Page MenuHomeFreeBSD

pf: Fix fallout from the STATE_LOOKUP macro removal
ClosedPublic

Authored by markj on Wed, Aug 19, 10:00 PM.
Tags
None
Referenced Files
F171595624: D59015.id185217.diff
Sat, Sep 12, 12:22 AM
F171474757: D59015.id184412.diff
Fri, Sep 11, 8:06 AM
F171457931: D59015.id185217.diff
Fri, Sep 11, 5:31 AM
Unknown Object (File)
Wed, Sep 9, 6:46 AM
Unknown Object (File)
Tue, Sep 8, 5:25 PM
Unknown Object (File)
Tue, Sep 8, 7:56 AM
Unknown Object (File)
Sun, Sep 6, 4:53 PM
Unknown Object (File)
Sun, Sep 6, 1:01 AM

Details

Summary

Commit 8572367b6814 ("pf: remove STATE_LOOKUP") introduced two seemingly
unintentional changes with respect to divert(4)-injected packets (i.e.,
the PACKET_LOOPED case): we no longer return the matching state, and
direct callers of pf_find_state() now treat matches of diverted packets
the same as having no matching state at all.

This seems inadvertent, and breaks certain rulesets which use divert-to.
Fix them, and add a regression test case.

Fixes: 8572367b6814 ("pf: remove STATE_LOOKUP")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable