Hello,
On Mon, Jan 04, 2021 at 11:21:50PM +1000, David Gwynne wrote:
> On Mon, Jan 04, 2021 at 01:57:24PM +0100, Alexander Bluhm wrote:
> > On Mon, Jan 04, 2021 at 11:46:16AM +0100, Alexandr Nedvedicky wrote:
> > > > let's put this in and then i'll have a look. ok by me.
> > > bluhm's diff is fine with me.
> >
> > Refactoring is commited, here is the remaining kernel diff after merge.
>
> this chunk pops out as a standalone change.
>
> having pf_find_state() return PF_PASS here means the callers short
> circuit and let the packet go through without running it through the
> a lot of the state handling, which includes things like protocol state
> updates, nat, scrubbing, some pflog handling, and most importantly,
> later calls to pf_route().
>
> ok?
I think this should go in. I've seen it in bluhm's larger diff,
which I still need to finish.
I'm fine if change will be committed as it solves a real bug.
OK sashan
>
> Index: pf.c
> ===================================================================
> RCS file: /cvs/src/sys/net/pf.c,v
> retrieving revision 1.1097
> diff -u -p -r1.1097 pf.c
> --- pf.c 4 Jan 2021 12:48:27 -0000 1.1097
> +++ pf.c 4 Jan 2021 13:08:26 -0000
> @@ -1122,12 +1122,6 @@ pf_find_state(struct pf_pdesc *pd, struc
> }
>
> *state = s;
> - if (pd->dir == PF_OUT && s->rt_kif != NULL && s->rt_kif != pd->kif &&
> - ((s->rule.ptr->rt == PF_ROUTETO &&
> - s->rule.ptr->direction == PF_OUT) ||
> - (s->rule.ptr->rt == PF_REPLYTO &&
> - s->rule.ptr->direction == PF_IN)))
> - return (PF_PASS);
>
> return (PF_MATCH);
> }
