Re: Adding packet filtering to tun interfaces

[Maxime Villard <max%m00nbsd.net@localhost>]

Le 12/03/2018 à 08:45, Tom Ivar Helbekkmo a écrit :
> Maxime Villard <max%M00nBSD.net@localhost> writes:
>
> > Doesn't seem correct to me, pfil_run_hooks can return zero but still
> > free the mbuf.
>
> When can it do that?

It can do that in L4 when handling fragments. When a fragment is received
NPF registers the packet in a list, and returns error=0 *mp=NULL. Later, when
the last fragment is received, the chain is complete; the packets in the list
are concatenated, and this time NPF returns error=0 *mp=reassembled_packet,
giving the "illusion" that the last received fragment was actually the
complete packet.

> [...]
>
> > I think it should rather be:
> >
> > +	if ((error = pfil_run_hooks(ifp->if_pfil, &m0, ifp, PFIL_OUT)) != 0)
> > +		goto out;
> > +	if (m0 == NULL)
> > +		goto out;
>
> I adapted the pfil_run_hooks() calls from those in if_vlan.c, so they'll
> need fixing, too.

Mmh yes, they will need fixing, I missed that.

But now that I'm thinking about it... Are you sure that your change indeed
enforces NPF policies? If you pass ifp->if_pfil normally it doesn't do IP
filtering, unless I missed something else.

Maxime