diff options
| -rw-r--r-- | sys/net/pf.c | 30 | ||||
| -rw-r--r-- | sys/net/pfvar.h | 3 |
2 files changed, 27 insertions, 6 deletions
diff --git a/sys/net/pf.c b/sys/net/pf.c index 317e4c9c37b..68110026f76 100644 --- a/sys/net/pf.c +++ b/sys/net/pf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pf.c,v 1.373 2003/07/04 08:24:52 markus Exp $ */ +/* $OpenBSD: pf.c,v 1.374 2003/07/04 10:39:30 henning Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -2102,6 +2102,8 @@ pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, int tag = -1; u_int16_t mss = tcp_mssdflt; + r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); + if (direction == PF_OUT) { bport = nport = th->th_sport; /* check outgoing packet for BINAT/NAT */ @@ -2112,6 +2114,8 @@ pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, pf_change_ap(saddr, &th->th_sport, pd->ip_sum, &th->th_sum, &naddr, nport, 0, af); rewrite++; + if (nat->natpass) + r = NULL; } } else { bport = nport = th->th_dport; @@ -2123,10 +2127,11 @@ pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, pf_change_ap(daddr, &th->th_dport, pd->ip_sum, &th->th_sum, &naddr, nport, 0, af); rewrite++; + if (rdr->natpass) + r = NULL; } } - r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); while (r != NULL) { r->evaluations++; if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || @@ -2416,6 +2421,8 @@ pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, struct pf_tag *pftag = NULL; int tag = -1; + r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); + if (direction == PF_OUT) { bport = nport = uh->uh_sport; /* check outgoing packet for BINAT/NAT */ @@ -2426,6 +2433,8 @@ pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, &uh->uh_sum, &naddr, nport, 1, af); rewrite++; + if (nat->natpass) + r = NULL; } } else { bport = nport = uh->uh_dport; @@ -2437,10 +2446,11 @@ pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, &uh->uh_sum, &naddr, nport, 1, af); rewrite++; + if (rdr->natpass) + r = NULL; } } - r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); while (r != NULL) { r->evaluations++; if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || @@ -2680,6 +2690,8 @@ pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction, #endif /* INET6 */ } + r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); + if (direction == PF_OUT) { /* check outgoing packet for BINAT/NAT */ if ((nat = pf_get_translation(PF_OUT, ifp, pd->proto, @@ -2700,6 +2712,8 @@ pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction, break; #endif /* INET6 */ } + if (nat->natpass) + r = NULL; } } else { /* check incoming packet for BINAT/RDR */ @@ -2721,10 +2735,11 @@ pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction, break; #endif /* INET6 */ } + if (rdr->natpass) + r = NULL; } } - r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); while (r != NULL) { r->evaluations++; if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || @@ -2896,6 +2911,8 @@ pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction, struct pf_tag *pftag = NULL; int tag = -1; + r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); + if (direction == PF_OUT) { /* check outgoing packet for BINAT/NAT */ if ((nat = pf_get_translation(PF_OUT, ifp, pd->proto, @@ -2914,6 +2931,8 @@ pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction, break; #endif /* INET6 */ } + if (nat->natpass) + r = NULL; } } else { /* check incoming packet for BINAT/RDR */ @@ -2933,10 +2952,11 @@ pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction, break; #endif /* INET6 */ } + if (rdr->natpass) + r = NULL; } } - r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); while (r != NULL) { r->evaluations++; if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 7c1504702b7..98344f6a339 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pfvar.h,v 1.161 2003/07/03 11:48:39 itojun Exp $ */ +/* $OpenBSD: pfvar.h,v 1.162 2003/07/04 10:39:31 henning Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -385,6 +385,7 @@ struct pf_rule { u_int8_t quick; u_int8_t ifnot; u_int8_t match_tag_not; + u_int8_t natpass; #define PF_STATE_NORMAL 0x1 #define PF_STATE_MODULATE 0x2 |