HomeFreeBSD

pf: Fix endless loop on NAT exhaustion with sticky-address

Description

pf: Fix endless loop on NAT exhaustion with sticky-address

When we try to find a source port in pf_get_sport() it's possible that
all available source ports will be in use. In that case we call
pf_map_addr() to try to find a new source IP to try from. If there are
no more available source IPs pf_map_addr() will return 1 and we stop
trying.

However, if sticky-address is set we'll always return the same IP
address, even if we've already tried that one.
We need to check the supplied address, because if that's the one we'd
set it means pf_get_sport() has already tried it, and we should error
out rather than keep trying.

PR: 233867
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D18483

Details

Provenance
kpAuthored on
Differential Revision
D18483: pf: Fix endless loop on NAT exhaustion with sticky-address
Parents
rS341997: Add myself to the calendar
Branches
Unknown
Tags
Unknown