git: d6e1ae659b11 - stable/14 - carp: check CARP status in in_localip_fib(), in6_localip_fib()

The branch stable/14 has been updated by glebius:

URL: https://cgit.FreeBSD.org/src/commit/?id=d6e1ae659b11a13a9c289424735394173907c1d3

commit d6e1ae659b11a13a9c289424735394173907c1d3
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2024-03-19 18:48:59 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2024-03-28 19:35:45 +0000

    carp: check CARP status in in_localip_fib(), in6_localip_fib()
    
    Don't report a BACKUP CARP address as local.  These two functions are used
    only by source address validation for input packets, controlled by sysctls
    net.inet.ip.source_address_validation and
    net.inet6.ip6.source_address_validation.  For this purpose we definitely
    want to treat BACKUP addresses as non local.
    
    This change is conservative and doesn't modify compat in_localip() and
    in6_localip().  They are used more widely than the FIB-aware versions.
    The change would modify the notion of ipfw(4) 'me' keyword.  There might
    be other consequences as in_localip() is used by various tunneling
    protocols.
    
    PR:                     277349
    (cherry picked from commit 56f7860087eec14b4a65310b70bd704e79e1b48c)
---
 sys/netinet/in.c   | 4 +++-
 sys/netinet6/in6.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index a23d32cff3dd..4ef1d9735658 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -167,7 +167,7 @@ in_localip(struct in_addr in)
 }
 
 /*
- * Like in_localip(), but FIB-aware.
+ * Like in_localip(), but FIB-aware and carp(4)-aware.
  */
 bool
 in_localip_fib(struct in_addr in, uint16_t fib)
@@ -178,6 +178,8 @@ in_localip_fib(struct in_addr in, uint16_t fib)
 
 	CK_LIST_FOREACH(ia, INADDR_HASH(in.s_addr), ia_hash)
 		if (IA_SIN(ia)->sin_addr.s_addr == in.s_addr &&
+		    (ia->ia_ifa.ifa_carp == NULL ||
+		    carp_master_p(&ia->ia_ifa)) &&
 		    ia->ia_ifa.ifa_ifp->if_fib == fib)
 			return (true);
 
diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
index 88ee0fdd3181..55d675417c41 100644
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -1807,7 +1807,7 @@ in6_localip(struct in6_addr *in6)
 }
 
 /*
- * Like in6_localip(), but FIB-aware.
+ * Like in6_localip(), but FIB-aware and carp(4)-aware.
  */
 bool
 in6_localip_fib(struct in6_addr *in6, uint16_t fib)
@@ -1818,6 +1818,8 @@ in6_localip_fib(struct in6_addr *in6, uint16_t fib)
 	IN6_IFADDR_RLOCK(&in6_ifa_tracker);
 	CK_LIST_FOREACH(ia, IN6ADDR_HASH(in6), ia6_hash) {
 		if (IN6_ARE_ADDR_EQUAL(in6, &ia->ia_addr.sin6_addr) &&
+		    (ia->ia_ifa.ifa_carp == NULL ||
+		    carp_master_p(&ia->ia_ifa)) &&
 		    ia->ia_ifa.ifa_ifp->if_fib == fib) {
 			IN6_IFADDR_RUNLOCK(&in6_ifa_tracker);
 			return (true);