HomeFreeBSD

pf: Use different address family for source and redirection address

Description

pf: Use different address family for source and redirection address

The function pf_map_addr() and source tracking operate on a single
address family. This made sense before introducing address family
translation. When combining af-to with route-to or with sticky-address,
the next-hop or the NAT address are of different address family than
the source address. For example in NAT64 scenaro an IPv6 source address
is translated to an IPv4 address and routed over IPv4 gateway.

Make source nodes dual-AF, that is have a separate source AF and
redirection AF. Store route AF in struct pf_kstate, export it to pfctl.
When loading rules with redirection pools with pfctl store address
family of each address. When printing states don't deduce next-hop's
address family from af-to, use the one stored in state.

Reviewed by: kp
Approved by: kp
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D51659

Details

Provenance
vegeta_tuxpowered.netAuthored on Jul 31 2025, 2:28 PM
Reviewer
kp
Differential Revision
D51659: pf: Use different address family for source and redirection address
Parents
rG539da08f5567: pfctl: Use sa_family_t for af instead of int
Branches
Unknown
Tags
Unknown