HomeFreeBSD

pf: don't reject route-to'd too-large packets

Description

pf: don't reject route-to'd too-large packets

If we're sending a packet via pf_route()/pf_route6() we check for packet
size and potentially generate ICMP(6) packet too big messages. If we do,
don't consider this a rejected packet. That is, return PF_PASS and set
the mbuf to NULL rather than returning PF_DROP.

This matters for locally generated packets, because with PF_DROP we
can end up returning EACCES to userspace, causing the connection to
terminate. Instead, with PF_PASS and a NULL mbuf this is translated to
PFIL_CONSUMED, which does not return an error to userspace.

MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")

Details

Provenance
kpAuthored on Dec 26 2025, 9:58 AM
Parents
rGa3394b6a23fb: m4: avoid warnings about too-long initializer strings
Branches
Unknown
Tags
Unknown