Page MenuHomeFreeBSD

pf: Fix error handling when pf_map_addr() fails
Needs ReviewPublic

Authored by vegeta_tuxpowered.net on Mon, Jun 9, 8:44 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Jun 17, 4:16 PM
Unknown Object (File)
Tue, Jun 17, 12:02 AM
Unknown Object (File)
Tue, Jun 17, 12:02 AM
Unknown Object (File)
Mon, Jun 16, 10:08 PM
Unknown Object (File)
Fri, Jun 13, 12:35 AM
Unknown Object (File)
Fri, Jun 13, 12:10 AM
Unknown Object (File)
Thu, Jun 12, 4:43 AM

Details

Reviewers
kp
Summary

When pf_map_addr() fails, for example for a NAT pool, we expect packet will
not be forwarded. The error returned by pf_map_addr() has been ignored in
pf_map_addr_sn(), though, causing packets being forwarded without NAT
applied. Catch the error, return the error to caller, let the caller handle
error counters for route-to pools just like it does for NAT pools. Add
tests for NAT and route-to rules.

Improve logging by not hardcoding function name and use func
instead.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

sys/netpfil/pf/pf_lb.c
813

We probably want that error log being PF_DEBUG_NOISY, or at least some increased verbosity log level.

tests/sys/netpfil/pf/nat.sh
803

That might be better done with atf_check -o "match:map-failed\s+1\s+" or something like it.