Page MenuHomeFreeBSD

pf: 'sticky-address' requires 'keep state'
ClosedPublic

Authored by vegeta_tuxpowered.net on Aug 15 2024, 6:59 PM.
Tags
None
Referenced Files
Unknown Object (File)
Dec 9 2024, 2:00 AM
Unknown Object (File)
Dec 3 2024, 10:05 PM
Unknown Object (File)
Dec 2 2024, 11:29 PM
Unknown Object (File)
Nov 15 2024, 12:28 AM
Unknown Object (File)
Nov 9 2024, 11:22 AM
Unknown Object (File)
Nov 9 2024, 11:20 AM
Unknown Object (File)
Nov 9 2024, 11:20 AM
Unknown Object (File)
Nov 6 2024, 6:23 AM

Details

Summary

When route_to() processes a packet without state, pf_map_addr() is called for
each packet. Pf_map_addr() will search for a source node and will find none
since those are created only in pf_create_state(). Thus sticky address,
even though requested in rule definition, will never work.

Raise an error when a stateless filter rule uses sticky address to avoid
confusion and to keep ruleset limitations in sync with what the pf code
really does.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision was not accepted when it landed; it landed in state Needs Review.Aug 16 2024, 9:45 AM
This revision was automatically updated to reflect the committed changes.