HomeFreeBSD

pf: Don't pfsync states with unrecoverable routing information

Description

pf: Don't pfsync states with unrecoverable routing information

States created by route-to rules can't be trusted when received with
pfsync version 1301 as they lack the rt and rt_kif information. They
are imported, though, and pf_route() function attempts to recover
the missing information for every forwarded packet.

Move the recovery operation to pfsync_state_import() so that it's
performed only once and if it's impossible don't import the state.
Add an additional check for cases when recovery might produce wrong
results.

Reviewed by: kp
Approved by: kp (mentor)
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D47906

Details

Provenance
vegeta_tuxpowered.netAuthored on Nov 29 2024, 10:20 PM
Reviewer
kp
Differential Revision
D47906: pf: Don't pfsync states with unrecoverable routing information
Parents
rG028dae5d3e88: style(9): fix typo
Branches
Unknown
Tags
Unknown