upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-06 07:12:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf: avoid passing through dummynet multiple times

Browse source 
In some setups we end up with multiple states created for a single
packet, which in turn can mean we run the packet through dummynet
multiple times. That's not expected or intended. Mark each packet when
it goes through dummynet, and do not pass packet through dummynet if
they're marked as having already passed through.

See also:	https://redmine.pfsense.org/issues/14854
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D44365
This commit is contained in:
Kristof Provost 2024-03-11 14:44:17 +01:00 committed by Franco Fichtner
parent b578125fb9
commit d8322a6ac4
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sys/netpfil/pf/pf.c
View file

@ -8301,6 +8301,9 @@ pf_pdesc_to_dnflow(const struct pf_pdesc *pd, const struct pf_krule *r,
dndir = pd->dir;
}
if (pd->pf_mtag->flags & PF_MTAG_FLAG_DUMMYNETED)
return (false);
memset(dnflow, 0, sizeof(*dnflow));
if (pd->dport != NULL)
@ -8442,6 +8445,7 @@ pf_dummynet_route(struct pf_pdesc *pd, struct pf_kstate *s,
if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
pd->pf_mtag->flags |= PF_MTAG_FLAG_DUMMYNET;
pd->pf_mtag->flags |= PF_MTAG_FLAG_DUMMYNETED;
ip_dn_io_ptr(m0, &dnflow);
if (*m0 != NULL) {
pd->pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;

2
sys/netpfil/pf/pf_mtag.h
View file

@ -41,7 +41,7 @@
#define PF_MTAG_FLAG_TRANSLATE_LOCALHOST 0x04
#define PF_MTAG_FLAG_PACKET_LOOPED 0x08
#define PF_MTAG_FLAG_FASTFWD_OURS_PRESENT 0x10
/* 0x20 unused */
#define PF_MTAG_FLAG_DUMMYNETED 0x20
#define PF_MTAG_FLAG_DUPLICATED 0x40
#define PF_MTAG_FLAG_SYNCOOKIE_RECREATED 0x80