Page MenuHomeFreeBSD

pf: 'sticky-address' requires 'keep state'
ClosedPublic

Authored by vegeta_tuxpowered.net on Aug 15 2024, 6:59 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Oct 13, 6:24 AM
Unknown Object (File)
Fri, Sep 26, 6:53 AM
Unknown Object (File)
Sep 2 2025, 12:09 PM
Unknown Object (File)
Aug 29 2025, 10:28 PM
Unknown Object (File)
Aug 15 2025, 2:22 PM
Unknown Object (File)
Aug 11 2025, 8:22 AM
Unknown Object (File)
Aug 10 2025, 7:22 PM
Unknown Object (File)
Aug 1 2025, 2:24 AM

Details

Summary

When route_to() processes a packet without state, pf_map_addr() is called for
each packet. Pf_map_addr() will search for a source node and will find none
since those are created only in pf_create_state(). Thus sticky address,
even though requested in rule definition, will never work.

Raise an error when a stateless filter rule uses sticky address to avoid
confusion and to keep ruleset limitations in sync with what the pf code
really does.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision was not accepted when it landed; it landed in state Needs Review.Aug 16 2024, 9:45 AM
This revision was automatically updated to reflect the committed changes.