Page MenuHomeFreeBSD

pf: tag dummynet'd route-to packets with their real destination
ClosedPublic

Authored by kp on Tue, May 10, 8:53 AM.

Details

Summary

If we delay route-to/dup-to/reply-to through dummynet we are eventually
returned to pf_test(). At that point we no longer have the context for
the route-to destination. We'd just skip the pf_test() and continue
processing. This means that route-to did not work as expected.

Extend pf_mtag to carry the route-to destination so we can apply it when
we re-enter pf_test().

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

sys/netpfil/pf/pf.c
6870

Can we assert network epoch here?

7426

What do you think about changing ifnet_byindexgen() to never return IFF_DYING interfaces?

P.S. I desire the need for this flag to be eliminated.

sys/netpfil/pf/pf.c
6870

Yeah, that makes sense.

Pretty much all of pf runs under net_epoch, but an assert will make it more obvious that it's safe to access these fields here.

7426

That would make sense to me, yes.

  • add NET_EPOCH_ASSERT
  • return 'int' for errors rather than 'bool'
This revision was not accepted when it landed; it landed in state Needs Review.Thu, May 12, 7:58 PM
This revision was automatically updated to reflect the committed changes.