[Bug 213736] pf: hardcoded if_output skips ip[6]_output and pfil order

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Mon Oct 24 05:08:15 UTC 2016


            Bug ID: 213736
           Summary: pf: hardcoded if_output skips ip[6]_output and pfil
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: franco at opnsense.org


Up until now pf_route[6] uses code copied from ip_output[6] to push packets to
their destination for the tags route-to, reply-to and dup-to. The packet is
consumed on the spot.

>From an architectural standpoint of pfil, this undermines its consistency:
Packets must either be consumed when they are dropped or when they are delayed

In case of ipfw, PACKET_TAG_FORWARD is used to store the hext hop for the
forward tag and evaluated properly outside the pfil hooks.  The same could be
done for pf, but it's not a crucial requirement.

Skipping the full ip_output[6] code in favour of a stub has other side effects
and fixing it would help align the packet processing consistency.

Of prime interest are productive combinations of ipfw+pf that in case of
route-to et al simply stop working as pf consumes all its traffic up front.


You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list