mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-11-27 08:00:11 +00:00
Code Issues Releases Activity

carp: check CARP status in in_localip_fib(), in6_localip_fib()

Browse Source 
Don't report a BACKUP CARP address as local.  These two functions are used
only by source address validation for input packets, controlled by sysctls
net.inet.ip.source_address_validation and
net.inet6.ip6.source_address_validation.  For this purpose we definitely
want to treat BACKUP addresses as non local.

This change is conservative and doesn't modify compat in_localip() and
in6_localip().  They are used more widely than the FIB-aware versions.
The change would modify the notion of ipfw(4) 'me' keyword.  There might
be other consequences as in_localip() is used by various tunneling
protocols.

PR:			277349
This commit is contained in:
Gleb Smirnoff 2024-03-19 11:48:59 -07:00
parent 470a2b3346
commit 56f7860087
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet/in.c
View File

@ -165,7 +165,7 @@ in_localip(struct in_addr in)
}
/*
* Like in_localip(), but FIB-aware.
* Like in_localip(), but FIB-aware and carp(4)-aware.
*/
bool
in_localip_fib(struct in_addr in, uint16_t fib)
@ -176,6 +176,8 @@ in_localip_fib(struct in_addr in, uint16_t fib)
CK_LIST_FOREACH(ia, INADDR_HASH(in.s_addr), ia_hash)
if (IA_SIN(ia)->sin_addr.s_addr == in.s_addr &&
(ia->ia_ifa.ifa_carp == NULL ||
carp_master_p(&ia->ia_ifa)) &&
ia->ia_ifa.ifa_ifp->if_fib == fib)
return (true);

4
sys/netinet6/in6.c
View File

@ -1805,7 +1805,7 @@ in6_localip(struct in6_addr *in6)
}
/*
* Like in6_localip(), but FIB-aware.
* Like in6_localip(), but FIB-aware and carp(4)-aware.
*/
bool
in6_localip_fib(struct in6_addr *in6, uint16_t fib)
@ -1816,6 +1816,8 @@ in6_localip_fib(struct in6_addr *in6, uint16_t fib)
IN6_IFADDR_RLOCK(&in6_ifa_tracker);
CK_LIST_FOREACH(ia, IN6ADDR_HASH(in6), ia6_hash) {
if (IN6_ARE_ADDR_EQUAL(in6, &ia->ia_addr.sin6_addr) &&
(ia->ia_ifa.ifa_carp == NULL ||
carp_master_p(&ia->ia_ifa)) &&
ia->ia_ifa.ifa_ifp->if_fib == fib) {
IN6_IFADDR_RUNLOCK(&in6_ifa_tracker);
return (true);