diff options
| author | Eugene Grosbein <eugen@FreeBSD.org> | 2018-10-27 07:32:26 +0000 |
|---|---|---|
| committer | Eugene Grosbein <eugen@FreeBSD.org> | 2018-10-27 07:32:26 +0000 |
| commit | 5310c191741e6b26b007f02cec3236787228ba69 (patch) | |
| tree | 85d87806fb7bd778d8f8ade2b012749931a2f1bf /sys | |
| parent | 9edef078cc0e3ea7d789b5df6a762ae1718cbb8f (diff) | |
Notes
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netpfil/ipfw/ip_fw_pfil.c | 24 |
1 files changed, 19 insertions, 5 deletions
diff --git a/sys/netpfil/ipfw/ip_fw_pfil.c b/sys/netpfil/ipfw/ip_fw_pfil.c index 56d5e9f9e780..c16471db4434 100644 --- a/sys/netpfil/ipfw/ip_fw_pfil.c +++ b/sys/netpfil/ipfw/ip_fw_pfil.c @@ -317,11 +317,12 @@ ipfw_check_frame(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir, struct ip_fw_args args; struct m_tag *mtag; + bzero(&args, sizeof(args)); + +again: /* fetch start point from rule, if any. remove the tag if present. */ mtag = m_tag_locate(*m0, MTAG_IPFW_RULE, 0, NULL); - if (mtag == NULL) { - args.rule.slot = 0; - } else { + if (mtag != NULL) { args.rule = *((struct ipfw_rule_ref *)(mtag+1)); m_tag_delete(*m0, mtag); if (args.rule.info & IPFW_ONEPASS) @@ -378,15 +379,28 @@ ipfw_check_frame(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir, case IP_FW_DUMMYNET: ret = EACCES; + int dir2; if (ip_dn_io_ptr == NULL) break; /* i.e. drop */ *m0 = NULL; - dir = (dir == PFIL_IN) ? DIR_IN : DIR_OUT; - ip_dn_io_ptr(&m, dir | PROTO_LAYER2, &args); + dir2 = (dir == PFIL_IN) ? DIR_IN : DIR_OUT; + ip_dn_io_ptr(&m, dir2 | PROTO_LAYER2, &args); return 0; + case IP_FW_NGTEE: + case IP_FW_NETGRAPH: + if (ng_ipfw_input_p == NULL) { + ret = EACCES; + break; /* i.e. drop */ + } + ret = ng_ipfw_input_p(m0, (dir == PFIL_IN) ? DIR_IN : DIR_OUT, + &args, (i == IP_FW_NGTEE) ? 1 : 0); + if (i == IP_FW_NGTEE) /* ignore errors for NGTEE */ + goto again; /* continue with packet */ + break; + default: KASSERT(0, ("%s: unknown retval", __func__)); } |