diff options
| author | Pawel Biernacki <kaktus@FreeBSD.org> | 2023-03-13 16:36:11 +0000 |
|---|---|---|
| committer | Pawel Biernacki <kaktus@FreeBSD.org> | 2023-03-13 16:46:21 +0000 |
| commit | 3eaffc626589eb2fc20a3c9c87eb8ab0ee89e783 (patch) | |
| tree | a89ba3569a19e5b27742506735be22f67dfa8fbf /sys/netinet6/ip6_forward.c | |
| parent | fc76ddee9be0d7f98c9f9a162627950f8102964e (diff) | |
netinet6: allow disabling excess log messages
RFC 4443 specifies cases where certain packets, like those originating from
local-scope addresses destined outside of the scope shouldn't be forwarded.
The current practice is to drop them, send ICMPv6 message where appropriate,
and log the message:
cannot forward src fe80:10::426:82ff:fe36:1d8, dst 2001:db8:db8::10, nxt
58, rcvif vlan5, outif vlan2
At times the volume of such messages cat get very high. Let's allow local
admins to disable such messages on per vnet basis, keeping the current
default (log).
Reported by: zarychtam@plan-b.pwste.edu.pl
Reviewed by: zlei (previous version), pauamma (docs)
Differential Revision: https://reviews.freebsd.org/D38644
Diffstat (limited to 'sys/netinet6/ip6_forward.c')
| -rw-r--r-- | sys/netinet6/ip6_forward.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index a95e58ba09a1..fc00eab4b784 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -114,7 +114,8 @@ ip6_forward(struct mbuf *m, int srcrt) IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { IP6STAT_INC(ip6s_cantforward); /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */ - if (V_ip6_log_time + V_ip6_log_interval < time_uptime) { + if (V_ip6_log_cannot_forward && + (V_ip6_log_time + V_ip6_log_interval < time_uptime)) { V_ip6_log_time = time_uptime; log(LOG_DEBUG, "cannot forward " @@ -221,7 +222,8 @@ again: IP6STAT_INC(ip6s_badscope); in6_ifstat_inc(nh->nh_ifp, ifs6_in_discard); - if (V_ip6_log_time + V_ip6_log_interval < time_uptime) { + if (V_ip6_log_cannot_forward && + (V_ip6_log_time + V_ip6_log_interval < time_uptime)) { V_ip6_log_time = time_uptime; log(LOG_DEBUG, "cannot forward " |