diff options
Diffstat (limited to 'sys/netinet/ip_input.c')
| -rw-r--r-- | sys/netinet/ip_input.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index e00f3b77c74c..3c340b376433 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -521,11 +521,6 @@ ip_input(struct mbuf *m) goto bad; } } - /* The unspecified address can appear only as a src address - RFC1122 */ - if (__predict_false(ntohl(ip->ip_dst.s_addr) == INADDR_ANY)) { - IPSTAT_INC(ips_badaddr); - goto bad; - } if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) { sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID); @@ -641,6 +636,17 @@ tooshort: } } passin: + /* + * The unspecified address can appear only as a src address - RFC1122. + * + * The check is deferred to here to give firewalls a chance to block + * (and log) such packets. ip_tryforward() will not process such + * packets. + */ + if (__predict_false(ntohl(ip->ip_dst.s_addr) == INADDR_ANY)) { + IPSTAT_INC(ips_badaddr); + goto bad; + } /* * Process options and, if not destined for us, |