CVSROOT: /cvs
Module name: src
Changes by: henn...@cvs.openbsd.org 2012/07/07 09:20:14
Modified files:
sys/net : pf_ioctl.c
Log message:
restore DIOCKILLSTATE semantics to what they were before the NAT rewrite.
when you kill states by IP, it is not all that clear which IP we're talking
about - before or after rewriting?
the old semantics were to always look at the "original" IP, i. e. before
rewriting. ever since the NAT rewrite we were unconditionally looking
at the wire side state key, which is the original address for PF_IN states,
but not for PF_OUT. So look at the SK_STACK state key in the PF_OUT case.
should fix "authpf doesn't remove NAT states" seen on misc a while ago
ok & testing & half of the analysis bob (he sez beck)
