mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-29 05:04:50 +00:00
carp: check CARP status in in_localip_fib(), in6_localip_fib()
Don't report a BACKUP CARP address as local. These two functions are used
only by source address validation for input packets, controlled by sysctls
net.inet.ip.source_address_validation and
net.inet6.ip6.source_address_validation. For this purpose we definitely
want to treat BACKUP addresses as non local.
This change is conservative and doesn't modify compat in_localip() and
in6_localip(). They are used more widely than the FIB-aware versions.
The change would modify the notion of ipfw(4) 'me' keyword. There might
be other consequences as in_localip() is used by various tunneling
protocols.
PR: 277349
(cherry picked from commit 56f7860087
)
This commit is contained in:
parent
77205dbc13
commit
d6e1ae659b
|
@ -167,7 +167,7 @@ in_localip(struct in_addr in)
|
|||
}
|
||||
|
||||
/*
|
||||
* Like in_localip(), but FIB-aware.
|
||||
* Like in_localip(), but FIB-aware and carp(4)-aware.
|
||||
*/
|
||||
bool
|
||||
in_localip_fib(struct in_addr in, uint16_t fib)
|
||||
|
@ -178,6 +178,8 @@ in_localip_fib(struct in_addr in, uint16_t fib)
|
|||
|
||||
CK_LIST_FOREACH(ia, INADDR_HASH(in.s_addr), ia_hash)
|
||||
if (IA_SIN(ia)->sin_addr.s_addr == in.s_addr &&
|
||||
(ia->ia_ifa.ifa_carp == NULL ||
|
||||
carp_master_p(&ia->ia_ifa)) &&
|
||||
ia->ia_ifa.ifa_ifp->if_fib == fib)
|
||||
return (true);
|
||||
|
||||
|
|
|
@ -1807,7 +1807,7 @@ in6_localip(struct in6_addr *in6)
|
|||
}
|
||||
|
||||
/*
|
||||
* Like in6_localip(), but FIB-aware.
|
||||
* Like in6_localip(), but FIB-aware and carp(4)-aware.
|
||||
*/
|
||||
bool
|
||||
in6_localip_fib(struct in6_addr *in6, uint16_t fib)
|
||||
|
@ -1818,6 +1818,8 @@ in6_localip_fib(struct in6_addr *in6, uint16_t fib)
|
|||
IN6_IFADDR_RLOCK(&in6_ifa_tracker);
|
||||
CK_LIST_FOREACH(ia, IN6ADDR_HASH(in6), ia6_hash) {
|
||||
if (IN6_ARE_ADDR_EQUAL(in6, &ia->ia_addr.sin6_addr) &&
|
||||
(ia->ia_ifa.ifa_carp == NULL ||
|
||||
carp_master_p(&ia->ia_ifa)) &&
|
||||
ia->ia_ifa.ifa_ifp->if_fib == fib) {
|
||||
IN6_IFADDR_RUNLOCK(&in6_ifa_tracker);
|
||||
return (true);
|
||||
|
|
Loading…
Reference in a new issue