Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 27 May 2009 12:44:36 +0000 (UTC)
From:      Edward Tomasz Napierala <trasz@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r192893 - head/sys/netinet
Message-ID:  <200905271244.n4RCiaRP097325@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: trasz
Date: Wed May 27 12:44:36 2009
New Revision: 192893
URL: http://svn.freebsd.org/changeset/base/192893

Log:
  Don't discard packets with 'Destination Unreachable' at the beginning
  of ip_forward(), if the IPSEC is compiled in.  It is possible that there
  is an SPD that this packets will go through, even if there is no matching
  route.  If not, ICMP will be sent anyway, after ip_output().
  
  This is somewhat similar in purpose to r191621, except that one was
  for the packets sent from the host, while this one is for packets
  being forwarded by the host.
  
  Reviewed by:	bz@
  Sponsored by:	Wheel Sp. z o.o. (http://www.wheel.pl)

Modified:
  head/sys/netinet/ip_input.c

Modified: head/sys/netinet/ip_input.c
==============================================================================
--- head/sys/netinet/ip_input.c	Wed May 27 12:33:57 2009	(r192892)
+++ head/sys/netinet/ip_input.c	Wed May 27 12:44:36 2009	(r192893)
@@ -1356,7 +1356,7 @@ ip_forward(struct mbuf *m, int srcrt)
 {
 	INIT_VNET_INET(curvnet);
 	struct ip *ip = mtod(m, struct ip *);
-	struct in_ifaddr *ia = NULL;
+	struct in_ifaddr *ia;
 	struct mbuf *mcopy;
 	struct in_addr dest;
 	struct route ro;
@@ -1380,10 +1380,17 @@ ip_forward(struct mbuf *m, int srcrt)
 #endif
 
 	ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m));
+#ifndef IPSEC
+	/*
+	 * 'ia' may be NULL if there is no route for this destination.
+	 * In case of IPsec, Don't discard it just yet, but pass it to
+	 * ip_output in case of outgoing IPsec policy.
+	 */
 	if (!srcrt && ia == NULL) {
 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
 		return;
 	}
+#endif
 
 	/*
 	 * Save the IP header and at most 8 bytes of the payload,
@@ -1435,7 +1442,8 @@ ip_forward(struct mbuf *m, int srcrt)
 	 * or a route modified by a redirect.
 	 */
 	dest.s_addr = 0;
-	if (!srcrt && V_ipsendredirects && ia->ia_ifp == m->m_pkthdr.rcvif) {
+	if (!srcrt && V_ipsendredirects &&
+	    ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif) {
 		struct sockaddr_in *sin;
 		struct rtentry *rt;
 
@@ -1502,7 +1510,7 @@ ip_forward(struct mbuf *m, int srcrt)
 		/* type, code set above */
 		break;
 
-	case ENETUNREACH:		/* shouldn't happen, checked above */
+	case ENETUNREACH:
 	case EHOSTUNREACH:
 	case ENETDOWN:
 	case EHOSTDOWN:

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200905271244.n4RCiaRP097325>