moved from 4.x to 6.x or 7.x Reviewed by: glebius MFC after: 1 week --- sys/netinet/ip_fastfwd.c | 6 +----- sys/netinet/ip_input.c | 4 ---- sys/netinet/ip_output.c | 19 +++++-------------- 3 files changed, 6 insertions(+), 23 deletions(-) (limited to 'sys/netinet') diff --git a/sys/netinet/ip_fastfwd.c b/sys/netinet/ip_fastfwd.c index 3b0496b..ce017d9 100644 --- a/sys/netinet/ip_fastfwd.c +++ b/sys/netinet/ip_fastfwd.c @@ -476,11 +476,7 @@ forwardlocal: */ #ifdef IPFIREWALL_FORWARD if (fwd_tag) { -#ifndef IPFIREWALL_FORWARD_EXTENDED - if (!in_localip(ip->ip_src) && - !in_localaddr(ip->ip_dst)) -#endif - dest.s_addr = ((struct sockaddr_in *) + dest.s_addr = ((struct sockaddr_in *) (fwd_tag + 1))->sin_addr.s_addr; m_tag_delete(m, fwd_tag); } diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index a860074..84768a7 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -423,9 +423,6 @@ tooshort: m->m_flags &= ~M_FASTFWD_OURS; goto ours; } -#ifndef IPFIREWALL_FORWARD_EXTENDED - dchg = (m_tag_find(m, PACKET_TAG_IPFORWARD, NULL) != NULL); -#else if ((dchg = (m_tag_find(m, PACKET_TAG_IPFORWARD, NULL) != NULL)) != 0) { /* * Directly ship on the packet. This allows to forward packets @@ -435,7 +432,6 @@ tooshort: ip_forward(m, dchg); return; } -#endif /* IPFIREWALL_FORWARD_EXTENDED */ #endif /* IPFIREWALL_FORWARD */ passin: diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index dcdc635..8efc288 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -457,20 +457,11 @@ sendit: /* Or forward to some other address? */ fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); if (fwd_tag) { -#ifndef IPFIREWALL_FORWARD_EXTENDED - if (!in_localip(ip->ip_src) && !in_localaddr(ip->ip_dst)) { -#endif - dst = (struct sockaddr_in *)&ro->ro_dst; - bcopy((fwd_tag+1), dst, sizeof(struct sockaddr_in)); - m->m_flags |= M_SKIP_FIREWALL; - m_tag_delete(m, fwd_tag); - goto again; -#ifndef IPFIREWALL_FORWARD_EXTENDED - } else { - m_tag_delete(m, fwd_tag); - /* Continue. */ - } -#endif + dst = (struct sockaddr_in *)&ro->ro_dst; + bcopy((fwd_tag+1), dst, sizeof(struct sockaddr_in)); + m->m_flags |= M_SKIP_FIREWALL; + m_tag_delete(m, fwd_tag); + goto again; } #endif /* IPFIREWALL_FORWARD */ -- cgit v1.1