diff options
| author | Markus Friedl <markus@cvs.openbsd.org> | 2005-01-04 19:42:40 +0000 |
|---|---|---|
| committer | Markus Friedl <markus@cvs.openbsd.org> | 2005-01-04 19:42:40 +0000 |
| commit | 0a3089268bf86c6df7169d12474eff34763edbf1 (patch) | |
| tree | 82b0116383944d1d9d66ea3df9782eeaeb3e1788 /sys/netinet/ip_output.c | |
| parent | e0f9857632385849b607c258b89fbb5fa612fd8b (diff) | |
restrict forwarding to ipsec processed traffic of ip.forwarding==2
ok deraadt, henning, fgsch, mcbride
Diffstat (limited to 'sys/netinet/ip_output.c')
| -rw-r--r-- | sys/netinet/ip_output.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index aeb80b98400..d81ff8af4cc 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.168 2004/11/10 03:27:27 mcbride Exp $ */ +/* $OpenBSD: ip_output.c,v 1.169 2005/01/04 19:42:38 markus Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -77,6 +77,7 @@ extern int ipsec_auth_default_level; extern int ipsec_esp_trans_default_level; extern int ipsec_esp_network_default_level; extern int ipsec_ipcomp_default_level; +extern int ipforwarding; #endif /* IPSEC */ static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *); @@ -683,6 +684,15 @@ sendit: hlen = ip->ip_hl << 2; #endif +#ifdef IPSEC + if ((flags & IP_FORWARDING) && (ipforwarding == 2) && + (m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) == NULL)) { + error = EHOSTUNREACH; + m_freem(m); + goto done; + } +#endif + /* * If small enough for interface, can just send directly. */ |