Page MenuHomeFreeBSD

pf: Always skip outbound filtering for inbound af-to rules
ClosedPublic

Authored by vegeta_tuxpowered.net on Sep 9 2025, 1:20 PM.
Tags
None
Referenced Files
F165216962: D52446.id162999.diff
Thu, Aug 6, 9:59 PM
F165216959: D52446.id161784.diff
Thu, Aug 6, 9:59 PM
F165216958: D52446.id.diff
Thu, Aug 6, 9:59 PM
F165216937: D52446.diff
Thu, Aug 6, 9:59 PM
Unknown Object (File)
Sun, Aug 2, 4:37 AM
Unknown Object (File)
Thu, Jul 30, 11:36 PM
Unknown Object (File)
Tue, Jul 28, 8:33 AM
Unknown Object (File)
Tue, Jul 21, 1:30 PM

Details

Summary

The af-to rules on inbound direction create a single state spanning both the
inbound and the outbound interface. Calling pf_test() for the outbound
direction in pf_route() makes the packet pass through state search, match
the existing state, never evaluate the ruleset, and increase state counters.

Check that the state comes from an af-to rule in inbound direction, and if
yes, skip outbound testing.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable