Page MenuHomeFreeBSD

ipfw: add additional check for orphaned states
ClosedPublic

Authored by ae on Jul 22 2025, 8:14 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Oct 12, 12:24 PM
Unknown Object (File)
Sun, Oct 12, 12:24 PM
Unknown Object (File)
Sun, Oct 12, 1:26 AM
Unknown Object (File)
Sat, Oct 11, 3:55 PM
Unknown Object (File)
Sun, Sep 28, 4:19 PM
Unknown Object (File)
Fri, Sep 26, 5:22 PM
Unknown Object (File)
Sep 16 2025, 11:53 AM
Unknown Object (File)
Sep 15 2025, 2:16 PM

Details

Summary

When parent rule of dynamic state is deleted and net.inet.ip.fw.dyn_keep_states is enabled, such states are called ORPHANED.
Orphaned states still keep pointer to original parent rule. In case when rule action is skipto this can lead to unpredictable consequences.
To avoid this problem add special handling for skipto action when we have found ORPHANED state.
Check that new rule has the same opcode and skipto number for O_SKIPTO rule action.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 65612
Build 62495: arc lint + arc unit

Event Timeline

ae held this revision as a draft.
ae published this revision for review.Jul 22 2025, 8:14 AM
This revision was not accepted when it landed; it landed in state Needs Review.Aug 3 2025, 9:59 AM
This revision was automatically updated to reflect the committed changes.