FreeBSD/sys/netpfil/ipfw/ip_fw2.c
/*
 * The verify_path function checks if a route to the src exists and
 * if it is reachable via ifp (when provided).
 * 
 * The 'verrevpath' option checks that the interface that an IP packet
 * arrives on is the same interface that traffic destined for the
 * packet's source address would be routed out of.
 * The 'versrcreach' option just checks that the source address is
 * reachable via any route (except default) in the routing table.
 * These two are a measure to block forged packets. This is also
 * commonly known as "anti-spoofing" or Unicast Reverse Path
 * Forwarding (Unicast RFP) in Cisco-ese. The name of the knobs
 * is purposely reminiscent of the Cisco IOS command,
 *
 *   ip verify unicast reverse-path
 *   ip verify unicast source reachable-via any
 *
 * which implements the same functionality. But note that the syntax
 * is misleading, and the check may be performed on all IP packets
 * whether unicast, multicast, or broadcast.
 */
The verify_path function checks if a route to the src exists and
if it is reachable via ifp (when provided).

The 'verrevpath' option checks that the interface that an IP packet
arrives on is the same interface that traffic destined for the
packet's source address would be routed out of.
The 'versrcreach' option just checks that the source address is
reachable via any route (except default) in the routing table.
These two are a measure to block forged packets. This is also
commonly known as "anti-spoofing" or Unicast Reverse Path
Forwarding (Unicast RFP) in Cisco-ese. The name of the knobs
is purposely reminiscent of the Cisco IOS command.

ip verify unicast reverse-path
ip verify unicast source reachable-via any

which implements the same functionality. But note that the syntax
is misleading, and the check may be performed on all IP packets
whether unicast, multicast, or broadcast.
The verify_path function checks if a route to the src exists and if it is reachable via ifp ( when provided ) . The ' verrevpath ' option checks that the interface that an IP packet arrives on is the same interface that traffic destined for the packet ' s source address would be routed out of . The ' versrcreach ' option just checks that the source address is reachable via any route ( except default ) in the routing table . These two are a measure to block forged packets . This is also commonly known as " anti - spoofing " or Unicast Reverse Path Forwarding ( Unicast RFP ) in Cisco - ese . The name of the knobs is purposely reminiscent of the Cisco IOS command . ip verify unicast reverse - path ip verify unicast source reachable - via any which implements the same functionality . But note that the syntax is misleading and the check may be performed on all IP packets whether unicast multicast or broadcast .
static int
verify_path(struct in_addr src, struct ifnet *ifp, u_int fib)
{
#if defined(USERSPACE) || !defined(__FreeBSD__)
	return 0;
#else
	struct nhop4_basic nh4;
	if (fib4_lookup_nh_basic(fib, src, NHR_IFAIF, 0, &nh4) != 0)
		return (0);
	if (ifp != NULL && ifp != nh4.nh_ifp)
		return (0);
	if (ifp == NULL && (nh4.nh_flags & NHF_DEFAULT) != 0)
		return (0);
	if (ifp == NULL && (nh4.nh_flags & (NHF_REJECT|NHF_BLACKHOLE)) != 0)
		return (0);
	return 1;
#endif 
}
static int verify_path ( struct in_addr src , struct ifnet * ifp , u_int fib ) { #if defined ( USERSPACE ) || ! defined ( __FreeBSD__ ) return 0 ; #else struct nhop4_basic nh4 ; if ( fib4_lookup_nh_basic ( fib , src , NHR_IFAIF , 0 , & nh4 ) != 0 ) return ( 0 ) ; if ( ifp != NULL && ifp != nh4 . nh_ifp ) return ( 0 ) ; if ( ifp == NULL && ( nh4 . nh_flags & NHF_DEFAULT ) != 0 ) return ( 0 ) ; if ( ifp == NULL && ( nh4 . nh_flags & ( NHF_REJECT | NHF_BLACKHOLE ) ) != 0 ) return ( 0 ) ; return 1 ; #endif }
The verify_path function checks if a route to the src exists and
 if it is reachable via ifp (when provided).
The verify_path function checks if a route to the src exists and if it is reachable via ifp ( when provided ) .
/*
	 * If ifp is provided, check for equality with rtentry.
	 * We should use rt->rt_ifa->ifa_ifp, instead of rt->rt_ifp,
	 * in order to pass packets injected back by if_simloop():
	 * routing entry (via lo0) for our own address
	 * may exist, so we need to handle routing assymetry.
	 */ /* if no ifp provided, check if rtentry is not default route */ /* or if this is a blackhole/reject route */ /* found valid route */ /* __FreeBSD__ */