svn commit: r223819 - stable/8/sys/netinet/ipfw

Andrey V. Elsukov ae at
Wed Jul 6 06:56:31 UTC 2011

Author: ae
Date: Wed Jul  6 06:56:31 2011
New Revision: 223819

  MFC r222582:
    O_FORWARD_IP is only action which depends from the result of lookup of
    dynamic rules. We are doing forwarding in the following cases:
     o For the simple ipfw fwd rule, e.g.
    	fwd ip from any to any out xmit em0
    	fwd,3128 tcp from any to any 80 in recv em1
     o For the dynamic fwd rule, e.g.
     	fwd tcp from any to 3333 setup keep-state
            When this rule triggers it creates a dynamic rule, but this
    	dynamic rule should forward packets only in forward direction.
     o And the last case that does not work before - simple fwd rule which
     triggers when some dynamic rule is already executed.
    PR:		kern/136695, kern/147720, kern/150798

Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/netinet/ipfw/ip_fw2.c
--- stable/8/sys/netinet/ipfw/ip_fw2.c	Wed Jul  6 06:34:08 2011	(r223818)
+++ stable/8/sys/netinet/ipfw/ip_fw2.c	Wed Jul  6 06:56:31 2011	(r223819)
@@ -2070,7 +2070,8 @@ do {								\
 			case O_FORWARD_IP:
 				if (args->eh)	/* not valid on layer2 pkts */
-				if (!q || dyn_dir == MATCH_FORWARD) {
+				if (q == NULL || q->rule != f ||
+				    dyn_dir == MATCH_FORWARD) {
 				    struct sockaddr_in *sa;
 				    sa = &(((ipfw_insn_sa *)cmd)->sa);
 				    if (sa->sin_addr.s_addr == INADDR_ANY) {

More information about the svn-src-stable-8 mailing list