upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-07 07:42:26 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf: log reused states in addition to failed state insertions

Browse source 
To assist debugging TCP connection reuse with NAT, expand the
existing log in pf_state_key_attach() from the failed to the reuse
case.
OK mikeb@

Obtained from:	OpenBSD, bluhm <bluhm@openbsd.org>, 3cd642e673
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2025-04-16 09:46:15 +02:00
parent 5b13b79a5c
commit 3f39713e4e
1 changed files with 27 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
sys/netpfil/pf/pf.c
View file

@ -1467,9 +1467,35 @@ keyattach:
si->key[PF_SK_STACK]->af &&
sk->af == si->key[PF_SK_STACK]->af &&
si->direction != s->direction))) {
bool reuse = false;
if (sk->proto == IPPROTO_TCP &&
si->src.state >= TCPS_FIN_WAIT_2 &&
si->dst.state >= TCPS_FIN_WAIT_2) {
si->dst.state >= TCPS_FIN_WAIT_2)
reuse = true;
if (V_pf_status.debug >= PF_DEBUG_MISC) {
printf("pf: %s key attach "
"%s on %s: ",
(idx == PF_SK_WIRE) ?
"wire" : "stack",
reuse ? "reuse" : "failed",
s->kif->pfik_name);
pf_print_state_parts(s,
(idx == PF_SK_WIRE) ?
sk : NULL,
(idx == PF_SK_STACK) ?
sk : NULL);
printf(", existing: ");
pf_print_state_parts(si,
(idx == PF_SK_WIRE) ?
sk : NULL,
(idx == PF_SK_STACK) ?
sk : NULL);
printf("\n");
}
if (reuse) {
/*
* New state matches an old >FIN_WAIT_2
* state. We can't drop key hash locks,
@ -1486,25 +1512,6 @@ keyattach:
si->timeout = PFTM_PURGE;
olds = si;
} else {
if (V_pf_status.debug >= PF_DEBUG_MISC) {
printf("pf: %s key attach "
"failed on %s: ",
(idx == PF_SK_WIRE) ?
"wire" : "stack",
s->kif->pfik_name);
pf_print_state_parts(s,
(idx == PF_SK_WIRE) ?
sk : NULL,
(idx == PF_SK_STACK) ?
sk : NULL);
printf(", existing: ");
pf_print_state_parts(si,
(idx == PF_SK_WIRE) ?
sk : NULL,
(idx == PF_SK_STACK) ?
sk : NULL);
printf("\n");
}
s->timeout = PFTM_UNLINKED;
if (idx == PF_SK_STACK)
/*