system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-09-29 05:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

carp: check CARP status in in_localip_fib(), in6_localip_fib()

Browse source 
Don't report a BACKUP CARP address as local.  These two functions are used
only by source address validation for input packets, controlled by sysctls
net.inet.ip.source_address_validation and
net.inet6.ip6.source_address_validation.  For this purpose we definitely
want to treat BACKUP addresses as non local.

This change is conservative and doesn't modify compat in_localip() and
in6_localip().  They are used more widely than the FIB-aware versions.
The change would modify the notion of ipfw(4) 'me' keyword.  There might
be other consequences as in_localip() is used by various tunneling
protocols.

PR:			277349
(cherry picked from commit 56f7860087)
This commit is contained in:
Gleb Smirnoff 2024-03-19 11:48:59 -07:00
parent 77205dbc13
commit d6e1ae659b
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sys/netinet/in.c
View file

@ -167,7 +167,7 @@ in_localip(struct in_addr in)
}
/*
* Like in_localip(), but FIB-aware.
* Like in_localip(), but FIB-aware and carp(4)-aware.
*/
bool
in_localip_fib(struct in_addr in, uint16_t fib)
@ -178,6 +178,8 @@ in_localip_fib(struct in_addr in, uint16_t fib)
CK_LIST_FOREACH(ia, INADDR_HASH(in.s_addr), ia_hash)
if (IA_SIN(ia)->sin_addr.s_addr == in.s_addr &&
(ia->ia_ifa.ifa_carp == NULL ||
carp_master_p(&ia->ia_ifa)) &&
ia->ia_ifa.ifa_ifp->if_fib == fib)
return (true);

4
sys/netinet6/in6.c
View file

@ -1807,7 +1807,7 @@ in6_localip(struct in6_addr *in6)
}
/*
* Like in6_localip(), but FIB-aware.
* Like in6_localip(), but FIB-aware and carp(4)-aware.
*/
bool
in6_localip_fib(struct in6_addr *in6, uint16_t fib)
@ -1818,6 +1818,8 @@ in6_localip_fib(struct in6_addr *in6, uint16_t fib)
IN6_IFADDR_RLOCK(&in6_ifa_tracker);
CK_LIST_FOREACH(ia, IN6ADDR_HASH(in6), ia6_hash) {
if (IN6_ARE_ADDR_EQUAL(in6, &ia->ia_addr.sin6_addr) &&
(ia->ia_ifa.ifa_carp == NULL ||
carp_master_p(&ia->ia_ifa)) &&
ia->ia_ifa.ifa_ifp->if_fib == fib) {
IN6_IFADDR_RUNLOCK(&in6_ifa_tracker);
return (true);