HomeFreeBSD

pf: Let pf_state_insert() handle redirect state conflicts

Description

pf: Let pf_state_insert() handle redirect state conflicts

When handling a redirect state conflict, pf_get_translation() tries
modifying the source port to avoid it. If it fails to find a free port,
the translation is aborted.

Instead, if we fail to find a free source port, simply press on with the
original source port and let pf_state_insert() handle the conflict as it
pleases, rather than second-guessing what it will do. In particular,
pf_state_insert() has special handling for TCP connections in a terminal
state, and might succeed despite a state conflict.

Reviewed by: kp
MFC after: 3 months
Sponsored by: Klara, Inc.
Sponsored by: Modirum
Differential Revision: https://reviews.freebsd.org/D46612

(cherry picked from commit 9569fddd8d0e48211e67fdc63dd72eba83883525)

Details

Provenance
markjAuthored on Sep 10 2024, 2:34 PM
Reviewer
kp
Differential Revision
D46612: pf: Let pf_state_insert() handle redirect state conflicts
Parents
rG5df40377e7b0: pf: Make pf_get_translation() more expressive
Branches
Unknown
Tags
Unknown