pf fastroute tag removal reviewers needed

Franco Fichtner franco at opnsense.org
Wed Sep 28 11:53:59 UTC 2016


Hi all,

The review can be found here:

https://reviews.freebsd.org/D8058

The larger motivation is to start work to align pf with pfil
packet flow in order to make pf and ipfw more useful in
combination with each other as e.g. pf offers powerful policy-
routing and ipfw offers a multitude of dummynet algorithms.

The main culprit of pfil not working correctly is pf's
route-to and reply-to (and the tag formerly known as fastroute)
as they would call if_output directly on the ifnet and consume
their packets this way.  That transmit code is also copied from
if_output() and should likely not be called from within pf,
especially when there is a pfil hook chain to go through.

The next targets after this review will be M_IP_NEXTHOP and
M_IP6_NEXTHOP, which ipfw uses to redirect packets by adhering
to the pfil hook chain.


Cheers,
Franco


More information about the freebsd-pf mailing list