From owner-freebsd-ipfw Wed Oct 30 9:38: 9 2002 Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A6F2337B404; Wed, 30 Oct 2002 09:38:07 -0800 (PST) Received: from mta6.srv.hcvlny.cv.net (mta6.srv.hcvlny.cv.net [167.206.5.17]) by mx1.FreeBSD.org (Postfix) with ESMTP id E94ED43E6E; Wed, 30 Oct 2002 09:38:04 -0800 (PST) (envelope-from avg@icyb.net.ua) Received: from edge.foundation.invalid (ool-182f90f3.dyn.optonline.net [24.47.144.243]) by mta6.srv.hcvlny.cv.net (iPlanet Messaging Server 5.2 HotFix 0.9 (built Jul 29 2002)) with ESMTP id <0H4T00DO12A8BD@mta6.srv.hcvlny.cv.net>; Wed, 30 Oct 2002 12:37:23 -0500 (EST) Received: from localhost (localhost.foundation.invalid [127.0.0.1]) by edge.foundation.invalid (8.12.6/8.12.3) with ESMTP id g9UHbFTg008733; Wed, 30 Oct 2002 12:37:17 -0500 (EST envelope-from avg@icyb.net.ua) Date: Wed, 30 Oct 2002 12:37:15 -0500 (EST) From: Andriy Gapon Subject: Re: kern/44417: ipfw layer2 rules are not checked for ether_output_frame() on bridged interface In-reply-to: <20021029095521.A12933@carp.icir.org> X-X-Sender: avg@edge.foundation.invalid To: Luigi Rizzo Cc: FreeBSD-gnats-submit@FreeBSD.ORG, freebsd-ipfw@FreeBSD.ORG Message-id: <20021030123045.D8706-100000@edge.foundation.invalid> MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII Content-transfer-encoding: 7BIT Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Luigi, you are right - my patch is incorrect, firewall rules are checked at the wrong place. This one should be better: 391,406d390 < if (rule) /* packet was already bridged */ < goto no_bridge; < < if (BDG_ACTIVE(ifp) ) { < struct ether_header *eh; /* a ptr suffices */ < < m->m_pkthdr.rcvif = NULL; < eh = mtod(m, struct ether_header *); < m_adj(m, ETHER_HDR_LEN); < m = bdg_forward_ptr(m, eh, ifp); < if (m != NULL) < m_freem(m); < return (0); < } < < no_bridge: 432a417,429 > } > > if (BDG_ACTIVE(ifp) ) { > splx(s); /* XXX */ > struct ether_header *eh; /* a ptr suffices */ > > m->m_pkthdr.rcvif = NULL; > eh = mtod(m, struct ether_header *); > m_adj(m, ETHER_HDR_LEN); > m = bdg_forward_ptr(m, eh, ifp); > if (m != NULL) > m_freem(m); > return (0); basically it moves check for bridging to after ipfw stuff. What do you think ? Thank you. -- Andriy Gapon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message