[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: Adding packet filtering to tun interfaces
Le 12/03/2018 à 08:45, Tom Ivar Helbekkmo a écrit :
Maxime Villard <max%M00nBSD.net@localhost> writes:
Doesn't seem correct to me, pfil_run_hooks can return zero but still
free the mbuf.
When can it do that?
It can do that in L4 when handling fragments. When a fragment is received
NPF registers the packet in a list, and returns error=0 *mp=NULL. Later, when
the last fragment is received, the chain is complete; the packets in the list
are concatenated, and this time NPF returns error=0 *mp=reassembled_packet,
giving the "illusion" that the last received fragment was actually the
I think it should rather be:
+ if ((error = pfil_run_hooks(ifp->if_pfil, &m0, ifp, PFIL_OUT)) != 0)
+ goto out;
+ if (m0 == NULL)
+ goto out;
I adapted the pfil_run_hooks() calls from those in if_vlan.c, so they'll
need fixing, too.
Mmh yes, they will need fixing, I missed that.
But now that I'm thinking about it... Are you sure that your change indeed
enforces NPF policies? If you pass ifp->if_pfil normally it doesn't do IP
filtering, unless I missed something else.
Main Index |
Thread Index |