netinet6: Check the hop limit after pfil in ip6_tryforward()HEADmain

ip6_tryforward() sends time exceeded for an expiring packet before the
inbound pfil hooks have seen it, whereas ip_tryforward() and
ip6_forward(), which ip6_input() calls after the hooks, check it
afterwards.  On the fast path the router therefore answers packets the
firewall blocks inbound, and pf never handles the expiry itself: a
nat64 (af-to) packet with hop limit 1 gets a time exceeded error from
the router, which a "block" ruleset then drops on the way out, instead
of the one pf_translate_af() sends with the untranslated addresses.

Check the hop limit after the inbound hooks.

Reviewed by:		kp
Fixes:			5a1842a2 ("Add ip6_tryforward() - a run to completion ...")
MFC after:		1 week
Sponsored by:		Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D61034

0 files changed, 0 insertions, 0 deletions