This repo is obsolete, please see git://git.code.sf.net/p/dummynet/code@master

[ipfw.git] / dummynet2 / ip_fw_pfil.c

diff --git a/dummynet2/ip_fw_pfil.c b/dummynet2/ip_fw_pfil.c
index db7cec6..a125ef2 100644 (file)
--- a/dummynet2/ip_fw_pfil.c
+++ b/dummynet2/ip_fw_pfil.c
@@ -59,7 +59,6 @@ __FBSDID("$FreeBSD: head/sys/netinet/ipfw/ip_fw_pfil.c 200601 2009-12-16 10:48:4
 #include <netinet/ip_var.h>
 #include <netinet/ip_fw.h>
 #include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/ip_dummynet.h>
 #include <netgraph/ng_ipfw.h>
 
 #include <machine/in_cksum.h>
@@ -74,16 +73,13 @@ static VNET_DEFINE(int, fw6_enable) = 1;
 
 int ipfw_chg_hook(SYSCTL_HANDLER_ARGS);
 
-/* Divert hooks. */
-void (*ip_divert_ptr)(struct mbuf *m, int incoming);
-
-/* ng_ipfw hooks. */
-ng_ipfw_input_t *ng_ipfw_input_p = NULL;
-
 /* Forward declarations. */
 static int ipfw_divert(struct mbuf **, int, struct ipfw_rule_ref *, int);
 
 #ifdef SYSCTL_NODE
+
+SYSBEGIN(f1)
+
 SYSCTL_DECL(_net_inet_ip_fw);
 SYSCTL_VNET_PROC(_net_inet_ip_fw, OID_AUTO, enable,
     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE3, &VNET_NAME(fw_enable), 0,
@@ -94,13 +90,16 @@ SYSCTL_VNET_PROC(_net_inet6_ip6_fw, OID_AUTO, enable,
     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE3, &VNET_NAME(fw6_enable), 0,
     ipfw_chg_hook, "I", "Enable ipfw+6");
 #endif /* INET6 */
+
+SYSEND
+
 #endif /* SYSCTL_NODE */
 
 /*
  * The pfilter hook to pass packets to ipfw_chk and then to
  * dummynet, divert, netgraph or other modules.
  * The packet may be consumed.
- */            
+ */
 int
 ipfw_check_hook(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
     struct inpcb *inp)
@@ -111,7 +110,8 @@ ipfw_check_hook(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
        int ret;
 
        /* all the processing now uses ip_len in net format */
-       SET_NET_IPLEN(mtod(*m0, struct ip *));
+       if (mtod(*m0, struct ip *)->ip_v == 4)
+               SET_NET_IPLEN(mtod(*m0, struct ip *));
 
        /* convert dir to IPFW values */
        dir = (dir == PFIL_IN) ? DIR_IN : DIR_OUT;
@@ -220,7 +220,7 @@ again:
 
        case IP_FW_NGTEE:
        case IP_FW_NETGRAPH:
-               if (!NG_IPFW_LOADED) {
+               if (ng_ipfw_input_p == NULL) {
                        ret = EACCES;
                        break; /* i.e. drop */
                }
@@ -229,8 +229,13 @@ again:
                if (ipfw == IP_FW_NGTEE) /* ignore errors for NGTEE */
                        goto again;     /* continue with packet */
                break;
-               
+
        case IP_FW_NAT:
+               /* honor one-pass in case of successful nat */
+               if (V_fw_one_pass)
+                       break; /* ret is already 0 */
+               goto again;
+
        case IP_FW_REASS:
                goto again;             /* continue with packet */
        
@@ -243,7 +248,7 @@ again:
                        FREE_PKT(*m0);
                *m0 = NULL;
        }
-       if (*m0)
+       if (*m0 && mtod(*m0, struct ip *)->ip_v == 4)
                SET_HOST_IPLEN(mtod(*m0, struct ip *));
        return ret;
 }
@@ -264,7 +269,7 @@ ipfw_divert(struct mbuf **m0, int incoming, struct ipfw_rule_ref *rule,
 
        /* Cloning needed for tee? */
        if (tee == 0) {
-               clone = *m0;    /* use the original mbuf */
+               clone = *m0;    /* use the original mbuf */
                *m0 = NULL;
        } else {
                clone = m_dup(*m0, M_DONTWAIT);